Method and device for determining transaction relationship of suspicious money laundering users

Abstract

The present invention provides a method and device for determining transaction relationships of suspicious money laundering users. The method comprises: constructing a suspicious money laundering user transaction network according to a full customer transaction relationship network and a set of suspicious money laundering users, wherein network nodes in the suspicious money laundering user transaction network are suspicious money laundering users; calculating transaction weights between various suspicious money laundering users in the suspicious money laundering user transaction network, and marking the suspicious money laundering user transaction network according to the transaction weights to obtain a suspicious money laundering user transaction relationship network; deleting transaction relationships between the suspicious money laundering users whose transaction weights in the suspicious money laundering user transaction relationship network are lower than a predetermined threshold, and obtaining a plurality of suspicious money laundering user transaction relationship groupings, thereby determining the transaction relationships between the suspicious money laundering users, and solving the problems in the related art of money laundering gang mining methods that the group size is too large and the money laundering transaction path is easily destroyed.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of communications, and in particular, to a method and device for determining a transaction relationship of a suspicious money laundering user. Background Art

[0002] In the upstream crime scenarios of anti-money laundering, most of the scenarios, such as underground banks, gambling, illegal fund-raising, etc., are gang crimes. Therefore, how to associate customers and accurately divide gangs is crucial, and is also a key step in further gang mining and manual verification. The transaction network between customers in the anti-money laundering scenario has two characteristics:

[0003] 1. Transactions between customers are complicated and the transaction volume is large, with normal transactions far outnumbering money laundering transactions;

[0004] 2. The most essential feature of money laundering is to convert illegal income into legal income or transfer funds through a series of transactions. Therefore, the main transaction links for money laundering are relatively long and often chain-like.

[0005] Due to the ever-changing methods of money laundering and the above-mentioned two characteristics, how to accurately identify money laundering gangs has become a rather thorny issue.

[0006] The commonly used method of mining money laundering gangs is to mine a single suspicious customer based on rules, and then use the financial relationship to associate customers. This method can easily evade this mining method when the link of the suspicious money laundering customer transaction is relatively long, or the associated gang is particularly large. At the same time, the basic idea of ​​the current common community grouping method is that the connection within the community is close, and the connection between communities is relatively distant. This division method is basically not suitable for money laundering scenarios, and the financial link in the gang is relatively easy to destroy. For example, the community grouping algorithm based on connection divides each connected graph into a community. This division method will not destroy the customer's transaction link when applying the customer transaction network. However, due to the complexity of transactions between customers, the divided groups are basically hundreds of thousands or even millions of customers, which makes it impossible to conduct manual analysis and judgment later.

[0007] There is currently no effective solution to the problem that the groups obtained by the above-mentioned money laundering gang mining method are too large and can easily disrupt the money laundering transaction path. Summary of the invention

[0008] The embodiment of the present invention provides a method and device for determining transaction relationships of suspicious money laundering users, so as to at least solve the problem that the group size obtained by the money laundering gang mining method in the related art is too large and the money laundering transaction path is easily destroyed.

[0009] According to one embodiment of the present invention, a method for determining transaction relationships of suspicious money laundering users is provided, comprising: constructing a suspicious money laundering user transaction network based on a full customer transaction relationship network and a set of suspicious money laundering users, wherein network nodes in the suspicious money laundering user transaction network are suspicious money laundering users; calculating transaction weights between each suspicious money laundering user in the suspicious money laundering user transaction network, and marking the suspicious money laundering user transaction network according to the transaction weights to obtain a suspicious money laundering user transaction relationship network; deleting transaction relationships between the suspicious money laundering users whose transaction weights in the suspicious money laundering user transaction relationship network are lower than a predetermined threshold, to obtain a plurality of suspicious money laundering user transaction relationship groupings, thereby determining the transaction relationships between the suspicious money laundering users.

