Indirect abnormal transaction identification method and device and indirect abnormal transaction model construction method and device

Abstract

The invention discloses an indirect abnormal transaction identification method and device and a model construction method and device, and relates to the field of big data, and the identification method comprises the steps: extracting the multi-dimensional transaction key element features and the position sequence of each third-party transaction opponent from the current channel business transaction data; according to the key element features and the position sequence, obtaining a current channel business transaction multi-dimensional information vector of each layer; converting each layer of multi-dimensional information vector to a transaction hyperplane through a non-associated orthogonal matrix; inputting the current transaction hyperplane composition graph into an indirect abnormal transaction path identification model to obtain a plurality of indirect abnormal transaction paths corresponding to each piece of current channel business transaction data to form a current traversal track graph; and matching the current passing track atlas with a historical passing track atlas in the indirect abnormal transaction identification stereo coupling model to obtain an identification result of whether the current channel business transaction is an indirect abnormal transaction or not. According to the invention, the accuracy of indirect abnormal transaction identification can be improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of big data, and particularly relates to a method and device for identifying indirect abnormal transactions and constructing a model. BACKGROUND

[0002] This section is intended to provide background or context to the embodiments of the application recited in the claims. The description herein does not constitute admission of prior art.

[0003] In the prior art, indirect abnormal transactions are mainly identified by manual identification, which mainly includes manual judgment by checking transaction contracts, checking transaction background information, checking transaction counterparties, inquiring company financial personnel, querying company official website disclosure information, and querying company external investment.

[0004] The existing indirect abnormal transaction identification scheme has the following disadvantages: manual analysis is time-consuming and inefficient, and is highly dependent on the professionalism and responsibility of the personnel involved, which can easily lead to incorrect identification of abnormal transactions. Indirect abnormal transactions often involve multiple transaction subjects, multiple transaction links, complex structures, and hidden identities and relationships, and involve multiple levels of control relationships, which are not directly related and are difficult to identify and confirm. Therefore, the existing indirect abnormal transaction identification scheme has the problem of low precision. SUMMARY

[0005] The embodiments of the present application provide a method for identifying indirect abnormal transactions to improve the precision of identifying indirect abnormal transactions, which comprises:

[0006] Obtaining current channel business transaction data;

[0007] Extracting current multi-dimensional business transaction key element features of each third-party transaction counterparty that transacts with the transaction initiator from the current channel business transaction data, and determining the current position sequence of each third-party transaction counterparty that transacts with the transaction initiator;

[0008] Obtaining a current channel business transaction multi-dimensional information vector of each layer according to the current multi-dimensional business transaction key element features of each third-party transaction counterparty and the current position sequence;

[0009] Converting each layer of the current channel business transaction multi-dimensional information vector to a current transaction hyperplane in a multi-dimensional cubic vector space by a non-associated orthogonal matrix;

[0010] input the current transaction hyperplane composition graph into a pre-constructed indirect abnormal transaction path identification model to obtain a plurality of indirect abnormal transaction paths corresponding to each piece of current channel business transaction data, which constitutes a current traversal trajectory graph; the indirect abnormal transaction path identification model is pre-trained according to relationship sample data between a historical transaction hyperplane composition graph and an indirect abnormal transaction path;

[0011] match the current traversal trajectory graph with a historical traversal trajectory graph in an indirect abnormal transaction identification stereoscopic coupling model to obtain an identification result of whether the current channel business transaction is an indirect abnormal transaction; the indirect abnormal transaction identification stereoscopic coupling model includes a plurality of historical traversal trajectory graphs formed after a plurality of pieces of historical channel business transaction data are converted into transaction hyperplanes.

[0012] The embodiment of the application provides a construction method of an indirect abnormal transaction identification stereoscopic coupling model, so as to improve the accuracy of indirect abnormal transaction identification, and the method comprises the following steps:

[0013] acquiring a plurality of pieces of historical channel business transaction data;

[0014] processing each piece of historical channel business transaction data according to the following method to form a historical traversal trajectory graph corresponding to each piece of historical channel business transaction data:

[0015] extracting historical multi-dimensional business transaction key element features of each third-party transaction counterparty that transacts with a transaction initiator from each piece of historical channel business transaction data, and determining a historical position sequence of each third-party transaction counterparty that transacts with the transaction initiator;

[0016] obtaining a historical multi-dimensional information vector of each layer of historical channel business transaction according to the historical multi-dimensional business transaction key element features of each third-party transaction counterparty and the historical position sequence;

[0017] converting each layer of historical channel business transaction multi-dimensional information vector into a transaction hyperplane in a multi-dimensional stereoscopic vector space through a non-associated orthogonal matrix;

[0018] inputting the transaction hyperplane composition graph into a pre-constructed indirect abnormal transaction path identification model to obtain a plurality of indirect abnormal transaction paths corresponding to each piece of historical channel business transaction data, which constitutes a historical traversal trajectory graph; the indirect abnormal transaction path identification model is pre-trained according to relationship sample data between a historical transaction hyperplane composition graph and an indirect abnormal transaction path;

[0019] constructing an indirect abnormal transaction identification stereoscopic coupling model from the historical traversal trajectory graphs corresponding to the plurality of pieces of historical channel business transaction data.

[0020] The embodiment of the present application also provides a device for identifying indirect abnormal transaction, which is used for improving the accuracy of indirect abnormal transaction identification, and the device comprises:

[0021] A second acquisition unit is configured to acquire current channel business transaction data.

[0022] An extraction unit is configured to extract current multi-dimensional business transaction key element features of each third-party transaction counterparty that transacts with the transaction initiator and determine a current position sequence of each third-party transaction counterparty that transacts with the transaction initiator.

[0023] An information vector generation unit is configured to obtain a current multi-dimensional information vector of each layer of the current channel business transaction according to the current multi-dimensional business transaction key element features of each third-party transaction counterparty and the current position sequence.

[0024] A conversion unit is configured to convert each layer of the current channel business transaction multi-dimensional information vector into a current transaction hyperplane in a multi-dimensional cubic vector space through a non-associated orthogonal matrix.

[0025] A graph construction unit is configured to input the current transaction hyperplane into a pre-constructed indirect abnormal transaction path identification model to obtain a current traversal trajectory graph composed of multiple indirect abnormal transaction paths corresponding to each piece of current channel business transaction data.

[0026] An identification unit is configured to match the current traversal trajectory graph with a historical traversal trajectory graph in an indirect abnormal transaction identification cubic coupling model to obtain an identification result of whether the current channel business transaction is an indirect abnormal transaction.

[0027] The embodiment of the present application also provides a device for constructing an indirect abnormal transaction identification cubic coupling model, which is used for improving the accuracy of indirect abnormal transaction identification, and the device comprises:

[0028] A first acquisition unit is configured to acquire multiple pieces of historical channel business transaction data.

[0029] A formation unit is configured to process each piece of historical channel business transaction data according to the following method to form a historical traversal trajectory graph corresponding to each piece of historical channel business transaction data.

[0030] extracting historical multi-dimension business transaction key element features of each third party transaction counterparty of the transaction initiating party from each piece of historical channel business transaction data, and determining a historical position sequence of each third party transaction counterparty of the transaction initiating party;

[0031] obtaining a historical channel business transaction multi-dimension information vector of each layer according to the historical multi-dimension business transaction key element features and the historical position sequence of each third party transaction counterparty;

[0032] converting the historical channel business transaction multi-dimension information vector of each layer to a transaction hyperplane in a multi-dimension cubic vector space through a non-associated orthogonal matrix;

[0033] inputting the transaction hyperplane into a pre-constructed indirect abnormal transaction path recognition model to obtain a historical crossing trajectory graph corresponding to each piece of historical channel business transaction data, wherein the indirect abnormal transaction path recognition model is generated by pre-training according to relationship sample data between historical transaction hyperplanes and indirect abnormal transaction paths;

[0034] a constructing unit configured to construct an indirect abnormal transaction recognition cubic coupling model according to the historical crossing trajectory graph corresponding to the plurality of pieces of historical channel business transaction data.

[0035] The embodiment of the present application also provides a computer device, which comprises a memory, a processor and a computer program stored in the memory and capable of running on the processor, and the processor implements the above-mentioned indirect abnormal transaction recognition method and model construction method when executing the computer program.

[0036] The embodiment of the present application also provides a computer readable storage medium, which stores a computer program, and the computer program implements the above-mentioned indirect abnormal transaction recognition method and model construction method when executed by a processor.

[0037] The embodiment of the present application also provides a computer program product, which comprises a computer program, and the computer program implements the above-mentioned indirect abnormal transaction recognition method and model construction method when executed by a processor.

