Fund settlement abnormity monitoring method, device and system
By generating transaction subgraphs and comparing their similarity, the problem of inaccurate risk assessment in traditional fund monitoring is solved, and more comprehensive identification of abnormal transactions is achieved.
Patent Information
- Application Number
- CN202510845167.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-06-23
- Publication Date
- 2025-10-31
AI Technical Summary
Traditional fund monitoring methods fail to correlate various attributes of bank statements, corporate transaction attributes, and corporate information, resulting in poor accuracy in transaction risk assessment.
By monitoring transaction amounts or frequencies, transaction data and information about the transacting parties are obtained, and a transaction subgraph is generated. A graph matching algorithm is then used to select candidate normal transaction subgraphs from the transaction relationship network whose maximum similarity is less than a threshold, thereby identifying abnormal transactions.
It improves the comprehensiveness of risk identification, reduces the possibility of missed risk detection, and monitors abnormal transactions by considering the correlation between different trading parties.
Smart Images
Figure CN120876083A_ABST
Abstract
Description
Technical Field
[0001] This disclosure relates to the field of financial risk monitoring technology, and in particular to a method, device and system for monitoring abnormal fund settlement. Background Technology
[0002] In related technologies, companies may delay payments to maintain a good customer base during transactions. Credit assessment, early warning, and credit limits between companies are crucial for banks, insurance companies, and other funding providers. Traditional fund monitoring relies primarily on financial data, analyzing a company's bank statements to obtain information on fund inflows and outflows, and combining this with operational management data to calculate financial indicators such as operational capacity, profitability, and solvency. This approach only tracks the amount of each transaction, failing to correlate various attributes of bank statements, company transaction attributes, and the company's own information, resulting in poor accuracy in risk assessment. Summary of the Invention
[0003] To overcome the problems existing in related technologies, this disclosure provides a method, device and system for monitoring abnormal fund settlement.
[0004] According to a first aspect of the present disclosure, a method for monitoring abnormal fund settlement is provided, comprising:
[0005] In response to the detection that the transaction amount of the transaction to be monitored is greater than a preset amount or the transaction frequency is greater than a preset frequency, the transaction data of the transaction to be monitored and the transaction party information of the transaction party associated with the transaction to be monitored are obtained;
[0006] Based on the transaction amount, the transaction party information, and the transaction relationship network, a first transaction sub-graph of the transaction to be monitored is generated;
[0007] A graph matching algorithm is used to select at least one candidate normal transaction subgraph that matches the first transaction subgraph from a preset transaction relationship network; the transaction relationship network is a transaction graph that includes the transaction parties and historical transaction information between different transaction parties.
[0008] The first transaction subgraph is compared with each candidate normal transaction subgraph in the at least one candidate normal transaction subgraph to obtain the similarity value corresponding to each candidate normal transaction subgraph.
[0009] Select the maximum similarity value from the similarity values corresponding to each candidate normal transaction subgraph;
[0010] If the maximum similarity value is less than a preset threshold, the transaction to be monitored is determined to be an abnormal transaction.
[0011] In some embodiments of this disclosure, the step of comparing the similarity of the first transaction subgraph with each of the at least one candidate normal transaction subgraphs to obtain a similarity value corresponding to each candidate normal transaction subgraph includes:
[0012] For each candidate normal transaction subgraph, calculate the similarity of transaction amount distribution, transaction frequency, and network structure between the candidate normal transaction subgraph and the first transaction subgraph;
[0013] The similarity of transaction amount distribution, transaction frequency, and network structure corresponding to the same candidate normal transaction subgraph is fused to obtain the comprehensive similarity index value between each candidate normal transaction subgraph and the first transaction subgraph;
[0014] The comprehensive similarity index value is determined as the similarity value.
[0015] In some embodiments of this disclosure, the fusion processing of the similarity of transaction amount distribution, transaction frequency, and network structure corresponding to the same candidate normal transaction subgraph to obtain a comprehensive similarity index value between each candidate normal transaction subgraph and the first transaction subgraph includes:
[0016] The comprehensive similarity index value is calculated using the following formula:
[0017] The overall similarity index value = α·similarity of transaction amount distribution + β·similarity of transaction frequency + γ·similarity of network structure, where α, β, and γ are all weight coefficients.