[0010] In an exemplary embodiment, before constructing a suspicious money laundering user transaction network based on the full customer transaction relationship network and a set of suspicious money laundering users, it may also include: obtaining the full customer transaction relationship network based on the full transaction data within a predetermined time, wherein the full customer transaction relationship network includes at least one of the following: transaction customers, transaction relationships between transaction customers, and transaction amounts of transaction customers within a predetermined time.

[0011] In an exemplary embodiment, the transaction weights between each of the suspected money laundering users may include at least one of the following: an amount-related weight and a customer distance weight, wherein the value of the amount-related weight is the smallest transaction amount among all the fund transfer amounts in the fund flow path between the suspicious money laundering users, and the value of the customer distance weight is the number of fund transfers in the shortest path in the fund flow path between the suspicious money laundering users.

[0012] In an exemplary embodiment, deleting the transaction relationships between suspicious money laundering users whose transaction weights in the suspicious money laundering user transaction relationship network are lower than a predetermined threshold may include: deleting the transaction relationships between suspicious money laundering users whose transaction weights in the suspicious money laundering user transaction relationship network are lower than a predetermined threshold according to a label propagation algorithm LPA.

[0013] In an exemplary embodiment, after obtaining a plurality of suspicious money laundering user transaction relationship groups, the method may further include: expanding the suspicious money laundering user transaction relationship groups according to the full customer transaction relationship network to obtain a suspicious money laundering user transaction relationship community.

[0014] In an exemplary embodiment, after obtaining the suspicious money laundering user transaction relationship community, the method may further include: performing a suspicion measurement on the suspicious money laundering user transaction relationship community to obtain a suspicion score.

[0015] In an exemplary embodiment, after obtaining the suspicious money laundering user transaction relationship community, it may also include: verifying the accuracy of the suspicious money laundering user transaction relationship community based on one of the following methods: determining the number of historical money laundering relationship network cases contained in the suspicious money laundering user transaction relationship community; when each suspicious money laundering user transaction relationship community in the full customer transaction relationship network does not contain a historical money laundering relationship network case, verifying the suspicious money laundering user transaction relationship community.

[0016] According to another embodiment of the present invention, there is provided a device for determining transaction relationships of suspicious money laundering users, comprising: a construction module, used to construct a suspicious money laundering user transaction network based on a full customer transaction relationship network and a set of suspicious money laundering users, wherein the network nodes in the suspicious money laundering user transaction network are suspicious money laundering users; a labeling module, used to calculate the transaction weights between each suspicious money laundering user in the suspicious money laundering user transaction network, and label the suspicious money laundering user transaction network according to the transaction weights to obtain a suspicious money laundering user transaction relationship network; and a deletion module, used to delete the transaction relationships between the suspicious money laundering users whose transaction weights in the suspicious money laundering user transaction relationship network are lower than a predetermined threshold, to obtain multiple suspicious money laundering user transaction relationship groupings, thereby determining the transaction relationships between the suspicious money laundering users.

[0017] According to yet another embodiment of the present invention, a computer-readable storage medium is provided, in which a computer program is stored, wherein the computer program is configured to execute the steps of any one of the above method embodiments when run.

[0018] According to yet another embodiment of the present invention, there is provided an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0019] Through the above-mentioned embodiments of the present invention, since the transaction relationships between some suspicious money laundering users in the suspicious money laundering user transaction relationship network are deleted, the suspicious money laundering user transaction relationship network is divided into multiple suspicious money laundering user transaction relationship groups. Therefore, the problem of too large group size obtained by the money laundering gang mining method in the related art can be solved. In addition, since the suspicious money laundering user transaction network is constructed according to the full customer transaction relationship network and the set of suspicious money laundering users, the problem of easy destruction of the money laundering transaction path in the related art can be solved, thereby achieving the effect of reducing the number of normal customer transactions in the money laundering gang group and accurately retaining the money laundering transaction path. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0021] Figure 1 It is a hardware structure block diagram of a mobile terminal of a method for determining a transaction relationship of a suspicious money laundering user according to an embodiment of the present invention;

