A method, device and storage medium for rapidly mining suspected related bills based on sliding windows

Abstract

The present invention provides a method, device and readable storage medium for rapidly mining suspected related bills based on a sliding window, including: filtering out the lending or crediting data in multiple bills and sorting them by transaction time; obtaining a lending record set and a crediting record set on the lending group bill set and the crediting group bill set respectively through a sliding time window, and obtaining the transaction records of the lending operation and the transaction records of the crediting operation through two-layer loop traversal; comparing the two groups of transaction records, and recording the transaction records that meet the matching rules into the result set R. This solution is based on the sliding window method, cross-comparing transaction details, and can mine the data of suspected missing counterparties, and can also mine suspicious behaviors of suspected middlemen, while greatly reducing the calculation time and improving the analysis efficiency, providing support for data improvement and fund tracking of bill analysis.

Description

Technical Field

[0001] The present invention relates to the field of bill data processing, and in particular to a method, device and storage medium for rapidly mining suspected associated bills based on a sliding window. Background Art

[0002] The data integrity of bill flow provides strong support for bill analysis. However, in actual situations, the bill flow obtained may have various defects due to various reasons, such as the counterparty of the transfer transaction is empty. The analysis object with anti-detection awareness will use intermediaries to conduct transfer transactions, such as cashing out or accepting bribes. Such situations will not only lead to the loss of key information, but also make it impossible to know the source or destination of the funds, and lose the direction of the next step of research and judgment. At the same time, in some in-depth research and judgment methods such as fund tracking, the analysis will be biased due to incomplete key information or failure to grasp the intermediaries.

[0003] The existing counterparty tagging mainly involves finding counterparties with the same amount and similar time to complete the case where one of the counterparties is empty. This is not systematic enough and cannot be managed centrally. In addition to manual identification, some comparisons using calculations and tables will also have a time complexity of O(n 2 ) is limited by the fact that it can only automatically analyze small amounts of data. When there are more analysis objects, the merged flow may reach tens or even millions, and the performance at this time cannot meet the purpose of fast analysis. Summary of the invention

[0004] In order to solve the problems in the prior art that the counterparty is empty and there is a middleman transaction and the time complexity is high, the following technical solutions are proposed in the embodiments of the present invention:

[0005] A method for quickly mining suspected related bills based on a sliding window, comprising:

[0006] S1: Filter and select the lending or crediting data whose transaction amount is not empty and is non-cash access in multiple bills, and sort them by transaction time to generate a lending group bill set FL and a credit group bill set TL;

[0007] S2: Obtain a set of lending records WFL whose transaction time difference does not exceed the time range T on the set FL through a sliding time window, and mark the earliest time and the latest time; obtain a set of lending records WTL whose transaction time is within the range of the earliest time to the latest time + T on the set TL through a sliding window;

[0008] S3: loop through the set WFL to obtain the transaction record fromRecord of the lending operation; loop through the set WTL to obtain the transaction record toRecord of the lending operation;

[0009] S4: Compare the transaction record fromRecord with the transaction record toRecord, and in response to a matching rule, record the transaction record that meets the matching rule into a result set R.

[0010] Furthermore, when the transaction time of the transaction record toRecord exceeds the transaction time of the transaction record fromRecord and reaches the limit T, the loop traversal of the set WTL is stopped, and the starting index of the set WTL is updated to the index of the current transaction record toRecord.

[0011] Furthermore, the matching rules include: simultaneously satisfying the conditions that the card numbers of the parties are different, the transaction amounts are consistent, the transaction time hours, minutes and seconds are not all 0, the time difference between the previous and next transactions is within the range of T, and the toRecord time is greater than or equal to the fromRecord time.

[0012] Furthermore, the transaction records meeting the matching rule include transaction time, transfer-out record ID and transfer-in record ID.

[0013] Furthermore, the result set R is displayed in the form of a relationship diagram.