[0038] The embodiment of the present application provides the indirect abnormal transaction recognition method and model construction scheme, and has the following beneficial technical effects:

[0039] Firstly, the embodiment of the present application hierarchically ranks the position of each third-party transaction counterparty and the transaction initiator, extracts the current multi-dimensional business transaction key element characteristics and the current position sequence of each third-party transaction counterparty, obtains a current channel business transaction multi-dimensional information vector of each layer according to the multi-dimensional business transaction key element characteristics and the position sequence, converts each layer current channel business transaction multi-dimensional information vector to a current transaction hyperplane in a multi-dimensional three-dimensional vector space through a non-correlation orthogonal matrix, the non-correlation orthogonal matrix can eliminate variable correlation, provide a more efficient space foundation for the construction of the transaction hyperplane, separate the originally overlapping or closely distributed data points in the dimensional space, realize the non-correlation orthogonalization and distinguishability of the channel business transaction data, thereby increasing the distinguishability of the channel business transaction data, and laying a foundation for subsequent accurate identification of indirect abnormal transaction paths.

[0040] Secondly, the embodiment of the present application converts each layer current channel business transaction multi-dimensional information vector to a current transaction hyperplane in a multi-dimensional three-dimensional vector space, the correlation of each layer channel business transaction node in the transaction hyperplane composition graph is simplified, the independence of each channel business transaction node is realized, and based on this, through the transaction hyperplane composition graph, the indirect abnormal transaction path identification model obtained by machine learning, and the cross in the financial field, the hidden hierarchical structure and hidden correlation between nodes in the indirect abnormal transaction link can be mined, and the identification accuracy and efficiency of the indirect abnormal transaction are improved.

[0041] In summary, the identification and model construction scheme of the indirect abnormal transaction provided by the embodiment of the present application can improve the identification accuracy and efficiency of the indirect abnormal transaction. BRIEF DESCRIPTION OF DRAWINGS

[0042] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description are only some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor. In the drawings:

[0043] Figure 1 It is a flow chart of the construction method of the indirect abnormal transaction identification three-dimensional coupled model in the embodiment of the present application;

[0044] Figure 2 It is a schematic diagram of a channel business transaction track graph in the embodiment of the present application;

[0045] Figure 3 It is a flow chart of the identification method of the indirect abnormal transaction in the embodiment of the present application;

[0046] Figure 4A structure schematic diagram of the device for constructing the indirect abnormal transaction identification stereoscopic coupling model in the embodiment of the present application.

[0047] Figure 5 A structure schematic diagram of the device for indirectly identifying abnormal transactions in the embodiment of the present application. DETAILED DESCRIPTION

[0048] To make the objectives, technical solutions and advantages of the embodiments of the present application clearer, further detailed descriptions will be made to the embodiments of the present application with reference to the drawings. Herein, the illustrative embodiments of the present application and their descriptions are used to explain the present application, but not as a limitation to the present application.

[0049] In the technical solutions of the present application, the acquisition, transmission, storage, use and processing of data all comply with the relevant provisions of laws and regulations.

[0050] It should be noted that in the embodiments of the present application, some industry existing solutions of software, components, models and the like may be mentioned, which should be considered as exemplary, and the purpose is only to illustrate the feasibility in the implementation of the technical solutions of the present application, but does not mean that the applicant has or will necessarily use the solutions.

[0051] Figure 1 A flowchart of the method for constructing the indirect abnormal transaction identification stereoscopic coupling model in the embodiment of the present application is shown in FIG. 1, which comprises the following steps: Figure 1

[0052] Step 101: acquiring a plurality of historical channel business transaction data;

[0053] Step 102: processing each piece of historical channel business transaction data according to the following method to form a historical passing track atlas corresponding to each piece of historical channel business transaction data:

[0054] Step 1021: extracting historical multi-dimensional business transaction key element features of each third-party transaction counterparty conducting channel business transaction with the transaction initiator from each piece of historical channel business transaction data, and determining a historical position sequence of each third-party transaction counterparty conducting channel business transaction with the transaction initiator;

[0055] Step 1022: obtaining a historical multi-dimensional information vector of each layer of historical channel business transaction according to the historical multi-dimensional business transaction key element features of each third-party transaction counterparty and the historical position sequence;

[0056] Step 1023: converting each layer of historical channel business transaction multi-dimensional information vector to a transaction hyperplane in a multi-dimensional stereoscopic vector space through a non-associated orthogonal matrix;

[0057] ​Step 1024: input the transaction hyperplane into a pre-constructed indirect abnormal transaction path identification model to obtain a plurality of indirect abnormal transaction path constituting historical pass-through track graphs corresponding to each piece of historical channel business transaction data (which can be as shown in Figure 2 The indirect abnormal transaction path identification model is generated by pre-training according to relationship sample data between the historical transaction hyperplane and the indirect abnormal transaction path.

[0058] Step 103: form an indirect abnormal transaction identification three-dimensional coupling model according to the historical pass-through track graphs corresponding to the plurality of historical channel business transaction data.

[0059] The embodiment of the application forms an indirect abnormal transaction identification three-dimensional coupling model by automatically identifying certain specific feature transactions (for example: specific account information, specific accounting rules, simultaneous accounting of the lender and the borrower, close accounting time, consistent accounting items or summary content, whether the transaction amount is equal or close), avoids multi-layer nesting by automation, hides the nature of the transaction, solves the problem of abnormal transaction false negatives, and improves the accuracy of indirect abnormal transaction identification. The following will be described in detail. Figure 2

[0060] In the above step 101, the process of obtaining the plurality of historical channel business transaction data can include:

[0061] Collect transaction information of enterprises and channel transaction counterparties (third parties), including but not limited to accounting rules, transaction records, transaction contracts, transaction counterparty shareholder information, and transaction counterparty financial statements of channel transaction counterparties (third parties), organize the relevant information, extract useful information, and ensure the accuracy, completeness and availability of the information.

[0062] Collect transaction information of related parties and channel transaction counterparties (third parties), including but not limited to transaction records, transaction contracts, transaction counterparty shareholder information, and transaction counterparty financial statements, organize the relevant information, extract useful information, and ensure the accuracy, completeness and availability of the information.

[0063] In the process of daily operation and management, collect all account information of channel transaction counterparties (third parties), including company accounts, company-controlled other subsidiary company account information, company shareholders, directors, and senior managers natural person account information, understand and master the equity relationship and hierarchical organization of channel transaction counterparties (third parties).

[0064] In the process of daily operation and management, collect all account information of related parties, including company accounts, company-controlled other subsidiary company account information, company shareholders, directors, and senior managers natural person account information, and other account information that may have transactions with channel transaction counterparties (third parties).

[0065] ​In step 102, the raw data is first collected from the transaction system, database or log file and preliminarily processed and processed, and the repeated data and invalid data are removed.

[0066] In step 1021, the transaction counterparty and the enterprise are layered according to the position of the transaction, each layer is marked as L1, L2, L3, …, Ln, and the channel business transaction multi-dimensional transaction space business model is used for labeling processing, so as to be ready for the later aggregation, extraction and conversion of data labels.

[0067] Table 1

[0068]

[0069] In the above table 1, the ellipsis indicates that the key element characteristics can also include other element characteristics.

[0070] In step 1021, the historical multi-dimensional business transaction key element characteristics are shown in the above table 1, and the transaction key element characteristics are extracted from the raw data, and the element coding is performed, such as transaction time, transaction amount, transaction type, transaction pricing method, transaction direction, transaction account information, etc.

[0071] In step 1021, the transaction state element characteristics are extracted from the raw data, and the element coding is performed, such as success (item quantity a), failure (item quantity β), and pending (item quantity γ).

[0072] From the above, in one embodiment, the historical multi-dimensional business transaction key element characteristics of each third-party transaction counterparty can include transaction time, transaction amount, transaction type, transaction pricing method, transaction direction, transaction account information and transaction state.

[0073] In step 1021, the indirect abnormal transaction identification method can also include the step of data preprocessing: field standardization processing is performed on the obtained data, and the storage position of the data is classified, and the field is counted into the format specification, which is convenient for unified and centralized management.

[0074] In step 1021, the indirect abnormal transaction identification method can also include the step of data preprocessing: data type selection. When defining the field, the most suitable data type is selected to ensure the integrity and correctness of the data. For example, for numerical data, integer and floating point values and the like can be selected; for text data, string, text and the like can be selected.

[0075] In the step 1021, the method for identifying indirect abnormal transactions can further include a data preprocessing step: processing of null values and default values. In data processing, null values and default values should be processed using fixed rules. NULL values are used to represent null values, rather than using 0 or empty string symbols. When defining fields, default values should also be set to avoid the situation that the fields are empty and cannot be queried.

[0076] In the step 1021, the method for identifying indirect abnormal transactions can further include a data preprocessing step: naming should be easy to understand and query, and abbreviations or initial letter abbreviations should be avoided. In addition, the naming of objects such as system tables, views and stored procedures should also be based on the unified rules established to facilitate maintenance and system processing.

[0077] In the step 1021, the method for identifying indirect abnormal transactions can further include indexing and partitioning. In order to improve the efficiency of data query and retrieval, how to more optimally set the index and partition should be fully considered. For example, when frequently querying within a date range, a partition or range index can be set for the date field; when frequently querying characters, fields, etc., the length, case, etc. of the field should be reconsidered to achieve the most suitable search settings.