[0018] In some embodiments of this disclosure, the transaction relationship network is constructed using the following steps:
[0019] Obtain information on the transacting parties and historical transaction information;
[0020] Each transaction party in the transaction party information is treated as a node;
[0021] Feature vectors are obtained by extracting features from the transaction party information and historical transaction information;
[0022] Based on the feature vector, the correlation between the transacting parties that have a transaction is calculated to obtain the correlation index value;
[0023] Based on the historical transaction information and the correlation index values, edges connecting different nodes are generated to obtain the transaction relationship network.
[0024] According to a second aspect of the present disclosure, a fund settlement anomaly monitoring device is provided, comprising:
[0025] The acquisition unit is used to acquire the transaction data of the transaction to be monitored and the transaction party information of the transaction party associated with the transaction to be monitored in response to the detection that the transaction amount of the transaction to be monitored is greater than a preset amount or the transaction frequency is greater than a preset frequency.
[0026] The generation unit is used to generate a first transaction sub-graph of the transaction to be monitored based on the transaction amount, the transaction party information, and the transaction relationship network;
[0027] The matching unit is used to select at least one candidate normal transaction subgraph that matches the first transaction subgraph from a preset transaction relationship network using a graph matching algorithm; the transaction relationship network is a transaction graph that includes transaction parties and historical transaction information between different parties.
[0028] The comparison unit is used to compare the similarity of the first transaction subgraph with each of the at least one candidate normal transaction subgraphs to obtain a similarity value for each candidate normal transaction subgraph.
[0029] The selection unit is used to select the maximum similarity value from the similarity values corresponding to each candidate normal transaction subgraph;
[0030] The determining unit is used to determine that the transaction to be monitored is an abnormal transaction when the maximum similarity value is less than a preset threshold.
[0031] In some embodiments of this disclosure, the comparison unit is specifically used for:
[0032] For each candidate normal transaction subgraph, calculate the similarity of transaction amount distribution, transaction frequency, and network structure between the candidate normal transaction subgraph and the first transaction subgraph;
[0033] The similarity of transaction amount distribution, transaction frequency, and network structure corresponding to the same candidate normal transaction subgraph is fused to obtain the comprehensive similarity index value between each candidate normal transaction subgraph and the first transaction subgraph;
[0034] The comprehensive similarity index value is determined as the similarity value.
[0035] In some embodiments of this disclosure, the comparison unit is specifically used for:
[0036] The comprehensive similarity index value is calculated using the following formula:
[0037] The overall similarity index value = α·similarity of transaction amount distribution + β·similarity of transaction frequency + γ·similarity of network structure, where α, β, and γ are all weight coefficients.
[0038] According to a third aspect of the present disclosure, an electronic device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the method as described in any one of the first aspects.
[0039] According to a fourth aspect of the present disclosure, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the method as described in any one of the first aspects.
[0040] According to a fifth aspect of the present disclosure, a computer program product is provided, including a computer program that, when executed by a processor, implements the method as described in any one of the first aspects.
[0041] The technical solution provided by the embodiments of this disclosure may include the following beneficial effects: By responding to the detection that the transaction amount of the transaction to be monitored is greater than a preset amount or the transaction frequency is greater than a preset frequency, transaction data of the transaction to be monitored and transaction party information of the parties associated with the transaction to be monitored are obtained; based on the transaction amount, transaction party information, and transaction relationship network, a first transaction subgraph of the transaction to be monitored is generated; a graph matching algorithm is used to select at least one candidate normal transaction subgraph that matches the first transaction subgraph from the preset transaction relationship network; the first transaction subgraph is compared with each candidate normal transaction subgraph in the at least one candidate normal transaction subgraph to obtain a similarity value corresponding to each candidate normal transaction subgraph; the maximum similarity value is selected from the similarity values corresponding to each candidate normal transaction subgraph; if the maximum similarity value is less than a preset threshold, the transaction to be monitored is determined to be an abnormal transaction. By utilizing the transaction relationship network to represent the relationships between different parties, abnormal transaction monitoring of complex related transactions is performed based on the transaction relationship network. This considers the relationship between different parties, improves the comprehensiveness of risk identification, and reduces the possibility of missed risk detection.