[0022] Figure 2 is a flow chart of a method for determining a transaction relationship of a suspicious money laundering user according to an embodiment of the present invention;

[0023] Figure 3 is a structural block diagram of a device for determining transaction relationships of suspicious money laundering users according to an embodiment of the present invention;

[0024] Figure 4 is a structural block diagram of a device for determining transaction relationships of suspicious money laundering users according to an optional embodiment of the present invention;

[0025] Figure 5 is a schematic diagram of the structure of a transaction network according to an optional embodiment of the present invention;

[0026] Figure 6 is a flow chart of a method for anti-money laundering transaction network grouping based on suspicious money laundering customers according to an optional embodiment of the present invention;

[0027] Figure 7 2 is a schematic diagram of a method for determining amount-related weights according to an optional embodiment of the present invention. DETAILED DESCRIPTION

[0028] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0029] It should be noted that the terms "including" and "having" and any variations thereof in the specification and claims of the present invention and the above-mentioned drawings are intended to cover non-exclusive inclusions. For example, a process, method, system, product or apparatus comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or apparatus.

[0030] In order to better understand the technical solutions of the embodiments and optional embodiments of the present invention, the following describes possible application scenarios of the embodiments and optional embodiments of the present invention, but is not intended to limit the application of the following scenarios.

[0031] The method embodiments provided in the embodiments of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Taking running on a mobile terminal as an example, Figure 1 1 is a hardware structure block diagram of a mobile terminal of a method for determining a transaction relationship of a suspicious money laundering user according to an embodiment of the present invention. Figure 1 As shown, the mobile terminal may include one or more ( Figure 1 Only one is shown in the figure) a processor 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA) and a memory 104 for storing data, wherein the mobile terminal may also include a transmission device 106 and an input / output device 108 for communication functions. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the mobile terminal. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations are shown.

[0032] The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the method for determining the transaction relationship of suspicious money laundering users in the embodiment of the present invention. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, to implement the above method. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the mobile terminal via a network. Examples of the above network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0033] The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the mobile terminal. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0034] In this embodiment, a method for determining transaction relationships of suspicious money laundering users running on the above mobile terminal is provided. Figure 2 is a flow chart of a method for determining a transaction relationship of a suspicious money laundering user according to an embodiment of the present invention. Figure 2 The process includes the following steps:

[0035] Step S201, constructing a suspicious money laundering user transaction network based on the full customer transaction relationship network and the set of suspicious money laundering users, wherein the network nodes in the suspicious money laundering user transaction network are suspicious money laundering users.

[0036] Step S202, calculating the transaction weights between the suspicious money laundering users in the suspicious money laundering user transaction network, and marking the suspicious money laundering user transaction network according to the transaction weights to obtain a suspicious money laundering user transaction relationship network.

[0037] Step S203, deleting the transaction relationships between the suspicious money laundering users whose transaction weights in the transaction relationship network of the suspicious money laundering users are lower than a predetermined threshold, and obtaining a plurality of suspicious money laundering user transaction relationship groupings, thereby determining the transaction relationships between the suspicious money laundering users.

[0038] Before step S201 of this embodiment, the method may further include: obtaining the full customer transaction relationship network based on the full transaction data within a predetermined time, wherein the full customer transaction relationship network includes at least one of the following: transaction customers, transaction relationships between transaction customers, and transaction amounts of transaction customers within a predetermined time.

[0039] In this embodiment, the transaction weights between each of the suspicious money laundering users may include at least one of the following: an amount-related weight and a customer distance weight, wherein the value of the amount-related weight is the smallest transaction amount among all the fund transfer amounts in the fund flow path between the suspicious money laundering users, and the value of the customer distance weight is the number of fund transfers in the shortest path in the fund flow path between the suspicious money laundering users.

[0040] In this embodiment, step S203 may include: deleting the transaction relationship between the suspicious money laundering users whose transaction weights are lower than a predetermined threshold in the transaction relationship network of the suspicious money laundering users according to the label propagation algorithm LPA.