[0078] In the step 1021, the method for identifying indirect abnormal transactions can further include hierarchical classification storage according to data processing results and information importance. According to data characteristics, data requirements, data integrity, etc., appropriate storage media are selected, and databases and cloud data are used for storage. Data with high demand is stored using cloud storage. At the same time, in order to prevent data loss, data backup and recovery strategies should be developed, and data backup should be performed regularly, and backup data should be saved in different places to ensure the reliability and integrity of the data.

[0079] In the step 1022, a first layer L1 transaction channel information vector is established for transaction elements related to the transaction time, transaction amount, transaction type, transaction pricing method, transaction account, transaction direction, transaction status, customer risk level, etc. of the transaction with the enterprise ;

[0080] In the step 1022, a second layer L2 transaction channel information vector is established for transaction elements related to the transaction time, transaction amount, transaction type, transaction pricing method, transaction account, transaction direction, transaction status, etc. of the transaction with the first layer channel enterprise ;

[0081] In the above step 1022, the third layer L3 transaction channel information vector is established for the transaction time, transaction amount, transaction type, transaction pricing method, transaction account, transaction direction, transaction status and other related transaction elements of the transaction with the second layer channel enterprise ;

[0082] In the above step 1022, the Nth layer Ln transaction channel information vector is established for the transaction time, transaction amount, transaction type, transaction pricing method, transaction account, transaction direction, transaction status and other related transaction elements of the transaction with the Nth layer Ln channel enterprise .

[0083] In the above step 1023, the channel business transaction is reflected and converted by the hyperplane:

[0084] Since the financial channel business transaction is often low-dimensional and inseparable, by mapping the data to a new transaction hyperplane vector space, the originally overlapping or closely distributed data points in the dimension space are separated, thereby increasing the distinguishability of the financial channel business data.

[0085] In specific implementation, the hyperplane is an (n-1) -dimensional subspace in an n-dimensional space, and the transaction hyperplane refers to an (n-1) -dimensional subspace in a high-dimensional space composed of multi-dimensional business transaction key element characteristics (such as transaction time, transaction amount, transaction type, transaction pricing method, transaction direction, transaction account information and transaction status) for dividing transaction types. It can cut the complex transaction environment into different regions by a high-dimensional boundary, and each region corresponds to a specific transaction characteristic, such as normal transaction and abnormal transaction.

[0086] The core function of the non-associated orthogonal matrix (denoted as G) is to perform orthogonal transformation on the original coordinates and convert them to a new orthogonal space, i.e., a space in which the transaction hyperplane is more easily constructed. Specifically:

[0087] In the original space, the original coordinates of the transaction node are x=(x1,x2,...,xn) (n is the variable dimension);

[0088] After transformation by the non-associated orthogonal matrix G, the coordinates in the new space are y=G·x (or y=G T ·x, depending on the transformation direction); here, y is the position coordinate in the new space, but its determination depends on the joint action of the original coordinate x and the matrix G: without the original coordinate x, y cannot be obtained by the matrix G alone.

[0089] Embodiments of the present application reflect the channel business transaction through data conversion to a new hyperplane, the purpose is to realize the business channel transaction data non-correlation orthogonalization distinguishable, the flow is as follows, namely in an embodiment, through non-correlation orthogonal matrix, the multidimensional information vector of each layer historical channel business transaction is converted to a multidimensional cubic vector space historical transaction hyperplane, which can include:

[0090] 1) the input vector group is the multidimensional transaction data vector of the channel business transaction in the above step 1022: That is, the multidimensional information vector of each layer historical channel business transaction is obtained.

[0091] 2) channel business transaction initialization: let the node , the norm of each layer channel business transaction node That is, according to the norm of each layer channel business transaction node, the norm of each layer channel business transaction node is determined.

[0092] 3) construct the mapping matrix of channel business transaction , wherein, , then , get ; that is, according to the norm of each layer channel business transaction node, the mapping matrix of each layer channel business transaction is constructed.

[0093] 4) after calculating the channel business transaction mapping transformation: At this time The form is .

[0094] 5) channel transaction business iteration calculation: when The word vector from the kth component, the norm of , construct , , get , then calculate, .

[0095] 6) get the non-correlation orthogonal matrix of channel business transaction: after n-1 iterations, a group of channel business transaction non-correlation orthogonal matrix is formed: That is, the corresponding hyperplane is an (n-1) dimensional subspace in n dimensional space.

[0096] The above steps 4) to 6) are: according to the mapping matrix of each layer channel business transaction, the non-correlation orthogonal matrix corresponding to the multidimensional information vector of each layer historical channel business transaction is obtained, so as to convert the multidimensional information vector of each layer historical channel business transaction to a multidimensional cubic vector space historical transaction hyperplane.​

[0097] In implementation, the construction of the transaction hyperplane relies on high-dimensional transaction variables (e.g., 10 factors constitute a 10-dimensional space), but the original variables may have multicollinearity (e.g., "price volatility" and "volume volatility" are highly correlated), resulting in unstable parameter estimation and complex calculation of the hyperplane. The non-correlation orthogonal matrix can eliminate the correlation between variables and provide a more efficient spatial basis for the construction of the transaction hyperplane.

[0098] Next, the step of constructing a channel-based abnormal transaction link is performed, i.e., the historical trajectory graph formed by the above-mentioned step 1024, and the embodiment of the application can also be referred to as a channel transaction link feature learning algorithm process.

[0099] Since the abnormal transaction channel business is nested in multiple layers, its real underlying transaction is usually complex and not directly connected by edges, which requires that the relationship between the nodes hidden by the related technical means be established, and it is not emphasized whether the two nodes are truly connected by edges in the graph. Even if the two nodes are far apart, the network link graph can express the relationship between nodes with similar structures. Even if the two nodes are far apart, the embodiment of the application describes the similarity of the two adjacent nodes through high-order similarity. The structural relationship of the transaction link of the two nodes can be obtained by breadth-first search traversal of the transaction nodes. The method of generating node embedding based on random walk of transaction link graph can capture different types of node relationships of channel business by adjusting the model parameters during the graph walk process.

[0100] Before implementing the channel transaction link feature learning algorithm process in the above-mentioned step 1024, the following steps are implemented:

[0101] 1) Given a business transaction node u, determine the conditional probability of maximizing the occurrence of adjacent nodes of the channel business transaction, i.e., according to the multi-dimensional information vector of each layer of historical channel business transaction, determine the neighbor nodes of each layer of channel business transaction node and the conditional probability of occurrence of each neighbor node:

[0102] ;

[0103] Wherein, is the adjacent node of the channel transaction node u, in Node2Vec, the adjacent transaction node of the channel transaction is not necessarily connected by a direct edge, but is determined according to the sampling strategy.

[0104] Often, if nodes influence each other, the calculation will be very complex. In this paper, the embodiment of the application realizes the independence of each channel business transaction neighbor node after the channel business transaction information data is converted and mapped to a new hyperplane by mirror reflection. Then the probability of adjacent nodes is as follows:

[0105] ;

[0106] The influence between each node of the channel business transaction and its neighbor node is mutual, so the neighbor node of the channel business transaction can be embedded and represented in the form of dot product, and the conditional probability is expressed as:

[0107] ;

[0108] Based on the above adjustment, the probability of the neighbor node of the channel business transaction is as follows:

[0109] ;

[0110] In the "1) Given a business transaction node u, determine the conditional probability of maximizing the occurrence of the adjacent node of the channel business transaction", the correlation strength between nodes (conditional probability calculation) is quantified, so that the correlation probability of two nodes can be calculated even if there is no direct transaction edge between them, which serves as the basis for subsequent path generation.

[0111] 2) Channel business transaction link trial:

[0112] The starting node u of the enterprise channel business transaction generates a financial business transaction sequence of length L through a random walk strategy, assuming that the current transaction sequence point is S i-1 , then the probability of the next transaction sequence point f is:

[0113] ;

[0114] Where is the probability of node v to f, and Q is the normalization constant.

[0115] In the random walk, the probability of jumping from the current node v to the next node f is determined to ensure that the walking direction tends to be high-correlation nodes (nodes with high correlation probability). The selection probability of the next node f is based on the previously calculated correlation probability, and the normalization constant Q is used to ensure that the sum of all possible next probabilities is 1. For example: the neighbors of node v are f1 and f2, and their correlation probabilities with v are 0.6 and 0.4 respectively, then the probability of jumping to f1 is 0.6 / (0.6+0.4)=0.6, and the probability of jumping to f2 is 0.4. The effect of this implementation is to control the random walk not to jump blindly, but to preferentially explore along the high-correlation path, thereby improving the efficiency of mining effective links.

