Abnormal bank account identification method and system, electronic device and storage medium

Abstract

The present disclosure provides a non-normal bank account identification method, system, electronic device and computer readable storage medium to solve the problem that only bank transaction data cannot well identify non-normal bank cards. The method comprises: acquiring network signaling data on the operator side and bank business behavior data including whether the user violates the rules; matching the network signaling data and the business behavior data according to the user identity information, extracting relevant information in the data of the two parties for data comparison and merging into a training sample data set for the user whose matching is successful; constructing a neural network model, and training the model based on a federated learning algorithm through the training sample data set to obtain an account identification model; identifying non-normal bank accounts based on the account identification model for the user business behavior data to be identified, and determining the rule violation account. The technical scheme of the present disclosure can improve the accuracy and efficiency of non-normal bank account identification, and can ensure user privacy and data security.

Description

Technical Field

[0001] This disclosure relates to the field of financial security, specifically to a method for identifying irregular bank accounts, a system for identifying irregular bank accounts, an electronic device, and a computer-readable storage medium. Background Technology

[0002] Currently, the identification of irregular bank accounts mainly relies on technologies such as intelligence gathering, illegal information collection, and irregular information (credit data) databases. Intelligence gathering, also known as crowdsourcing, primarily comes from internet companies, but its accuracy is low, and its use by banks easily leads to user complaints. Illegal information collection, which involves tracing transactions related to criminal cases, is usually handled retrospectively, lacking timeliness and posing a significant threat to society. As for irregular information databases, irregular users are characterized by their dispersed, latent, and complex nature, making single-source data insufficient for detection. Furthermore, some banks' own irregular account identification models are limited to their own bank card transaction data, unable to pinpoint the actual user, identify user risk, or effectively freeze irregular bank cards in a timely manner. Summary of the Invention

[0003] To at least address the technical problem in existing technologies that cannot effectively identify non-compliant bank cards based solely on bank card transaction data, this disclosure provides a method, system, electronic device, and computer-readable storage medium for identifying abnormal bank accounts. This method can build a model based on basic user behavior data from the telecommunications industry and business data from the banking side, expanding the data sources from both sides, improving the accuracy and efficiency of identifying abnormal bank accounts, and ensuring user privacy and data security.

[0004] In a first aspect, this disclosure provides a method for identifying abnormal bank accounts, the method comprising:

[0005] The operator-side user mobile network signaling data and the bank-side user business behavior data are acquired respectively, and the user business behavior data includes whether the user has violated regulations.

[0006] Based on user identity information, the user's mobile network signaling data and user service behavior data are matched. For each successfully matched user, relevant information is extracted from their mobile network signaling data and service behavior data for data comparison processing. The user's mobile network signaling data and user service behavior data after comparison processing are merged into a training sample dataset.

[0007] A neural network model is constructed, and the neural network model is trained using the training sample dataset based on the federated learning algorithm to obtain an account recognition model;

[0008] Based on the account recognition model, abnormal bank accounts are identified from the bank-side user business behavior data to be identified, and illegal accounts are determined.

[0009] Furthermore, the method also includes:

[0010] Users are tagged based on their historical business data to determine whether they have violated regulations. The tagged results are divided into non-violation accounts and suspected violation accounts.

[0011] Furthermore, the user mobile network signaling data includes user identity information, mobile phone number information, online time period, active city, communication trajectory and communication characteristic indicators. The communication characteristic indicators include at least one of the following: corresponding IMSI number, corresponding IMEI number, corresponding terminal type number, traffic type number and broadband traffic type percentage.

[0012] The user business behavior data includes user identity information, mobile phone number information, transaction time, activity city, transaction location, bank account, IP, amount, and account tags;

[0013] Before matching user mobile network signaling data and user service behavior data based on user identity information, the process also includes:

[0014] The mean and standard deviation of the communication characteristic indicators in the user mobile network signaling data are calculated and normalized.

[0015] User identity information and mobile phone number information in user mobile network signaling data and user service behavior data are encrypted using the same national cryptographic algorithm.

[0016] Furthermore, the matching of user mobile network signaling data and user service behavior data based on user identity information includes:

[0017] The encrypted user identity information in the user's mobile network signaling data is matched with the encrypted user identity information in the user's business behavior data. For each successfully matched user, a feature value is generated as the identifier of the successfully matched user, and the feature value of each successfully matched user is different.

[0018] Furthermore, for each successfully matched user, relevant information is extracted from their mobile network signaling data and service behavior data for data comparison processing, including:

[0019] Set time-based authentication, cross-regional transactions, and transaction trajectory compliance features;

[0020] For each successfully matched user, the transaction time is compared with the online time period, the active city with the active city, and the transaction location with the communication trajectory. Based on the comparison results, the time authentication, cross-regional transaction and transaction trajectory conformity features are labeled to obtain their respective feature values.

