A method, system and device for detecting corporate economic crimes

Abstract

The present application provides a method, system and device for detecting corporate economic crimes, which relates to the field of information processing technology, can effectively improve the efficiency and accuracy of detecting corporate economic crimes, and meet the diversified needs of existing corporate economic crime detection. The method includes: obtaining first multi-dimensional data of the target enterprise; based on a pre-built integral model, determining the integral item corresponding to each dimensional data in the first multi-dimensional data, and calculating the suspicious score of the target enterprise through the determined integral item, and the suspicious score is used to determine whether the target enterprise is suspected of economic crimes; when the target enterprise is suspected of economic crimes, obtaining second multi-dimensional data of the target enterprise; and determining the type of economic crime of the target enterprise based on the first multi-dimensional data and the second multi-dimensional data.

Description

Technical Field

[0001] The present application relates to the field of information processing technology, and in particular to a method, system and equipment for detecting corporate economic crimes. Background Art

[0002] Economic investigation technology refers to the process of analyzing corporate operation information to infer whether related companies are suspected of economic crimes such as money laundering, illegal fundraising, etc., providing a forward-looking perspective for solving economic crime cases, thereby protecting the property safety of the country and citizens.

[0003] With the development of the Internet economy, economic crimes are becoming more rampant, and the importance of economic investigation is becoming more and more important. However, the existing economic investigation technology mainly determines whether the target enterprise is a shell enterprise based on information such as the registered address and social security purchase status. The judgment of crime type is single and the accuracy rate is low, which cannot meet the diversified needs and accuracy requirements of existing corporate economic crime investigation. Summary of the invention

[0004] The embodiments of the present application provide a method, system and device for corporate economic crime investigation, which can effectively improve the efficiency and accuracy of corporate economic crime investigation and meet the diversified needs of existing corporate economic crime investigation.

[0005] In a first aspect, the present application provides a method for investigating corporate economic crimes, comprising: obtaining first multi-dimensional data of a target enterprise; determining, based on a pre-built integral model, the integral items corresponding to each dimensional data in the first multi-dimensional data, and calculating the suspicious score of the target enterprise through the determined integral items, wherein the suspicious score is used to determine whether the target enterprise is suspected of an economic crime; when the target enterprise is suspected of an economic crime, obtaining second multi-dimensional data of the target enterprise; and determining the type of economic crime of the target enterprise based on the first multi-dimensional data and the second multi-dimensional data.

[0006] The embodiment of the present application determines the integral item corresponding to the first dimension data through an integral model to calculate the suspicious score of the target enterprise, thereby screening out the target enterprises suspected of economic crimes, reducing the objects of corporate economic crime investigation, and improving the efficiency of corporate economic crime investigation. The target enterprises suspected of economic crimes are further confirmed and classified through the second dimension data, thereby improving the accuracy of corporate economic crime investigation, and the types of corporate economic crimes are subdivided to meet the diversified needs of existing corporate economic crime investigations.

[0007] Exemplarily, determining the economic crime type of the target enterprise according to the first multi-dimensional data and the second multi-dimensional data includes:

[0008] Reconstructing the first multi-dimensional data and the second multi-dimensional data to generate a heterogeneous graph of the target enterprise, wherein the heterogeneous graph includes node information and edge information;

[0009] Based on the heterogeneous graph node classification model, determining the node prediction value corresponding to the edge relationship between each node through the node information and the edge information;

[0010] According to the node prediction value, a node label of the corresponding node is determined, and according to the node label, the economic crime type of the target enterprise is determined.

[0011] Exemplarily, the heterogeneous graph-based node classification model uses the node information and the edge information to:

[0012] In a second aspect, the present application provides a corporate economic crime investigation system, comprising:

[0013] A first multi-dimensional data acquisition unit, used to acquire first multi-dimensional data of a target enterprise;

[0014] an integral item determining unit, configured to determine an integral item corresponding to each dimensional data in the first multi-dimensional data;

[0015] a suspicious score calculation unit, configured to determine, based on a pre-built integral model, an integral item corresponding to each dimensional data in the first multi-dimensional data, and calculate a suspicious score of the target enterprise through the determined integral item, wherein the suspicious score is used to determine whether the target enterprise is suspected of economic crime;

[0016] A second multi-dimensional data acquisition unit, used for acquiring second multi-dimensional data of the target enterprise when the target enterprise is suspected of economic crime;

[0017] An economic crime classification determination unit is used to determine the economic crime type of the target enterprise based on the first multi-dimensional data and the second multi-dimensional data.