[0116] Based on the above "1) Given a business transaction node u, determine the conditional probability of maximizing the occurrence of the adjacent node of the channel business transaction" and "2) Channel business transaction link trial", the channel transaction link feature learning algorithm process is as follows:

[0117] The new hyperplane after the reflection transformation of the financial transaction is taken as an input graph: , the dimension of the node is d, the number of parallel walks of each financial transaction node is m, the transaction walk step length is l, and the number of neighbors of the channel transaction node is n. That is, an initial structure graph composed of a current transaction hyperplane is obtained, G; each layer of channel business transaction nodes in the initial structure graph is a third-party transaction counterparty, V, the dimension d of each layer of channel business transaction nodes is a multi-dimensional information vector of each layer of historical channel business transactions, and the edge represents the association relationship between the third-party transaction counterparties. The weight w of the edge represents the association strength between the transaction nodes.

[0118] 1) Initialize the business transaction path way to be empty, that is, initialize the indirect abnormal transaction path set to be empty.

[0119] 2) Calculate the correlation probability p of each edge of the financial business transaction node, that is, based on the above-mentioned multi-dimensional information vector of each layer of historical channel business transactions, determine the neighbor nodes of each layer of channel business transaction nodes, and the conditional probability of each neighbor node, which can represent the correlation probability p.

[0120] 3) According to the calculated correlation probability, adjust the new graph of the channel business transaction weight , that is, according to the conditional probability, adjust the weight of the edge in the initial structure graph, and obtain a new structure graph after weight adjustment.

[0121] 4) For the channel business transaction node u, perform from 1 to l times, obtain all transaction sequences, that is, the neighbor nodes of the node u, and add them to the neighbor set of the transaction node u, that is, each layer of channel business transaction nodes in the new structure graph is taken as a starting point, and the following random walk operation of obtaining neighbor nodes is performed: according to the probability of each layer of channel business transaction nodes to the next node, according to the preset transaction walk step length and the preset parallel walk number, the neighbor nodes of each layer of channel business transaction nodes are obtained and added to the neighbor set of each layer of channel business transaction nodes.

[0122] 5) From according to the transaction correlation probability p, the transaction node s is obtained, that is, based on the conditional probability, the transaction node is selected from the neighbor set, and a preset number of parallel walk ordered paths starting from each layer of channel business transaction nodes are generated.

[0123] 6) Add the transaction node s to the transaction path way set.

[0124] 7) Based on the above, the channel business transaction each node u performs random walk, generates a walk path starting from the node u, and parallel walk obtains multiple paths.

[0125] 8) aggregate all paths to remove duplicates, return the link node path of the channel business transaction, and obtain a plurality of indirect abnormal transaction paths corresponding to each current channel business transaction data to form a current traversal trajectory graph.

[0126] The parameters in the embodiment of the application directly affect the quality of the path, and need to be adjusted according to the transaction scenario:

[0127] Node dimension d: length of node embedding vector (such as d=128), the larger d is, the more details can be captured, but the larger the calculation amount is;

[0128] Parallel walking number m: number of paths generated by each node (such as m=10), the larger m is, the more comprehensive the associated mode covered is;

[0129] Walking step length l: maximum length of each path (such as l=5, then the path contains at most 6 nodes), the larger l is, the deeper the multi-layer nested link can be mined (such as A→B→C→D→E→F);

[0130] Neighbor number n: upper limit of neighbors considered each time (such as n=3), n is too small and important associations can be missed, and n is too large and redundancy is increased.

[0131] Output path, for example: {[A→C→B], [A→D→E→B], [C→E]}, judge which of these paths are indirect abnormal transaction paths, and form a current traversal trajectory graph, that is, the input of the indirect abnormal transaction path identification model is a graph composed of transaction hyperplanes, and the output is: indirect abnormal transaction path.

[0132] The link learning parameter tuning scheme can be as follows:

[0133] 1) According to the financial channel transaction business, the parameter setting is returned to 1 through the experience rule, and the input parameter setting is 0.5;

[0134] 2) Since the channel business performs interest transfer, it is difficult to perform multiple asset packaging on its business asset transaction, and the number of underlying transaction asset transfers is generally limited, so the number of steps of single channel transaction node random walking is set to 80, which can capture the underlying transaction information and control financial risks;

[0135] 3) Through the channel, the number of transaction nodes is generally not too much according to the business type, and considering the time complexity, the total number of walks num_ways is set to 5000, which can effectively capture the underlying abnormal transaction.

[0136] In the above step 1024, Figure 2 A schematic diagram of a traversal trajectory graph of a channel business transaction in the embodiment of the application is as follows: Figure 2As shown, the position of each layer of historical channel business transaction node in the transaction hyperplane stereoscopic vector space is different, and finally the indirectly abnormal transaction identification stereoscopic coupling model constructed can include many pieces of Figure 2 As shown, the trajectory atlas.

[0137] The steps of using the indirectly abnormal transaction identification stereoscopic coupling model trained above to actually identify indirectly abnormal transactions are introduced below.

[0138] Figure 3 The flowchart of the indirectly abnormal transaction identification method in the embodiment of the present application is shown in Figure 3 As shown, the method comprises the following steps:

[0139] Step 201: Obtain current channel business transaction data;

[0140] Step 202: Extract the current multi-dimensional business transaction key element features of each third-party transaction counterparty conducting channel business transactions with the transaction initiator from the current channel business transaction data, and determine the current position sequence of each third-party transaction counterparty conducting channel business transactions with the transaction initiator;

[0141] Step 203: Obtain each layer of current channel business transaction multi-dimensional information vector according to the current multi-dimensional business transaction key element features of each third-party transaction counterparty and the current position sequence;

[0142] Step 204: Convert each layer of current channel business transaction multi-dimensional information vector to a current transaction hyperplane of a multi-dimensional stereoscopic vector space through a non-associated orthogonal matrix;

[0143] Step 205: Input the current transaction hyperplane into the pre-constructed indirectly abnormal transaction path identification model to obtain the current trajectory atlas (which can be shown as Figure 2 As shown) corresponding to each piece of current channel business transaction data; the indirectly abnormal transaction path identification model is generated by pre-training according to the relationship sample data between the historical transaction hyperplane atlas and the indirectly abnormal transaction path;

[0144] Step 206: Match the current trajectory atlas with the historical trajectory atlas in the indirectly abnormal transaction identification stereoscopic coupling model to obtain the identification result of whether the current channel business transaction is an indirectly abnormal transaction; the indirectly abnormal transaction identification stereoscopic coupling model comprises a plurality of historical trajectory atlases formed by converting a plurality of pieces of historical channel business transaction data into transaction hyperplanes.

[0145] The implementation of steps 201 to 205 can refer to the steps of constructing the indirect abnormal transaction identification stereoscopic coupling model described above. In the above steps 201 to 205, the data mentioned is current data, such as current channel business transaction data, current traversal trajectory graph, etc. The current traversal trajectory graph is obtained through the above steps 201 to 205, wherein:

[0146] In one embodiment, in the above step 204, converting each layer of current channel business transaction multidimensional information vector to a current transaction hyperplane in a multi-dimensional stereoscopic vector space through a non-associated orthogonal matrix can include:

[0147] Obtaining each layer of current channel business transaction multidimensional information vector;

[0148] Determining the norm of each layer of channel business transaction node according to each layer of current channel business transaction multidimensional information vector;

[0149] Constructing a mapping matrix of each layer of channel business transaction according to the norm of each layer of channel business transaction node;

[0150] According to the mapping matrix of each layer of channel business transaction, a non-associated orthogonal matrix corresponding to each layer of current channel business transaction multidimensional information vector is obtained to convert each layer of current channel business transaction multidimensional information vector to a current transaction hyperplane in a multi-dimensional stereoscopic vector space.

[0151] In the above step 205, inputting the current transaction hyperplane structure graph into the pre-constructed indirect abnormal transaction path identification model to obtain a plurality of indirect abnormal transaction paths corresponding to each current channel business transaction data to form a current traversal trajectory graph can include:

[0152] Obtaining an initial structure graph formed by the current transaction hyperplane; each layer of channel business transaction node in the initial structure graph is a third party transaction counterparty, each layer of channel business transaction node is a historical channel business transaction multidimensional information vector, an edge represents an association relationship between third party transaction counterparties, and an edge weight represents an association strength between transaction nodes;

[0153] According to each layer of historical channel business transaction multidimensional information vector, determining the neighbor node of each layer of channel business transaction node and the conditional probability of occurrence of each neighbor node;

[0154] According to the conditional probability of occurrence of each neighbor node, determining the probability of each layer of channel business transaction node to the next node;

[0155] According to the conditional probability, adjusting the weight of the edge in the initial structure graph to obtain a new structure graph after weight adjustment;

[0156] Taking each layer channel business transaction node in the new structure diagram as a starting point, the following neighbor node acquisition operation of random walk is performed: according to the probability of each layer channel business transaction node to the next node, random walk is performed according to a preset transaction walk step length and a preset parallel walk number, neighbor nodes of each layer channel business transaction node are acquired, and are added to a neighbor set of each layer channel business transaction node.