[0021] The method further includes:

[0022] Add time authentication, cross-regional transactions, and transaction trajectory compliance feature values ​​to the training sample dataset; and,

[0023] The training sample dataset is processed into {(x1, y1), (x2, y2), ..., (x... i y i ), ..., (x w y w In the form of )}

[0024] Where x i y represents the set of parameters for the i-th user, including user characteristics, mobile phone number, bank account number, IP address, transaction amount, transaction time, time authentication characteristics, cross-regional transaction characteristics, transaction trajectory compliance characteristics, and various communication characteristic indicators; i Let i be a label indicating whether the i-th user has violated the rules.

[0025] Furthermore, the neural network model is a backpropagation (BP) neural network model, including an input layer, a hidden layer, and an output layer, wherein the input layer is x from the training sample dataset. i The parameters are set, and the output is y. i The label values, as well as the added cross-regional transactions and abnormal information, are used. The activation functions of the hidden layer and the output layer use the Sigmoid function, and the termination condition for recursion is set to be that the error is less than the set threshold.

[0026] Furthermore, the method also includes:

[0027] Based on the account identification model, the mobile network signaling data of the operator-side user to be identified is used to identify the mobile phone numbers corresponding to abnormal bank accounts, and suspected SIM card sales information is identified.

[0028] Secondly, this disclosure provides a system for identifying irregular bank accounts, including:

[0029] The acquisition module is configured to acquire mobile network signaling data of users on the operator side and user business behavior data on the bank side, respectively. The user business behavior data includes a tag indicating whether the user has violated regulations.

[0030] The data processing module is configured to match user mobile network signaling data and user service behavior data based on user identity information. For each successfully matched user, relevant information is extracted from their mobile network signaling data and service behavior data for data comparison processing. The user mobile network signaling data and user service behavior data after comparison processing are then merged into a training sample dataset.

[0031] The training module is configured to build a neural network model and train the neural network model using the training sample dataset based on a federated learning algorithm to obtain an account recognition model.

[0032] The identification module is configured to identify abnormal bank accounts based on the account identification model and determine the non-compliant accounts from the bank-side user business behavior data to be identified.

[0033] Thirdly, this disclosure provides an electronic device including a memory and a processor, wherein the memory stores a computer program, and when the processor runs the computer program stored in the memory, the processor performs the abnormal bank account identification method as described in any of the first aspects.

[0034] Fourthly, this disclosure provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the abnormal bank account identification method described in either the first or second aspect above.

[0035] Beneficial effects:

[0036] The non-compliant bank account identification method, system, electronic device, and computer-readable storage medium disclosed herein acquire mobile network signaling data from the operator side and user business behavior data from the bank side, wherein the user business behavior data includes a user violation label; match the user mobile network signaling data and user business behavior data according to user identity information; for each successfully matched user, extract relevant information from the mobile network signaling data and business behavior data for data comparison processing, and merge the compared user mobile network signaling data and user business behavior data into a training sample dataset; construct a neural network model, and train the neural network model using the training sample dataset based on a federated learning algorithm to obtain an account identification model; identify non-compliant bank accounts based on the bank side user business behavior data to be identified using the account identification model, and determine the non-compliant accounts. This technical solution can build a model based on basic user behavior data from the telecommunications industry and bank side business data, expand the data sources of both parties, and identify the rationality of transactions by comparing communication data and banking business data. While ensuring user privacy and data security, it improves the accuracy and efficiency of non-compliant bank account identification, promptly blocks non-compliant bank cards, and avoids financial losses. Attached Figure Description

[0037] Figure 1 This is a flowchart illustrating a method for identifying abnormal bank accounts provided in Embodiment 1 of this disclosure;

[0038] Figure 2 This is a schematic diagram of a BP neural network model provided in Embodiment 1 of this disclosure;

[0039] Figure 3 This is a schematic diagram of a local model construction process using XGBoost, provided in Embodiment 1 of this disclosure;

[0040] Figure 4 This is an architecture diagram of an abnormal bank account identification system provided in Embodiment 2 of this disclosure;

[0041] Figure 5 This is an architectural diagram of an electronic device provided in Embodiment 3 of this disclosure. Detailed Implementation

[0042] To enable those skilled in the art to better understand the technical solutions of this disclosure, the disclosure will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments and drawings described herein are merely for explaining the invention and are not intended to limit the invention.

[0043] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this disclosure are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence; furthermore, in the absence of conflict, the embodiments and features in the embodiments of this disclosure can be arbitrarily combined with each other.

