A method for banks to detect illegal transfer of online gambling funds based on tripartite graphs

Abstract

The present invention relates to a method for a bank to detect illegal transfer of online gambling funds based on a three-part graph. The method comprises the following steps: obtaining a list of bank public accounts to be detected, constructing a three-part graph model based on the transaction flow of each bank public account in the list; analyzing the three-part graph model to obtain general graph features and special graph features corresponding to each bank public account in the list; substituting the general features, general graph features and special graph features corresponding to each bank public account in the list into a model for detecting illegal transfer of online gambling funds, and obtaining a list of suspected accounts output by the model for detecting illegal transfer of online gambling funds. The present invention improves the reliability of a bank in identifying illegal transfer of online gambling funds, and enhances the interpretability of the bank's identification results of illegal transfer of online gambling funds.

Description

Technical Field

[0001] The invention relates to the field of anti-illegal transfer of gambling funds, and in particular to a method for banks to detect illegal transfer of online gambling funds based on a three-part graph. Background Art

[0002] At present, the illegal transfer of online gambling funds is generally identified by using pre-set anti-illegal transfer of gambling funds rules, anti-illegal transfer of gambling funds models trained by unsupervised machine learning, anti-illegal transfer of gambling funds models trained by supervised machine learning, and pre-set anti-illegal transfer of gambling funds knowledge graphs.

[0003] Among them, the anti-illegal transfer of gambling funds rules are based on relevant transactions and accounts identified by subsequent cases, as well as abnormal transaction patterns and account characteristics summarized by manual experience. They are easy to apply and can achieve rapid detection and response. Suspects are triggered by clear rules and conditions and have good explainability. However, they are only applicable to strong rules. Weak rules will lead to poor recognition of illegal transfer of online gambling funds, low detection efficiency, and misidentification, which will bring a lot of workload to subsequent operation and maintenance personnel.

[0004] The anti-illegal transfer of gambling funds model trained by unsupervised machine learning takes samples consisting of weak features as input and abnormal transactions or suspicious gangs as output. It does not need to label samples in advance before training. When the number of training samples is not large enough, it can also achieve good recognition effect in identifying new illegal transfer patterns of gambling funds. It is mainly used to detect abnormal transaction behaviors or account groups, and perform a posteriori analysis to confirm illegal transfer of gambling funds or illegal transfer of gambling funds gangs; however, abnormal behaviors cannot be directly identified as illegal transfer of gambling funds. Therefore, the false alarm rate of this method will be relatively high and the results will be less interpretable.

[0005] The anti-illegal transfer of gambling funds model trained by supervised machine learning extracts feature information from account-related information and transaction flow data of accounts or transactions that have engaged in illegal transfer of online gambling funds. At the same time, experts are required to label the accounts or transactions according to the illegal transfer of gambling funds, and train the model based on the features and labels. The model can achieve efficient recognition and has a certain degree of robustness. However, due to the rapid development of illegal transfer of gambling funds crimes, the criminal methods are complex and highly concealed, and most of them are unused or less used criminal methods. The model is affected by the completeness of the sample library and it is difficult to identify the corresponding criminal behavior.

[0006] The knowledge graph against illegal transfer of gambling funds organizes, stores and manages account information, transaction behavior and other related data in the form of a graph; and uses graph algorithms to analyze and mine the graph to identify suspicious illegal transfer of gambling funds. It has strong advantages in association and penetration, and can track complex capital links and identify illegal transfer of gambling funds. However, it may be impossible to build a knowledge graph due to insufficient data. At the same time, since criminals have certain anti-detection experience, they may use some means to affect the effectiveness of graph analysis. Summary of the invention

[0007] In view of the problems existing in the prior art, an embodiment of the present invention provides a method for a bank to detect illegal transfer of online gambling funds based on a three-part graph, which overcomes the above problems or at least partially solves the above problems.

[0008] The embodiment of the present invention provides a method for banks to detect illegal transfer of online gambling funds based on a three-part graph, comprising:

[0009] Obtain a list of public bank accounts to be detected, and construct a three-part graph model based on the transaction flow of each public bank account in the list; wherein the transaction is an operating transaction, and the transaction flow includes information on the transaction object, transaction time, and transaction amount;

[0010] Analyze the three-part graph model to obtain general graph features and special graph features corresponding to each bank public account in the list;

[0011] Substituting the general features, general graph features and special graph features corresponding to each bank public account in the list into the online gambling fund illegal transfer behavior detection model to obtain a list of suspected accounts output by the online gambling fund illegal transfer behavior detection model;

[0012] Among them, the online gambling fund illegal transfer behavior detection model is trained based on the general characteristics, general graph characteristics, special graph characteristics of the bank's public accounts in the detected bank's public account list and the judgment information of whether it is on the gambling fund illegal transfer blacklist.