[0042] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description
[0043] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.
[0044] Figure 1 This is a flowchart illustrating a method for monitoring abnormal fund settlements according to an exemplary embodiment.
[0045] Figure 2 This is a block diagram illustrating a fund settlement anomaly monitoring device according to an exemplary embodiment.
[0046] Figure 3 This is a block diagram illustrating an apparatus for a method of monitoring abnormal fund settlements according to an exemplary embodiment. Detailed Implementation
[0047] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numerals in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Rather, they are merely examples of apparatuses and methods consistent with some aspects of the invention as detailed in the appended claims.
[0048] The terminology used in this disclosure is for the purpose of describing particular embodiments only and is not intended to be limiting of the present disclosure. The singular forms “a” and “the” as used in this disclosure and the appended claims are also intended to include the plural forms, unless the context clearly indicates otherwise.
[0049] It should be understood that although the terms first, second, third, etc., may be used to describe various information in embodiments of this disclosure, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, first information may also be referred to as second information without departing from the scope of embodiments of this disclosure, and similarly, second information may also be referred to as first information. Depending on the context, the words “if” and “suppose” as used herein may be interpreted as “when”, “when”, or “in response to a determination”.
[0050] Furthermore, various forms of processes shown in the embodiments of this disclosure can be used to reorder, add, or delete steps. For example, the steps described in this application can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this disclosure can be achieved, and this is not limited herein.
[0051] In related technologies, companies may delay payments to maintain a good customer base during transactions. Credit assessment, early warning, and credit limits between companies are crucial for banks, insurance companies, and other funding providers. Traditional fund monitoring relies primarily on financial data, analyzing a company's bank statements to obtain information on fund inflows and outflows, and combining this with operational management data to calculate financial indicators such as operational capacity, profitability, and solvency. This approach only tracks the amount of each transaction, failing to correlate various attributes of bank statements, company transaction attributes, and the company's own information, resulting in poor accuracy in risk assessment.
[0052] To address the aforementioned issues, this disclosure provides a method, apparatus, and system for monitoring abnormal fund settlements. The method involves acquiring transaction data and party information of associated parties in a monitored transaction upon detecting a transaction amount exceeding a preset amount or transaction frequency exceeding a preset frequency. Based on the transaction amount, party information, and transaction relationship network, a first transaction subgraph of the monitored transaction is generated. A graph matching algorithm is used to select at least one candidate normal transaction subgraph matching the first transaction subgraph from the preset transaction relationship network. The first transaction subgraph is compared with each candidate normal transaction subgraph in the at least one candidate normal transaction subgraph to obtain a similarity value for each candidate normal transaction subgraph. The maximum similarity value is selected from the similarity values of each candidate normal transaction subgraph. If the maximum similarity value is less than a preset threshold, the monitored transaction is determined to be an abnormal transaction. By utilizing the transaction relationship network to represent the relationships between different parties, abnormal transaction monitoring of complex related transactions is performed based on the transaction relationship network. This considers the correlation between different parties, improving the comprehensiveness of risk identification and reducing the possibility of missed risk detection.
[0053] Figure 1 This is a flowchart illustrating a method for monitoring abnormal fund settlements according to an exemplary embodiment, such as... Figure 1 As shown, it should be noted that the fund settlement anomaly monitoring method of this disclosure is applied in a fund settlement anomaly monitoring device. For example... Figure 1 As shown, the method may include the following steps:
[0054] Step 101: In response to the detection that the transaction amount of the transaction to be monitored is greater than a preset amount or the transaction frequency is greater than a preset frequency, obtain the transaction data of the transaction to be monitored, as well as the transaction party information of the transaction party associated with the transaction to be monitored.