[0044] The terminology used in the embodiments of this disclosure is for the purpose of describing particular embodiments only and is not intended to be limiting of this disclosure. The singular forms “a,” “the,” and “the” as used in the embodiments of this disclosure and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise.

[0045] In the following description, the use of suffixes such as “module,” “part,” or “unit” to denote elements is solely for the purpose of illustrative purposes and has no specific meaning in itself. Therefore, “module,” “part,” or “unit” may be used interchangeably.

[0046] The following detailed embodiments illustrate the technical solution of this disclosure and how it addresses the problem that relying solely on bank card transaction data is insufficient to accurately and effectively identify violating accounts, locate the actual user, identify user risks, and effectively freeze violating bank cards in a timely manner. The following specific embodiments can be combined with each other, and similar concepts or processes may not be repeated in some embodiments.

[0047] Figure 1 This is a flowchart illustrating a method for identifying abnormal bank accounts provided in Embodiment 1 of this disclosure, as follows: Figure 1 As shown, the method includes:

[0048] Step S101: Obtain mobile network signaling data from the operator side and user business behavior data from the bank side, respectively. The user business behavior data includes a tag indicating whether the user has violated regulations.

[0049] Step S102: Match user mobile network signaling data and user service behavior data according to user identity information. For each successfully matched user, extract relevant information from their mobile network signaling data and service behavior data for data comparison processing, and merge the compared user mobile network signaling data and user service behavior data into a training sample dataset.

[0050] Step S103: Construct a neural network model and train the neural network model using the training sample dataset based on the federated learning algorithm to obtain an account recognition model;

[0051] Step S104: Based on the account recognition model, identify abnormal bank accounts in the bank-side user business behavior data to be identified, and determine the non-compliant accounts.

[0052] To address the issue that a single data source from banks cannot accurately and effectively identify non-compliant accounts, this example, in addition to acquiring user business behavior data from the bank side, also utilizes user mobile network signaling data from the operator side to assist in identifying bank card transaction behavior. The operator-side user mobile network signaling data is collected and stored daily by telecommunications operators, including all user daily network signaling information that may be related to transactions. Within the user business behavior data, there is data on some potentially non-compliant accounts that have already been identified and have been marked for subsequent model training.

[0053] Since operators and banks collect data according to their respective needs, data preprocessing is required for data comparison and model training. This includes: normalizing the telecom operator dataset to ensure all features in the training data have zero mean and variance of the same order; and encrypting the portion of the data containing user attribute information to ensure user privacy and data security. Then, matching is performed based on the encrypted user identity information, aligning user mobile network signaling data and user business behavior data. For the matched data, which includes user mobile network signaling data and user business behavior data of the same user, comparing some feature indicators can identify some abnormal situations in bank account transactions. These abnormal situations are then labeled. The successfully matched user mobile network signaling data, user business behavior data, and labeled data are then merged into a training sample dataset. After obtaining the training sample data, a neural network model is constructed and trained using the training sample dataset based on a federated learning algorithm. Neural networks have large-scale parallelism, distributed storage and processing, self-organization, self-adaptation, and self-learning capabilities, making them particularly suitable for handling imprecise and fuzzy information processing problems that require simultaneous consideration of many factors and conditions. The specific neural network model can be selected according to the specific circumstances, such as feedforward neural networks (FFNN) or back propagation neural networks (BP). After training, the applicable parameters of the model are obtained, and the trained model is called the account recognition model. Then, based on the account recognition model, abnormal bank accounts are identified from the bank-side user business behavior data to be identified, and illegal accounts are determined. The results are then used for the timely handling of illegal activities.

[0054] This embodiment utilizes federated learning to train and expand the data sources from both parties, establishing an account identification model. The resulting model has a wider coverage, making the identification results more accurate. Furthermore, the model can be updated again when the data from both parties is updated, solving the problem of limited coverage in existing technologies. By comparing communication data and banking business data, the legitimacy of transactions is identified, improving the accuracy and efficiency of identifying abnormal bank accounts while ensuring user privacy and data security. Illegal bank cards can be blocked in a timely manner to avoid financial losses.

[0055] Furthermore, the method also includes:

[0056] Users are tagged based on their historical business data to determine whether they have violated regulations. The tagged results are divided into non-violation accounts and suspected violation accounts.

[0057] Obtaining user business behavior data is the data preparation for building the subsequent classification model. Fraud must be marked based on historical business data. The marking results are divided into two types (0: non-violation account, 1: suspected violation account).

[0058] Furthermore, the user mobile network signaling data includes user identity information, mobile phone number information, online time period, active city, communication trajectory and communication characteristic indicators. The communication characteristic indicators include at least one of the following: corresponding IMSI number, corresponding IMEI number, corresponding terminal type number, traffic type number and broadband traffic type percentage.