[0014] The present invention also proposes a device for quickly mining suspected associated bills based on a sliding window, the device using the mining method as described above, including:

[0015] Data acquisition unit: configured to filter out the lending or crediting data of multiple bills whose transaction amounts are not empty and are non-cash access, and generate a lending group bill set FL and a credit group bill set TL in order of transaction time;

[0016] Sliding window analysis unit: configured to obtain a lending record set WFL whose transaction time difference does not exceed a time range T on the set FL through a sliding time window, and mark the earliest time and the latest time; obtain a lending record set WTL whose transaction time is within the range of the earliest time to the latest time + T on the set TL through a sliding window;

[0017] A loop traversal unit: configured to loop through the set WFL to obtain a transaction record fromRecord of a lending operation; loop through the set WTL to obtain a transaction record toRecord of a lending operation;

[0018] A detection unit: configured to compare the transaction record fromRecord with the transaction record toRecord, and in response to a matching rule, record the transaction record that meets the matching rule into a result set R;

[0019] Update unit: configured to stop looping through the set WTL and update the starting index of the set WTL to the index of the transaction record toRecord of the current lending operation when the transaction time of the transaction record toRecord exceeds the transaction time of the transaction record fromRecord and reaches the limit value T;

[0020] Display unit: configured to display the result set R to the user, and mark it as the original record after the user makes a second confirmation.

[0021] Furthermore, the matching rules executed by the device include: simultaneously satisfying the conditions that the party's card number is different, the transaction amount is consistent, the transaction time hours, minutes and seconds are not all 0, the time difference between the previous and next transactions is within the range of T, and the toRecord time is greater than or equal to the fromRecord time.

[0022] Furthermore, the transaction records meeting the matching rule include transaction time, transfer-out record ID and transfer-in record ID.

[0023] Furthermore, the result set R is displayed in the form of a relationship diagram.

[0024] The present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed, the detection method according to any one of claims 1 to 5 is performed.

[0025] The technical effect of the present invention is as follows: this solution is based on a sliding window approach to cross-check transaction details, which can dig out data of suspected missing counterparties and suspicious behaviors of suspected middlemen, while greatly reducing calculation time and improving analysis efficiency, thus providing support for data improvement of bill analysis and fund tracking. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] The accompanying drawings are included to provide a further understanding of the embodiments and are incorporated into and constitute a part of this specification. The accompanying drawings illustrate the embodiments and are used together with the description to explain the principles of the present invention. It will be easy to recognize other embodiments and many expected advantages of the embodiments because they become better understood by reference to the following detailed description. The elements of the drawings are not necessarily to scale with each other. The same reference numerals refer to corresponding similar parts.

[0027] Figure 1An example diagram showing the results of a method for quickly mining suspected related bills based on a sliding window according to the present invention;

[0028] Figure 2 An example diagram of determining suspected bills based on the results of a method for rapidly mining suspected associated bills based on a sliding window according to the present invention;

[0029] Figure 3 A flowchart of a method for quickly mining suspected associated bills based on a sliding window according to an embodiment of the present invention;

[0030] Figure 4 A structural diagram of a device for quickly mining suspected associated bills based on a sliding window according to an embodiment of the present invention; DETAILED DESCRIPTION

[0031] The present application will be further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the relevant invention, rather than to limit the invention. It should also be noted that, for ease of description, only the parts related to the relevant invention are shown in the accompanying drawings.

[0032] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0033] First, the basic principle of the present invention is introduced, which is helpful for understanding the method of the present invention for quickly mining suspected related bills based on a sliding window.

[0034] For the transaction flow data between multiple analysis objects within a limited range, the sliding window method is used for rapid comparison and analysis to find out that the actual opponent is other analysis objects in the same case, but the transaction counterparty is missing in the data or there are records of intermediary traders.

[0035] All bank records in the same batch are divided into credit and debit, and then compared in two layers. A pair of records that meet the matching rules are saved in the result set. Finally, the suspected related records are intuitively displayed in the form of a relationship diagram. After the user makes a second confirmation, the original record is marked and applied to various analysis applications.