[0041] After step S203 of this embodiment, the method may further include: expanding the suspicious money laundering user transaction relationship grouping according to the full customer transaction relationship network to obtain a suspicious money laundering user transaction relationship community.

[0042] In this embodiment, after obtaining the suspicious money laundering user transaction relationship community, the method may further include: measuring the suspicious degree of the suspicious money laundering user transaction relationship community to obtain a suspicious degree score.

[0043] In this embodiment, after obtaining the suspicious money laundering user transaction relationship community, the method may further include: verifying the accuracy of the suspicious money laundering user transaction relationship community based on one of the following methods: determining the number of historical money laundering relationship network cases contained in the suspicious money laundering user transaction relationship community; and verifying the suspicious money laundering user transaction relationship community when none of the suspicious money laundering user transaction relationship communities in the full customer transaction relationship network contains any historical money laundering relationship network case.

[0044] Through the above steps, since the transaction relationships between some suspicious money laundering users in the suspicious money laundering user transaction relationship network are deleted, the suspicious money laundering user transaction relationship network is divided into multiple suspicious money laundering user transaction relationship groups. Therefore, the problem of too large group size obtained by the money laundering gang mining method in the related technology can be solved. In addition, since the suspicious money laundering user transaction network is constructed according to the full customer transaction relationship network and the set of suspicious money laundering users, the problem of easy destruction of the money laundering transaction path in the related technology can be solved, thereby achieving the effect of reducing the number of normal customer transactions in the money laundering gang group and accurately retaining the money laundering transaction path.

[0045] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods described in each embodiment of the present invention.

[0046] In this embodiment, a suspicious money laundering user transaction relationship determination device is also provided, which is used to implement the above-mentioned embodiments and preferred embodiments, and the descriptions that have been made will not be repeated. As used below, the terms "module" and "unit" can be a combination of software and / or hardware that implements a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0047] Figure 3 is a structural block diagram of a device for determining a transaction relationship of a suspicious money laundering user according to an embodiment of the present invention. Figure 3 As shown, the device includes: a construction module 10, a marking module 20 and a deletion module 30.

[0048] The construction module 10 is used to construct a suspicious money laundering user transaction network based on the full customer transaction relationship network and the set of suspicious money laundering users, wherein the network nodes in the suspicious money laundering user transaction network are suspicious money laundering users.

[0049] The labeling module 20 is used to calculate the transaction weights between the suspicious money laundering users in the suspicious money laundering user transaction network, and label the suspicious money laundering user transaction network according to the transaction weights to obtain a suspicious money laundering user transaction relationship network.

[0050] The deleting module 30 is used to delete the transaction relationships between the suspicious money laundering users whose transaction weights in the suspicious money laundering user transaction relationship network are lower than a predetermined threshold, and obtain a plurality of suspicious money laundering user transaction relationship groups, thereby determining the transaction relationships between the suspicious money laundering users.

[0051] Figure 4 is a structural block diagram of a device for determining a transaction relationship of a suspicious money laundering user according to an optional embodiment of the present invention. Figure 4 As shown, the device includes Figure 3 In addition to all modules shown, you can also include:

[0052] The acquisition module 40 is used to obtain the full customer transaction relationship network based on the full transaction data within a predetermined time before constructing the suspicious money laundering user transaction network based on the full customer transaction relationship network and the set of suspicious money laundering users, wherein the full customer transaction relationship network may include at least one of the following: transaction customers, transaction relationships between transaction customers, and transaction amounts of transaction customers within a predetermined time.

[0053] In this embodiment, the transaction weights between each of the suspected money laundering users may include at least one of the following: an amount-related weight and a customer distance weight, wherein the value of the amount-related weight is the smallest transaction amount among all the fund transfer amounts in the fund flow path between the suspicious money laundering users, and the value of the customer distance weight is the number of fund transfers in the shortest path in the fund flow path between the suspicious money laundering users.

