Anti-money laundering intelligent analysis system and method

Abstract

The invention discloses an anti-money laundering intelligent analysis system and method, and relates to the technical field of financial security, and the method comprises the steps: defining nodes and edges for a transaction subject and a fund flow direction based on an original transaction data set, and constructing a transaction relation graph; analyzing an abnormal region set of fund flow based on the transaction relation graph, identifying whether a hidden transaction mode exists in the abnormal region set, and extracting a suspicious transaction sub-graph; performing risk assessment on each node in the suspicious transaction subgraph by adopting a random forest algorithm, if a risk score is greater than a risk threshold, marking the node as a high-risk node, and generating a high-risk transaction path; the contextual information of a high-risk transaction path is extracted, feature vectorization processing is performed on the contextual information, a risk interpretation model is constructed, a risk interpretation report is generated, and a set of complete interpretable anti-money laundering risk control system is realized.

Description

Technical Field

[0001] This application relates to the field of financial security technology, and in particular to an anti-money laundering intelligent analysis system and method. Background Technology

[0002] As a crucial line of defense for financial security, anti-money laundering plays an irreplaceable role in maintaining economic order and preventing criminal activities. With the increasing complexity and globalization of financial transactions, the timely detection and blocking of illicit capital flows has become an urgent need for regulatory agencies and financial institutions worldwide. However, current anti-money laundering methods largely rely on traditional rules and manual review, which are not only inefficient but also vulnerable to new money laundering techniques. Especially when faced with massive amounts of data and covert transaction patterns, they often result in underreporting and false positives, failing to meet the requirements of real-time accuracy.

[0003] In this context, the limitations of existing methods are mainly reflected in their insufficient ability to uncover complex transaction relationships and poor interpretability of risk assessments. These shortcomings prevent many potential money laundering activities from being identified in a timely manner, increasing the vulnerability of the financial system.

[0004] A deeper challenge lies in effectively integrating multi-source data and extracting valuable relationship networks. Due to the diverse sources and complex structures of the data, simple data processing struggles to reveal hidden patterns of association behind transactions. This lack of association further leads to biased risk assessments, failing to fully depict the dynamic characteristics of money laundering. More importantly, even if some suspicious relationships are discovered, transforming these relationships into intuitive and logically sound judgment criteria remains a technical challenge. The lack of semantic interpretation and adaptive adjustment mechanisms for risk outcomes causes the system to behave unpredictably in different scenarios.

[0005] Therefore, how to build an intelligent analysis framework based on multi-source data that can deeply explore transaction relationships, provide interpretable risk assessments, and dynamically adapt to different scenarios has become a key issue that urgently needs to be addressed in the current anti-money laundering field. Summary of the Invention

[0006] This application aims to at least partially address one of the technical problems in related technologies. To this end, one objective of this application is to propose an intelligent anti-money laundering analysis system and method, realizing a complete and interpretable anti-money laundering risk control system.

[0007] One aspect of this application provides an anti-money laundering intelligent analysis method, comprising:

[0008] Step S100: Based on the original transaction dataset, define nodes and edges for transaction entities and fund flows, and construct a transaction relationship graph;

[0009] Step S200: Analyze the abnormal region set of fund flows based on the transaction relationship graph, identify whether there are hidden transaction patterns in the abnormal region set, and extract suspicious transaction subgraphs;

[0010] Step S300: Use the random forest algorithm to assess the risk of each node in the suspicious transaction subgraph. If the risk score is greater than the risk threshold, mark it as a high-risk node and generate a high-risk transaction path.

[0011] Step S400: Extract contextual information for high-risk transaction paths, perform feature vectorization processing on the contextual information, construct a risk interpretation model, and generate a risk interpretation report;

[0012] The method for constructing the original transaction dataset is as follows: construct a multi-source data acquisition framework, with data sources including financial transaction records, customer identity information and external regulatory databases, acquire heterogeneous data from the data sources, perform standardization processing on different data formats of the heterogeneous data, and generate the original transaction dataset;

[0013] The specific method for constructing the transaction relationship graph is as follows: using graph database technology, the transaction subject, fund flow and transaction time are extracted from the original transaction dataset. The transaction subject is used as a node and the fund flow is used as an edge to define the transaction relationship graph, where the weight of the edge is the transaction amount and the transaction time is used as a node attribute.

[0014] The construction of a transaction relationship graph based on the original transaction dataset, defining nodes and edges for transaction entities and fund flows, also includes: calculating the centrality score of each node and setting a score threshold, identifying nodes with centrality scores greater than the score threshold as key nodes; for transaction time, constructing a time series, setting a time window, extracting the transaction subgraph of the transaction relationship graph for each node within the time window, and identifying abnormal patterns based on the transaction subgraph.