[0018] Specifically, the economic crime classification determination unit includes:

[0019] A heterogeneous graph generation subunit, configured to reconstruct the first multi-dimensional data and the second multi-dimensional data to generate a heterogeneous graph of the target enterprise, wherein the heterogeneous graph includes node information and edge information;

[0020] A node prediction value determination subunit, used to determine the node prediction value corresponding to the edge relationship between each node through the node information and the edge information based on the heterogeneous graph node classification model;

[0021] The economic crime classification determination subunit is used to determine the node label of the corresponding node according to the node prediction value, and determine the economic crime type of the target enterprise according to the node label

[0022] In a third aspect, the present application provides an enterprise economic crime investigation device, comprising a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, it implements the method described in the first aspect or any optional method of the first aspect.

[0023] In a fourth aspect, the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method described in the first aspect or any optional method of the first aspect is implemented.

[0024] In a fifth aspect, an embodiment of the present application provides a computer program product, which, when executed on an enterprise economic crime investigation device, enables the enterprise economic crime investigation device to execute the steps of the enterprise economic crime investigation method described in the first aspect above.

[0025] It can be understood that the beneficial effects of the second to fifth aspects mentioned above can be found in the relevant description of the first aspect mentioned above, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0027] Figure 1 It is a flow chart of a method for detecting corporate economic crimes provided by an embodiment of the present application;

[0028] Figure 2 It is a flowchart of a method for determining the type of economic crime of a target enterprise provided in an embodiment of the present application;

[0029] Figure 3 is an image schematic diagram of a heterogeneous graph provided in an embodiment of the present application;

[0030] Figure 4 It is a structural diagram of an enterprise economic crime investigation system provided by an embodiment of the present application;

[0031] Figure 5 It is a structural schematic diagram of an enterprise economic crime investigation device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0032] In the following description, specific details such as specific system structures, technologies, etc. are provided for the purpose of illustration rather than limitation, so as to provide a thorough understanding of the embodiments of the present application. However, it should be clear to those skilled in the art that the present application may also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to prevent unnecessary details from obstructing the description of the present application.

[0033] It should be understood that the term "and / or" used in the specification of this application and the appended claims refers to any combination of one or more of the associated listed items and all possible combinations, and includes these combinations. In addition, in the description of the specification of this application and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0034] It should also be understood that references to "one embodiment" or "some embodiments" etc. described in the specification of the present application mean that one or more embodiments of the present application include specific features, structures or characteristics described in conjunction with the embodiment. Thus, the statements "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. that appear in different places in the specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in other ways.

[0035] In the existing corporate economic crime investigation methods, when only single-dimensional data such as address and social security are used for economic investigation, the accuracy of economic crime investigation cannot be guaranteed, and the crime types obtained are single. When combining individual behavior and corporate behavior for corporate economic crime investigation, it is necessary to manually construct the behavioral characteristics of economic crimes, which is inefficient and cannot guarantee the accuracy of economic crime investigation. In addition, due to the privacy of data, it is impossible to obtain the privacy information of a large number of companies. Economic crime investigation methods based on the assumption that the privacy information of a large number of companies can be directly obtained are often difficult to implement.

[0036] See also Figure 1 , Figure 1 This is a flow chart of a method for detecting corporate economic crimes provided by an embodiment of the present application, which is described in detail as follows:

[0037] Step S101, obtaining first multi-dimensional data of a target enterprise.

[0038] In the embodiments of the present application, in order to avoid the low accuracy and single crime type caused by using single dimensional data such as address, social security, etc. to investigate economic crimes of enterprises, multi-dimensional data is obtained, and then economic crimes of enterprises are investigated based on the obtained multi-dimensional data. This can effectively improve the accuracy of economic crime investigation of enterprises and better classify the economic crimes of enterprises.

[0039] In some embodiments of the present application, the first multi-dimensional data includes, but is not limited to, whether the enterprise contains personnel with a criminal record of economic crimes, the attendance rate of core personnel, the activity track of core personnel, public information of the enterprise, and whether the company personnel's companions contain personnel with a criminal record of economic crimes, and each dimension of data corresponds to at least one integral item. The integral item corresponding to each dimension of data can be obtained through business logic analysis, data set testing, debugging, and inspection.

[0040] It should also be noted that the first dimension data is enterprise-related data that does not involve deep privacy or sensitive information, and can be obtained from data such as enterprise public information and enterprise-related information captured by web crawlers.

[0041] It should also be noted that the target enterprise is one or more enterprises that need to be investigated for economic crimes.