[0013] According to a method for banks to detect illegal transfer of online gambling funds based on a three-part graph provided by the present invention, a three-part graph model is constructed based on the transaction flow of each bank's public account in the list, specifically:

[0014] The transaction objects of all public bank accounts in the list are counted to determine the transfer-in account and the transfer-out account; wherein the transfer-in / transfer-out account is the transaction object of the public bank account in the transfer-in / transfer-out transaction flow;

[0015] A three-part graph model is constructed by taking the transfer-in account, the bank public account and the transfer-out account as the nodes of the first layer, the second layer and the third layer in the three-part graph model, and taking the transactions between the accounts as the edges between the corresponding nodes of the three-part graph model; wherein the edges of the three-part graph model have corresponding attribute tags, and the attribute tags include: transaction time and transaction amount.

[0016] According to a method for banks to detect illegal transfer of online gambling funds based on a three-part graph provided by the present invention, the three-part graph model is analyzed to obtain the special graph features corresponding to the public accounts of each bank in the list, specifically:

[0017] Get a preset time window set;

[0018] For each time window in the time window set, based on the transaction flow of each bank's public account, calculate the weight of each edge of the three-part graph model under the corresponding time window;

[0019] Aggregate the weights of the edges connected to the corresponding nodes of each bank's public account in the corresponding time window to obtain the first suspicion degree of each bank's public account in the corresponding time window;

[0020] The weight sum of the edges connected to the corresponding nodes of the transfer-in / transfer-out accounts in the corresponding time window is used as the suspicion of the transfer-in / transfer-out accounts in the corresponding time window, and the suspicion of the edges connected to the corresponding nodes of each bank's public account is aggregated to obtain the second suspicion of each bank's public account in the corresponding time window;

[0021] The first suspicion and the second suspicion of each bank's public account in each time window are used as the special graph features of each bank's public account;

[0022] The aggregation operations include, but are not limited to, summing, averaging, averaging, maximum value, minimum value and median.

[0023] According to a method for banks to detect illegal transfer of online gambling funds based on a three-part graph provided by the present invention, for each time window in the time window set, based on the transaction flow of each bank's public account, the weight of each edge of the three-part graph model under the corresponding time window is calculated, specifically:

[0024] Sort the transaction records of each bank's public account in order from the earliest to the latest transaction time;

[0025] The transaction flow sorting sequence of each bank's public account is scanned respectively by means of a sliding time window, and the transaction flow in the same sliding window during the scanning process is included in the same transaction subset, so as to obtain each transaction subset under each bank's public account in the corresponding time window;

[0026] Based on the transaction statistics of each transaction subset under each bank's public account in the corresponding time window, the suspicion of each bank's public account in each transaction subset under it in the corresponding time window is calculated; wherein the transaction statistics information includes: the ratio of the number of transfer-in accounts to the number of transfer-out accounts, the ratio of the number of transfer-in transactions to the number of transfer-out transactions, and the ratio of the value of the transfer-in amount to the transfer-out amount;

[0027] The suspicion degree of each bank's public account in each subordinate transaction subset in the corresponding time window is used as the weight of the edge corresponding to the transaction flow of each transaction subset in the corresponding time window.

[0028] According to a method for banks to detect illegal transfer of online gambling funds based on a three-part graph provided by the present invention, the suspicion of each bank's public account in each transaction subset under it in the corresponding time window is specifically calculated by the following formula:

[0029] w ij =a1f(α ij )+a2f(β ij )+a3g(γ ij )

[0030] f(α ij )=tanh(bα ij )

[0031] f(β ij )=tanh(bβ ij )

[0032]

[0033] In the above formula, a1 represents the first weight coefficient, f(·) represents the first suspicion conversion function, α ij represents the ratio of the number of transfer-in accounts to the number of transfer-out accounts in the transaction subset j under the bank's public account i in the corresponding time window, a2 represents the second weight coefficient, β ij represents the ratio of the number of inbound and outbound transactions in the transaction subset j of the bank's public account i in the corresponding time window, a3 represents the third weight coefficient, g(·) represents the second suspicion conversion function, γ ij It represents the numerical ratio of the amount transferred in and the amount transferred out in the transaction subset j under the bank's public account i in the corresponding time window, b represents the first suspicion conversion parameter, and c represents the second suspicion conversion parameter.

[0034] According to a method for banks to detect illegal transfer of online gambling funds based on a three-part graph provided by the present invention, the three-part graph model is analyzed to obtain the general graph features corresponding to the public accounts of each bank in the list, specifically: the out-degree, in-degree, centrality and PageRank values ​​of the nodes corresponding to the public accounts of each bank are solved, and used as the general graph features of the public accounts of each bank.