[0036] The specific steps of the bill mining process are as follows:

[0037] There are multiple analysis objects in one case, such as the transaction flows of three cards A, B, and C.

[0038] 1. Filter out the transfer records whose transaction amount is not empty and are non-cash deposits and withdrawals, sort them by transaction time, and define the resulting set as the lending group FL.

[0039] 2. Filter out the transfer records with non-empty transaction amounts and non-cash deposits and withdrawals, sort them by transaction time, and define the resulting set as the credit group TL.

[0040] The data contents of the lending group FL are as follows:

[0041] Serial number Trading Hours Our card number The other party's card number Borrowing Amount 1 2021-01-01 01:11:01 62284800000001 62284800000002 lend 1000 2 2021-01-01 01:21:01 62284800000001 62284800000002 lend 2000 3 2021-01-01 01:31:01 62284800000001 lend 3000 4 2021-01-01 01:41:01 62284800000001 lend 4000 5 2021-01-01 01:51:01 62284800000001 lend 5000 6 2021-01-01 03:11:01 62284800000001 62284800000003 lend 6000 7 2021-01-01 03:21:01 62284800000002 62284800000004 lend 7000 8 2021-01-01 04:31:01 62284800000002 lend 8000

[0042] The TL data content of the loan group is as follows:

[0043] Serial number Trading Hours Our card number The other party's card number Borrowing Amount 11 2021-01-01 01:11:01 62284800000002 62284800000001 Credit 1000 12 2021-01-01 01:21:01 62284800000002 Credit 2000 13 2021-01-01 01:31:01 62284800000002 62284800000001 Credit 3000 14 2021-01-01 01:41:01 62284800000002 Credit 4000 15 2021-01-01 01:51:10 62284800000002 Credit 5000 16 2021-01-01 03:11:01 62284800000002 62284800000003 Credit 6000 17 2021-01-01 03:21:01 62284800000001 62284800000005 Credit 7000 18 2021-01-01 05:31:01 62284800000001 Credit 9000

[0044] The data is described as follows:

[0045] Sequence numbers 1 and 11 are interference data and are normal data;

[0046] Sequence numbers 2 and 12 are abnormal data. The creditor's transaction records do not contain counterparty information. They are actually the same transaction.

[0047] Sequence numbers 3 and 13 are abnormal data. The lending party’s transaction records do not contain counterparty information. They are actually the same transaction.

[0048] Sequence numbers 4 and 14 are abnormal data. They do not have counterparty information, but the transaction time is the same, so they are actually the same transaction.

[0049] Sequence numbers 5 and 15 are abnormal data. There is no counterparty information, and the transaction time difference is 10 seconds. They are actually the same transaction.

[0050] Serial numbers 6 and 16 are suspicious data, using the middleman with the last number 0003 to transfer funds;

[0051] Serial numbers 7 and 17 are abnormal data, using the middleman numbers 0004 and 0005 to transfer funds;

[0052] Sequence numbers 8 and 18, interference data.

[0053] 3. The sliding window of the lending group is defined as a set of records whose transaction time difference with the previous and next transaction records does not exceed the time range T. It is defined as WFL, and records the earliest time startT ime and the latest time endT ime.

[0054] 4. The sliding window of the loan group is defined as the set of records with transaction time starting from the earliest time startT ime to the latest time endT ime + time range T, which is defined as WTL.

[0055] Serial number Lending Group Sliding Window WFL Serial number Credit Group Sliding Window WTL 1 2021-01-01 01:11:01 11 2021-01-01 01:11:01 2 2021-01-01 01:21:01 12 2021-01-01 01:21:01 3 2021-01-01 01:31:01 13 2021-01-01 01:31:01 4 2021-01-01 01:41:01 14 2021-01-01 01:41:01 5 2021-01-01 01:51:01 15 2021-01-01 01:51:10

[0056] 5. The first layer loops through WFL and obtains the transaction record fromRecord of the lending operation.