[0055] In one embodiment, if the transaction amount of the transaction to be monitored is greater than a preset amount or the transaction frequency is greater than a preset frequency, it indicates that there is a risk of fund settlement. Therefore, the transaction data of the transaction to be monitored and the transaction information of the transaction parties associated with the transaction to be monitored can be obtained to determine whether the transaction to be monitored is an abnormal transaction.
[0056] Step 102: Based on the transaction amount, transaction party information, and transaction relationship network, generate the first transaction sub-graph of the transactions to be monitored.
[0057] In one embodiment, the data can first be standardized based on external data. This standardization process includes establishing a relational table of enterprise entities corresponding to different data sources, based on the names of each entity. Based on this relational table, primary key identification is performed on the data obtained from different external systems to form a data sample of enterprise entities. The data sample is then deduplicated using the enterprise entity information as the primary key, thus completing the standardization process.
[0058] Step 103: Use a graph matching algorithm to select at least one candidate normal transaction subgraph that matches the first transaction subgraph from the preset transaction relationship network.
[0059] A transaction network is a transaction map that includes historical transaction information between the transacting parties and between different transacting parties.
[0060] In one embodiment, at least one candidate normal transaction subgraph that matches the first transaction subgraph can be selected from the transaction relationship network based on the structure or attributes of the first transaction subgraph.
[0061] In this process, the transaction relationship network can be segmented according to preset rules to obtain multiple subgraphs, and at least one candidate normal transaction subgraph that matches the first transaction subgraph can be selected from the multiple subgraphs.
[0062] Step 104: Compare the similarity of the first transaction subgraph with each of the at least one candidate normal transaction subgraphs to obtain the similarity value corresponding to each candidate normal transaction subgraph.
[0063] In some embodiments of this disclosure, step 104 may specifically include the following steps:
[0064] Step a1: For each candidate normal transaction subgraph, calculate the similarity of transaction amount distribution, transaction frequency, and network structure between the candidate normal transaction subgraph and the first transaction subgraph.
[0065] In one embodiment, cosine similarity or Euclidean distance can be used to calculate the similarity of transaction amount distribution, transaction frequency, and network structure between the normal transaction subgraph and the first transaction subgraph, respectively. Abnormal clusters can be identified through K-Means clustering.
[0066] Step a2 involves fusing the similarity of transaction amount distribution, transaction frequency, and network structure corresponding to the same candidate normal transaction subgraph to obtain the comprehensive similarity index value between each candidate normal transaction subgraph and the first transaction subgraph.
[0067] In some embodiments of this disclosure, step a2 may specifically include the following steps:
[0068] The overall similarity index value is calculated using the following formula:
[0069] The overall similarity index value = α·similarity of transaction amount distribution + β·similarity of transaction frequency + γ·similarity of network structure, where α, β, and γ are all weight coefficients, which can be preset according to actual needs.
[0070] Step a3: Determine the comprehensive similarity index value as the similarity value.
[0071] Step 105: Select the maximum similarity value from the similarity values corresponding to each candidate normal transaction subgraph.
[0072] In one embodiment, a candidate true long transaction subgraph that is most similar to the first transaction subgraph is selected from a plurality of candidate true long transaction subgraphs.
[0073] Step 106: If the maximum similarity value is less than a preset threshold, the transaction to be monitored is determined to be an abnormal transaction.
[0074] In one embodiment, if the maximum similarity is less than a preset threshold, it indicates that the transaction to be monitored corresponding to the first transaction subgraph is still significantly different from the most similar normal historical transaction, and the transaction to be monitored can be determined to be an abnormal transaction.
[0075] In some embodiments of this disclosure, the transaction relationship network is constructed using the following steps:
[0076] Obtain information on the transacting parties and historical transaction information;
[0077] Each party in the transaction information is treated as a node;
[0078] Feature vectors are obtained by extracting features from transaction information and historical transaction information;
[0079] The correlation index value is obtained by calculating the correlation between trading parties that have transactions based on feature vectors.