[0035] According to a method for banks to detect illegal transfer of online gambling funds based on a three-part graph provided by the present invention, the general characteristics corresponding to the public accounts of each bank include: account information of each public account, and transaction behavior statistics and other behavior statistics during the sampling period;

[0036] The account information includes: basic information of the individual, basic information of the transaction partner, basic information of the third-party institution with which the transaction is conducted, customer profile, business registration information, and a blacklist of illegal transfers of gambling funds;

[0037] The transaction behavior statistical information includes: fund retention statistical information, as well as transaction number statistical information, transaction amount statistical information, transaction period statistical information, and transaction object statistical information for private accounts and public accounts;

[0038] The other behavior statistics include: login behavior statistics and change behavior statistics;

[0039] The basic information includes: registration information and business information;

[0040] The illegal gambling fund transfer blacklist includes: the illegal gambling fund transfer blacklist covered by regulatory rules and the illegal gambling fund transfer blacklist issued by various regulatory authorities;

[0041] The login behavior includes: login time and login device;

[0042] The change behavior includes: change time and change item.

[0043] The present invention provides a method for banks to detect illegal transfer of online gambling funds based on a three-part graph. The method uses the transaction flow of a bank's public account to construct a three-part graph model. With the aid of the three-part graph model, characteristic information of the bank's public account is extracted from multiple time scales. The characteristic information of the bank's public account is used to identify illegal transfer of online gambling funds, thereby improving the reliability of the bank's identification of illegal transfer of online gambling funds and enhancing the interpretability of the bank's identification results of illegal transfer of online gambling funds. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0045] Figure 1 It is a flow chart of a method for banks to detect illegal transfer of online gambling funds based on a three-part graph provided by the present invention;

[0046] Figure 2 It is a schematic diagram of the construction process of the online gambling fund illegal transfer behavior detection model provided by the present invention;

[0047] Figure 3 It is a schematic diagram of a three-part graph model provided by the present invention;

[0048] Figure 4 It is a triangular state analysis diagram of the three-part graph model provided by the present invention;

[0049] Figure 5 It is a practical operation flow chart for obtaining the special graph features of each bank's public account provided by the present invention. DETAILED DESCRIPTION

[0050] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0051] Combine the following Figure 1-Figure 5 The present invention describes a method for banks to detect illegal transfer of online gambling funds based on a three-part graph.

[0052] like Figure 1 As shown, the present invention provides a method for banks to detect illegal transfer of online gambling funds based on a three-part graph, comprising:

[0053] S11. Obtain a list of public bank accounts to be detected, and construct a three-part graph model based on the transaction flow of each public bank account in the list; wherein the transaction is an operating transaction, and the transaction flow includes information on the transaction object, transaction time, and transaction amount;

[0054] Because the transaction flows of bank public accounts include not only operating flows, but also other transaction flows such as investment transactions, management expenses, rent, and regular flows such as flows of different accounts of insurance, banks, governments or public departments, and companies with the same name, in order to avoid some unnecessary data interference, the transaction flows of this application specifically refer to operating flows.

[0055] S12, analyzing the three-part graph model to obtain general graph features and special graph features corresponding to the public accounts of each bank in the list;

[0056] It should be noted here that the three-part graph model can reflect the transaction flow of the bank's corporate accounts in detail. The process of analyzing the three-part graph model is actually the process of analyzing the transaction behavior of all the bank's corporate accounts and extracting behavioral features. By constructing a three-part graph model and using it to extract features, the bank's identification results of illegal transfer of online gambling funds can be explained.

[0057] S13, substituting the general features, general graph features and special graph features corresponding to each bank public account in the list into the online gambling fund illegal transfer behavior detection model to obtain a list of suspected accounts output by the online gambling fund illegal transfer behavior detection model;

[0058] In the technical field, the present invention is used by banks to identify whether corporate accounts within the bank are used for illegal transfer transactions of gambling funds for online gambling. The method of the present invention can also be adaptively used in other financial institutions and organizations.

[0059] Among them, the online gambling fund illegal transfer behavior detection model is trained based on the general characteristics, general graph characteristics, special graph characteristics of the bank's public accounts in the detected bank's public account list and the judgment information of whether it is on the gambling fund illegal transfer blacklist.

[0060] It should be noted that the process of obtaining the general features, general graph features, and special graph features of the bank-to-public accounts in the detected bank-to-public account list and the bank-to-public account list to be detected is the same;

[0061] In addition, the online gambling funds illegal transfer behavior detection model is a post-event model, which is mainly used to identify whether the bank's public account has conducted illegal transfer transactions of online gambling funds;

[0062] Figure 2 The following is a flow chart of the construction process of the detection model for illegal transfer of online gambling funds. Figure 2 As shown in the figure, the construction process of the online gambling funds illegal transfer behavior detection model can be divided into three stages: building a three-part graph model, building a data set, and training the online gambling funds illegal transfer behavior detection model. The specific steps are as follows:

[0063] Step 1: Construct a three-part graph model, which includes the following two sub-steps:

[0064] Step 1.1: Design of three-part graph model framework. Figure 3 The following is an example of a three-part graph model diagram: Figure 3 As shown, the nodes represent account numbers, and the edges represent transactions between account numbers. The three-part graph model is divided into three layers. There are no edge connections between nodes in each layer. There are edge connections between the first-layer nodes and the second-layer (middle-layer) nodes, and there are edge connections between the second-layer nodes and the third-layer nodes. The second layer places the account set to be detected, and the first / third layers place accounts related to their transfer-in / transfer-out flows, that is, the first layer places transfer-in accounts, the second layer places bank public accounts (hereinafter also referred to as intermediate accounts), and the third layer places transfer-out accounts. The accounts corresponding to the second-layer nodes are in-bank accounts, and the accounts corresponding to the first-layer nodes / third-layer nodes are not restricted, and most of them are out-of-bank accounts. The connecting edges between the first-layer nodes and the second-layer nodes represent the transfer-in flows of the accounts corresponding to the second-layer nodes, and the connecting edges between the second-layer nodes and the third-layer nodes represent the transfer-out flows of the accounts corresponding to the second-layer nodes. Step 1.2: Data processing The above figure specifically includes the following three sub-steps:

[0065] Step 1.2.1: Data preparation. Prepare a set of detected bank accounts (i.e. determine the list of detected bank accounts), set the sampling period in advance, and extract the relevant data of each bank account in the list from the bank database in a targeted manner;

[0066] The relevant data mainly include account information (including basic information, information of affiliated companies, customer profiles, login behavior and change behavior), all types of transaction flows (the sampling period is generally based on natural months, and this embodiment takes all types of transaction flows of a specified number of natural months) and external data (not limited to industrial and commercial registration information, gambling fund illegal transfer blacklists covered by regulatory rules, gambling fund illegal transfer blacklists issued by various regulatory departments and related third-party data);

[0067] Step 1.2.2: Processing. In addition to operating transactions, bank public account transaction flows also include investment transactions, management fees, rent and other transaction flows. Only operating transactions are retained here. At the same time, it is also necessary to exclude transactions related to insurance payments, bank payments, government or public sector payments, transactions with different accounts of the same-name enterprise, and other regular transactions.

[0068] Step 1.2.3: Data graph. The middle-layer nodes of the three-part graph model correspond to the bank's public accounts, and the node attributes include account information and external data. The first-layer nodes and the third-layer nodes correspond to the payment account and the receiving account, respectively. The node attributes include account labels (such as internal and external accounts, personal and public accounts, etc.) and external data. The edges between the first-layer nodes and the middle-layer nodes correspond to the bank's public account transfer flow, and the edges between the middle layer and the third layer correspond to the bank's public account transfer flow. The edge attributes are mainly transaction information (transaction time, transaction amount, transaction tag, etc.).

[0069] At this stage, the bank's public account transaction flow is represented in the form of nodes, edges, and edge attribute labels in the three-part graph model to obtain the final constructed three-part graph model. Node attribute labels can also be represented in the three-part graph model when necessary.

[0070] Step 2: Construct a data set. The data set is generated by extracting general features, general graph features, and special graph features of bank public accounts from different dimensions. The multi-dimensional features enrich the content of the training samples and further improve the recognition accuracy of the detection model for illegal transfer of online gambling funds.

[0071] Taking the bank's public account as a sample, the general graph features and special graph features of the bank's public account are extracted from the three-part graph model, and the general features, general graph features and special graph features of the bank's public account are used as sample features. Specifically, they are:

[0072] General features mainly refer to the attributes of bank public account nodes, transaction behavior statistics (including transaction count statistics, transaction amount statistics, counterparty statistics (private and public), transaction period statistics, fund retention statistics, etc.) and other behavior statistics (account login behavior statistics, account change behavior statistics, etc.). These features are mainly basic statistics of accounts and their transactions, and the features for establishing corresponding rule processing do not need to rely on graph model generation.

[0073] General graph features, including general graph indicators (not limited to conventional graph indicators such as node in-degree, node centrality, PageRank, etc.).

[0074] Special graph features refer to features calculated from the three-part graph model in combination with domain experience. Special graph feature extraction is achieved by quantifying the illegal transfer of gambling funds in online gambling on the three-part graph model. Here, the main goal is to find a triangular shape on the three-part graph model, which is specifically defined as:

[0075] When the suspicious account is in the middle layer, its transaction behavior of illegal transfer of online gambling funds presents a triangular shape on the three-part graph model. Figure 4 The triangular state analysis diagram of the three-part graph model is shown, as Figure 4As shown, in the triangle pattern, the number of payment accounts is greater than the number of receiving accounts, and the number of incoming transaction flows in the bank's public account is greater than the number of outgoing transaction flows, thus forming the aggregation and flow of funds, and the funds stay in the bank's public account for a shorter time.