[0057] 6. The second layer loops through WTL to obtain the transaction record toRecord of the credit operation.

[0058] 7. Compare fromRecord and toRecord, and record the result if the following matching rules are met at the same time:

[0059] Our card numbers are different because there is no transfer between the same card.

[0060] The transaction amount is the same. Because the same transaction amount must be the same.

[0061] The transaction time hours, minutes, and seconds cannot all be 0, such as: 2021-01-01 00:00:00. This is because we want to exclude records where the transaction time is only up to the date.

[0062] The time difference is within a certain range, and the toRecord time is greater than or equal to fromRecord, because the receiving time is later than the sending time.

[0063] 8. For those that meet the matching rules, add the transaction time, transfer-out record ID, and transfer-in record ID to the result set, which is defined as R.

[0064] 9. When the transaction time of toRecord exceeds the transaction time of fromRecord and reaches the limit value T, stop the second-level loop, that is, jump out of the loop of the current WTL collection. And set the starting index of the second-level loop to the current toRecord index to reduce invalid traversal.

[0065] 10. Move the sliding window to obtain new WFL and WTL, and repeat steps 5 to 9

[0066] 11. The analysis results are displayed visually in the form of a relationship diagram of the transaction records that are suspected to be related, and the user will mark the original record after a second confirmation.

[0067] The results are shown as Figure 1 The suspected associated bill judgment result is as follows Figure 2 shown.

[0068] Figure 3 This is a flow chart of a method for quickly mining suspected related bills based on a sliding window according to an embodiment of the present invention. The method comprises:

[0069] S1: Filter and select the lending or crediting data whose transaction amount is not empty and is non-cash access in multiple bills, and sort them by transaction time to generate a lending group bill set FL and a credit group bill set TL;

[0070] S2: Obtain a set of lending records WFL whose transaction time difference does not exceed the time range T on the set FL through a sliding time window, and mark the earliest time and the latest time; obtain a set of lending records WTL whose transaction time is within the range of the earliest time to the latest time + T on the set TL through a sliding window;

[0071] S3: loop through the set WFL to obtain the transaction record fromRecord of the lending operation; loop through the set WTL to obtain the transaction record toRecord of the lending operation;

[0072] S4: Compare the transaction record fromRecord with the transaction record toRecord, and in response to a matching rule, record the transaction record that meets the matching rule into a result set R.

[0073] Through the above-mentioned bill data mining method, based on the sliding window method, cross-checking the transaction details of borrowing and lending can dig out two types of suspected related bill flows. One is that due to the data itself, one or both transaction counterparties are empty. As long as the amount is consistent and the transaction time difference is within the specified range, it can be mined through this method; the other is that there is no problem with the data itself, and the analysis object intends to transfer through a single or multiple intermediaries. As long as the amount is consistent and the transaction time difference is within the specified range, it can also be mined through this method.

[0074] In the case of combined mining of bill flow of multiple analysis objects, the time complexity of double-layer loop traversal is O(n 2 ), this method uses a sliding window to limit the amount of data n involved in each analysis, which minimizes the size of n, greatly reduces the calculation time, and improves the analysis efficiency.

[0075] At the same time, the limiting conditions can be adjusted according to the application scenario. If you are mining missing transaction counterparties, you can lower the time limit value. The transaction flow within 10 minutes or 30 minutes is relatively small. If you are mining middlemen, the time limit may be set to a few days. At this time, the flow will be relatively large. The amount of flow can be controlled by limiting the transaction amount.

[0076] In a specific implementation of the present invention, when the transaction time of the transaction record toRecord exceeds the transaction time of the transaction record fromRecord and reaches the limit value T, the loop traversal of the set WTL is stopped, and the starting index of the set WTL is updated to the index of the current transaction record toRecord. This reduces invalid traversal, saves analysis time, and improves analysis efficiency.