[0042] Step S102, based on the pre-built integral model, determine the integral item corresponding to each dimensional data in the above-mentioned first multi-dimensional data, and calculate the suspicious score of the above-mentioned target enterprise through the determined integral item, and the above-mentioned suspicious score is used to determine whether the above-mentioned target enterprise is suspected of economic crime.

[0043] In an embodiment of the present application, after determining the integral item corresponding to each dimensional data in the first multi-dimensional data, the determined integral item is input into a pre-built integral model, the suspicious score of the target enterprise is calculated, and then based on the result output by the integral model, i.e., the calculated suspicious score of the target enterprise, it is determined whether the target enterprise is suspected of economic crime.

[0044] In practical applications, whether an enterprise contains personnel with a criminal record of economic crimes is to determine whether the personnel of the target enterprise to be investigated contain personnel with a criminal record of economic crimes. The target enterprise personnel can be identified by face recognition through image recognition methods, and matched with the internal criminal files of the public security department to determine whether the target enterprise personnel to be investigated contain personnel with a criminal record of economic crimes. When the enterprise contains personnel with a criminal record of economic crimes, the corresponding integral item is A, and when the enterprise does not contain personnel with a criminal record of economic crimes, the corresponding integral item is B, and A and B have different values. In general, the value of A is greater than the value of B, and B can be zero.

[0045] In practical applications, the attendance rate of core personnel is to determine the attendance rate of core personnel of the target enterprise to be investigated, such as management and above. The attendance rate of core personnel can be counted through company attendance records, or the face recognition of target enterprise personnel can be performed through image recognition methods to record whether the core personnel are on duty, thereby calculating the attendance rate of the core personnel. When determining the integral item corresponding to the attendance rate of core personnel, the range to which the attendance rate belongs can be determined, and then the corresponding integral item can be determined. For example, the integral item corresponding to the attendance rate (0-15%) is C, and the integral item corresponding to the attendance rate (15%-30%) is D. The lower the attendance rate, the higher the value of the corresponding integral item.

[0046] In practical applications, the activity trajectory of core personnel is to determine the activity trajectory of core personnel of the target enterprise to be investigated, such as management and above, and to determine whether the core personnel have approached or entered suspicious places. Suspicious places include but are not limited to: suspected gambling places, enterprises included in the list of dishonest persons, and enterprises with personnel with a criminal record of economic crimes. The activity trajectory of core personnel can be obtained through city-level cameras based on face recognition methods. When the activity trajectory of the core personnel is approaching or entering a suspicious place, the corresponding integral item is E. When the activity trajectory of the core personnel is not approaching or entering a suspicious place, the corresponding integral item is F. The value of E is higher than the value of F, and F can be zero.

[0047] In actual applications, enterprise public information includes but is not limited to public violation information, public opinion risk information, and economic crime-related information automatically detected by natural language processing (NLP) technology, such as whether the company's promotional materials contain financial fraud words, such as guaranteed principal and high interest, etc. When the enterprise public information contains any one or more of the above economic crime-related information, the corresponding integral item is G, or the corresponding integral item is determined according to different information types; when the enterprise public information does not contain the above economic crime-related information, the corresponding integral item is H, which can be zero.

[0048] In practical applications, whether the company personnel's companions include people with a criminal record of economic crimes is to determine whether other people traveling with the target company personnel include people with a criminal record of economic crimes. The facial recognition of the company personnel's companions can be performed through image recognition methods, and matched with the internal criminal files of the public security to determine whether the company personnel's companions to be investigated include people with a criminal record of economic crimes. When the company personnel's companions include people with a criminal record of economic crimes, the corresponding integral item is I, and when the company personnel's companions do not include people with a criminal record of economic crimes, the corresponding integral item is J, and I and J are different values. The value of I is greater than the value of J, and J can be zero.

[0049] It should be noted that when a dimension of data is marked as highly suspicious, the corresponding score item will be marked as highly suspicious. For example, the attendance rate of core personnel is a necessary condition for maintaining the normal operation of the company. The attendance rate will be marked as highly suspicious. For example, the score item corresponding to the attendance rate (0-15%) is recorded as 60 points, and the score item corresponding to the attendance rate (15%-30%) is recorded as 50 points. The existence of public opinion risks in corporate public information is not necessarily related to whether the company is suspected of economic crimes, so the impact of this item on the suspicious score will be smaller.