[0076] Figure 5 The actual operation flow chart of obtaining the special graph features of each bank's public account is shown as follows: Figure 5 As shown, a time window set T = {T1, T2, ...T d}, for each time window T k Collecting special graph features from the three-part graph model includes the following four sub-steps:

[0077] Step 2.1: Divide the transaction data of the bank's public accounts into transaction subsets. Assume that the bank's public account i, extract the relevant transaction data and sort them by time, using a sliding time window T k Scan the sorted transaction data (the step size is configurable, the default is T k ), the incoming transactions and outgoing transactions falling within the time window are classified into a transaction subset, and the transaction subsets under the bank's public account i are obtained;

[0078] Step 2.2: Quantification in the triangle pattern. Calculate α for each bank account i and transaction subset j. ij , β ij and γ ij ; α ij represents the ratio of the number of transfer-in accounts to the number of transfer-out accounts, β ij represents the ratio of the number of transfers in to the number of transfers out, γ ij represents the ratio of the amount transferred in to the amount transferred out, and the suspicion degree w of the bank's public account i in its subordinate transaction subset j ij for:

[0079] w ij =a1f(α ij )+a2f(β ij )+a3g(γ ij )

[0080] Wherein, a1, a2, and a3 are constant terms and satisfy a1+a2+a3=1, and f(·) and g(·) represent suspicion conversion functions.

[0081] f(·) needs to satisfy the following properties: it takes values ​​between 0 and 1 on [0,+∞); it is monotonically increasing on [0,+∞); it is a right saturation function. The following forms are provided here but are not limited to:

[0082]

[0083] or

[0084] f(x)=tanh(bx)

[0085] Among them, b>0.

[0086] g(·) needs to satisfy the following properties: it takes values ​​between 0 and 1 on [0,+∞); it is monotonically increasing on [0,1) and monotonically decreasing on [1,+∞). g(·) is not limited to the following forms,

[0087] g(x)=c -(x-1)2

[0088] Among them, c>1.

[0089] For all public bank accounts, calculate the suspicion of each transaction subset under it.

[0090] Step 2.3: Quantification of edge suspicion in the three-part graph model. Assume that the suspicion in its subordinate transaction subset j is w ij , the weights of the edges corresponding to all incoming and outgoing transactions in this subset are set to ω ij .

[0091] Calculate all nodes in the middle layer and finally get k The weights of all edges in the conditional three-part graph model.

[0092] Step 2.4: Calculate graph features. This includes the following two sub-steps:

[0093] Step 2.4.1: For each node in the middle layer of the three-part graph model, perform a suspicion aggregation operation on the edge weights, not limited to sum, mean, maximum, minimum, median, etc., and calculate the bank public account corresponding to the node in the time window T k The first suspicion.

[0094] Step 2.4.2:

[0095] For each node in the middle layer of the three-part graph model, the associated nodes are divided into the nodes corresponding to the incoming transaction objects in the first layer and the nodes corresponding to the outgoing transaction objects in the third layer; the weights of the connecting edges of the associated nodes are summed up to obtain the suspicion of the nodes in the first layer and the third layer.

[0096] For each node in the middle layer of the three-part graph model, the suspicion aggregation operation is performed on its associated nodes, which is not limited to sum, mean, maximum, minimum, median, etc., and the public bank account corresponding to the node is calculated in the time window T k The second degree of suspicion.

[0097] According to the above process, each time window is calculated to obtain the first suspicion and the second suspicion of each bank's public account at each time scale, which are output as the special graph features of each bank's public account.

[0098] Step 3) Train the online gambling fund illegal transfer behavior detection model. Use an algorithm to train the model on the data set, and mainly use machine learning algorithms (not limited to tree models, Bayesian models, ensemble learning, neural networks, support vectors, etc.). It specifically includes the following three sub-steps:

[0099] Step 3.1: Preprocessing: According to the actual situation (data, algorithm, application), use appropriate data processing technology to process the data set before training (cleaning, transformation, planning, etc.).

[0100] Among them, the marked illegal gambling fund transfer accounts belong to a small sample, and the number of normal accounts and illegal gambling fund transfer accounts in the training sample set may be unevenly distributed. Here, we choose to use relevant technologies (such as oversampling and undersampling) to balance the samples according to the actual situation;

[0101] Step 3-2) Parameter optimization. Here, the main task is to optimize the algorithm hyperparameters. Randomly divide the data set into a training set and a test set, and select the parameter optimization method and evaluation method (AUC, F1, etc.). Perform model training and evaluation on the training set, select the next set of hyperparameters through the parameter optimization method, and continue model training and evaluation until the optimization termination condition is met. Based on the optimal hyperparameter combination, generate a model on the training set, and verify the generalization performance on the test set. If the performance does not meet expectations, return to the previous adjustment.

[0102] Step 3-3) Output the learning model. Use the optimal hyperparameter combination to train the model on the data set to detect illegal transfer of online gambling funds.

[0103] The present invention utilizes the bank's public account transaction flow to construct a three-part graph model, and with the aid of the three-part graph model, extracts characteristic information of the bank's public account from multiple time scales, and utilizes the characteristic information of the bank's public account to identify illegal transfer of online gambling funds, thereby improving the reliability of the bank's identification of illegal transfer of online gambling funds and enhancing the interpretability of the bank's identification results of illegal transfer of online gambling funds.