[0015] The specific method for identifying abnormal patterns based on transaction subgraphs is as follows: calculate the transaction amount characteristics of the transaction subgraph, compare the transaction amount characteristics of historical events with the transaction amount characteristics of the current transaction subgraph, and confirm the abnormal pattern.

[0016] The specific method for analyzing abnormal clustering of fund flows based on transaction relationship graphs, identifying whether there are hidden transaction patterns in abnormal clusters, and extracting suspicious transaction subgraphs is as follows:

[0017] Step S210: Apply the community detection algorithm to perform group analysis based on the transaction relationship graph and divide the communities into clusters;

[0018] Step S220: For each cluster community, extract its community feature value, set an anomaly threshold, and regard the cluster community whose community feature value exceeds the anomaly threshold as an anomaly region;

[0019] Step S230: Using a depth-limited search algorithm, starting from the initial node in the abnormal region, traverse the abnormal region along the directed edges, record the visited nodes and edges, and identify hidden transaction patterns.

[0020] Step S240: Extract the nodes and edges involved in the identified hidden transaction patterns to construct a suspicious transaction subgraph;

[0021] The hidden transaction patterns include a fund circulation pattern and a hierarchical transfer pattern. If the traversed edges form a loop, it is judged as a fund circulation pattern. If the traversed edges are transferred between nodes at different levels and the amount shows a decreasing trend, it is judged as a hierarchical transfer pattern.

[0022] The method for using the random forest algorithm to assess the risk of each node in the suspicious transaction subgraph, and marking a node as high-risk if its risk score is greater than the risk threshold, and generating high-risk transaction paths is as follows:

[0023] Step S310: Extract the node attributes and graph structure features of the nodes in the suspicious transaction subgraph, wherein the graph structure features include node degree and clustering coefficient;

[0024] Step S320: For each node, query the historical transaction amount and historical transaction count of its associated transaction entities to obtain the historical transaction records of each node's associated transaction entities;

[0025] Step S330: Standardize the node attributes, graph structure features, and historical transaction records of the nodes to obtain a unified feature dataset;

[0026] Step S340: Use the random forest algorithm to perform risk quantification assessment on the unified feature dataset and calculate the risk score for each node;

[0027] Step S350: If the risk score of a node is greater than the risk threshold, it is marked as a high-risk node. By traversing the graph structure features, the transaction path directly associated with the high-risk node is obtained, and a high-risk transaction path is formed.

[0028] The risk score is calculated as follows:

[0029] Step S341: Rows represent nodes, columns represent feature dimensions, construct a feature matrix, and label each node with its risk label, where 0 represents normal and 1 represents high risk;

[0030] Step S342: Construct a sample set by combining the feature matrix with the corresponding risk labels, which is used to train the random forest model;

[0031] Step S343: Randomly draw N samples with replacement from the training sample set to form a training set, and select n features from all feature dimensions as the candidate feature set for the current decision tree;

[0032] Step S344: At the current node, traverse each feature in the candidate feature set, select the feature that maximizes the Gini coefficient and the splitting threshold as the splitting basis, and divide the sample into left and right child nodes.

[0033] Step S345: Recursively execute the node splitting process on the left and right child nodes until the stopping condition is met;

[0034] Step S346: Repeatedly construct T decision trees and combine the T decision trees to generate a random forest model;

[0035] Step S347: For each node to be risk-assessed, extract its node attributes, graph structure features, and historical transaction records of related transaction entities as features. For each decision tree in the random forest, starting from the root node, traverse the branches of the decision tree according to the value of the node's features until a leaf node is reached. Each leaf node corresponds to a risk label and a risk score.

[0036] Step S348: Statistically analyze the risk labels of the T decision trees, take the voting results corresponding to the majority of risk labels as the final risk classification, and average the risk scores of the T decision trees to obtain the final risk score;

[0037] The specific method for extracting contextual information from high-risk transaction paths, performing feature vectorization processing on the contextual information, constructing a risk interpretation model, and generating a risk interpretation report is as follows:

[0038] Step S410: For high-risk transaction paths, obtain contextual information including background information, entity relationships, and purpose of funds;

[0039] Step S420: Based on the context information, natural language processing technology is used to segment and extract semantics from the text content of the context information to generate a set of structured feature vectors;

[0040] Step S430: For the generated feature vector set, calculate the correlation of each feature vector using statistical analysis methods. If the correlation of a certain feature vector is less than the correlation threshold, then remove the feature vector to obtain the refined feature vector combination.