[0157] Based on the conditional probability, a transaction node is selected from the neighbor set, a preset parallel walk number of ordered paths starting from each layer channel business transaction node is generated, all paths are aggregated for a de-duplication operation, and a plurality of indirect abnormal transaction paths corresponding to each current channel business transaction data are obtained to form a current traversal trajectory graph.

[0158] The embodiment of the application uses channel business transaction link trial to perform batch running, on the one hand, the system automatically captures, cleanses, identifies, and deletes abnormal transaction information (cleanses and deletes channel transactions, removes false information and retains real abnormal transaction data); on the other hand, whether the current channel business transaction is an indirect abnormal transaction is identified by combining similarity calculation and distance calculation, and is pushed to a transaction institution for further verification and confirmation by an abnormal transaction management post personnel.

[0159] In one embodiment, in the above step 206, the current traversal trajectory graph is matched with a historical traversal trajectory graph in an indirect abnormal transaction identification stereoscopic coupling model to obtain an identification result of whether the current channel business transaction is an indirect abnormal transaction, including:

[0160] Obtaining current channel business transaction scene information;

[0161] According to the current channel business transaction scene information, determining a matching mode of the current traversal trajectory graph and the pre-constructed indirect abnormal transaction identification stereoscopic coupling model;

[0162] According to the matching mode, matching the current traversal trajectory graph with a historical traversal trajectory graph in the indirect abnormal transaction identification stereoscopic coupling model to obtain an identification result of whether the current channel business transaction is an indirect abnormal transaction.

[0163] In specific implementation, according to the channel business transaction scene information, whether similarity calculation or a combination of distance calculation is used to identify indirect abnormal transactions can improve the efficiency and accuracy of indirect abnormal transaction identification.

[0164] Similarity calculation can accurately identify the topological characteristics of complex transaction paths and is suitable for rapid screening of large-scale transaction graphs; distance calculation has time flexibility, allows nonlinear alignment of the time axis, has strong anti-interference, and is robust to transaction delays or advances. Specifically:

[0165] 1) Similarity calculation and matching method:

[0166] By comparing the transaction path diagram ( ) and the preset abnormal transaction pattern diagram ( ) to determine the degree of matching between the two. The specific steps are: 1. Edge set intersection ( ): Count the transaction relationships shared by the two (such as transactions from account A to B); 2. Edge set union ( ): Count all transaction relationships between the two; 3. Similarity calculation: the ratio of intersection to union. The larger the value, the higher the matching degree.

[0167] Similarity calculation: Sim ( ) = ;

[0168] Simulation scenario: Check whether the transaction path of an asset management product matches a known abnormal transaction pattern. 1. Pattern diagram: A→B→C (typical abnormal transaction path); 2. Detection diagram: X→Y→Z (suspected abnormal transaction path).

[0169] Matching process: 1. Edge set intersection: A→B and X→Y are both fund transfers; 2. Edge set union: Pattern graph: 3 edges, Graph to be tested: 3 edges; 3. Similarity calculation: .

[0170] The matching rules can be adjusted according to the actual transaction situation (such as allowing node alias mapping), and the similarity can be increased to 66%.

[0171] Result: The system marks it as a suspected abnormal transaction and requires manual review.

[0172] The advantage lies in structured matching, which accurately identifies complex transaction topologies and supports flexible adjustment of matching thresholds (e.g., ≥50% is suspected abnormal transactions).

[0173] As can be seen from the above, in one embodiment, if the matching method is a similarity calculation matching method, according to the matching method, the current travel trajectory map is matched with the historical travel trajectory map in the indirect abnormal transaction identification three-dimensional coupling model to obtain an identification result of whether the current channel business transaction is an indirect abnormal transaction, including:

[0174] Determine the edge set intersection of the current travel trajectory map and each historical travel trajectory map in the indirect abnormal transaction identification three-dimensional coupling model;

[0175] Determine the edge set union of the current travel trajectory map and each historical travel trajectory map in the indirect abnormal transaction identification three-dimensional coupling model;

[0176] According to the proportion of the intersection in the union, the similarity between the current passing trajectory graph and each historical passing trajectory graph is determined, and the recognition result of whether the current channel business transaction is an indirect abnormal transaction is obtained according to the similarity.

[0177] 2) Distance calculation matching mode:

[0178] The minimum cumulative distance is calculated by dynamic programming to align two transaction time sequences (such as transaction timestamps of different levels) to measure their similarity. For example:

[0179] If the level 1 transaction time is [Day 1, Day 2] and the level 2 transaction time is [Day 2, Day 3], the distance calculation can align the two sequences and calculate the matching degree after the offset.

[0180] Distance calculation: ;

[0181] D(i,j) represents the minimum cumulative distance from the first i points of time sequence X to the first j points of time sequence Y.

[0182] Simulation scenario: Aligning cross-level transaction time sequences to detect abnormal density. Data: 1. Level 1 transaction time: [Day 1, Day 3, Day 5]; 2. Level 2 transaction time: [Day 2, Day 4, Day 6].

[0183] Distance calculation: 1. Calculate the minimum cumulative distance path; 2. The time difference after alignment is 1 day (level 1: Day 1→ level 2: Day 2).

[0184] Result: The time offset is within the allowed range (≤2 days), and it is determined to be a normal transaction.

[0185] The advantage is that it can flexibly handle timestamp offsets and avoid misjudgment, and it can capture time density anomalies (such as sudden increase in level 3 transactions).

[0186] From the above, in one embodiment, the identification of the above indirect abnormal transaction can further include:

[0187] By aligning the channel business transaction time sequences of different levels through dynamic programming, the minimum cumulative distance of the channel business transaction time sequences of different levels is determined to verify the recognition result of the indirect abnormal transaction.

[0188] In specific implementation, determining the minimum cumulative distance of the channel business transaction time sequences of different levels to verify the recognition result of the indirect abnormal transaction can further improve the recognition accuracy of the indirect abnormal transaction.

[0189] From the above, in one embodiment, by dynamically aligning the channel business transaction time series of different layers, the minimum cumulative distance of the channel business transaction time series of different layers is determined to verify the identification result of indirect abnormal transaction, comprising:

[0190] Determine the channel business transaction time series of each layer, convert the channel business transaction time series of each layer into a numerical sequence, and determine the length of the channel business transaction time series of each layer according to the numerical sequence;

[0191] According to the length of the channel business transaction time series of each layer, determine the minimum cumulative distance between the channel business transaction time series of each two layers to realize the alignment of the channel business transaction time series of each two layers;

[0192] Determine whether the aligned time difference is within the allowed range;

[0193] If the aligned time difference is not within the allowed range, determine that the current channel business transaction is an indirect abnormal transaction.

[0194] In order to facilitate understanding of how the present application is implemented, an example of the above distance calculation matching method is as follows.

[0195] Sequence definition:

[0196] Level 1 time series (first layer channel business transaction time series) X = [Day 1, Day 3, Day 5] (converted to numerical value: X = [1, 3, 5], length m = 3); Level 2 time series (second layer channel business transaction time series) Y = [Day 2, Day 4, Day 6] (converted to numerical value: Y = [2, 4, 6], length n = 3).

[0197] Objective: Calculate the minimum cumulative distance of X and Y, and find the optimal alignment path to determine whether the aligned time difference is within the allowed range (≤2 days).

[0198] Construct a (m+1)×(n+1) distance matrix D, where D[i][j] represents the minimum cumulative distance of the first i elements of X and the first j elements of Y.

[0199] Recurrence formula: ; (i.e. current distance + minimum cumulative distance of previous step, which can come from "above", "left" or "top-left").

[0200] Initial conditions:

[0201] D[0][0]=0 (the cumulative distance of the empty sequence is 0);

[0202] The first row D[0][j]=∞ (empty sequence cannot align with non-empty sequence);

[0203] The first column D[i][0]=∞ (for the same reason).

[0204] Calculation process:

[0205] 1) Single distance matrix (basic distance):

[0206] First, calculate the direct distance of each element in X and Y as shown in Table 2:

[0207] Table 2

[0208]

[0209] 2) Dynamic programming matrix (cumulative distance):

[0210] Based on the recursive formula, calculate D[i][j] (matrix size 4x4) as shown in Table 3:

[0211] Table 3

[0212]

[0213] 3) Optimal path backtracking:

[0214] The minimum cumulative distance is D[3][3]=3, and the path from (3,3) to (0,0) is: (0,0)→(1,1)→(2,2)→(3,3);

[0215] Corresponding alignment relationship:

[0216] (Distance 1 day);

[0217] (Distance 1 day);

[0218] (Distance 1 day).

[0219] 4) Result analysis:

[0220] Minimum cumulative distance: 3 (1+1+1);

[0221] Single-step time difference: all 1 day, all ≤2 days allowed range;

[0222] Recognition result: two sequences align normally, no abnormal density.