[0077] In a specific embodiment of the present invention, the matching rules include: simultaneously satisfying the conditions that the party's card number is different, the transaction amount is consistent, the transaction time hours, minutes and seconds are not all 0, the time difference between the previous and next transactions is within the range of T, and the toRecord time is greater than or equal to the fromRecord time.

[0078] In a specific implementation of the present invention, the transaction record that meets the matching rule includes transaction time, transfer-out record ID, and transfer-in record ID.

[0079] In a specific embodiment of the present invention, the result set R is displayed in the form of a relationship diagram, which makes the displayed results simple and intuitive, and is convenient for customers to select and judge.

[0080] Further references Figure 4 , as a response to the above Figure 3 In order to realize the method, the present application also provides an embodiment of a device for quickly mining suspected related bills based on a sliding window. Figure 3 Corresponding to the embodiments of the method, the device can be specifically included in various electronic devices.

[0081] A device for rapidly mining suspected associated bills based on a sliding window, comprising:

[0082] Data acquisition unit 1: configured to filter out lending or crediting data whose transaction amount is not empty and is non-cash access in multiple bills, and generate lending group bill set FL and credit group bill set TL in order of transaction time;

[0083] Sliding window analysis unit 2: configured to obtain a lending record set WFL whose transaction time difference does not exceed a time range T on the set FL through a sliding time window, and mark the earliest time and the latest time; obtain a lending record set WTL whose transaction time is within the range of the earliest time to the latest time + T on the set TL through a sliding window;

[0084] Loop traversal unit 3: configured to loop traverse the set WFL to obtain the transaction record fromRecord of the lending operation; loop traverse the set WTL to obtain the transaction record toRecord of the lending operation;

[0085] Detection unit 4: configured to compare the transaction record fromRecord with the transaction record toRecord, and in response to a matching rule, record the transaction record that meets the matching rule into a result set R;

[0086] Update unit 5: configured to stop looping through the set WTL and update the starting index of the set WTL to the index of the transaction record toRecord of the current lending operation when the transaction time of the transaction record toRecord exceeds the transaction time of the transaction record fromRecord and reaches the limit value T;

[0087] Display unit 6: configured to display the result set R to the user, and mark it as the original record after the user makes a second confirmation.

[0088] In a specific implementation of a device for quickly mining suspected related bills based on a sliding window of the present invention, the matching rules executed by the device include: simultaneously satisfying the conditions that the party's card number is different, the transaction amount is consistent, the transaction time hours, minutes and seconds are not all 0, the time difference between the previous and next transactions is within the range of T, and the toRecord time is greater than or equal to the fromRecord time.

[0089] In a specific implementation of a device for rapidly mining suspected associated bills based on a sliding window of the present invention, the transaction records meeting the matching rule include transaction time, outgoing record ID, and incoming record ID.

[0090] In a specific implementation of a device for rapidly mining suspected related bills based on a sliding window of the present invention, the result set R is displayed in the form of a relationship diagram.

[0091] For the convenience of description, the above system is described by dividing it into various units according to its functions. Of course, when implementing the present application, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0092] It can be known from the description of the above implementation methods that those skilled in the art can clearly understand that the present application can be implemented by means of software plus a necessary general hardware platform. Based on such an understanding, the technical solution of the present application can be essentially or partly contributed to the prior art in the form of a software product, which can be stored in a storage medium such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in the various embodiments of the present application or certain parts of the embodiments.

[0093] According to the method, device and readable storage medium for quickly mining suspected related bills based on a sliding window of the present invention, based on the sliding window method, cross-matching transaction details can mine the data of suspected missing counterparties and the suspicious behavior of suspected middlemen, while greatly reducing the calculation time and improving the analysis efficiency, providing support for data improvement and fund tracking of bill analysis. It can be used as a supplement to existing analysis methods and has broad application prospects.

[0094] Finally, it should be noted that the above embodiments are only intended to illustrate rather than limit the technical solutions of the present invention. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that the present invention can still be modified or replaced by equivalents. Any modification or partial replacement that does not depart from the spirit and scope of the present invention should be included in the scope of the claims of the present invention.