[0041] Step S440: Determine whether there is an abnormal pattern in the high-risk trading path based on the refined feature vector combination. If an abnormal pattern is detected, mark it as a high-risk trading path segment.

[0042] Step S450: For the marked high-risk transaction path segments, obtain the corresponding background information, subject relationships, and contextual information on the use of funds, and generate a risk explanation report.

[0043] One aspect of this application provides an anti-money laundering intelligent analysis system, comprising:

[0044] The transaction graph generation module is used to construct a transaction relationship graph based on the original transaction dataset, defining nodes and edges for transaction entities and fund flows;

[0045] The suspicious transaction extraction module is used to analyze the abnormal area set of fund flows based on the transaction relationship graph, identify whether there are hidden transaction patterns in the abnormal area set, and extract the suspicious transaction subgraph;

[0046] The risk path marking module is used to perform risk assessment on each node in the suspicious transaction subgraph using the random forest algorithm. If the risk score is greater than the risk threshold, it is marked as a high-risk node and a high-risk transaction path is generated.

[0047] The risk report generation module is used to extract contextual information from high-risk transaction paths, perform feature vectorization processing on the contextual information, construct a risk interpretation model, and generate a risk interpretation report.

[0048] The anti-money laundering intelligent analysis system and method proposed in this application have the following advantages over existing technologies:

[0049] This application achieves a panoramic capture of transaction information by collecting heterogeneous data sources such as financial transaction records, customer identity information, and external regulatory data, thereby enhancing the ability to characterize transaction behavior.

[0050] This application uses graph database technology to construct a transaction relationship network, revealing the correlation structure and evolutionary rules behind complex transactions, discovering hidden money laundering risks, integrating scattered transaction data into a structured relationship network, extracting rich structural and dynamic features, improving the depth of understanding of transaction patterns and the accuracy of anomaly detection, while reducing the cost of manual feature engineering.

[0051] This application enables automatic grouping and relational reasoning of transaction entities, discovers key nodes, abnormal regions, and loop structures in the network, and forms a multi-level, multi-granular profile of abnormal transactions, providing a new perspective for risk assessment.

[0052] This application achieves a seamless transition from suspicious patterns to risk quantification, providing fine-grained risk scores and revealing the intrinsic structure and main sources of risk, making risk assessment more accurate, comprehensive, and interpretable.

[0053] This application forms a risk analysis report that integrates transaction background, relationship structure, and behavioral interpretation. It makes full use of rich contextual information, making risk assessment more transparent, credible, and actionable, and effectively supporting the implementation of anti-money laundering work. Attached Figure Description

[0054] Figure 1 A flowchart of an anti-money laundering intelligent analysis method provided in this application;

[0055] Figure 2 Flowchart of the method for extracting suspicious transaction sub-graphs provided in this application;

[0056] Figure 3 Flowchart of the method for generating high-risk transaction paths provided in this application;

[0057] Figure 4 A functional block diagram of an anti-money laundering intelligent analysis system provided in this application. Detailed Implementation

[0058] To better understand this application, various aspects of this application will be described in more detail with reference to the accompanying drawings. It should be understood that these detailed descriptions are merely illustrative of exemplary embodiments of this application and are not intended to limit the scope of this application in any way. Throughout the specification, the same reference numerals refer to the same elements. The expression "and / or" includes any and all combinations of one or more of the associated listed items.

[0059] In the accompanying drawings, the size, dimensions, and shapes of the elements have been slightly adjusted for ease of illustration. The drawings are for illustrative purposes only and are not strictly to scale. As used herein, the terms “approximately,” “about,” and similar terms are used to indicate approximation, not degree, and are intended to illustrate inherent deviations in measured or calculated values ​​that will be recognized by one of ordinary skill in the art. Furthermore, the order in which the steps are described in this application does not necessarily indicate the order in which these steps occur in actual operation, unless otherwise expressly defined or deduced from the context.

[0060] It should also be understood that expressions such as "comprising," "including," "having," "containing," and / or "comprising" are open-ended rather than closed-ended expressions in this specification, indicating the presence of the stated features, elements, and / or components, but not excluding the presence of one or more other features, elements, components, and / or combinations thereof. Furthermore, when expressions such as "at least one of..." appear after a list of listed features, they modify the entire list of features, not just individual elements in the list. Additionally, when describing embodiments of this application, the word "may" is used to mean "one or more embodiments of this application." And the term "exemplary" is intended to refer to examples or illustrations.