[0080] Based on historical transaction information and correlation index values, edges connecting different nodes are generated to obtain a transaction relationship network.
[0081] In one example, information about the transacting parties and historical transaction information can be received from external systems, including basic corporate identity data, corporate bank transaction data, and inter-company fund receipt and payment data. External systems include banking transaction systems, tax systems, business registration inquiry systems, and securities systems.
[0082] Data standardization can be performed based on external data. This standardization process includes establishing a relational table of enterprise entities corresponding to different data sources, based on their names. Primary key identification is then performed on the data obtained from different external systems using this relational table to form a data sample of enterprise entities. Within this data sample, duplicates are removed using the enterprise entity information as the primary key, completing the standardization process. The standardized historical transaction information is then stored in a transaction data table.
[0083] Understandably, by calculating the correlation between trading parties based on feature vectors, the correlation index value can be used to reflect the potential relationship between different trading parties, thereby further improving the comprehensiveness of identifying abnormal fund settlement risks.
[0084] According to the fund settlement anomaly monitoring method proposed in this disclosure, in response to the detection that the transaction amount of the transaction to be monitored is greater than a preset amount or the transaction frequency is greater than a preset frequency, the transaction data of the transaction to be monitored and the transaction party information of the parties associated with the transaction to be monitored are obtained; based on the transaction amount, transaction party information, and transaction relationship network, a first transaction subgraph of the transaction to be monitored is generated; a graph matching algorithm is used to select at least one candidate normal transaction subgraph that matches the first transaction subgraph from the preset transaction relationship network; the first transaction subgraph is compared with each candidate normal transaction subgraph in the at least one candidate normal transaction subgraph to obtain a similarity value corresponding to each candidate normal transaction subgraph; the maximum similarity value is selected from the similarity values corresponding to each candidate normal transaction subgraph; if the maximum similarity value is less than a preset threshold, the transaction to be monitored is determined to be an abnormal transaction. By using a transaction relationship network to reflect the relationship between different parties, abnormal transaction monitoring of complex related transactions is performed based on the transaction relationship network. This considers the relationship between different parties, improves the comprehensiveness of risk identification, and reduces the possibility of missed risk detection.
[0085] Figure 2 This is a block diagram illustrating a fund settlement anomaly monitoring device according to an exemplary embodiment. (Refer to...) Figure 2 The device includes an acquisition unit 201, a generation unit 202, a matching unit 203, a comparison unit 204, a selection unit 205, and a determination unit 206.
[0086] The acquisition unit 201 is used to acquire the transaction data of the transaction to be monitored and the transaction party information of the transaction party associated with the transaction to be monitored in response to the detection that the transaction amount of the transaction to be monitored is greater than a preset amount or the transaction frequency is greater than a preset frequency.
[0087] The generation unit 202 is used to generate a first transaction sub-graph of the transaction to be monitored based on the transaction amount, transaction party information and transaction relationship network;
[0088] The matching unit 203 is used to select at least one candidate normal transaction subgraph that matches the first transaction subgraph from a preset transaction relationship network using a graph matching algorithm; the transaction relationship network is a transaction graph that includes transaction parties and historical transaction information between different transaction parties;
[0089] The comparison unit 204 is used to compare the similarity of the first transaction subgraph with each of the at least one candidate normal transaction subgraphs to obtain the similarity value corresponding to each candidate normal transaction subgraph.
[0090] Unit 205 is used to select the maximum similarity value from the similarity values corresponding to each candidate normal transaction subgraph;
[0091] The determination unit 206 is used to determine that the transaction to be monitored is an abnormal transaction when the maximum similarity value is less than a preset threshold.
[0092] In some embodiments of this disclosure, the determining unit 206 may specifically be used for:
[0093] For each candidate normal transaction subgraph, calculate the similarity of transaction amount distribution, transaction frequency, and network structure between the candidate normal transaction subgraph and the first transaction subgraph;
[0094] The similarity of transaction amount distribution, transaction frequency, and network structure corresponding to the same candidate normal transaction subgraph is fused to obtain the comprehensive similarity index value between each candidate normal transaction subgraph and the first transaction subgraph;
[0095] The comprehensive similarity index value is determined as the similarity value.