[0050] In some embodiments of the present application, when constructing a point model, corresponding point rules are set for each dimension of data through business logic and data analysis debugging. For example, the point item corresponding to an enterprise whose core personnel include persons with a criminal record of economic crimes is recorded as 60 points; the point item corresponding to an attendance rate of 0-15% of the core personnel is recorded as 60 points, the point item corresponding to an attendance rate of 15%-30% is recorded as 50 points, and the point item corresponding to an attendance rate of 30%-50% is recorded as 20 points; the point item corresponding to an enterprise whose core personnel's activity trajectory has approached or entered suspicious places is recorded as 20 points; the point item corresponding to an enterprise suspected of economic crimes such as high capital and profit in the company's public information is recorded as 50 points; the point item corresponding to an enterprise whose company personnel's companions include persons with a criminal record of economic crimes is recorded as 50 points; the point item corresponding to an enterprise that has contacted suspicious enterprises (enterprises with high suspicious scores or a history of economic crimes) more than a predetermined number of times within a predetermined time, such as 15 times within a month, is recorded as 30 points, and other points rules are used to construct a point model.

[0051] After the integral model is constructed, the acquired first dimensional data is input into the integral model to determine the integral item corresponding to each dimensional data, and then the suspicious score of the target enterprise can be calculated by the suspicious score calculation formula provided by the integral model. The suspicious score calculation formula is used to add the integral items corresponding to each dimensional data in the first multi-dimensional data, and the added value is the suspicious score of the target enterprise.

[0052] In the embodiment of the present application, based on the above-mentioned integral model, the suspicious score of the above-mentioned target enterprise is calculated according to the determined integral item and the suspicious score calculation formula, wherein the above-mentioned suspicious score calculation formula is:

[0053]

[0054] Among them, y represents the suspicious score; x i represents the i-th dimension data in the first multi-dimensional data; n represents the dimension of the first multi-dimensional data, i∈(1,n), n>1, and n is an integer; ω i Represents x i The corresponding nonlinear parameter is Represents the integral term of the i-th dimension data.

[0055] In a specific embodiment, x i represents the attendance rate of the core personnel of the enterprise, ω i Represents the nonlinear parameter corresponding to the attendance rate of the core personnel of the enterprise, such as attendance rate 0% ≤ x i <15%, then

[0056] Step S103, when the target enterprise is suspected of economic crime, obtaining second multi-dimensional data of the target enterprise.

[0057] In the embodiment of the present application, the second multi-dimensional data includes but is not limited to: whether there is undisclosed violation information and bank flow information.

[0058] In some embodiments of the present application, after calculating the suspicious score of the target enterprise, it is possible to determine whether the target enterprise is suspected of economic crime based on the comparison result of the suspicious score and the predetermined score. The predetermined score is a score point used to determine whether the target enterprise is suspected of economic crime. For example, if the predetermined score is 100 points, when the suspicious score of the target enterprise exceeds 100 points, the target enterprise is determined to be suspected of economic crime; when the suspicious score of the target enterprise does not exceed 100 points, the target enterprise is determined not to be suspected of economic crime.

[0059] In practical applications, determining whether the target enterprise is suspected of economic crimes can provide preparation or evidence for subsequent applications for violation records, bank statements and other deeply sensitive privacy data, namely the second multi-dimensional data. Evidence that the target enterprise is suspected of economic crimes can be provided to public security organs, municipal supervision bureaus, banks and other institutions, and deep privacy information of the target enterprise suspected of economic crimes can be obtained from relevant departments, thereby solving the problem of being unable to obtain sensitive enterprise data, enabling accurate classification of enterprise economic crime types, reducing the amount of data required to be obtained, and improving the efficiency of economic crime investigation.

[0060] Step S104: determining the economic crime type of the target enterprise based on the first multi-dimensional data and the second multi-dimensional data.

[0061] In the embodiment of the present application, by combining the first multi-dimensional data and the second multi-dimensional data for analysis, the economic crime classification result of the target enterprise can be determined quickly and accurately.

[0062] In the embodiment of the present application, the economic crime classification results include the target enterprise being a shell company, the target enterprise being an illegal fund-raising company, the target enterprise being a financial fraud company, etc. Determining the economic crime classification results of the target enterprise is to determine whether the target enterprise is any one or more of a shell company, an illegal fund-raising company, or a financial fraud company.

[0063] See also Figure 2 and Figure 3 , Figure 2 is a flow chart of a method for determining the type of economic crime of a target enterprise provided in an embodiment of the present application. Figure 3 This is a schematic diagram of an isomorphic image provided in an embodiment of the present application; Figure 3 ,right Figure 2 The method provided for determining the type of economic crime committed by the target enterprise is described in detail as follows:

[0064] Step S201: reconstruct the first multi-dimensional data and the second multi-dimensional data to generate a heterogeneous graph of the target enterprise, wherein the heterogeneous graph includes node information and edge information.