[0061] Unless otherwise specified, all terms used herein (including engineering and technical terms) shall have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains. It should also be understood that, unless expressly stated herein, terms defined in common dictionaries shall be interpreted as having the meaning consistent with their meaning in the context of the relevant art, and not as having an idealized or overly formalized meaning.

[0062] It should be noted that, where there is no conflict, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0063] Example 1

[0064] like Figure 1 As shown, this application provides an intelligent anti-money laundering analysis method, which includes:

[0065] Step S100: Based on the original transaction dataset, define nodes and edges for transaction entities and fund flows, and construct a transaction relationship graph;

[0066] The method for constructing the original transaction dataset is as follows: construct a multi-source data acquisition framework, with data sources including financial transaction records, customer identity information and external regulatory databases, acquire heterogeneous data from the data sources, perform standardization processing on different data formats of the heterogeneous data, and generate the original transaction dataset;

[0067] The original transaction dataset is used for subsequent construction of the transaction relationship network.

[0068] Specifically, in constructing the multi-source data acquisition framework, a distributed data acquisition system is first designed to obtain heterogeneous data from financial transaction records, customer identity information, and external regulatory databases. For example, daily transfer data, including transaction amount, timestamp, and account ID, is extracted from transaction records; user data, including name, ID number, and contact information, is obtained from customer identity information; and blacklist records, including risk scores and violation records, are synchronized daily from external regulatory databases. To address the heterogeneity of different data formats, the system employs automatic standardization. Using regular expressions and data mapping algorithms, transaction amounts are uniformly converted to RMB units while retaining 2.5 decimal places; timestamps are standardized to UTC+8 format; and ID numbers are anonymized using hash algorithms to ensure data privacy. This ultimately generates a unified raw transaction dataset with consistent fields across all records, facilitating subsequent analysis. This process forms a complete logical chain from acquisition to standardization, ensuring data consistency and usability. Simultaneously, automatic standardization improves processing efficiency, meeting the needs of large-scale data processing in financial scenarios.

[0069] The specific method for constructing the transaction relationship graph is as follows: using graph database technology, the transaction subject, fund flow and transaction time are extracted from the original transaction dataset. The transaction subject is used as a node and the fund flow is used as an edge to define the transaction relationship graph, where the weight of the edge is the transaction amount and the transaction time is used as a node attribute.

[0070] Furthermore, the construction of the transaction relationship graph based on the original transaction dataset, defining nodes and edges for transaction entities and fund flows, also includes: calculating the centrality score of each node and setting a score threshold, identifying nodes with a centrality score greater than the score threshold as key nodes; for transaction time, constructing a time series, setting a time window, extracting the transaction subgraph of the transaction relationship graph for each node within the time window, and identifying abnormal patterns based on the transaction subgraph.

[0071] The formula for calculating the centrality score is as follows: Where PR(i) represents the centrality score of node i, d is the damping factor, M(i) is the set of all nodes linked to node i, and L(j) is the number of links pointed to by node j.

[0072] For example, suppose we have a dataset containing 1 million transaction records. Each transaction record includes the transaction entity, transaction amount, transaction time, and fund flow. We use the Neo4j graph database to store and process the data. Transaction entities are defined as nodes, each representing an account. The initial number of nodes is 100,000 accounts. Edges are defined as fund flows; the direction of a directed edge indicates the flow of funds from one account to another. The edge weight is the transaction amount, and the edge attribute includes the timestamp of the transaction. A multi-dimensional transaction relationship graph is generated using the Cypher query language. Specifically, the PageRank algorithm is used to identify key transaction entities, calculating the centrality score of each node. A score threshold of 0.85 is set, and 500 core account nodes with centrality scores higher than the threshold are selected for subsequent analysis of fund flow patterns.

[0073] The specific method for identifying abnormal patterns based on transaction subgraphs is as follows: calculate the transaction amount characteristics of the transaction subgraph, compare the transaction amount characteristics of historical events with the transaction amount characteristics of the current transaction subgraph, and confirm the abnormal pattern.

[0074] For example, the transaction sub-graph of the time window can be extracted to analyze the periodic changes in fund flow. For instance, if an account is found to have an abnormally large inflow from the 1st to the 5th, with an average amount of 100,000 yuan, the abnormal pattern can be confirmed by comparing it with historical data.

[0075] Step S200: Analyze the abnormal region set of fund flows based on the transaction relationship graph, identify whether there are hidden transaction patterns in the abnormal region set, and extract suspicious transaction subgraphs;

[0076] Figure 2 The flowchart below illustrates the method for extracting suspicious transaction subgraphs provided in this application. The specific method for extracting suspicious transaction subgraphs involves analyzing abnormal clustering of fund flows based on transaction relationship graphs and identifying whether hidden transaction patterns exist within these abnormal clusters.