[0054] The deleting unit 31 is used to delete the transaction relationships between the suspicious money laundering users whose transaction weights are lower than a predetermined threshold in the suspicious money laundering user transaction relationship network according to the label propagation algorithm LPA.

[0055] The expansion module 50 is used to expand the suspicious money laundering user transaction relationship groups according to the full customer transaction relationship network after obtaining multiple suspicious money laundering user transaction relationship groups to obtain suspicious money laundering user transaction relationship communities.

[0056] The determination module 60 is used to determine the degree of suspicion of the suspicious money laundering user transaction relationship community after obtaining the suspicious money laundering user transaction relationship community to obtain a suspicion score.

[0057] The verification module 70 is used to verify the accuracy of the suspicious money laundering user transaction relationship community after obtaining it based on one of the following methods: determining the number of historical money laundering relationship network cases contained in the suspicious money laundering user transaction relationship community; and verifying the suspicious money laundering user transaction relationship community when none of the suspicious money laundering user transaction relationship communities in the full customer transaction relationship network contains any historical money laundering relationship network cases.

[0058] It should be noted that the above modules can be implemented by software or hardware. For the latter, it can be implemented in the following ways, but not limited to: the above modules are all located in the same processor; or the above modules are located in different processors in any combination.

[0059] In order to facilitate the understanding of the technical solution provided by the present invention, it will be described in detail below in combination with embodiments of specific scenarios.

[0060] Banks have a large number of customer transaction records. A record in the transaction table of the database represents a transaction between customers. Figure 5 is a schematic diagram of the structure of a transaction network according to an optional embodiment of the present invention, such as Figure 5 As shown, the customer's transaction network is a form of presenting transactions between customers in the form of a directed graph or an undirected graph. Figure 5 The midpoint represents the customer, and the edge represents the transaction between customers. For example, the transaction between customer A and customer B is 2.

[0061] exist Figure 5 In the network graph, the subgraph corresponding to the nodes with close internal connections is called a community. In the related art, the structure of a community in a network graph is generally found through a community clustering algorithm (also called a community discovery algorithm).

[0062] At present, the anti-money laundering community division actually used by anti-money laundering gangs is to warn suspicious money laundering customers based on rules, and then use transactions to associate the warned customers to form groups (also called communities). Specifically, a single suspicious money laundering customer is screened out through rules, and then customers with transaction relationships between suspicious money laundering customers are associated, and those with transactions are divided into a group.

[0063] Specifically, this method of mining money laundering gangs is generally based on rules to mine a single suspicious customer, and then use the financial relationship to associate customers. When the link of the suspicious money laundering customer transaction is relatively long, this method can easily evade this mining method or the associated gang is particularly large. At the same time, the basic idea of ​​the current common community grouping method is that the connection within the community is close, and the connection between communities is relatively distant. This division method is basically not suitable for money laundering scenarios, and the financial link in the gang is relatively easy to destroy. For example, the community grouping algorithm based on connection divides each connected graph into a community. This division method will not destroy the customer's transaction link when applying the customer transaction network, but due to the complexity of transactions between customers, the divided groups are basically hundreds of thousands or even millions of customers, making it impossible to conduct manual analysis and judgment later.

[0064] The main purpose of this embodiment is to construct an accurate customer transaction network clustering method for anti-money laundering scenarios, to solve the problems of large group size and destruction of money laundering transaction paths in related technologies, to retain the money laundering transaction paths while including as few normal customer transactions as possible in the group, so that the grouping can be more accurate, and then input into the downstream anti-money laundering suspicious group identification algorithm to mine money laundering groups.

[0065] Figure 6 is a flow chart of a method for anti-money laundering transaction network grouping based on suspicious money laundering customers according to an optional embodiment of the present invention. Figure 6 As shown, the process includes the following steps:

[0066] Step S601, constructing a customer transaction network diagram based on all customer transactions.