[0065] In the embodiment of the present application, the node information is the information of the enterprise node and the personnel node. For the enterprise node, each enterprise is independently called a node, and each enterprise node is accompanied by relevant enterprise characteristics, that is, the data characteristics related to the enterprise in the first multidimensional data and the second multidimensional data, such as the characteristics of the target enterprise's public information containing the words "high capital and profit". For enterprises known to be suspected of economic crimes, node labels are set, and the node labels are shell companies, illegal fund-raising companies, and fraud companies, that is, the node labels correspond to the economic crime types of the enterprises. For personnel nodes, each enterprise personnel is independently called a node, and the personnel nodes are accompanied by relevant personal characteristics, that is, the data characteristics related to individuals in the first multidimensional data and the second multidimensional data, such as the activity tracks and criminal records of core personnel.

[0066] Edge information refers to the information about the edges connecting enterprises, the edges connecting enterprises and individuals, and the edges connecting individuals. The edges connecting enterprises represent the existence of flow transactions between the two enterprises; the edges connecting enterprises and individuals represent the existence of an employment relationship between the enterprises and individuals; and the edges connecting individuals represent the existence of a peer relationship between the two.

[0067] like Figure 3 As shown in the figure, company A is a company suspected of fraud, and its node label is fraud company. There is a flow transaction between company C and company A; Zhang San and Li Si are in an employment relationship with company A; Wang Wu and Li Si are colleagues in a certain period of time, and Wang Wu is in an employment relationship with company B. Company B and company C are companies with unknown labels. It is necessary to analyze the heterogeneous graph to perform information fusion between nodes and find a better information fusion result. According to the information fusion result, determine the type of node label of company B and company C, that is, determine the type of economic crime of company B and company C, that is, in Figure 3In the example, both Enterprise B and Enterprise C are target enterprises, and their corresponding node labels need to be determined, so as to determine the economic crime types of Enterprise B and Enterprise C based on the corresponding node labels.

[0068] In some embodiments of the present application, for the bank statements of an enterprise, multiple economic anomaly indicators can be constructed through business logic, such as the number of low-amount remittances and the total remittance amount in a single month; for the transaction information between enterprises, the name of the counterparty enterprise will be matched with the abnormal enterprise database to obtain abnormal transaction data related to the enterprise.

[0069] Step S202, based on the heterogeneous graph node classification model, the node prediction value corresponding to the edge relationship between each node is determined through the above node information and the above edge information.

[0070] In an embodiment of the present application, a heterogeneous graph node classification model is used to classify nodes in a heterogeneous graph, realize information fusion between heterogeneous nodes, and thereby determine a node prediction value of a corresponding node based on the fusion result.

[0071] In some embodiments of the present application, the heterogeneous graph node classification model is a neural network model based on a relational graph attention neural network model, in which the fusion of information between heterogeneous graph nodes is realized to find a more accurate node aggregation expression, so that the nodes in the heterogeneous graph can be accurately and effectively classified.

[0072] In practical applications, each enterprise node is accompanied by relevant enterprise features, which can be used to construct the feature matrix of the enterprise node through the heterogeneous graph node classification model; each personnel node is accompanied by relevant personal features, which can be used to construct the feature matrix of the personnel node through the heterogeneous graph node classification model.

[0073] In practical applications, edge information includes the edge relationships between nodes. The heterogeneous graph node classification model can be used to learn the edge relationships between nodes and obtain the corresponding parameter matrix. In the learning process, a multi-head attention mechanism is introduced to obtain a more accurate node aggregation expression, thereby obtaining the node prediction value corresponding to the edge relationship between nodes.

[0074] In some embodiments of the present application, the node aggregation expression determined by the heterogeneous graph node classification model determines the node prediction value corresponding to the edge relationship between each node based on the above-mentioned node information and the above-mentioned edge information.

[0075] Specifically, the node aggregation expression is:

[0076] Y r =HW r

[0077] Among them, r represents the edge relationship in the above heterogeneous graph, Y r represents the node prediction value of r in the above heterogeneous graph, H represents the feature matrix of the relevant nodes, and W r Represents the parameter matrix obtained by learning the attention neural network in the above relational graph.

[0078] Step S203, determining the node label of the corresponding node according to the node prediction value, and determining the economic crime type of the target enterprise according to the node label.