[0077] Step S210: Apply the community detection algorithm to perform group analysis based on the transaction relationship graph and divide the communities into clusters;

[0078] Step S220: For each cluster community, extract its community feature value, set an anomaly threshold, and regard the cluster community whose community feature value exceeds the anomaly threshold as an anomaly region;

[0079] The community characteristic value is obtained by weighted summation of the size, total capital flow, and transaction frequency of each cluster community;

[0080] The scale refers to the number of nodes in each cluster community;

[0081] For example, the Louvain algorithm is used to divide the clustered communities by optimizing the modularity Q. Assuming that the transaction relationship graph contains 10,000 nodes and 50,000 edges, and the initial modularity value is 0.3, after multiple rounds of optimization, 10 main communities are finally divided. The largest community contains 3,000 nodes and accounts for 40% of the total capital flow. By comparing the thresholds, it can be shown that the clustered community has obvious clustering characteristics.

[0082] Step S230: Using a depth-limited search algorithm, starting from the initial node in the abnormal region, traverse the abnormal region along the directed edges, record the visited nodes and edges, and identify hidden transaction patterns.

[0083] The hidden transaction patterns include a fund circulation pattern and a hierarchical transfer pattern. If the traversed edges form a loop, it is judged as a fund circulation pattern. If the traversed edges are transferred between nodes at different levels and the amount shows a decreasing trend, it is judged as a hierarchical transfer pattern.

[0084] Step S240: Extract the nodes and edges involved in the identified hidden transaction patterns to construct a suspicious transaction subgraph;

[0085] The suspicious transaction subgraph is used for subsequent risk quantification assessment.

[0086] Step S300: Use the random forest algorithm to assess the risk of each node in the suspicious transaction subgraph. If the risk score is greater than the risk threshold, mark it as a high-risk node and generate a high-risk transaction path.

[0087] like Figure 3 The diagram shown is a flowchart of the method for generating high-risk transaction paths provided in this application. The method involves using a random forest algorithm to assess the risk of each node in the suspicious transaction subgraph. If the risk score is greater than a risk threshold, the node is marked as a high-risk node. The specific method for generating high-risk transaction paths is as follows:

[0088] Step S310: Extract the node attributes and graph structure features of the nodes in the suspicious transaction subgraph, wherein the graph structure features include node degree and clustering coefficient;

[0089] The node degree is the number of edges connected to the node, reflecting the node's direct influence. The higher the node degree, the more critical the node's role in the network.

[0090] The clustering coefficient refers to the degree of interconnection between a node's neighboring nodes. The higher the clustering coefficient, the more likely the nodes are to form closely connected groups. The clustering coefficient of a node is defined as the ratio of the actual number of edges between its neighboring nodes to the possible number of edges.

[0091] Step S320: For each node, query the historical transaction amount and historical transaction count of its associated transaction entities to obtain the historical transaction records of each node's associated transaction entities;

[0092] Step S330: Standardize the node attributes, graph structure features, and historical transaction records of the nodes to obtain a unified feature dataset;

[0093] Step S340: Use the random forest algorithm to perform risk quantification assessment on the unified feature dataset and calculate the risk score for each node;

[0094] The risk score is calculated as follows:

[0095] Step S341: Rows represent nodes, columns represent feature dimensions, construct a feature matrix, and label each node with its risk label, where 0 represents normal and 1 represents high risk;

[0096] Step S342: Construct a sample set by combining the feature matrix with the corresponding risk labels, which is used to train the random forest model;

[0097] Step S343: Randomly draw N samples with replacement from the training sample set to form a training set, and select n features from all feature dimensions as the candidate feature set for the current decision tree;

[0098] Preferably, n is the square root of the number of feature dimensions;

[0099] Step S344: At the current node, traverse each feature in the candidate feature set, select the feature that maximizes the Gini coefficient and the splitting threshold as the splitting basis, and divide the sample into left and right child nodes.

[0100] Step S345: Recursively execute the node splitting process on the left and right child nodes until the stopping condition is met;

[0101] The stopping condition is that the number of samples is less than the sample threshold.

[0102] Step S346: Repeatedly construct T decision trees and combine the T decision trees to generate a random forest model;

[0103] Step S347: For each node to be risk-assessed, extract its node attributes, graph structure features, and historical transaction records of related transaction entities as features. For each decision tree in the random forest, starting from the root node, traverse the branches of the decision tree according to the value of the node's features until a leaf node is reached. Each leaf node corresponds to a risk label and a risk score.