[0067] In this embodiment, step S601 may include: obtaining all transaction data of the customer within one month, preprocessing the transaction data, and building a customer transaction network.

[0068] In step S601 of this embodiment, the input is the transaction data of all customers for one month, and the output is the transaction network G(V,E) of all customers, where the points are all customers V, the edges E are the transaction relationships between customers, and the weight of the edges is the total transaction amount between customers in one month.

[0069] Step S602: Calculate the relationship weights between black samples according to a weight calculation formula.

[0070] In this embodiment, step S602 may include: inputting the transaction network G(V, E) in step S601, assuming that set H is a set of suspicious money laundering customers. Taking all customers in set H as points, constructing a transaction network G_H, the weight between two points is defined as w ij , the weight calculation formula is as follows:

[0071]

[0072] u 1 =i,u 2 ,....u sij =j∈shortest_path (k) ,

[0073]

[0074] max_amt=log 10 (max ij∈H (amt ij )),

[0075]

[0076] i,j∈H,

[0077] in:

[0078] m represents the number of all shortest paths from i to j, shortest_path (k) represents the kth shortest path,

[0079] represents the total amount of related transactions on the kth shortest path between two customers i and j,

[0080] amt ij represents the total amount of related transactions between two customers i and j,

[0081] w ij represents the weight between two customers i and j in G_H,

[0082] shortest ij Represents the length of the shortest path between i and j in the transaction network G.

[0083] Specifically, the weight consists of two parts, namely, the amount-related weight and the measure of customer distance.

[0084] The first part is the amount-related weight. Figure 7 is a schematic diagram of a method for determining amount-related weights according to an optional embodiment of the present invention. Figure 7 As shown in Figure 1, this method assumes that the flow of funds between customers is determined by the link with the least funds. Figure 7 In the diagram showing the method of determining the amount-related weights, the associated amount of the shortest path between a and d is 100.

[0085] The second part is a measure of customer distance. The shorter the shortest path, the closer the relationship and the greater the weight.

[0086] Combining the above two parts, this weight measures the closeness of the transaction relationship between two customers. The shorter the transaction path and the larger the transaction amount of the shortest path, the closer the relationship.

[0087] Step S603, obtaining a transaction relationship graph consisting of suspicious money laundering black samples according to the relationship and relationship weights between the black samples.

[0088] In this embodiment, step S603 mainly processes the fund transaction relationship of all customers into the fund association relationship between black samples, and transforms the fund transaction network between customers into a close transaction relationship network.

[0089] Step S604: remove the edges in the transaction relationship graph whose weights are lower than a set threshold.

[0090] In this embodiment, step S604 may include: simplifying the network in step S603, retaining the edges in G_H whose weights are greater than the threshold m, and the initial threshold may be taken as α can be initially set to 1 and can be modified according to actual effects.

[0091] In step S604 of this embodiment, in order to ensure that the final output grouping result does not cut off the capital chain of customers with relatively close connections, the threshold can be appropriately larger. Because the role of step S604 is to further group the larger group in step S603, and because the reconstructed G_H edge represents the closeness of the transaction relationship, the grouping standard can be set as the connection between customers in the community is relatively close, and the connection between different groups is distant.

[0092] Step S605: divide the community into different communities.

[0093] In this embodiment, step S605 may include: using a commonly used community clustering algorithm Label Propagation Algorithm (LPA) to perform clustering to obtain a clustering community of suspicious samples.

[0094] Step S606, expanding the first-degree neighbors of the community to form a community that includes the main money laundering capital links and transaction details.

[0095] In this embodiment, step S606 may include: expanding each group of suspicious customers to a group of all customers.

[0096] Specifically, the group in step S604 is input Let V i is the node in the group, Ner i For neighbors of V i in G,Sub_Graph i for subgraph of G made up of Ner i .