[0079] In an embodiment of the present application, after obtaining the node prediction value corresponding to the edge relationship between each node, the node label of the corresponding enterprise node can be determined based on the node prediction value, and thus the economic crime type of the target enterprise can be determined based on the node label.

[0080] In an embodiment of the present application, the integral item corresponding to the first dimensional data is determined through an integral model to calculate the suspicion score of the target enterprise, thereby screening out the target enterprises suspected of economic crimes, reducing the objects of corporate economic crime investigation, and improving the efficiency of corporate economic crime investigation. The target enterprises suspected of economic crimes are further confirmed and classified through the second dimensional data, which improves the accuracy of corporate economic crime investigation, and subdivides the types of corporate economic crimes, meeting the diversified needs of existing corporate economic crime investigations.

[0081] It should be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0082] Based on the corporate economic crime investigation method provided in the above embodiment, the embodiment of the present application further provides an apparatus embodiment for implementing the above method embodiment.

[0083] See also Figure 4 , Figure 4 Schematic diagram of the enterprise economic crime investigation system provided in the embodiment of the present application. The units included are used to execute Figure 1 For details, please refer to the steps in the corresponding embodiment. Figure 1 For the convenience of explanation, only the parts related to this embodiment are shown. Figure 4 , the enterprise economic crime investigation system 4 includes:

[0084] A first multi-dimensional data acquisition unit 41, used to acquire first multi-dimensional data of a target enterprise;

[0085] A suspicious score calculation unit 42 is used to determine the integral item corresponding to each dimensional data in the first multi-dimensional data based on a pre-built integral model, and calculate the suspicious score of the target enterprise through the determined integral item, and the suspicious score is used to determine whether the target enterprise is suspected of economic crime;

[0086] A second multi-dimensional data acquisition unit 43, used for acquiring second multi-dimensional data of the target enterprise when the target enterprise is suspected of economic crime;

[0087] The economic crime classification determination unit 44 is used to determine the economic crime type of the target enterprise according to the first multi-dimensional data and the second multi-dimensional data.

[0088] Specifically, the suspicious score calculation unit 42 is specifically used for:

[0089] Based on the above-mentioned integral model, the suspicious score of the above-mentioned target enterprise is calculated according to the determined integral items and the suspicious score calculation formula, wherein the above-mentioned suspicious score calculation formula is:

[0090]

[0091] Among them, y represents the suspicious score; x i represents the i-th dimension data in the first multi-dimensional data; n represents the dimension of the first multi-dimensional data, i∈(1,n), n>1, and n is an integer; ω i Represents x i The corresponding nonlinear parameter is Represents the integral term of the i-th dimension data.

[0092] Specifically, the economic crime classification determination unit 44 includes:

[0093] A heterogeneous graph generation subunit, configured to reconstruct the first multi-dimensional data and the second multi-dimensional data to generate a heterogeneous graph of the target enterprise, wherein the heterogeneous graph includes node information and edge information;

[0094] A node prediction value determination subunit is used to determine the node prediction value corresponding to the edge relationship between each node based on the heterogeneous graph node classification model through the above node information and the above edge information;

[0095] The economic crime classification determination subunit is used to determine the node label of the corresponding node according to the node prediction value, and determine the economic crime type of the target enterprise according to the node label

[0096] Specifically, the economic crime classification determines sub-units, which are specifically used for:

[0097] The node aggregation expression determined by the heterogeneous graph node classification model determines the node prediction value corresponding to the edge relationship between each node according to the above node information and the above edge information.

[0098] The above node aggregation expression is:

[0099] Y r =HW r

[0100] Among them, r represents the edge relationship in the above heterogeneous graph, Y r represents the node prediction value of r in the above heterogeneous graph, H represents the feature matrix of the relevant nodes, and W r Represents the parameter matrix obtained by learning the attention neural network in the above relational graph.

[0101] The above-mentioned first multi-dimensional data includes: whether the enterprise contains persons with a criminal record of economic crimes, the attendance rate of core personnel, the activity trajectory of core personnel, the enterprise's public information, and whether the company's personnel's companions contain persons with a criminal record of economic crimes. Each dimensional data corresponds to at least one score item.

[0102] The above-mentioned second multi-dimensional data includes: whether there is any undisclosed violation information and bank transaction information.