[0104] The risk score of a leaf node is the proportion of high-risk samples in that leaf node, and the risk label is high-risk or normal.

[0105] Step S348: Statistically analyze the risk labels of the T decision trees, take the voting results corresponding to the majority of risk labels as the final risk classification, and average the risk scores of the T decision trees to obtain the final risk score;

[0106] Step S350: If the risk score of a node is greater than the risk threshold, it is marked as a high-risk node. By traversing the graph structure features, the transaction path directly associated with the high-risk node is obtained, and a high-risk transaction path is formed.

[0107] Preferably, the risk threshold is 0.7;

[0108] In the specific implementation, the first step is to construct a subgraph of suspicious transactions. Assuming the subgraph contains 100 nodes and 300 edges, where nodes represent transaction entities and edges represent transaction relationships, attribute data for each node is extracted. For example, node A has a transaction amount of 5 million yuan and a transaction frequency of 10 times per day. Combined with graph structure features, the node degree is 15, and the clustering coefficient is 0.6. Next, a random forest algorithm is used to quantify the risk of each node. Transaction amount, transaction frequency, node degree, clustering coefficient, and the historical behavior of associated entities are used as input features. The algorithm classifies and scores nodes by constructing multiple decision trees, outputting a risk score. Assuming node A has a score of 0.85 and a risk threshold of 0.7, the node's risk score exceeds the threshold, and node A is therefore marked as a high-risk node. Subsequently, a set of high-risk transaction paths is generated based on the high-risk nodes. Specifically, a graph traversal algorithm is used to identify all transaction paths originating from node A, and these paths are categorized into the high-risk transaction path set.

[0109] The above steps transform the original suspicious transaction subgraph into a structured representation of high-risk nodes and paths, and quantify the risk level of each node. This process integrates features from multiple dimensions, including transaction attributes, related entity behavior, and graph structure. Utilizing the random forest algorithm, it effectively identifies high-risk nodes and paths from complex transaction data, improving the accuracy and efficiency of risk control. The calculated risk scores are compared with preset risk thresholds to identify high-risk nodes, and high-risk transaction paths are generated based on graph structure information, providing support for subsequent risk analysis and decision-making.

[0110] Step S400: Extract contextual information for high-risk transaction paths, perform feature vectorization processing on the contextual information, construct a risk interpretation model, and generate a risk interpretation report;

[0111] The specific method for extracting contextual information from high-risk transaction paths, performing feature vectorization processing on the contextual information, constructing a risk interpretation model, and generating a risk interpretation report is as follows:

[0112] Step S410: For high-risk transaction paths, obtain contextual information including background information, entity relationships, and purpose of funds;

[0113] Step S420: Based on the context information, natural language processing technology is used to segment and extract semantics from the text content of the context information to generate a set of structured feature vectors;

[0114] Step S430: For the generated feature vector set, calculate the correlation of each feature vector using statistical analysis methods. If the correlation of a certain feature vector is less than the correlation threshold, then remove the feature vector to obtain the refined feature vector combination.

[0115] The correlation of each feature vector is calculated as follows: the correlation between each feature vector and the risk label is calculated using the Pearson correlation coefficient; the absolute value of the Pearson correlation coefficient is used to measure the correlation strength of the feature vector. The closer the absolute value of the Pearson correlation coefficient is to 1, the stronger the linear correlation between the feature and the risk label, and the greater the contribution of the feature to risk judgment. Conversely, the closer the absolute value of the Pearson correlation coefficient is to 1, the smaller the linear correlation between the feature and the risk label.

[0116] Step S440: Determine whether there is an abnormal pattern in the high-risk trading path based on the refined feature vector combination. If an abnormal pattern is detected, mark it as a high-risk trading path segment.

[0117] The aforementioned abnormal patterns are identified by compiling expert experience and regulatory provisions in the field of anti-money laundering into a rule base for risk assessment.

[0118] Step S450: For the marked high-risk transaction path segments, obtain the corresponding background information, entity relationships, and contextual information on the use of funds, and generate a risk explanation report;

[0119] For example, based on the transaction entities in a high-risk transaction path segment, relevant background information, entity relationships, and fund usage are retrieved from the context information. The retrieved context information is categorized to form a structured information representation. Based on the rule matching results, a rule-level risk explanation is generated, such as "This transaction triggered a large cash transaction rule, with the amount exceeding 100,000 yuan." A pattern-level risk explanation is also generated, such as "This transaction path exhibits a circular transfer pattern, suspected of money laundering." Natural language generation technology is used to integrate the context information, rule explanation, and pattern explanation to generate a coherent risk explanation text, such as "This high-risk transaction path involves three transaction entities, A, B, and C. Among them, A and B have frequent large cash transactions, B and C have a circular transfer pattern, and the fund usage involves gambling and investment. Based on this, it is judged that there is a money laundering risk."