[0104] On the basis of the above embodiments, as an optional embodiment, the three-part graph model is constructed based on the transaction flow of each bank's public account in the list, specifically:

[0105] The transaction objects of all public bank accounts in the list are counted to determine the transfer-in account and the transfer-out account; wherein the transfer-in / transfer-out account is the transaction object of the public bank account in the transfer-in / transfer-out transaction flow;

[0106] A three-part graph model is constructed by taking the transfer-in account, the bank public account and the transfer-out account as the nodes of the first layer, the second layer and the third layer in the three-part graph model, and taking the transactions between the accounts as the edges between the corresponding nodes of the three-part graph model; wherein the edges of the three-part graph model have corresponding attribute tags, and the attribute tags include: transaction time and transaction amount.

[0107] Here, the three-part graph model has three layers of nodes, and the nodes represent accounts, and the edges represent transaction flows; among them, the second-layer nodes represent the bank's public accounts, which are some pre-selected internal accounts to be detected. The first-layer nodes and the third-layer nodes respectively represent the payment accounts (transfer-in accounts) and receiving accounts (transfer-out accounts) that have operating transaction relationships with the bank's public accounts.

[0108] The second layer is usually called the middle layer, and the public account is called the middle account. It should be noted that there is no edge connection between nodes belonging to the same layer; there may be multiple transactions when the two parties are the same, and we use one edge to represent one transaction, so there may be multiple edges between the same two nodes; the accounts corresponding to the first layer nodes and the third layer nodes are not limited to be accounts of the bank.

[0109] The present invention presents the operational transaction behavior of the bank's public account in the form of a three-part graph model, and realizes in-depth mining of the bank's public account transaction behavior through in-depth analysis of the three-part graph model, thereby achieving the effect of assisting in the detection of illegal transfer of online gambling funds.

[0110] Based on the above embodiments, as an optional embodiment, the three-part graph model is analyzed to obtain the dedicated graph features corresponding to the public accounts of each bank in the list, specifically:

[0111] Get a preset time window set;

[0112] For each time window in the time window set, based on the transaction flow of each bank's public account, calculate the weight of each edge of the three-part graph model under the corresponding time window;

[0113] It should be noted that the present invention uses weights to indicate the suspicion of each business transaction of each bank's public account.

[0114] Aggregate the weights of the edges connected to the corresponding nodes of each bank's public account in the corresponding time window to obtain the first suspicion degree of each bank's public account in the corresponding time window;

[0115] It should be noted that the first suspicion level of each bank's corporate account in the corresponding time window is measured from the perspective of each bank's corporate account itself.

[0116] The weight sum of the edges connected to the corresponding nodes of the transfer-in / transfer-out accounts in the corresponding time window is used as the suspicion of the transfer-in / transfer-out accounts in the corresponding time window, and the suspicion of the edges connected to the corresponding nodes of each bank's public account is aggregated to obtain the second suspicion of each bank's public account in the corresponding time window;

[0117] It should be noted that the second suspicion level of each bank's corporate account in the corresponding time window is measured from the perspective of the accounts related to each corporate account.

[0118] The first suspicion and the second suspicion of each bank's public account in each time window are used as the special graph features of each bank's public account;

[0119] The aggregation operations include, but are not limited to, summing, averaging, averaging, maximum value, minimum value and median.

[0120] It should be noted that only several feasible forms of the polymerization operation are provided here, and performing the polymerization operation in other reasonable ways will not affect the execution and effect of the present invention.

[0121] The special graph feature referred to in the present invention refers to the feature calculated from the three-part graph model in combination with the field experience, that is, the illegal transfer transaction behavior of gambling funds in online gambling is quantified on the three-part graph model, and the quantified data is calculated to obtain the feature. Here, a triangular shape is found on the three-part graph model to realize the quantification of the illegal transfer transaction behavior of gambling funds in online gambling. The triangular shape is when the suspicious account is in the middle layer, the number of payment accounts is greater than the number of receiving accounts, and the number of transfer-in transaction flows of the suspicious account is greater than the number of transfer-out transaction flows, thereby forming the aggregation and flow of funds, and the funds stay in the account for a short time. With the help of the three-part graph model, the present invention captures the triangular shape from multiple time scales, and then realizes the extraction of the suspicious quantitative features of the public accounts of each bank. In this process, the transaction information of the public accounts of each bank is fully utilized, and the information richness of the special graph feature is improved.

[0122] On the basis of the above embodiments, as an optional embodiment, for each time window in the time window set, based on the transaction flow of each bank's public account, the weight of each edge of the three-part graph model under the corresponding time window is calculated, specifically:

[0123] Sort the transaction records of each bank's public account in order from the earliest to the latest transaction time;

[0124] The transaction flow sorting sequence of each bank's public account is scanned respectively by means of a sliding time window, and the transaction flow in the same sliding window during the scanning process is included in the same transaction subset, so as to obtain each transaction subset under each bank's public account in the corresponding time window;

[0125] In the present technical field, the step length of the time window sliding can be configured according to the actual situation. The time window scanning divides all the operating transactions of the bank's public account into different transaction subsets, and the transaction time of the operating transactions divided into the same transaction subset is similar, which is conducive to identifying the triangle pattern;

[0126] Based on the transaction statistics of each transaction subset under each bank's public account in the corresponding time window, the suspicion of each bank's public account in each transaction subset under it in the corresponding time window is calculated; wherein the transaction statistics information includes: the ratio of the number of transfer-in accounts to the number of transfer-out accounts, the ratio of the number of transfer-in transactions to the number of transfer-out transactions, and the ratio of the value of the transfer-in amount to the transfer-out amount;

[0127] The present invention uses the statistical information of transaction subsets to achieve the quantification of the triangle shape, that is, to calculate the suspicion of each bank's public account in each transaction subset under it;

[0128] The suspicion degree of each bank's public account in each subordinate transaction subset in the corresponding time window is used as the weight of the edge corresponding to the transaction flow of each transaction subset in the corresponding time window.