[0103] The embodiment of the present application determines the integral item corresponding to the first dimension data through an integral model to calculate the suspicious score of the target enterprise, thereby screening out the target enterprises suspected of economic crimes, reducing the objects of corporate economic crime investigation, and improving the efficiency of corporate economic crime investigation. The target enterprises suspected of economic crimes are further confirmed and classified through the second dimension data, thereby improving the accuracy of corporate economic crime investigation, and the types of corporate economic crimes are subdivided to meet the diversified needs of existing corporate economic crime investigations.

[0104] It should be noted that the information interaction, execution process and other contents between the above-mentioned modules are based on the same concept as the method embodiment of the present application. Their specific functions and technical effects can be found in the method embodiment part and will not be repeated here.

[0105] Figure 5 Schematic diagram of the enterprise economic crime investigation device provided by the embodiment of the present application. Figure 5 As shown, the enterprise economic crime investigation device 5 of this embodiment includes: a processor 50, a memory 51, and a computer program 52 stored in the memory 51 and executable on the processor 50, such as a speech recognition program. When the processor 50 executes the computer program 52, the steps in the above-mentioned enterprise economic crime investigation method embodiments are implemented, such as Figure 1Alternatively, when the processor 50 executes the computer program 52, the functions of each module / unit in the above-mentioned device embodiments are implemented, for example Figure 4 The functions of units 41-44 are shown.

[0106] Exemplarily, the computer program 52 may be divided into one or more modules / units, one or more modules / units are stored in the memory 51 and executed by the processor 50 to complete the present application. One or more modules / units may be a series of computer program instruction segments that can complete specific functions, and the instruction segments are used to describe the execution process of the computer program 52 in the enterprise economic crime investigation device 5. For example, the computer program 52 may be divided into a first multi-dimensional data acquisition unit 41, a suspicious score calculation unit 42, a second multi-dimensional data acquisition unit 43, and an economic crime classification determination unit 44. For specific functions of each unit, please refer to Figure 1 The relevant descriptions in the corresponding embodiments are not repeated here.

[0107] The enterprise economic crime investigation device may include, but is not limited to, a processor 50 and a memory 51. Those skilled in the art will appreciate that Figure 5 It is only an example of the enterprise economic crime investigation device 5 and does not constitute a limitation of the enterprise economic crime investigation device 5. It may include more or fewer components than shown in the figure, or a combination of certain components, or different components. For example, the enterprise economic crime investigation device may also include input and output devices, network access devices, buses, etc.

[0108] The processor 50 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.

[0109] The memory 51 may be an internal storage unit of the enterprise economic crime investigation device 5, such as a hard disk or memory of the enterprise economic crime investigation device 5. The memory 51 may also be an external storage device of the enterprise economic crime investigation device 5, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the enterprise economic crime investigation device 5. Further, the memory 51 may also include both an internal storage unit and an external storage device of the enterprise economic crime investigation device 5. The memory 51 is used to store computer programs and other programs and data required by the enterprise economic crime investigation device. The memory 51 may also be used to temporarily store data that has been output or is to be output.

[0110] The embodiment of the present application also provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the above-mentioned corporate economic crime investigation method can be implemented.

[0111] An embodiment of the present application provides a computer program product. When the computer program product is run on an enterprise economic crime investigation device, the enterprise economic crime investigation device can implement the above-mentioned enterprise economic crime investigation method when executing.

[0112] The technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated in a processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0113] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0114] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0115] The embodiments described above are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