[0120] The above steps embody the refinement and transformation from data to information and then to knowledge, integrating quantitative analysis and qualitative judgment, statistical modeling and rule engine, forming a systematic risk interpretation scheme, and realizing a complete anti-money laundering risk control system.

[0121] Example 2

[0122] like Figure 4 As shown, this application provides an anti-money laundering intelligent analysis system, comprising:

[0123] The transaction graph generation module is used to construct a transaction relationship graph based on the original transaction dataset, defining nodes and edges for transaction entities and fund flows;

[0124] The suspicious transaction extraction module is used to analyze the abnormal area set of fund flows based on the transaction relationship graph, identify whether there are hidden transaction patterns in the abnormal area set, and extract the suspicious transaction subgraph;

[0125] The risk path marking module is used to perform risk assessment on each node in the suspicious transaction subgraph using the random forest algorithm. If the risk score is greater than the risk threshold, it is marked as a high-risk node and a high-risk transaction path is generated.

[0126] The risk report generation module is used to extract contextual information from high-risk transaction paths, perform feature vectorization processing on the contextual information, construct a risk interpretation model, and generate a risk interpretation report.

[0127] In addition, the parts of the technical solutions provided in the embodiments of this application that are consistent with the implementation principles of the corresponding technical solutions in the prior art have not been described in detail, so as to avoid excessive elaboration.

[0128] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above descriptions are merely specific embodiments of the present invention and are not intended to limit the invention. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. An intelligent analysis method for anti-money laundering, characterized in that, include: Based on the original transaction dataset, nodes and edges are defined for transaction entities and fund flows to construct a transaction relationship graph; Based on the analysis of transaction relationship graphs, abnormal regions of fund flows are identified, and whether there are hidden transaction patterns in the abnormal regions are identified, and suspicious transaction subgraphs are extracted. The random forest algorithm is used to assess the risk of each node in the suspicious transaction subgraph. If the risk score is greater than the risk threshold, it is marked as a high-risk node and a high-risk transaction path is generated. For high-risk transaction paths, extract their contextual information, perform feature vectorization on the contextual information, construct a risk interpretation model, and generate a risk interpretation report.

2. The anti-money laundering intelligent analysis method as described in claim 1, characterized in that, The method for constructing the original transaction dataset is as follows: construct a multi-source data acquisition framework, with data sources including financial transaction records, customer identity information and external regulatory databases, acquire heterogeneous data from the data sources, perform standardization processing on different data formats of the heterogeneous data, and generate the original transaction dataset.

3. The anti-money laundering intelligent analysis method as described in claim 2, characterized in that, The specific method for constructing the transaction relationship graph is as follows: using graph database technology, the transaction subject, fund flow and transaction time are extracted from the original transaction dataset. The transaction subject is used as a node and the fund flow is used as an edge to define the transaction relationship graph, where the weight of the edge is the transaction amount and the transaction time is used as a node attribute.

4. The anti-money laundering intelligent analysis method as described in claim 3, characterized in that, The construction of a transaction relationship graph based on the original transaction dataset, defining nodes and edges for transaction entities and fund flows, also includes: calculating the centrality score of each node and setting a score threshold, identifying nodes with centrality scores greater than the score threshold as key nodes; for transaction time, constructing a time series, setting a time window, extracting the transaction subgraph of the transaction relationship graph for each node within the time window, and identifying abnormal patterns based on the transaction subgraph.

5. The anti-money laundering intelligent analysis method as described in claim 4, characterized in that, The specific method for identifying abnormal patterns based on transaction subgraphs is as follows: calculate the transaction amount characteristics of the transaction subgraph, compare the transaction amount characteristics of historical events with the transaction amount characteristics of the current transaction subgraph, and confirm the abnormal pattern.

6. The anti-money laundering intelligent analysis method as described in claim 5, characterized in that, The specific method for analyzing abnormal clustering of fund flows based on transaction relationship graphs, identifying whether there are hidden transaction patterns in abnormal clusters, and extracting suspicious transaction subgraphs is as follows: The application community detection algorithm performs grouping analysis based on transaction relationship graphs to divide communities into clusters. For each cluster community, extract its community feature value, set an anomaly threshold, and regard the cluster community whose community feature value exceeds the anomaly threshold as an abnormal region. Using a depth-limited search algorithm, starting from the initial node in the abnormal region, the algorithm traverses the abnormal region along the directed edges, records the visited nodes and edges, and identifies hidden transaction patterns. The hidden transaction patterns include fund circulation patterns and hierarchical transfer patterns. If the traversed edges form a loop, it is judged as a fund circulation pattern. If the traversed edges transfer between nodes at different levels and the amount shows a decreasing trend, it is judged as a hierarchical transfer pattern. Extract the nodes and edges involved in the identified hidden transaction patterns to construct a suspicious transaction subgraph.

