A gang mining method, device, equipment and readable storage medium

Abstract

The application discloses a gang mining method, which discards the traditional fixed networking analysis mode based on transaction relationship, and analyzes from a business type to determine a corresponding networking mode. For a case that transaction relationship cannot be used for group drawing, networking relationship is obtained according to corresponding business scene analysis data relationship, availability of the networking relationship is analyzed, and then the relationship available for networking is screened. Then, suspicious transaction nodes are screened. Finally, the selected networking relationship is used to draw a group, and suspicious transaction gangs are mined. The scheme sets forth an implementation process of selecting candidate networking relationship, analyzing candidate relationship, determining group drawing relationship, and drawing a group by using the selected relationship, mines the most effective group drawing mode under different business scenes, and realizes universal gang mining networking analysis. The application also discloses a gang mining device, equipment and readable storage medium, and has corresponding technical effects.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of security assurance, and in particular to a gang mining method, device, equipment and readable storage medium. BACKGROUND

[0002] Gang mining is an important part of anti-money laundering monitoring system, and gang mining mainly identifies gang money laundering mode in money laundering and identifies close contact customers of suspicious customers. The existing gang mining scheme generally applies transaction relationship for networking, constructs a directed graph according to the pay-receive relationship, and then mines various types of close contact customers of suspicious customers as gang cases for early warning.

[0003] The gang mining scheme of the above-mentioned application transaction relationship for networking is only applicable to the case where the private scene or the actual business private transaction (number of pens, amount) accounts for a large proportion, and cannot realize effective mining and identification in other business scenarios, and the application range is narrow.

[0004] In summary, how to realize effective gang mining in various business scenarios is a technical problem that the technical personnel in the field urgently need to solve at present. SUMMARY

[0005] The purpose of the present application is to provide a gang mining method, device, equipment and readable storage medium to realize effective gang mining in various business scenarios.

[0006] To solve the above technical problems, the present application provides the following technical scheme:

[0007] A gang mining method comprises:

[0008] Receiving user transaction data;

[0009] Determining a graphing mode according to a transaction type in a business scenario corresponding to the user transaction data;

[0010] If it is determined that the graphing mode is a transaction relationship graphing, an association network is constructed for the user transaction data according to the transaction relationship;

[0011] If it is determined that the graphing mode is other relationship graphing, a customer association relationship in the user transaction data is extracted;

[0012] The customer association relationship is screened according to a networking rule to obtain a candidate networking relationship;

[0013] If the candidate networking relationship is a strong relationship graphing, an association network is constructed for the user transaction data according to the candidate networking relationship;

[0014] If the candidate networking relationship is a weak relationship group graph, suspicious customers in the user transaction data are screened according to the candidate networking relationship to build an association network.

[0015] Suspected customers and their gang networking analysis are performed according to the association network, and a gang mining result is obtained.

[0016] Optionally, the determination of the group graph mode according to the transaction type in the business scenario corresponding to the user transaction data comprises:

[0017] If only private transactions exist in the business scenario corresponding to the user transaction data, the transaction relationship group graph is determined.

[0018] If only public transactions exist in the business scenario corresponding to the user transaction data, the other relationship group graph is determined.

[0019] If the business scenario corresponding to the user transaction data includes private transactions and public transactions, a main transaction type of a risk transaction scenario in the business scenario is determined; if the main transaction type is a private transaction, the transaction relationship group graph is determined; and if the main transaction type is a public transaction, the other relationship group graph is determined.

[0020] Optionally, the screening of the customer association relationship according to the networking screening rule comprises:

[0021] The non-distinctive relationship in the customer association relationship is removed to obtain a first relationship.

[0022] The transaction data amount corresponding to each first relationship is determined, and the relationship whose transaction data amount is not in a first range is removed to obtain a second relationship.

[0023] The value set of each second relationship is determined, and the relationship whose magnitude of the value set is not in a second range is removed to obtain a third relationship.

[0024] The non-distinctive value set in the third relationship is removed to obtain a fourth relationship.

[0025] The fourth relationship is taken as the candidate networking relationship.

[0026] Optionally, the screening of suspicious customers in the user transaction data according to the candidate networking relationship to build an association network comprises:

[0027] Suspicious customers in the user transaction data are screened to obtain a suspicious customer set.

[0028] It is judged whether the total amount of the suspicious customer set is greater than a threshold value.

[0029] If yes, an associated network is constructed for the suspicious customer set according to the candidate group networking relationship.

[0030] If no, an associated network is constructed for the suspicious customer set according to the candidate group networking relationship.

[0031] Optionally, after the candidate group networking relationship is obtained by screening the customer association relationship according to the group networking rule, the method further includes: eliminating abnormal values in the candidate group networking relationship.

[0032] A gang mining apparatus, comprising:

[0033] A data receiving unit configured to receive user transaction data;

[0034] A group graph mode determining unit configured to determine a group graph mode according to a transaction type in a business scenario corresponding to the user transaction data;

[0035] A transaction relationship group graph unit configured to, if it is determined that the group graph mode is a transaction relationship group graph, construct an associated network for the user transaction data according to transaction relationships;

[0036] An other relationship determining unit configured to, if it is determined that the group graph mode is an other relationship group graph, extract customer association relationships in the user transaction data;

[0037] A relationship screening unit configured to screen the customer association relationships according to a group networking rule to obtain a candidate group networking relationship;

[0038] A strong relationship group graph unit configured to, if the candidate group networking relationship is a strong relationship group graph, construct an associated network for the user transaction data according to the candidate group networking relationship;

[0039] A weak relationship group graph unit configured to, if the candidate group networking relationship is a weak relationship group graph, construct an associated network for suspicious customers in the user transaction data according to the candidate group networking relationship;

[0040] An associated network analysis unit configured to perform gang networking analysis on suspicious customers and gangs according to the associated network to obtain a gang mining result.