[0059] The user business behavior data includes user identity information, mobile phone number information, transaction time, activity city, transaction location, bank account, IP, amount, and account tags;

[0060] Before matching user mobile network signaling data and user service behavior data based on user identity information, the process also includes:

[0061] The mean and standard deviation of the communication characteristic indicators in the user mobile network signaling data are calculated and normalized.

[0062] User identity information and mobile phone number information in user mobile network signaling data and user service behavior data are encrypted using the same national cryptographic algorithm.

[0063] Telecommunications operators collect user mobile signaling data, including indicators such as user mobile phone number, IMSI, IMEI, terminal type, current province, current city, current cell number, traffic type, online duration, start time, and end time. This data is used to assist in identifying bank card transaction behavior, and the original data needs to be preprocessed. Based on the collected information, the following can be obtained: user identity information, mobile phone number information, online time period, active city, communication trajectory, and communication characteristic indicators. Communication characteristic indicators may include one or more of the following: corresponding IMSI count, corresponding IMEI count, corresponding terminal type count, traffic type count, and broadband traffic type percentage. After data collection, the data is structured as shown in Table 1 below, constructing dataset A.

[0064] Table 1 - Statistical Information and Data Structure of User Mobile Signaling Data

[0065]

[0066] The bank collects user business behavior data, including metrics such as user mobile phone number, bank account number, IP address, transaction time, and amount, as well as extracted and labeled account tags (0: non-violation account, 1: suspected violation account). Dataset B is constructed, with the following data structure:

[0067] Table 2 - Data Structure of Customer Business Behavior

[0068]

[0069] To ensure that all features in the training data of the input model have zero mean and variance of the same order, the dataset A of mobile signaling data from telecom operators is normalized. For communication feature indicators, the mean and standard deviation of each indicator for all numbers are calculated. Taking the number of cells spanned as an example: Cell_cnt avg =∑(cell_cnt1+…cell_cnt n ) / n, where n is the size of the sample data in dataset A, Cell_cnt Standarddeviation =sqrt(((cell_cnt1-Cell_cnt avg ) 2 +(cell_cnt2-Cell_cnt avg ) 2 +......( cell_cnt n -Cell_cnt avg ) 2 Then, the feature index is normalized using the following formula: (Cell_cnt - Cell_cnt) / (n-1). avg ) / ( Cell_cnt StandarddeviationAfter normalization, the user identity information and mobile phone number information in datasets A and B are encrypted using the same national cryptographic algorithm. Before encryption, the data is stored separately on the operator's side and the bank's side. The national cryptographic algorithm used is the SM2 (256-bit elliptic curve) encryption algorithm, which has high cryptographic complexity, fast processing speed, and lower machine performance consumption. After encryption, the operator's dataset A' and the bank's dataset B' are uploaded to the coordinating node. Subsequent model training is performed on the coordinating node. Uploading the encrypted dataset after encrypting user attribute information ensures data security and prevents user privacy leaks.

[0070] Furthermore, the matching of user mobile network signaling data and user service behavior data based on user identity information includes:

[0071] The encrypted user identity information in the user's mobile network signaling data is matched with the encrypted user identity information in the user's business behavior data. For each successfully matched user, a feature value is generated as the identifier of the successfully matched user, and the feature value of each successfully matched user is different.

[0072] First, matching is performed based on user ID card information. Since the encryption algorithm is the same, users with the same ID card information in both datasets can be successfully matched. If a match is successful, a feature value Q is generated as the identifier of the successfully matched user. The Q value is different for each successfully matched user. Then, relevant information is extracted from the matched users and processed in the third step. That is: operator user ID card information sample A={user1, user2, ..., usern}; encrypted using SM4: SM4(A)={SM4(user1), SM4(user2), ..., SM4(usern); bank B={b_user1, b_user2, ..., b_usern}; encrypted using SM4: SM4(B)={SM4(b_user1), SM4(b_user2), ..., SM4(b_userk)}; if there exists SM4(user i)= SM4(user j) i∈(1,n); j∈(1,k), then the match is successful, and Q is generated, Q=Q(SM4(useri)). Each generated feature value represents a user, and the feature value can be mapped to the corresponding data information of that user in the database of both parties.

[0073] For each successfully matched user, relevant information is extracted from their mobile network signaling data and service behavior data for data comparison processing, including:

[0074] Set time-based authentication, cross-regional transactions, and transaction trajectory compliance features;

[0075] For each successfully matched user, the transaction time is compared with the online time period, the active city with the active city, and the transaction location with the communication trajectory. Based on the comparison results, the time authentication, cross-regional transaction and transaction trajectory conformity features are labeled to obtain their respective feature values.