[0129] The present invention utilizes the quantification result of the triangle shape to realize the quantification of the suspicion of commercial transactions, and assigns the suspicion as a weight, thereby providing decisive assistance for the extraction of the suspicion quantification feature.

[0130] Based on the above embodiments, as an optional embodiment, the suspicion degree of each bank's public account in each transaction subset under the corresponding time window is calculated by the following formula:

[0131] w ij =a1f(α ij )+a2f(β ij )+a3g(γ ij )

[0132] f(α ij )=tanh(bα ij )

[0133] f(β ij )=tanh(bβ ij )

[0134]

[0135] In the above formula, a1 represents the first weight coefficient, f(.) represents the first suspicion conversion function, α ij represents the ratio of the number of transfer-in accounts to the number of transfer-out accounts in the transaction subset j under the bank's public account i in the corresponding time window, a2 represents the second weight coefficient, β ij represents the ratio of the number of inbound and outbound transactions in the transaction subset j of the bank's public account i in the corresponding time window, a3 represents the third weight coefficient, g() represents the second suspicion conversion function, γ ij It represents the numerical ratio of the amount transferred in and the amount transferred out in the transaction subset j under the bank's public account i in the corresponding time window, b represents the first suspicion conversion parameter, and c represents the second suspicion conversion parameter.

[0136] This embodiment only provides preferred representations of the first suspicion conversion function and the second suspicion conversion function, but is not limited thereto;

[0137] In general, f(·) needs to satisfy the following properties: it takes values ​​between 0 and 1 on [0,+∞); it is monotonically increasing on [0,+∞); and it is a right saturating function. For example: Or f(x)=tanh(bx), where b>0.

[0138] g(·) needs to satisfy the following properties: it takes values ​​between 0 and 1 on [0,+∞); it is monotonically increasing on [0,1) and monotonically decreasing on [1,+∞). For example: Among them, c>1.

[0139] This embodiment provides a feasible method for quantifying the triangle state.

[0140] Based on the above embodiments, as an optional embodiment, the three-part graph model is analyzed to obtain the general graph features corresponding to each bank's public account in the list, specifically: solving the out-degree, in-degree, centrality and PageRank values ​​of the nodes corresponding to each bank's public account, and using them as the general graph features of each bank's public account.

[0141] The present invention extracts general graph features of bank public accounts from multiple angles, enriches the types of general graph features, and thus improves the recognition accuracy of the online gambling fund illegal transfer behavior detection model. Based on the above embodiments, as an optional embodiment, the general features corresponding to each bank public account include: account information of each public account, and transaction behavior statistics and other behavior statistics during the sampling period;

[0142] The account information includes: basic information of the individual, basic information of the transaction partner, basic information of the third-party institution with which the transaction is conducted, customer profile, business registration information, and a blacklist of illegal transfers of gambling funds;

[0143] The transaction behavior statistical information includes: fund retention statistical information, as well as transaction number statistical information, transaction amount statistical information, transaction period statistical information, and transaction object statistical information for private accounts and public accounts;

[0144] The other behavior statistics include: login behavior statistics and change behavior statistics;

[0145] The basic information includes: registration information and business information;

[0146] The illegal gambling fund transfer blacklist includes: the illegal gambling fund transfer blacklist covered by regulatory rules and the illegal gambling fund transfer blacklist issued by various regulatory authorities;

[0147] The login behavior includes: login time and login device;

[0148] The change behavior includes: change time and change item.

[0149] The general features of the present invention include basic account information and statistical information, which can provide basic data for the detection of illegal transfer of online gambling funds, enhance the accuracy of identifying illegal transfer of online gambling funds, and improve the interpretability of detection results.