[0096] In some embodiments of this disclosure, the determining unit 206 may specifically be used for:
[0097] The overall similarity index value is calculated using the following formula:
[0098] The overall similarity index value = α·similarity of transaction amount distribution + β·similarity of transaction frequency + γ·similarity of network structure, where α, β, and γ are all weight coefficients.
[0099] In some embodiments of this disclosure, the apparatus may further include building units for:
[0100] Obtain information on the transacting parties and historical transaction information;
[0101] Each party in the transaction information is treated as a node;
[0102] Feature vectors are obtained by extracting features from transaction information and historical transaction information;
[0103] The correlation index value is obtained by calculating the correlation between trading parties that have transactions based on feature vectors.
[0104] Based on historical transaction information and correlation index values, edges connecting different nodes are generated to obtain a transaction relationship network.
[0105] Regarding the apparatus in the above embodiments, the specific manner in which each module performs its operation has been described in detail in the embodiments related to the method, and will not be elaborated upon here.
[0106] According to the fund settlement anomaly monitoring device proposed in this disclosure, in response to the detection that the transaction amount of the transaction to be monitored is greater than a preset amount or the transaction frequency is greater than a preset frequency, the device acquires the transaction data of the transaction to be monitored, as well as the transaction party information of the parties associated with the transaction to be monitored; based on the transaction amount, transaction party information, and transaction relationship network, a first transaction subgraph of the transaction to be monitored is generated; a graph matching algorithm is used to select at least one candidate normal transaction subgraph that matches the first transaction subgraph from the preset transaction relationship network; the first transaction subgraph is compared with each candidate normal transaction subgraph in the at least one candidate normal transaction subgraph to obtain a similarity value corresponding to each candidate normal transaction subgraph; the maximum similarity value is selected from the similarity values corresponding to each candidate normal transaction subgraph; if the maximum similarity value is less than a preset threshold, the transaction to be monitored is determined to be an abnormal transaction. By using a transaction relationship network to represent the relationship between different parties, abnormal transaction monitoring of complex related transactions is performed based on the transaction relationship network. This considers the relationship between different parties, improves the comprehensiveness of risk identification, and reduces the possibility of missed risk detection.
[0107] Figure 3 This is a block diagram illustrating an apparatus for a method of detecting anomalies in fund settlement, according to an exemplary embodiment. For example, apparatus 300 may be an electronic device, such as a mobile phone, computer, digital broadcasting terminal, messaging device, game console, tablet device, medical device, fitness equipment, personal digital assistant, etc.
[0108] Reference Figure 3 The device 300 may include one or more of the following components: a processing component 302, a memory 304, a power component 306, a multimedia component 308, an audio component 310, an input / output (I / O) interface 312, a sensor component 314, and a communication component 316.
[0109] Processing component 302 typically controls the overall operation of device 300, such as operations associated with display, telephone calls, data communication, camera operation, and recording. Processing component 302 may include one or more processors 320 to execute instructions to perform all or part of the steps of the methods described above. Furthermore, processing component 302 may include one or more modules to facilitate interaction between processing component 302 and other components. For example, processing component 302 may include a multimedia module to facilitate interaction between multimedia component 308 and processing component 302.
[0110] Memory 304 is configured to store various types of data to support the operation of device 300. Examples of this data include instructions for any application or method operating on device 300, contact data, phonebook data, messages, pictures, videos, etc. Memory 304 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.
[0111] The power supply component 306 provides power to the various components of the device 300. The power supply component 306 may include a power management system, one or more power sources, and other components associated with generating, managing, and distributing power to the device 300.