[0076] The method further includes:

[0077] Add time authentication, cross-regional transactions, and transaction trajectory compliance feature values ​​to the training sample dataset; and,

[0078] The training sample dataset is processed into {(x1, y1), (x2, y2), ..., (x... i y i ), ..., (x w y w In the form of )}

[0079] Where x i y represents the set of parameters for the i-th user, including user characteristics, mobile phone number, bank account number, IP address, transaction amount, transaction time, time authentication characteristics, cross-regional transaction characteristics, transaction trajectory compliance characteristics, and various communication characteristic indicators; i Let i be a label indicating whether the i-th user has violated the rules.

[0080] We define time-based authentication, cross-regional transactions, and transaction trajectory compliance features to characterize the rationality of bank transaction information and improve model training performance. During annotation, if City_use∈City, then long_distance=1 for cross-regional transactions; otherwise, long_distance=0. If SQ_Bank∈Trace, then pass_by=1 for transaction trajectory compliance; otherwise, pass_by=0. If Serv_cnt∈Time, then time-based authentication DTS=1; otherwise, DTS=0. The training sample dataset is shown in Table 3 below.

[0081] Table 3 - Training Sample Dataset Structure

[0082]

[0083] Then the training sample dataset is processed, and the aligned dataset can now be viewed as C = {(x1, y1), (x2, y2), ..., (x...} w y w )},x i ={ID,Number,bank_acc,sery_cnt,…,Acc_cnt},y i Let i be a label, where 0 represents a non-blacklisted account and 1 represents a suspected violation account, i∈(1,w).

[0084] Furthermore, the neural network model is a backpropagation (BP) neural network model, including an input layer, a hidden layer, and an output layer, wherein the input layer is x from the training sample dataset. i The parameters are set, and the output is y. i The label values, as well as the added cross-regional transactions and abnormal information, are used. The activation functions of the hidden layer and the output layer use the Sigmoid function, and the termination condition for recursion is set to be that the error is less than the set threshold.

[0085] A backpropagation (BP) neural network model is constructed. The BP neural network model has a three-layer structure: an input layer, hidden layers, and an output layer. The constructed model can be as follows: Figure 2 As shown. For existing samples, the input layer consists of various parameter indicators, and the output layer consists of labels (violations), cross-regional transactions, and abnormal information (inconsistent transaction trajectories, failed time authentication). The weights from the input layer to the hidden layer are denoted as v. ih The threshold of the h-th neuron in the hidden layer is set to γ. h The weights from the hidden layer to the output layer are set to w. hj The threshold of the j-th neuron in the output layer is θ j This indicates that the input of the j-th neuron in the output layer is represented by β. j It indicates. In Figure 2 In the given information, there are d input neurons, q hidden neurons, and a threshold with q hidden neurons. l There are 1 output neuron, therefore there are l Threshold for each output neuron.

[0086] Where b in the βj formula h =f(α h -γ h The activation functions for both the hidden and output layers use the Sigmoid function. Suppose that in a certain training example (x... k y k In this context, we assume the training output of the neural network is... , The prediction error is By adjusting the value of the calculation parameter (d+l+1)q+l, the size can be further reduced. , making The reduction is less than the threshold .

[0087] The training process for BP neural network models is now quite mature, and existing techniques can be referenced during training. Once the error falls below a set threshold, the model training is considered complete, resulting in an account recognition model; this model is then sent to both the operator and bank nodes.

[0088] In another embodiment of this disclosure, XGBoost can also be used for local model construction based on federated learning, and the construction process is as follows: Figure 3 As shown, it includes: S1: Initializing the predicted value for each sample i; S2: Calculating the loss function. l For each sample prediction value, take the derivative; S3: Build a new tree k based on the derivative information; S4: Accumulate the scores of each feature in the first to k trees; S5: Iterate through and build new trees until the reduction in the loss function is less than the threshold or the maximum number of iterations is reached; that is, by adding a tree each time, a new function is learned to fit the error of the previous prediction. Assuming that the model training results in K trees, each feature corresponds to K leaf nodes in the K trees, and each leaf node corresponds to a score. The sum of the scores corresponding to each tree is the predicted value y of the sample. pre The binary classification y is processed by the sigmoid function and then compared with a threshold to output the corresponding y. i .