[0097] Then, the group dimension suspicion score Score i for:

[0098]

[0099] Among them, function I is a piecewise function, when m∈H∩Sub_Graph i When , function I is 1, when When , the function I is 0. Because H∩Sub_Graph i There must be black samples in the denominator. Not 0.

[0100] The final output of the grouping result Sub_Graph i (i.e., suspicious gangs), and group dimension suspicion score Score i (ie, a suspicious group score). In addition, the suspicious group score can be combined with the single customer suspicious score to calculate a comprehensive suspicious score.

[0101] After step S606 of this embodiment, the method may further include: mining downstream gangs and classifying money laundering types in the community containing the main money laundering capital links and transaction details.

[0102] After step S606 of this embodiment, the following may be further included: verifying the grouping result and calculating the comprehensive accuracy rate. Specifically, the historical data may be used for backtesting to check the number of historically reported cases included in the screened cases. At the same time, manual verification may be performed for the cases of historically reported customers that were not hit in the historical backtesting.

[0103] This embodiment transforms the customer fund relationship network into a transaction close relationship network between suspicious money laundering customers (black samples), and designs and groups the points and edges of the new network, which can solve the problems of large group size and destruction of money laundering transaction paths in related technologies, while retaining the money laundering transaction path and including as few normal customer transactions as possible in the group.

[0104] An embodiment of the present invention further provides a computer-readable storage medium, in which a computer program is stored, wherein the computer program is configured to execute the steps of any of the above method embodiments when running.

[0105] In an exemplary embodiment, the storage medium may be configured to store a computer program for performing the following steps:

[0106] S1, constructing a suspicious money laundering user transaction network based on the full customer transaction relationship network and the set of suspicious money laundering users, wherein the network nodes in the suspicious money laundering user transaction network are suspicious money laundering users;

[0107] S2, calculating the transaction weights between the suspicious money laundering users in the suspicious money laundering user transaction network, and marking the suspicious money laundering user transaction network according to the transaction weights to obtain a suspicious money laundering user transaction relationship network;

[0108] S3, deleting the transaction relationships between the suspicious money laundering users whose transaction weights in the suspicious money laundering user transaction relationship network are lower than a predetermined threshold, and obtaining a plurality of suspicious money laundering user transaction relationship groupings, thereby determining the transaction relationships between the suspicious money laundering users.

[0109] In an exemplary embodiment, the computer-readable storage medium may include, but is not limited to, various media that can store computer programs, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk.

[0110] An embodiment of the present invention further provides an electronic device, including a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0111] In an exemplary embodiment, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0112] In an exemplary embodiment, the processor may be configured to perform the following steps via a computer program:

[0113] S1, constructing a suspicious money laundering user transaction network based on the full customer transaction relationship network and the set of suspicious money laundering users, wherein the network nodes in the suspicious money laundering user transaction network are suspicious money laundering users;

[0114] S2, calculating the transaction weights between the suspicious money laundering users in the suspicious money laundering user transaction network, and marking the suspicious money laundering user transaction network according to the transaction weights to obtain a suspicious money laundering user transaction relationship network;

[0115] S3, deleting the transaction relationships between the suspicious money laundering users whose transaction weights in the suspicious money laundering user transaction relationship network are lower than a predetermined threshold, and obtaining a plurality of suspicious money laundering user transaction relationship groupings, thereby determining the transaction relationships between the suspicious money laundering users.

[0116] For specific examples in this embodiment, reference may be made to the examples described in the above embodiments and exemplary implementation modes, and this embodiment will not be described in detail herein.

[0117] Obviously, those skilled in the art should understand that the above modules or steps of the present invention can be implemented by a general computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be executed in a different order than here, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present invention is not limited to any specific combination of hardware and software.