[0223] In specific implementation, through dynamic programming, the similarity of cross-level transaction time series can be flexibly measured, effectively avoiding false judgments caused by small time shifts, and further improving the accuracy of indirect abnormal transaction identification.

[0224] Finally, a further preferred embodiment of the application is introduced.

[0225] After the artificial verification feedback information, the system carries out human-computer interaction training through human-computer training mode, and in an embodiment, the above-mentioned indirect abnormal transaction identification method can further include: updating the historical passing trajectory atlas according to the identification result of the indirect abnormal transaction, and obtaining an updated indirect abnormal transaction identification stereoscopic coupling model by using the updated historical passing trajectory atlas.

[0226] The training method can be simulation in a virtual environment. By using existing transaction information and supplemented artificial verification information, a virtual transaction environment is continuously calculated and constructed, the machine is trained in the simulated environment, the simulation data is continuously corrected by using the comparison between real data and simulation data, and the accuracy deviation of the simulation data is within the deviation range of the real data.

[0227] The training content can be that the abnormal transaction management personnel provide basic data for machine learning through activities such as creation, marking and supplementing information, which is an important basis for the establishment of the machine learning model. In the last stage of machine learning, the abnormal transaction management personnel serve as data fine-tuners, participate in model optimization and adjustment, and ensure that the model meets the basic logic of transaction occurrence and the needs and expectations of the post personnel.

[0228] The training target can be that the ultimate goal of human-computer training is to enable the model to have the ability of generalization processing, that is, to accurately process existing transactions and to process unseen transactions, so as to ensure that the accuracy deviation is within the allowable range.

[0229] In summary, the beneficial technical effects of the indirect abnormal transaction identification and model construction method provided by the embodiment of the application are:

[0230] 1. The embodiment of the application effectively dimensionizes business transactions of different levels, uses hyperplane reflection conversion to effectively map the vector of abnormal transactions to a new hyperplane vector space, separates the originally overlapping or close features in the transaction dimension space, and thus increases the distinguishability of financial channel business data.

[0231] 2. The embodiment of the application uses hyperplane reflection conversion to reflect channel business transactions to a new hyperplane, realizes orthogonalization data differentiation of each level of business transaction, and is easy for subsequent abnormal transaction link feature algorithm learning.

[0232] 3. Since the abnormal transaction channel business is nested in multiple layers, the real bottom transaction is usually complex and has no direct edge connection, and the transaction link feature learning algorithm can effectively establish the channel business transaction link.

[0233] 4、The embodiment of the present application can effectively penetrate different channel underlying businesses, capture effective abnormal transaction link node information, and construct effective abnormal transaction links through the transaction link feature learning algorithm.

[0234] 5、The embodiment of the present application can quickly and effectively identify underlying abnormal transactions, realize abnormal transaction identification after multi-layer penetration, and especially solve problems that cannot be identified by artificial means after multi-layer nesting.

[0235] 6、The embodiment of the present application can quickly and effectively complete abnormal transaction capture, and prevent financial institutions from transferring interest risks through underlying assets.

[0236] 7、The embodiment of the present application can quickly and effectively capture effective abnormal transaction paths from massive business transaction data, identify underlying abnormal transactions of channel businesses, and prevent financial transaction risks based on the hyperplane reflection conversion and transaction link feature learning algorithm.

[0237] To sum up, the embodiment of the present application collects enterprise and channel type transaction counterparty transaction information and associated party and channel type transaction counterparty transaction information, sets rule parameters, establishes an indirect abnormal transaction identification stereoscopic coupling model, carries out indirect abnormal transaction identification work, and improves the efficiency and accuracy of indirect abnormal transaction identification.

[0238] The embodiment of the present application also provides a construction device of an indirect abnormal transaction identification stereoscopic coupling model, as described in the following embodiment. Since the principle of solving the problem of the device is similar to the method of identifying indirect abnormal transactions and constructing a model, the implementation of the device can be referred to the implementation of the method of identifying indirect abnormal transactions and constructing a model, and repeated parts will not be described again.

[0239] Figure 4 The structure diagram of the construction device of the indirect abnormal transaction identification stereoscopic coupling model in the embodiment of the present application is shown in FIG. 1. Figure 4 As shown in FIG. 1, the construction device comprises:

[0240] A first acquisition unit 11 is configured to acquire a plurality of historical channel business transaction data.

[0241] A forming unit 12 is configured to process each piece of historical channel business transaction data to form a historical penetration trajectory graph corresponding to each piece of historical channel business transaction data according to the following method:

[0242] Extract historical multi-dimensional business transaction key element features of each third party transaction counterparty that transacts channel business with the transaction initiator from each piece of historical channel business transaction data, and determine the historical position sequence of each third party transaction counterparty that transacts channel business with the transaction initiator.

[0243] According to the historical multi-dimensional business transaction key element characteristics of each third-party transaction counterparty and the historical position sequence, a multi-dimensional information vector of each layer of historical channel business transaction is obtained;

[0244] Each layer of the multi-dimensional information vector of the historical channel business transaction is converted into a transaction hyperplane of a multi-dimensional cubic vector space through a non-associated orthogonal matrix;

[0245] The transaction hyperplane is input into a pre-constructed indirect abnormal transaction path identification model to obtain a historical penetration trajectory graph corresponding to each piece of historical channel business transaction data; the indirect abnormal transaction path identification model is pre-trained according to relationship sample data between the historical transaction hyperplane graph and the indirect abnormal transaction path;

[0246] The construction unit 13 is configured to construct an indirect abnormal transaction identification cubic coupling model from the historical penetration trajectory graphs corresponding to the plurality of pieces of historical channel business transaction data.

[0247] In one embodiment, the historical multi-dimensional business transaction key element characteristics of each third-party transaction counterparty include transaction time, transaction amount, transaction type, transaction pricing method, transaction direction, transaction account information and transaction status.

[0248] The embodiment of the present application also provides an indirect abnormal transaction identification device, as described in the following embodiment. Since the principle of solving the problem of the device is similar to the indirect abnormal transaction identification and the model construction method, the implementation of the device can be referred to the implementation of the indirect abnormal transaction identification and the model construction method, and the repeated parts will not be described here.

[0249] Figure 5 The structure of the indirect abnormal transaction identification device in the embodiment of the present application is shown in FIG. 1, which includes: Figure 5

[0250] The second acquisition unit 21 is configured to acquire current channel business transaction data.

[0251] The extraction unit 22 is configured to extract the current multi-dimensional business transaction key element characteristics of each third-party transaction counterparty that transacts with the transaction initiator from the current channel business transaction data, and determine the current position sequence of each third-party transaction counterparty that transacts with the transaction initiator.

[0252] The information vector generation unit 23 is configured to obtain a multi-dimensional information vector of each layer of current channel business transaction according to the current multi-dimensional business transaction key element characteristics of each third-party transaction counterparty and the current position sequence.

[0253] ​a conversion unit 24 configured to convert each layer of the current channel business transaction multidimensional information vector into a current transaction hyperplane in a multi-dimensional cubic vector space through a non-associated orthogonal matrix;

[0254] a graph construction unit 25 configured to input the current transaction hyperplane into a pre-constructed indirect abnormal transaction path identification model to obtain a plurality of indirect abnormal transaction paths corresponding to each piece of current channel business transaction data, thereby constructing a current traversal trajectory graph; the indirect abnormal transaction path identification model is generated by pre-training according to relationship sample data between a historical transaction hyperplane graph and an indirect abnormal transaction path;

[0255] a recognition unit 26 configured to match the current traversal trajectory graph with a historical traversal trajectory graph in an indirect abnormal transaction identification cubic coupling model to obtain a recognition result of whether the current channel business transaction is an indirect abnormal transaction; the indirect abnormal transaction identification cubic coupling model includes a plurality of historical traversal trajectory graphs formed by converting a plurality of pieces of historical channel business transaction data into transaction hyperplanes.

[0256] In one embodiment, the conversion unit is specifically configured to:

[0257] obtain each layer of the current channel business transaction multidimensional information vector;

[0258] determine the norm of each layer of the channel business transaction node according to the current channel business transaction multidimensional information vector of each layer;

[0259] construct a mapping matrix of each layer of the channel business transaction according to the norm of each layer of the channel business transaction node;

[0260] obtain a non-associated orthogonal matrix corresponding to each layer of the current channel business transaction multidimensional information vector according to the mapping matrix of each layer of the channel business transaction, so as to convert each layer of the current channel business transaction multidimensional information vector into a current transaction hyperplane in a multi-dimensional cubic vector space.

[0261] In one embodiment, the recognition unit is specifically configured to:

[0262] obtain current channel business transaction scene information;

[0263] determine a matching manner of the current traversal trajectory graph and the pre-constructed indirect abnormal transaction identification cubic coupling model according to the current channel business transaction scene information;

[0264] match the current traversal trajectory graph with a historical traversal trajectory graph in the indirect abnormal transaction identification cubic coupling model according to the matching manner, to obtain a recognition result of whether the current channel business transaction is an indirect abnormal transaction.