[0089] The objective function of the model is Obj= Suppose for the th i Whether a sample is an abnormal predicted value = ,in K Indicates the number of trees. Indicates sample features, Represents the k-th tree pair of samples The final result is obtained by summing all the prediction results. Combine with actual labels Perform loss function l The model is constructed using mean squared error. This represents the regularization term, defines the complexity, and aims to obtain a model with lower complexity. By calculating the loss function of the current tree, the tree with the largest decrease in loss function is selected as the shape of the current tree, until the reduction in loss function is less than a threshold. The loss is uploaded to the coordinating node using secure encryption by both the operator and the bank. The coordinating node then calculates and updates the model based on the encrypted parameters and returns the updated model to both nodes for local model updates.

[0090] Furthermore, the method also includes:

[0091] Based on the account identification model, the mobile network signaling data of the operator-side user to be identified is used to identify the mobile phone numbers corresponding to abnormal bank accounts, and suspected SIM card sales information is identified.

[0092] By sending the account identification model to the operator, suspected SIM card sales information can be identified at the operator's side, cutting off the industrial chain of illegal accounts.

[0093] Furthermore, the method also includes:

[0094] The user attribute information of the violating accounts is encrypted using a preset encryption algorithm and stored in the abnormal account database;

[0095] Receives abnormal bank account inquiry requests from external users, including encrypted user attribute information.

[0096] The encrypted user attribute information in the query request is compared with the corresponding encrypted data in the abnormal account database to identify whether the external user is involved in any violations, and the identification result is returned to the external user.

[0097] By regularly updating the account identification model and periodically identifying users who violate regulations, the database of abnormal users can be enriched; and the local abnormal user database can be exported to provide enterprise customers with more accurate identification of accounts that violate regulations.

[0098] This disclosed embodiment constructs a model based on basic user behavior data from the telecommunications industry and business data from the banking side. It expands the data sources of both parties through vertical federated learning, models abnormal bank card data, analyzes user communication trajectories and bank card transaction locations, generates an abnormal account database, and promptly blocks abnormal bank cards to avoid financial losses.

[0099] Figure 4 This is an architecture diagram of an abnormal bank account identification system provided in Embodiment 2 of this disclosure, as follows: Figure 4 As shown, it includes:

[0100] The acquisition module 11 is configured to acquire mobile network signaling data of users on the operator side and user business behavior data on the bank side, respectively. The user business behavior data includes a tag indicating whether the user has violated regulations.

[0101] The data processing module 12 is configured to match user mobile network signaling data and user service behavior data based on user identity information. For each successfully matched user, relevant information is extracted from their mobile network signaling data and service behavior data for data comparison processing. The user mobile network signaling data and user service behavior data after comparison processing are merged into a training sample dataset.

[0102] Training module 13 is configured to construct a neural network model and train the neural network model using the training sample dataset based on a federated learning algorithm to obtain an account recognition model;

[0103] The identification module 14 is configured to identify abnormal bank accounts based on the account identification model and determine the non-compliant accounts from the bank-side user business behavior data to be identified.

[0104] Furthermore, the acquisition module 11 is also configured to mark whether a user has violated regulations based on the user's historical business data, and the label results are divided into non-violation accounts and suspected violation accounts.

[0105] Furthermore, the user mobile network signaling data includes user identity information, mobile phone number information, online time period, active city, communication trajectory and communication characteristic indicators. The communication characteristic indicators include at least one of the following: corresponding IMSI number, corresponding IMEI number, corresponding terminal type number, traffic type number and broadband traffic type percentage.

[0106] The user business behavior data includes user identity information, mobile phone number information, transaction time, activity city, transaction location, bank account, IP, amount, and account tags;

[0107] The data processing module 12 includes:

[0108] The normalization unit is configured to calculate the mean value and standard deviation of the communication characteristic indicators in the user mobile network signaling data, and then perform normalization processing.

[0109] The encryption unit is configured to encrypt user identity information and mobile phone number information in user mobile network signaling data and user service behavior data respectively using the same national cryptographic algorithm.

[0110] Furthermore, the data processing module 12 also includes:

[0111] The matching unit is configured to match the encrypted user identity information in the user's mobile network signaling data with the encrypted user identity information in the user's service behavior data. For each successfully matched user, a feature value is generated as the identifier of the successfully matched user, and the feature value is different for each successfully matched user.

[0112] Furthermore, the data processing module 12 also includes:

[0113] The unit is configured to set time authentication, cross-regional transactions, and transaction trajectory compliance features.

[0114] The annotation unit is set up to compare the transaction time with the online time period, the active city with the active city, the transaction location with the communication trajectory for each successfully matched user corresponding to the feature value, and to annotate the time authentication, cross-regional transaction and transaction trajectory conformity features according to the comparison results to obtain their respective feature values.