[0112] Multimedia component 308 includes a screen that provides an output interface between the device 300 and the user. In some embodiments, the screen may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touchscreen to receive input signals from the user. The touch panel includes one or more touch sensors to sense touches, swipes, and gestures on the touch panel. The touch sensors may sense not only the boundaries of the touch or swipe action but also the duration and pressure associated with the touch or swipe operation. In some embodiments, multimedia component 308 includes a front-facing camera and / or a rear-facing camera. When the device 300 is in an operating mode, such as a shooting mode or a video mode, the front-facing camera and / or the rear-facing camera may receive external multimedia data. Each front-facing camera and rear-facing camera may be a fixed optical lens system or have focal length and optical zoom capabilities.
[0113] Audio component 310 is configured to output and / or input audio signals. For example, audio component 310 includes a microphone (MIC) configured to receive external audio signals when device 300 is in an operating mode, such as call mode, recording mode, and voice recognition mode. The received audio signals may be further stored in memory 304 or transmitted via communication component 316. In some embodiments, audio component 310 also includes a speaker for outputting audio signals.
[0114] I / O interface 312 provides an interface between processing component 302 and peripheral interface modules, such as keyboards, click wheels, buttons, etc. These buttons may include, but are not limited to, home buttons, volume buttons, power buttons, and lock buttons.
[0115] Sensor assembly 314 includes one or more sensors for providing status assessments of various aspects of device 300. For example, sensor assembly 314 may detect the on / off state of device 300, the relative positioning of components such as the display and keypad of device 300, changes in the position of device 300 or a component of device 300, the presence or absence of user contact with device 300, the orientation or acceleration / deceleration of device 300, and temperature changes of device 300. Sensor assembly 314 may include a proximity sensor configured to detect the presence of nearby objects without any physical contact. Sensor assembly 314 may also include a light sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, sensor assembly 314 may also include an accelerometer, a gyroscope, a magnetometer, a pressure sensor, or a temperature sensor.
[0116] Communication component 316 is configured to facilitate wired or wireless communication between device 300 and other devices. Device 300 can access wireless networks based on communication standards, such as WiFi, 2G, or 3G, or combinations thereof. In one exemplary embodiment, communication component 316 receives broadcast signals or broadcast-related information from an external broadcast management system via a broadcast channel. In one exemplary embodiment, communication component 316 also includes a near-field communication (NFC) module to facilitate short-range communication. For example, the NFC module may be implemented based on radio frequency identification (RFID) technology, Infrared Data Association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology, and other technologies.
[0117] In an exemplary embodiment, the apparatus 300 may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to perform the methods described above.
[0118] In an exemplary embodiment, a non-transitory computer-readable storage medium including instructions is also provided, such as a memory 304 including instructions, which can be executed by a processor 320 of the device 300 to perform the above-described method. For example, the non-transitory computer-readable storage medium may be a ROM, random access memory (RAM), CD-ROM, magnetic tape, floppy disk, and optical data storage device, etc.
[0119] In an exemplary embodiment, a computer program product is also provided, including a computer program that implements the above-described method when executed by the processor 320 of the device 300.
[0120] Other embodiments of the invention will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This disclosure is intended to cover any variations, uses, or adaptations of the invention that follow the general principles of the invention and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of the invention are indicated by the following claims.
[0121] It should be understood that the present invention is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of the invention is limited only by the appended claims.
Claims
1. A method for monitoring abnormal fund settlements, characterized in that, include: In response to the detection that the transaction amount of the transaction to be monitored is greater than a preset amount or the transaction frequency is greater than a preset frequency, the transaction data of the transaction to be monitored and the transaction party information of the transaction party associated with the transaction to be monitored are obtained; Based on the transaction amount, the transaction party information, and the transaction relationship network, a first transaction sub-graph of the transaction to be monitored is generated; A graph matching algorithm is used to select at least one candidate normal transaction subgraph that matches the first transaction subgraph from a preset transaction relationship network; the transaction relationship network is a transaction graph that includes the transaction parties and historical transaction information between different transaction parties. The first transaction subgraph is compared with each candidate normal transaction subgraph in the at least one candidate normal transaction subgraph to obtain the similarity value corresponding to each candidate normal transaction subgraph. Select the maximum similarity value from the similarity values corresponding to each candidate normal transaction subgraph; If the maximum similarity value is less than a preset threshold, the transaction to be monitored is determined to be an abnormal transaction.