[0118] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for determining transaction relationships of suspicious money laundering users, characterized in that: include: Constructing a suspicious money laundering user transaction network based on the full customer transaction relationship network and the set of suspicious money laundering users, wherein the network nodes in the suspicious money laundering user transaction network are suspicious money laundering users; Calculating the transaction weights between each suspicious money laundering user in the suspicious money laundering user transaction network, and marking the suspicious money laundering user transaction network according to the transaction weights to obtain a suspicious money laundering user transaction relationship network, wherein the transaction weights between each suspicious money laundering user include at least one of the following: an amount-related weight and a customer distance weight, wherein the value of the amount-related weight is the minimum transaction amount among each fund transfer amount in the fund transaction path between the suspicious money laundering users, and the value of the customer distance weight is the number of fund transfers in the shortest path in the fund transaction path between the suspicious money laundering users; The transaction relationships between the suspicious money laundering users whose transaction weights in the suspicious money laundering user transaction relationship network are lower than a predetermined threshold are deleted to obtain a plurality of suspicious money laundering user transaction relationship groupings, thereby determining the transaction relationships between the suspicious money laundering users.

2. The method according to claim 1, characterized in that Before constructing a suspicious money laundering user transaction network based on the full customer transaction relationship network and the set of suspicious money laundering users, it also includes: The full-customer transaction relationship network is obtained according to the full transaction data within a predetermined time, wherein the full-customer transaction relationship network includes at least one of the following: transaction customers, transaction relationships between transaction customers, and transaction amounts of transaction customers within a predetermined time.

3. The method according to claim 1, characterized in that Deleting the transaction relationship between the suspicious money laundering users whose transaction weights are lower than a predetermined threshold in the transaction relationship network of the suspicious money laundering users, including: The transaction relationships between the suspicious money laundering users whose transaction weights in the suspicious money laundering user transaction relationship network are lower than a predetermined threshold are deleted according to the label propagation algorithm LPA.

4. The method according to claim 1, characterized in that After obtaining multiple suspicious money laundering user transaction relationship groups, it also includes: The suspicious money laundering user transaction relationship grouping is expanded according to the full customer transaction relationship network to obtain a suspicious money laundering user transaction relationship community.

5. The method according to claim 4, characterized in that After obtaining the community of suspected money laundering user transaction relationships, it also includes: The suspicious degree of the transaction relationship community of the suspicious money laundering user is measured to obtain a suspicious degree score.

6. The method according to claim 4, characterized in that After obtaining the community of suspected money laundering user transaction relationships, it also includes: Verify the accuracy of the transaction relationship community of the suspected money laundering user based on one of the following methods: Determining the number of historical money laundering relationship network cases included in the suspected money laundering user transaction relationship community; When each of the suspicious money laundering user transaction relationship communities in the full customer transaction relationship network does not contain any historical money laundering relationship network case, the suspicious money laundering user transaction relationship community is verified.

7. A device for determining transaction relationships of suspicious money laundering users, characterized in that: include: A construction module, used to construct a suspicious money laundering user transaction network based on the full customer transaction relationship network and the set of suspicious money laundering users, wherein the network nodes in the suspicious money laundering user transaction network are suspicious money laundering users; a labeling module, used for calculating the transaction weights between each suspicious money laundering user in the suspicious money laundering user transaction network, and labeling the suspicious money laundering user transaction network according to the transaction weights to obtain a suspicious money laundering user transaction relationship network, wherein the transaction weights between each of the suspicious money laundering users include at least one of the following: an amount-related weight and a customer distance weight, wherein the value of the amount-related weight is the minimum transaction amount among each fund transfer amount in the fund transaction path between the suspicious money laundering users, and the value of the customer distance weight is the number of fund transfers in the shortest path in the fund transaction path between the suspicious money laundering users; The deletion module is used to delete the transaction relationships between the suspicious money laundering users whose transaction weights in the suspicious money laundering user transaction relationship network are lower than a predetermined threshold, and obtain a plurality of suspicious money laundering user transaction relationship groupings, thereby determining the transaction relationships between the suspicious money laundering users.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the computer program implements the steps of the method described in any one of claims 1 to 6 when executed by a processor.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method described in any one of claims 1 to 6 are implemented.

Images