[0115] The processing unit is configured to add time authentication, cross-regional transaction, and transaction trajectory compliance feature values ​​to the training sample dataset; and,

[0116] The training sample dataset is processed into {(x1, y1), (x2, y2), ..., (x... i y i )...,(x w y w In the form of )}

[0117] Where x i y represents the set of parameters for the i-th user, including user characteristics, mobile phone number, bank account number, IP address, transaction amount, transaction time, time authentication characteristics, cross-regional transaction characteristics, transaction trajectory compliance characteristics, and various communication characteristic indicators; i Let i be a label indicating whether the i-th user has violated the rules.

[0118] Furthermore, the neural network model is a backpropagation (BP) neural network model, including an input layer, a hidden layer, and an output layer, wherein the input layer is x from the training sample dataset. i The parameters are set, and the output is y. i The label values, as well as the added cross-regional transactions and abnormal information, are used. The activation functions of the hidden layer and the output layer use the Sigmoid function, and the termination condition for recursion is set to be that the error is less than the set threshold.

[0119] Furthermore, the identification module 14 is also configured as follows:

[0120] Based on the account identification model, the mobile network signaling data of the operator-side user to be identified is used to identify the mobile phone numbers corresponding to abnormal bank accounts, and suspected SIM card sales information is identified.

[0121] The abnormal bank account identification system of this disclosure is used to implement the abnormal bank account identification method in Method Embodiment 1, so the description is relatively simple. For details, please refer to the relevant description in Method Embodiment 1 above, which will not be repeated here.

[0122] In addition, such as Figure 5 As shown, Embodiment 3 of this disclosure also provides an electronic device, including a memory 10 and a processor 20. The memory 10 stores a computer program. When the processor 20 runs the computer program stored in the memory 10, the processor 20 executes the various possible methods described above.

[0123] The memory 10 is connected to the processor 20. The memory 10 can be a flash memory, a read-only memory, or another type of memory. The processor 20 can be a central processing unit or a microcontroller.

[0124] Furthermore, embodiments of this disclosure also provide a computer-readable storage medium storing a computer program, which is executed by a processor using the various possible methods described above.

[0125] The computer-readable storage medium includes volatile or non-volatile, removable or non-removable media implemented in any method or technology for storing information, such as computer-readable instructions, data structures, computer program modules or other data. Computer-readable storage media include, but are not limited to, RAM (Random Access Memory), ROM (Read-Only Memory), EEPROM (Electrically Erasable Programmable Read-Only Memory), flash memory or other memory technologies, CD-ROM (Compact Disc Read-Only Memory), DVD or other optical disc storage, cartridges, magnetic tapes, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and is accessible to a computer.

[0126] It is understood that the above embodiments are merely exemplary embodiments used to illustrate the principles of this disclosure, and this disclosure is not limited thereto. For those skilled in the art, various modifications and improvements can be made without departing from the spirit and substance of this disclosure, and these modifications and improvements are also considered to be within the scope of protection of this disclosure.

Claims

1. A method for identifying irregular bank accounts, characterized in that, The method includes: The operator-side user mobile network signaling data and the bank-side user business behavior data are acquired respectively, and the user business behavior data includes whether the user has violated regulations. Based on user identity information, user mobile network signaling data and user business behavior data are matched. For each successfully matched user, relevant information is extracted from their mobile network signaling data and business behavior data for data comparison processing. The user mobile network signaling data and user business behavior data after comparison processing are merged into a training sample dataset. Specifically, for the matched data, which includes the user mobile network signaling data and user business behavior data of the same user, some feature indicators in these two types of data are compared to identify abnormal situations in bank account transactions and the abnormal situations are marked. Then, the successfully matched user mobile network signaling data, user business behavior data and abnormal situation marked data are merged into a training sample dataset. A neural network model is constructed, and the neural network model is trained using the training sample dataset based on the federated learning algorithm to obtain an account recognition model; Based on the account recognition model, abnormal bank accounts are identified from the bank-side user business behavior data to be identified, and non-compliant accounts are determined. For each successfully matched user, relevant information is extracted from their mobile network signaling data and service behavior data for data comparison processing, including: Set time-based authentication, cross-regional transactions, and transaction trajectory compliance features; For each successfully matched user, the transaction time is compared with the online time period, the active city with the active city, and the transaction location with the communication trajectory. Based on the comparison results, the time authentication, cross-regional transaction and transaction trajectory conformity features are labeled to obtain their respective feature values. The method further includes: Add time authentication, cross-regional transactions, and transaction trajectory compliance feature values ​​to the training sample dataset; and, The training sample dataset is processed into {(x1, y1), (x2, y2), ..., (x... i y i ), ..., (x w y w In the form of )} Where x i y represents the set of parameters for the i-th user, including user characteristics, mobile phone number, bank account number, IP address, transaction amount, transaction time, time authentication characteristics, cross-regional transaction characteristics, transaction trajectory compliance characteristics, and various communication characteristic indicators; i Let represent the label for whether the i-th user has violated the rules, where 0 indicates a non-violation account and 1 indicates a suspected violation account.