2. The method for monitoring abnormal fund settlement according to claim 1, characterized in that, The step of comparing the similarity of the first transaction subgraph with each of the at least one candidate normal transaction subgraphs to obtain a similarity value for each candidate normal transaction subgraph includes: For each candidate normal transaction subgraph, calculate the similarity of transaction amount distribution, transaction frequency, and network structure between the candidate normal transaction subgraph and the first transaction subgraph; The similarity of transaction amount distribution, transaction frequency, and network structure corresponding to the same candidate normal transaction subgraph is fused to obtain the comprehensive similarity index value between each candidate normal transaction subgraph and the first transaction subgraph; The comprehensive similarity index value is determined as the similarity value.
3. The method for monitoring abnormal fund settlement according to claim 2, characterized in that, The process of fusing the similarity of transaction amount distribution, transaction frequency, and network structure corresponding to the same candidate normal transaction subgraph to obtain a comprehensive similarity index value between each candidate normal transaction subgraph and the first transaction subgraph includes: The comprehensive similarity index value is calculated using the following formula: The overall similarity index value = α·similarity of transaction amount distribution + β·similarity of transaction frequency + γ·similarity of network structure, where α, β, and γ are all weight coefficients.
4. The method for monitoring abnormal fund settlement according to claim 1, characterized in that, The transaction relationship network is constructed using the following steps: Obtain information on the transacting parties and historical transaction information; Each transaction party in the transaction party information is treated as a node; Feature vectors are obtained by extracting features from the transaction party information and historical transaction information; Based on the feature vector, the correlation between the transacting parties that have a transaction is calculated to obtain the correlation index value; Based on the historical transaction information and the correlation index values, edges connecting different nodes are generated to obtain the transaction relationship network.
5. A fund settlement anomaly monitoring device, characterized in that, include: The acquisition unit is used to acquire the transaction data of the transaction to be monitored and the transaction party information of the transaction party associated with the transaction to be monitored in response to the detection that the transaction amount of the transaction to be monitored is greater than a preset amount or the transaction frequency is greater than a preset frequency. The generation unit is used to generate a first transaction sub-graph of the transaction to be monitored based on the transaction amount, the transaction party information, and the transaction relationship network; The matching unit is used to select at least one candidate normal transaction subgraph that matches the first transaction subgraph from a preset transaction relationship network using a graph matching algorithm; the transaction relationship network is a transaction graph that includes transaction parties and historical transaction information between different transaction parties. The comparison unit is used to compare the similarity of the first transaction subgraph with each of the at least one candidate normal transaction subgraphs to obtain a similarity value for each candidate normal transaction subgraph. The selection unit is used to select the maximum similarity value from the similarity values corresponding to each candidate normal transaction subgraph; The determining unit is used to determine that the transaction to be monitored is an abnormal transaction when the maximum similarity value is less than a preset threshold.
6. The fund settlement anomaly monitoring device according to claim 5, characterized in that, The comparison unit is specifically used for: For each candidate normal transaction subgraph, calculate the similarity of transaction amount distribution, transaction frequency, and network structure between the candidate normal transaction subgraph and the first transaction subgraph; The similarity of transaction amount distribution, transaction frequency, and network structure corresponding to the same candidate normal transaction subgraph is fused to obtain the comprehensive similarity index value between each candidate normal transaction subgraph and the first transaction subgraph; The comprehensive similarity index value is determined as the similarity value.
7. The fund settlement anomaly monitoring device according to claim 6, characterized in that, The comparison unit is specifically used for: The comprehensive similarity index value is calculated using the following formula: The overall similarity index value = α·similarity of transaction amount distribution + β·similarity of transaction frequency + γ·similarity of network structure, where α, β, and γ are all weight coefficients.
8. An electronic device, characterized in that, include: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the method as described in any one of claims 1 to 4.
9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method as described in any one of claims 1 to 4.
10. A computer program product, comprising a computer program, characterized in that, The computer program, when executed by a processor, implements the method as described in any one of claims 1 to 4.