[0265] In an embodiment, if the matching manner is the similarity calculation matching manner, the current passing trajectory graph is matched with the historical passing trajectory graphs in the indirect abnormal transaction identification stereoscopic coupling model according to the matching manner, and an identification result of whether the current channel business transaction is an indirect abnormal transaction is obtained, including:

[0266] determining a set intersection of edges of the current passing trajectory graph and each historical passing trajectory graph in the indirect abnormal transaction identification stereoscopic coupling model;

[0267] determining a set union of edges of the current passing trajectory graph and each historical passing trajectory graph in the indirect abnormal transaction identification stereoscopic coupling model;

[0268] determining a similarity between the current passing trajectory graph and each historical passing trajectory graph according to a proportion of the intersection to the union, and obtaining the identification result of whether the current channel business transaction is an indirect abnormal transaction according to the similarity.

[0269] In an embodiment, the identification device of the indirect abnormal transaction described above can further include:

[0270] a verification unit configured to determine a minimum cumulative distance of the channel business transaction time sequences of different layers by dynamic programming alignment to verify the identification result of the indirect abnormal transaction.

[0271] In an embodiment, the verification unit is specifically configured to:

[0272] determine the channel business transaction time sequence of each layer, convert the channel business transaction time sequence of each layer into a numerical sequence, and determine the length of the channel business transaction time sequence of each layer according to the numerical sequence;

[0273] determine the minimum cumulative distance between the channel business transaction time sequences of each two layers according to the length of the channel business transaction time sequence of each layer, so as to realize the alignment of the channel business transaction time of each two layers;

[0274] determine whether the aligned time difference is within an allowable range;

[0275] if the aligned time difference is not within the allowable range, determine that the current channel business transaction is an indirect abnormal transaction.

[0276] In an embodiment, the graph construction unit is specifically configured to:

[0277] obtain an initial structure graph constituted by the current transaction hyperplane; each layer channel business transaction node in the initial structure graph is a third-party transaction counterparty, the dimension of each layer channel business transaction node is a multi-dimensional information vector of each layer historical channel business transaction, the edge represents the association relationship between the third-party transaction counterparties, and the weight of the edge represents the association strength between the transaction nodes.

[0278] determine the neighbor nodes of each layer channel business transaction node according to the multi-dimensional information vector of each layer historical channel business transaction, and the conditional probability of occurrence of each neighbor node;

[0279] determine the probability of each layer channel business transaction node to the next node according to the conditional probability of occurrence of each neighbor node;

[0280] adjust the weight of the edge in the initial structure graph according to the conditional probability, and obtain a new structure graph after weight adjustment;

[0281] take each layer channel business transaction node in the new structure graph as a starting point, and perform the following random walk operation to obtain neighbor nodes: according to the probability of each layer channel business transaction node to the next node, randomly walk according to a preset transaction walking step and a preset number of parallel walks, obtain the neighbor nodes of each layer channel business transaction node, and add to the neighbor set of each layer channel business transaction node;

[0282] select transaction nodes from the neighbor set based on the conditional probability, generate a preset number of parallel walks of ordered paths starting from each layer channel business transaction node, and aggregate all paths to obtain a plurality of indirect abnormal transaction paths corresponding to each current channel business transaction data, and obtain a current traversal trajectory graph.

[0283] In one embodiment, the above-mentioned indirect abnormal transaction identification device further comprises an updating unit for:

[0284] updating the historical traversal trajectory graph according to the identification result of the indirect abnormal transaction, and obtaining an updated indirect abnormal transaction identification three-dimensional coupling model by using the updated historical traversal trajectory graph.

[0285] The embodiment of the present application also provides a computer device, which comprises a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the above-mentioned indirect abnormal transaction identification and model construction method when executing the computer program.

[0286] The embodiment of the present application also provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the above-mentioned indirect abnormal transaction identification and model construction method.

[0287] The embodiment of the present application also provides a computer program product, which comprises a computer program, and the computer program is executed by a processor to implement the above-mentioned indirect abnormal transaction identification and model construction method.

[0288] The beneficial technical effects of the indirect abnormal transaction identification and model construction scheme provided by the embodiment of the present application are:

[0289] Firstly, the embodiment of the present application stratifies the position of the transaction between each third-party transaction counterparty and the transaction initiator, extracts the current multi-dimensional business transaction key element features and the current position sequence of each third-party transaction counterparty, obtains the current channel business transaction multi-dimensional information vector of each layer according to the multi-dimensional business transaction key element features and the position sequence, and converts the current channel business transaction multi-dimensional information vector of each layer to a current transaction hyperplane in a multi-dimensional cubic vector space through a non-correlation orthogonal matrix. The non-correlation orthogonal matrix can eliminate variable correlation, provide a more efficient space basis for the construction of the transaction hyperplane, separate the originally overlapping or closely distributed data points in the dimensional space, realize the non-correlation orthogonalization and distinguishability of the channel business transaction data, thereby increasing the distinguishability of the channel business transaction data and laying a foundation for the subsequent accurate identification of the indirect abnormal transaction path.

[0290] Secondly, the embodiment of the present application converts the current channel business transaction multi-dimensional information vector of each layer to a current transaction hyperplane in a multi-dimensional cubic vector space. The correlation of each layer of channel business transaction nodes in the transaction hyperplane construction graph is simplified, the independence of each channel business transaction node is realized, and based on this, through the transaction hyperplane construction graph, the indirect abnormal transaction path identification model obtained by machine learning, and the cross in the financial field, the hidden hierarchical structure and hidden correlation between nodes in the indirect abnormal transaction link can be mined, and the identification accuracy and efficiency of the indirect abnormal transaction are improved.

[0291] In summary, the indirect abnormal transaction identification and model construction scheme provided by the embodiment of the present application can improve the identification accuracy and efficiency of the indirect abnormal transaction.

[0292] Those skilled in the art will understand that the embodiments of the present application can be provided as a method, a system, or a computer program product. Therefore, the present application can take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can take the form of a computer program product implemented on one or more computer usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer usable program code.

[0293] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 one or more flowcharts and / or blocks Figure 1 one or more flowcharts and / or blocks

[0294] These computer program instructions can also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the function specified in the flowchart block or blocks. Figure 1 one or more flowcharts and / or blocks Figure 1 one or more flowcharts and / or blocks

[0295] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 one or more flowcharts and / or blocks Figure 1 one or more flowcharts and / or blocks

[0296] The above-described specific embodiments, the purpose, technical solutions and advantages of the present application are further described in detail, it should be understood that the above-described is only the specific embodiments of the present application, and is not used to limit the protection scope of the present application, any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present application should be included in the protection scope of the present application.

Claims

1. A method for identifying indirect abnormal transactions, characterized in that: include: Get the current channel business transaction data; Extracting the current multi-dimensional business transaction key element features of each third-party transaction counterparty that conducts the channel business transaction with the transaction initiator from the current channel business transaction data, and determining the current position order of each third-party transaction counterparty that conducts the channel business transaction with the transaction initiator; Obtaining a multi-dimensional information vector of the current channel business transaction at each layer based on the key element characteristics of the current multi-dimensional business transaction of each third-party counterparty and the current position sequence; The multi-dimensional information vector of each layer of current channel business transaction is converted into a current transaction hyperplane in a multi-dimensional three-dimensional vector space through a non-associated orthogonal matrix; The current transaction hyperplane composition graph is input into a pre-built indirect abnormal transaction path identification model to obtain a current trajectory map consisting of multiple indirect abnormal transaction paths corresponding to each current channel business transaction data; the indirect abnormal transaction path identification model is pre-trained and generated based on sample data of the relationship between the historical transaction hyperplane composition graph and the indirect abnormal transaction paths; The current travel trajectory map is matched with the historical travel trajectory map in the indirect abnormal transaction identification three-dimensional coupling model to obtain an identification result of whether the current channel business transaction is an indirect abnormal transaction; the indirect abnormal transaction identification three-dimensional coupling model includes multiple historical travel trajectory maps formed by performing transaction hyperplane transformation on multiple historical channel business transaction data.

2. The method according to claim 1, wherein The multi-dimensional information vector of each layer of the current channel business transaction is converted into a current transaction hyperplane in a multi-dimensional three-dimensional vector space through a non-associated orthogonal matrix, including: Obtain multi-dimensional information vectors of business transactions in each layer of the current channel; Determine the norm of each layer of channel business transaction nodes based on the multi-dimensional information vector of each layer of current channel business transactions; According to the norm of each layer of channel business transaction nodes, a mapping matrix of each layer of channel business transactions is constructed; According to the mapping matrix of each layer of channel business transactions, a non-correlated orthogonal matrix corresponding to the multi-dimensional information vector of each layer of current channel business transactions is obtained to convert the multi-dimensional information vector of each layer of current channel business transactions into a current transaction hyperplane in a multi-dimensional three-dimensional vector space.