2. The method according to claim 1, characterized in that, The method further includes: Users are tagged based on their historical business data to determine whether they have violated regulations. The tagged results are divided into non-violation accounts and suspected violation accounts.

3. The method according to claim 1, characterized in that, The user mobile network signaling data includes user identity information, mobile phone number information, online time period, active city, communication trajectory and communication characteristic indicators. The communication characteristic indicators include at least one of the following: corresponding IMSI number, corresponding IMEI number, corresponding terminal type number, traffic type number and broadband traffic type percentage. The user business behavior data includes user identity information, mobile phone number information, transaction time, activity city, transaction location, bank account, IP, amount, and account tags; Before matching user mobile network signaling data and user service behavior data based on user identity information, the process also includes: The mean and standard deviation of the communication characteristic indicators in the user mobile network signaling data are calculated and normalized. User identity information and mobile phone number information in user mobile network signaling data and user service behavior data are encrypted using the same national cryptographic algorithm.

4. The method according to claim 3, characterized in that, The matching of user mobile network signaling data and user service behavior data based on user identity information includes: The encrypted user identity information in the user's mobile network signaling data is matched with the encrypted user identity information in the user's business behavior data. For each successfully matched user, a feature value is generated as the identifier of the successfully matched user, and the feature value of each successfully matched user is different.

5. The method according to claim 1, characterized in that, The neural network model is a backpropagation (BP) neural network model, including an input layer, a hidden layer, and an output layer, wherein the input layer is x from the training sample dataset. i The parameters are set, and the output is y. i The label values, as well as the added cross-regional transactions and abnormal information, are used. The activation functions of the hidden layer and the output layer use the Sigmoid function, and the termination condition for recursion is set to be that the error is less than the set threshold.

6. The method according to claim 1, characterized in that, The method further includes: Based on the account identification model, the mobile network signaling data of the operator-side user to be identified is used to identify the mobile phone numbers corresponding to abnormal bank accounts, and suspected SIM card sales information is identified.

7. A system for identifying irregular bank accounts, characterized in that, include: The acquisition module is configured to acquire mobile network signaling data of users on the operator side and user business behavior data on the bank side, respectively. The user business behavior data includes a tag indicating whether the user has violated regulations. The data processing module is configured to match user mobile network signaling data and user business behavior data based on user identity information. For each successfully matched user, relevant information is extracted from their mobile network signaling data and business behavior data for data comparison processing. The user mobile network signaling data and user business behavior data after comparison processing are then merged into a training sample dataset. Specifically, for the matched data, which includes the user mobile network signaling data and user business behavior data of the same user, some feature indicators in these two types of data are compared to identify abnormal situations in bank account transactions, and the abnormal situations are marked. Then, the successfully matched user mobile network signaling data, user business behavior data, and abnormal situation marked data are merged into a training sample dataset. The training module is configured to build a neural network model and train the neural network model using the training sample dataset based on a federated learning algorithm to obtain an account recognition model. The identification module is configured to identify abnormal bank accounts based on the account identification model and determine the non-compliant accounts from the bank-side user business behavior data to be identified. The data processing module includes: The unit is configured to set time authentication, cross-regional transactions, and transaction trajectory compliance features. The annotation unit is set up to compare the transaction time with the online time period, the active city with the active city, the transaction location with the communication trajectory for each successfully matched user corresponding to the feature value, and to annotate the time authentication, cross-regional transaction and transaction trajectory conformity features according to the comparison results to obtain their respective feature values. The processing unit is configured to add time authentication, cross-regional transaction, and transaction trajectory compliance feature values ​​to the training sample dataset; and, The training sample dataset is processed into {(x1, y1), (x2, y2), ..., (x... i y i )...,(x w y w In the form of )} Where x i y represents the set of parameters for the i-th user, including user characteristics, mobile phone number, bank account number, IP address, transaction amount, transaction time, time authentication characteristics, cross-regional transaction characteristics, transaction trajectory compliance characteristics, and various communication characteristic indicators; i Let represent the label for whether the i-th user has violated the rules, where 0 indicates a non-violation account and 1 indicates a suspected violation account.

8. An electronic device, characterized in that, The device includes a memory and a processor, wherein the memory stores a computer program, and when the processor runs the computer program stored in the memory, the processor performs the abnormal bank account identification method as described in any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the abnormal bank account identification method as described in any one of claims 1-6.

Images