[0150] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0151] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for banks to detect illegal transfer of online gambling funds based on a three-part graph, characterized in that: include: Obtain a list of public bank accounts to be detected, and construct a three-part graph model based on the transaction flow of each public bank account in the list; wherein the transaction is an operating transaction, and the transaction flow contains information on the transaction object, transaction time, and transaction amount; Analyze the three-part graph model to obtain general graph features and special graph features corresponding to each bank public account in the list; Substituting the general features, general graph features and special graph features corresponding to each bank public account in the list into the online gambling fund illegal transfer behavior detection model to obtain a list of suspected accounts output by the online gambling fund illegal transfer behavior detection model; The network gambling fund illegal transfer behavior detection model is trained based on the general features, general graph features, special graph features of the bank public accounts in the detected bank public account list and the determination information of whether the bank public accounts are in the gambling fund illegal transfer blacklist; The three-part graph model is constructed based on the transaction flow of the public accounts of each bank in the list, specifically: The transaction objects of all public bank accounts in the list are counted to determine the transfer-in account and the transfer-out account; wherein the transfer-in / transfer-out account is the transaction object of the public bank account in the transfer-in / transfer-out transaction flow; The transfer-in account, the bank public account and the transfer-out account are the nodes of the first layer, the second layer and the third layer in the three-part graph model, and the transactions between the accounts are the edges between the corresponding nodes of the three-part graph model, so as to construct a three-part graph model; wherein the edges of the three-part graph model have corresponding attribute tags, and the attribute tags include: transaction time and transaction amount; The three-part graph model is analyzed to obtain the special graph features corresponding to the public accounts of each bank in the list, specifically: Get a preset time window set; For each time window in the time window set, based on the transaction flow of each bank's public account, calculate the weight of each edge of the three-part graph model under the corresponding time window; Aggregate the weights of the edges connected to the corresponding nodes of each bank's public account in the corresponding time window to obtain the first suspicion degree of each bank's public account in the corresponding time window; The weight sum of the edges connected to the corresponding nodes of the transfer-in / transfer-out accounts in the corresponding time window is used as the suspicion of the transfer-in / transfer-out accounts in the corresponding time window, and the suspicion of the edges connected to the corresponding nodes of each bank's public account is aggregated to obtain the second suspicion of each bank's public account in the corresponding time window; The first suspicion and the second suspicion of each bank's public account in each time window are used as the special graph features of each bank's public account; The aggregation operations include: summing, averaging, averaging, maximum value, minimum value and median; The analysis of the three-part graph model to obtain the general graph features corresponding to each bank's public account in the list is specifically as follows: solving the out-degree, in-degree, centrality and PageRank values ​​of the nodes corresponding to each bank's public account, and using them as the general graph features of each bank's public account; The general characteristics corresponding to the public accounts of each bank include: account information of each public account, and transaction behavior statistics and other behavior statistics during the sampling period; The account information includes: basic information of the individual, basic information of the transaction partner, basic information of the third-party institution with which the transaction is conducted, customer profile, business registration information, and a blacklist of illegal transfers of gambling funds; The transaction behavior statistical information includes: fund retention statistical information, as well as transaction number statistical information, transaction amount statistical information, transaction period statistical information, and transaction object statistical information for private accounts and public accounts; The other behavior statistics include: login behavior statistics and change behavior statistics; The basic information includes: registration information and business information; The illegal gambling fund transfer blacklist includes: the illegal gambling fund transfer blacklist covered by regulatory rules and the illegal gambling fund transfer blacklist issued by various regulatory authorities; The login behavior includes: login time and login device; The change behavior includes: change time and change item.

2. The method for banks to detect illegal transfer of online gambling funds according to claim 1, characterized in that: For each time window in the time window set, based on the transaction flow of each bank's public account, the weight of each edge of the three-part graph model under the corresponding time window is calculated, specifically: Sort the transaction records of each bank's public account in order from the earliest to the latest transaction time; The transaction flow sorting sequence of each bank's public account is scanned respectively by means of a sliding time window, and the transaction flow in the same sliding window during the scanning process is included in the same transaction subset, so as to obtain each transaction subset under each bank's public account in the corresponding time window; Based on the transaction statistics of each transaction subset under each bank's public account in the corresponding time window, the suspicion of each bank's public account in each transaction subset under it in the corresponding time window is calculated; wherein the transaction statistics information includes: the ratio of the number of transfer-in accounts to the number of transfer-out accounts, the ratio of the number of transfer-in transactions to the number of transfer-out transactions, and the ratio of the value of the transfer-in amount to the transfer-out amount; The suspicion degree of each bank's public account in each subordinate transaction subset in the corresponding time window is used as the weight of the edge corresponding to the transaction flow of each transaction subset in the corresponding time window.

3. The method for banks to detect illegal transfer of online gambling funds according to claim 2, characterized in that: The suspicion degree of each bank's public account in each transaction subset under the corresponding time window is calculated by the following formula: In the above formula, represents the first weight coefficient, represents the first suspicion conversion function, Indicates the bank's public account in the corresponding time window Subordinate transaction subsets The ratio of the number of transfer-in accounts to the number of transfer-out accounts, represents the second weight coefficient, Indicates the bank's public account in the corresponding time window Subordinate transaction subsets The ratio of the number of transfer-in transactions to the number of transfer-out transactions. represents the third weight coefficient, represents the second suspicion conversion function, Indicates the bank's public account in the corresponding time window Subordinate transaction subsets The numerical ratio of the amount transferred in to the amount transferred out. represents the first suspicion conversion parameter, Represents the second suspicion conversion parameter.

Images