Claims

1. A method for investigating corporate economic crimes, characterized in that: The enterprise economic crime detection method comprises: Obtain the first multi-dimensional data of the target enterprise; Based on a pre-built integral model, determine the integral item corresponding to each dimensional data in the first multi-dimensional data, and calculate the suspicious score of the target enterprise through the determined integral item, wherein the suspicious score is used to determine whether the target enterprise is suspected of economic crime; When the target enterprise is suspected of economic crime, obtaining second multi-dimensional data of the target enterprise; Determining the type of economic crime of the target enterprise according to the first multi-dimensional data and the second multi-dimensional data; Wherein, determining the economic crime type of the target enterprise according to the first multi-dimensional data and the second multi-dimensional data includes: Reconstructing the first multi-dimensional data and the second multi-dimensional data to generate a heterogeneous graph of the target enterprise, wherein the heterogeneous graph includes node information and edge information; Based on the heterogeneous graph node classification model, determining the node prediction value corresponding to the edge relationship between each node through the node information and the edge information; Determine a node label of a corresponding node according to the node prediction value, and determine the type of economic crime of the target enterprise according to the node label; The node information includes: information of enterprise nodes and personnel nodes, the enterprise node information includes: data features related to the enterprise in the first multi-dimensional data and the second multi-dimensional data; the personnel node information includes: data features related to the enterprise in the first multi-dimensional data and the second multi-dimensional data; The edge information includes edge relationships between nodes, and the node prediction value corresponding to the edge relationship between nodes is determined based on the heterogeneous graph node classification model through the node information and the edge information, including: Through the heterogeneous graph node classification model, the edge relationship between each node is learned to obtain the corresponding parameter matrix and the feature matrix of each node to obtain the node aggregation expression; Determine, by means of the node aggregation expression, the node prediction value corresponding to the edge relationship between each node according to the node information and the edge information; The step of determining the integral item corresponding to each dimension of the first multi-dimensional data based on the pre-built integral model, and calculating the suspicious score of the target enterprise by using the determined integral item, includes: Based on the integral model, the suspicious score of the target enterprise is calculated according to the determined integral item and the suspicious score calculation formula, wherein the suspicious score calculation formula is used to add the integral item corresponding to each dimensional data in the first multi-dimensional data, and the added value is the suspicious score of the target enterprise; Among them, the first multi-dimensional data includes at least one of the following: whether the enterprise contains persons with a criminal record of economic crimes, the attendance rate of core personnel, the activity trajectory of core personnel, the enterprise's public information, and whether the company's personnel's companions contain persons with a criminal record of economic crimes, and each dimensional data corresponds to at least one score item; the second multi-dimensional data includes at least one of the following: whether there is undisclosed violation information, bank flow information.

2. An enterprise economic crime investigation system, characterized in that: The enterprise economic crime detection system comprises: A first multi-dimensional data acquisition unit, used to acquire first multi-dimensional data of a target enterprise; an integral item determining unit, configured to determine an integral item corresponding to each dimensional data in the first multi-dimensional data; a suspicion score calculation unit, configured to determine, based on a pre-built score model, the score item corresponding to each dimension of the first multi-dimensional data, and calculate the suspicion score of the target enterprise through the determined score item, wherein the suspicion score is used to determine whether the target enterprise is suspected of economic crime; A second multi-dimensional data acquisition unit, used for acquiring second multi-dimensional data of the target enterprise when the target enterprise is suspected of economic crime; an economic crime classification determination unit, configured to determine the economic crime type of the target enterprise based on the first multi-dimensional data and the second multi-dimensional data; Wherein, the economic crime classification determination unit includes: A heterogeneous graph generation subunit, configured to reconstruct the first multi-dimensional data and the second multi-dimensional data to generate a heterogeneous graph of the target enterprise, wherein the heterogeneous graph includes node information and edge information; A node prediction value determination subunit, used to determine the node prediction value corresponding to the edge relationship between each node through the node information and the edge information based on the heterogeneous graph node classification model; An economic crime classification determination subunit, used to determine a node label of a corresponding node according to the node prediction value, and determine the economic crime type of the target enterprise according to the node label; The node information includes: information of enterprise nodes and personnel nodes, the enterprise node information includes: data features related to the enterprise in the first multi-dimensional data and the second multi-dimensional data; the personnel node information includes: data features related to the enterprise in the first multi-dimensional data and the second multi-dimensional data; The edge information includes edge relationships between nodes, and the node prediction value determination subunit is specifically used for: The edge relationship between each node is learned through the heterogeneous graph node classification model to obtain a corresponding parameter matrix and a feature matrix of each node to obtain a node aggregation expression; through the node aggregation expression, according to the node information and the edge information, the node prediction value corresponding to the edge relationship between each node is determined; The suspicious score calculation unit is specifically used to: calculate the suspicious score of the target enterprise based on the integral model, according to the determined integral item and the suspicious score calculation formula, wherein the suspicious score calculation formula is used to add the integral item corresponding to each dimensional data in the first multi-dimensional data, and the added value is the suspicious score of the target enterprise; Among them, the first multi-dimensional data includes at least one of the following: whether the enterprise contains persons with a criminal record of economic crimes, the attendance rate of core personnel, the activity trajectory of core personnel, the enterprise's public information, and whether the company's personnel's companions contain persons with a criminal record of economic crimes, and each dimensional data corresponds to at least one score item; the second multi-dimensional data includes at least one of the following: whether there is undisclosed violation information, bank flow information.

3. An enterprise economic crime investigation device, characterized in that: The method comprises a processor, a memory and a computer program stored in the memory and executable on the processor, wherein the method for detecting corporate economic crimes as claimed in claim 1 is implemented when the processor executes the computer program.

4. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the corporate economic crime investigation method as claimed in claim 1 is implemented.

Images