7. The anti-money laundering intelligent analysis method as described in claim 6, characterized in that, The method for using the random forest algorithm to assess the risk of each node in the suspicious transaction subgraph, and marking a node as high-risk if its risk score is greater than the risk threshold, and generating high-risk transaction paths is as follows: Extract node attributes and graph structure features from nodes in the suspicious transaction subgraph, wherein the graph structure features include node degree and clustering coefficient; For each node, query the historical transaction amount and number of transactions of its associated transaction entities to obtain the historical transaction records of each node's associated transaction entities; The node attributes, graph structure features, and historical transaction records of the nodes are standardized to obtain a unified feature dataset; The random forest algorithm is used to perform risk quantification assessment on a unified feature dataset, and a risk score is calculated for each node. If a node's risk score is greater than the risk threshold, it is marked as a high-risk node. By traversing the graph's structural features, transaction paths directly associated with high-risk nodes are obtained, forming high-risk transaction paths.

8. The anti-money laundering intelligent analysis method as described in claim 7, characterized in that, The risk score is calculated as follows: Rows represent nodes, columns represent feature dimensions, construct a feature matrix, and label each node with its risk label, where 0 represents normal and 1 represents high risk; The feature matrix and the corresponding risk labels are used to construct a sample set for training the random forest model; N samples are randomly drawn with replacement from the training sample set to form a training set. N features are selected from all feature dimensions as the candidate feature set for the current decision tree. At the current node, traverse each feature in the candidate feature set, select the feature that maximizes the Gini coefficient and the splitting threshold as the splitting basis, and divide the sample into left and right child nodes. Recursively execute the node splitting process on the left and right child nodes until the stopping condition is met; Repeatedly construct T decision trees, and combine the T decision trees to generate a random forest model; For each node to be risk-assessed, its node attributes, graph structure features, and historical transaction records of related transaction entities are extracted as features. For each decision tree in the random forest, starting from the root node, the branches of the decision tree are traversed according to the value of the node's features until a leaf node is reached. Each leaf node corresponds to a risk label and a risk score. The risk labels of the T decision trees are statistically analyzed, and the voting results corresponding to the majority of risk labels are used as the final risk classification. The risk scores of the T decision trees are averaged to obtain the final risk score.

9. The anti-money laundering intelligent analysis method as described in claim 8, characterized in that, The specific method for extracting contextual information from high-risk transaction paths, performing feature vectorization processing on the contextual information, constructing a risk interpretation model, and generating a risk interpretation report is as follows: For high-risk transaction paths, obtain contextual information including background information, relationships between entities, and the purpose of funds; Based on the context information, natural language processing techniques are used to segment and extract semantics from the text content of the context information, generating a set of structured feature vectors; For the generated feature vector set, the correlation of each feature vector is calculated by statistical analysis. If the correlation of a certain feature vector is less than the correlation threshold, the feature vector is removed to obtain the refined feature vector combination. The refined feature vector combination is used to determine whether there are abnormal patterns in the high-risk trading path. If an abnormal pattern is detected, it is marked as a high-risk trading path segment. For high-risk transaction segments marked, obtain the corresponding background information, entity relationships, and contextual information on the use of funds, and generate a risk explanation report.

10. An anti-money laundering intelligent analysis system, used to implement the anti-money laundering intelligent analysis method according to any one of claims 1-9, characterized in that, include: The transaction graph generation module is used to construct a transaction relationship graph based on the original transaction dataset, defining nodes and edges for transaction entities and fund flows; The suspicious transaction extraction module is used to analyze the abnormal area set of fund flows based on the transaction relationship graph, identify whether there are hidden transaction patterns in the abnormal area set, and extract the suspicious transaction subgraph; The risk path marking module is used to perform risk assessment on each node in the suspicious transaction subgraph using the random forest algorithm. If the risk score is greater than the risk threshold, it is marked as a high-risk node and a high-risk transaction path is generated. The risk report generation module is used to extract contextual information from high-risk transaction paths, perform feature vectorization processing on the contextual information, construct a risk interpretation model, and generate a risk interpretation report.

Images