3. The method according to claim 1, wherein The current passage trajectory map is matched with the historical passage trajectory map in the indirect abnormal transaction identification three-dimensional coupling model to obtain the identification result of whether the current channel business transaction is an indirect abnormal transaction, including: Get the current channel business transaction scenario information; According to the current channel business transaction scenario information, determine the matching method between the current travel trajectory map and the pre-built indirect abnormal transaction identification three-dimensional coupling model; According to the matching method, the current travel trajectory map is matched with the historical travel trajectory map in the indirect abnormal transaction identification three-dimensional coupling model to obtain an identification result of whether the current channel business transaction is an indirect abnormal transaction.

4. The method according to claim 3, wherein If the matching method is a similarity calculation matching method, the current travel trajectory map is matched with the historical travel trajectory map in the indirect abnormal transaction identification stereo coupling model according to the matching method to obtain an identification result of whether the current channel business transaction is an indirect abnormal transaction, including: Determine the edge set intersection of the current travel trajectory map and each historical travel trajectory map in the indirect abnormal transaction identification three-dimensional coupling model; Determine the edge set union of the current travel trajectory map and each historical travel trajectory map in the indirect abnormal transaction identification three-dimensional coupling model; According to the ratio of the intersection to the union, the similarity between the current travel trajectory map and each historical travel trajectory map is determined, and based on the similarity, an identification result of whether the current channel business transaction is an indirect abnormal transaction is obtained.

5. The method according to claim 4, wherein Also includes: Through dynamic programming, the channel business transaction time series of different layers are aligned, and the minimum cumulative distance of the channel business transaction time series of different layers is determined to verify the identification results of indirect abnormal transactions.

6. The method according to claim 5, wherein Through dynamic programming, the transaction time series of different channel business layers are aligned, and the minimum cumulative distance of the transaction time series of different channel business layers is determined to verify the identification results of indirect abnormal transactions, including: Determine a time sequence of channel business transactions at each layer, convert the time sequence of channel business transactions at each layer into a numerical sequence, and determine the length of the time sequence of channel business transactions at each layer according to the numerical sequence; According to the length of each layer of channel business transaction time series, the minimum cumulative distance between each two layers of channel business transaction time series is determined to achieve the alignment of each two layers of channel business transaction time series; Determine whether the time difference after alignment is within the allowable range; If the time difference after alignment is not within the allowable range, the current channel business transaction is determined to be an indirect abnormal transaction.

7. The method according to claim 1, wherein Input the current transaction hyperplane graph into the pre-built indirect abnormal transaction path identification model to obtain the current trajectory map composed of multiple indirect abnormal transaction paths corresponding to each current channel business transaction data, including: Obtain an initial structure diagram formed by the current transaction hyperplane; each channel business transaction node in the initial structure diagram represents a third-party transaction counterparty, the dimension of each channel business transaction node is a multi-dimensional information vector of each layer of historical channel business transactions, the edges represent the association relationship between third-party transaction counterparties, and the edge weights represent the strength of the association between transaction nodes; Based on the multi-dimensional information vector of each layer of historical channel business transactions, determine the neighbor nodes of each layer of channel business transaction nodes and the conditional probability of each neighbor node appearing; According to the conditional probability of each neighbor node appearing, the probability of each layer of channel business transaction node to the next node is determined; Adjusting the weights of the edges in the initial structure graph according to the conditional probability to obtain a new structure graph after weight adjustment; Starting from each channel business transaction node in the new structure diagram, the following random walk operation is performed to obtain neighbor nodes: based on the probability of each channel business transaction node to the next node, random walk is performed according to the preset transaction walk step length and the preset number of parallel walks to obtain the neighbor nodes of each channel business transaction node and add them to the neighbor set of each channel business transaction node; Based on the conditional probability, transaction nodes are selected from the neighbor set, and several preset parallel ordered paths starting from each layer of channel business transaction nodes are generated. All paths are summarized and deduplicated to obtain multiple indirect abnormal transaction paths corresponding to each current channel business transaction data to form the current travel trajectory map.

8. The method according to claim 1, wherein Also includes: According to the identification results of indirect abnormal transactions, the historical travel trajectory map is updated, and the updated indirect abnormal transaction identification three-dimensional coupling model is obtained using the updated historical travel trajectory map.

9. A method for constructing a three-dimensional coupling model for indirect abnormal transaction identification, characterized in that: include: Obtain business transaction data of multiple historical channels; Process each historical channel's business transaction data in the following manner to form a historical trajectory map corresponding to each historical channel's business transaction data: Extracting the key historical multi-dimensional business transaction characteristics of each third-party counterparty that conducted channel business transactions with the transaction initiator from each historical channel business transaction data, and determining the historical position sequence of each third-party counterparty that conducted channel business transactions with the transaction initiator; Obtaining a multi-dimensional information vector of each layer of historical channel business transactions based on the key element characteristics of each third-party counterparty's historical multi-dimensional business transactions and the historical position sequence; The multi-dimensional information vector of each layer of historical channel business transactions is converted into a transaction hyperplane in a multi-dimensional three-dimensional vector space through a non-correlated orthogonal matrix; The transaction hyperplane composition graph is input into a pre-built indirect abnormal transaction path identification model to obtain a historical trajectory map consisting of multiple indirect abnormal transaction paths corresponding to each historical channel business transaction data; the indirect abnormal transaction path identification model is pre-trained and generated based on sample data of the relationship between the historical transaction hyperplane composition graph and the indirect abnormal transaction paths; The historical trajectory maps corresponding to business transaction data of multiple historical channels are used to form a three-dimensional coupling model for indirect abnormal transaction identification.

10. The method according to claim 9, wherein The key characteristics of each third-party counterparty's historical multi-dimensional business transactions include: transaction time, transaction amount, transaction type, transaction pricing method, transaction direction, transaction account information and transaction status.

11. A device for identifying indirect abnormal transactions, characterized in that: include: The second acquisition unit is used to obtain the current channel business transaction data; An extraction unit is used to extract the current multi-dimensional business transaction key element characteristics of each third-party transaction counterparty that conducts the channel business transaction with the transaction initiator from the current channel business transaction data, and to determine the current position order of each third-party transaction counterparty that conducts the channel business transaction with the transaction initiator; An information vector generating unit, configured to obtain a multi-dimensional information vector of the current channel business transaction at each layer based on the key element characteristics of the current multi-dimensional business transaction of each third-party transaction counterparty and the current position sequence; A conversion unit, configured to convert the multi-dimensional information vector of each layer of the current channel business transaction into a current transaction hyperplane in a multi-dimensional three-dimensional vector space through a non-associated orthogonal matrix; A graph construction unit is configured to input the current transaction hyperplane composition graph into a pre-constructed indirect abnormal transaction path identification model to obtain a current trajectory graph consisting of multiple indirect abnormal transaction paths corresponding to each current channel business transaction data; the indirect abnormal transaction path identification model is pre-trained and generated based on sample data of the relationship between the historical transaction hyperplane composition graph and the indirect abnormal transaction paths; The identification unit is used to match the current travel trajectory map with the historical travel trajectory map in the indirect abnormal transaction identification three-dimensional coupling model to obtain an identification result of whether the current channel business transaction is an indirect abnormal transaction; the indirect abnormal transaction identification three-dimensional coupling model includes multiple historical travel trajectory maps formed by performing transaction hyperplane transformation on multiple historical channel business transaction data.

12. A device for constructing a three-dimensional coupling model for indirect abnormal transaction identification, characterized in that: include: A first acquisition unit is used to acquire business transaction data of multiple historical channels; The forming unit is configured to process each historical channel business transaction data according to the following method to form a historical travel trajectory map corresponding to each historical channel business transaction data: Extracting the key historical multi-dimensional business transaction characteristics of each third-party counterparty that conducted channel business transactions with the transaction initiator from each historical channel business transaction data, and determining the historical position sequence of each third-party counterparty that conducted channel business transactions with the transaction initiator; Obtaining a multi-dimensional information vector of each layer of historical channel business transactions based on the key element characteristics of each third-party counterparty's historical multi-dimensional business transactions and the historical position sequence; The multi-dimensional information vector of each layer of historical channel business transactions is converted into a transaction hyperplane in a multi-dimensional three-dimensional vector space through a non-correlated orthogonal matrix; The transaction hyperplane composition graph is input into a pre-built indirect abnormal transaction path identification model to obtain a historical trajectory map consisting of multiple indirect abnormal transaction paths corresponding to each historical channel business transaction data; the indirect abnormal transaction path identification model is pre-trained and generated based on sample data of the relationship between the historical transaction hyperplane composition graph and the indirect abnormal transaction paths; The construction unit is used to form a three-dimensional coupling model for indirect abnormal transaction identification by combining historical travel trajectory maps corresponding to business transaction data of multiple historical channels.

13. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the method according to any one of claims 1 to 10 is implemented.

14. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 10 is implemented.

15. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 10 is implemented.

Images