Claims

1. A method for quickly mining suspected related bills based on a sliding window, characterized in that: include: S1: Filter and select the lending or crediting data whose transaction amount is not empty and is non-cash access in multiple bills, and sort them by transaction time to generate a lending group bill set FL and a credit group bill set TL; S2: Obtain a set of lending records WFL whose transaction time difference does not exceed the time range T on the set FL through a sliding time window, and mark the earliest time and the latest time: Obtain a set of lending records WTL whose transaction time is within the range of the earliest time to the latest time + T on the set TL through a sliding window; S3: loop through the set WFL to obtain the transaction record fromRecord of the lending operation; loop through the set WTL to obtain the transaction record toRecord of the lending operation; When the transaction time of the transaction record toRecord exceeds the transaction time of the transaction record fromRecord and reaches the limit value T, stop looping through the set WTL and update the starting subscript of the set WTL to the subscript of the current transaction record toRecord; S4: Compare the transaction record fromRecord with the transaction record toRecord, and in response to a matching rule, record the transaction record that meets the matching rule into a result set R; The matching rules include: simultaneously satisfying the conditions that the card numbers of the parties are different, the transaction amounts are the same, the transaction time hours, minutes and seconds are not all 0, the time difference between the previous and next transactions is within the range of T, and the toRecord time is greater than or equal to the fromRecord time.

2. According to claim 1, a method for rapidly mining suspected related bills based on a sliding window is characterized in that: The transaction records that meet the matching rules include transaction time, transfer-out record ID, and transfer-in record ID.

3. According to claim 1, a method for rapidly mining suspected related bills based on a sliding window is characterized in that: The result set R is displayed in the form of a relationship diagram.

4. A device for rapidly mining suspected related bills based on a sliding window, characterized in that: include: Data acquisition unit: configured to filter out the lending or crediting data of multiple bills whose transaction amounts are not empty and are non-cash access, and generate a lending group bill set FL and a credit group bill set TL in order of transaction time; Sliding window analysis unit: configured to obtain a set of lending records WFL whose transaction time difference does not exceed the time range T on the set FL through a sliding time window, and mark the earliest time and the latest time: obtain a set of lending records WTL whose transaction time is within the range of the earliest time to the latest time + T on the set TL through a sliding window: A loop traversal unit: configured to loop through the set WFL to obtain a transaction record fromRecord of a lending operation; and loop through the set WTL to obtain a transaction record toRecord of a lending operation; When the transaction time of the transaction record toRecord exceeds the transaction time of the transaction record fromRecord and reaches the limit value T, stop looping through the set WTL and update the starting subscript of the set WTL to the subscript of the current transaction record toRecord; A detection unit: configured to compare the transaction record fromRecord with the transaction record toRecord, and in response to a matching rule, record the transaction record that meets the matching rule into a result set R; Update unit: configured to stop looping through the set WTL and update the starting index of the set WTL to the index of the transaction record toRecord of the current lending operation when the transaction time of the transaction record toRecord exceeds the transaction time of the transaction record fromRecord and reaches the limit value T: Display unit: configured to display the result set R to the user, and mark it as the original record after the user performs a second confirmation; The matching rules executed by the device include: simultaneously satisfying the conditions that the party's card number is different, the transaction amount is consistent, the transaction time is not all 0, the time difference between the previous and next transactions is within the range of T, and the toRecord time is greater than or equal to the fromRecord time.

5. The device for rapidly mining suspected related bills based on a sliding window according to claim 4, characterized in that: The transaction records that meet the matching rules include transaction time, transfer-out record ID, and transfer-in record ID.

6. The device for rapidly mining suspected related bills based on a sliding window according to claim 4, characterized in that: The result set R is displayed in the form of a relationship diagram.

7. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed, the method for quickly mining suspected related bills based on a sliding window as described in any one of claims 1 to 3 is performed.

Images