[0041] Optionally, the group graph mode determining unit comprises:

[0042] A private transaction determining subunit configured to, if there is only private transaction in a business scenario corresponding to the user transaction data, determine that the transaction relationship group graph;

[0043] A public transaction determining subunit configured to, if there is only public transaction in the business scenario corresponding to the user transaction data, determine that the other relationship group graph.

[0044] The mixed determination sub-unit is configured to determine a main transaction type of a risk transaction scenario in the business scenario if the user transaction data corresponds to a private transaction and a public transaction, determine the transaction relationship group graph if the main transaction type is the private transaction, and determine the other relationship group graph if the main transaction type is the public transaction.

[0045] Optionally, the relationship screening unit comprises:

[0046] The first processing sub-unit is configured to eliminate non-distinctive relationships in the customer association relationship to obtain first relationships.

[0047] The second processing sub-unit is configured to determine transaction data amounts corresponding to each of the first relationships, eliminate relationships whose transaction data amounts are not within a first range, and obtain second relationships.

[0048] The third processing sub-unit is configured to determine value sets of each of the second relationships, eliminate relationships whose value set magnitudes are not within a second range, and obtain third relationships.

[0049] The fourth processing sub-unit is configured to eliminate non-distinctive value sets in the third relationships to obtain fourth relationships.

[0050] The determination sub-unit is configured to take the fourth relationships as the candidate group networking relationships.

[0051] A computer device comprises:

[0052] A memory is configured to store a computer program.

[0053] A processor is configured to implement the steps of the gang mining method when the computer program is executed.

[0054] A readable storage medium has a computer program stored thereon, and the computer program is configured to implement the steps of the gang mining method when executed by a processor.

[0055] The method provided by the embodiment of the present application provides a gang mining scheme suitable for various application scenarios, which discards the traditional fixed network analysis mode based on transaction relationship, and analyzes from the business type to determine the corresponding network mode, wherein for the case that the transaction relationship cannot be used for group drawing, the network relationship is obtained according to the corresponding business scene analysis data relationship, the availability of the network relationship is analyzed, and then the relationship available for network is screened, the suspicious transaction node is screened, and finally the gang of suspicious transactions is mined according to the selected network relationship group drawing, the scheme describes the implementation process of selecting candidate network relationship, analyzing candidate relationship, determining group drawing relationship and using the selected relationship for group drawing, the most effective group drawing mode in different business scenarios is mined, and universal gang mining network analysis is realized.

[0056] Correspondingly, the embodiment of the present application also provides a gang mining device, equipment and readable storage medium corresponding to the above-mentioned gang mining method, which has the above-mentioned technical effects, and will not be described here. BRIEF DESCRIPTION OF DRAWINGS

[0057] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related art, the drawings needed to be used in the embodiment or related art description will be briefly introduced. Obviously, the drawings in the following description only some embodiments of the present application, and for those skilled in the art, other drawings can be obtained without creative labor on the basis of these drawings.

[0058] Figure 1 It is a schematic diagram of a whole anti-money laundering architecture;

[0059] Figure 2 It is an implementation flowchart of a gang mining method in the embodiment of the present application;

[0060] Figure 3 It is a whole design schematic diagram of a gang mining group drawing scheme in the embodiment of the present application;

[0061] Figure 4 It is a structure schematic diagram of a gang mining device in the embodiment of the present application;

[0062] Figure 5 It is a structure schematic diagram of a computer device in the embodiment of the present application. DETAILED DESCRIPTION

[0063] The core of the present application is to provide a gang mining method, which can realize effective gang mining in various business scenarios.

[0064] For those skilled in the art to better understand the present application, the present application will be further described in detail below in combination with the drawings and specific embodiments. Obviously, the described embodiments are only a part of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0065] As Figure 1 shown is a kind of anti-money laundering overall architecture schematic diagram, anti-money laundering overall system includes data warehouse module, monitoring function module and auditing module.In the monitoring function module, the functions mainly include list monitoring, suspicious monitoring, risk rating, large amount monitoring, and due diligence, risk events, data statistics etc., wherein suspicious monitoring is an important component in monitoring module, it is mainly from the transaction of various scenes routine monitoring, obtain the abnormal transaction customer and carry out early warning, the present application belongs to one of suspicious monitoring functions in anti-money laundering monitoring module, i.e. Figure 1 Money laundering gang discovery in , the following is referred to as "gang mining".

[0066] The existing gang mining scheme generally applies transaction relationship to network, forms directed graph (all edges are directed graph) according to the relationship between receiving and paying, and then mines various types of gangs, such as scattered transfer and centralized transfer, centralized transfer and scattered transfer, fast in and fast out, etc. Suspicious gang cases can also be found through community discovery technology; if the nodes or edges are filtered, a suspicious customer association network can be formed, and the closely related customers of the suspicious customers can be found as gang cases through graph mining algorithm to provide early warning.

[0067] The above-mentioned gang mining scheme using transaction relationship to network is only applicable to private scene or actual business where private transaction (number of transactions, amount) accounts for a large proportion. If the business scene is dominated by public transactions, using transaction relationship to form a graph will form a super node centered on a merchant, and the final graph will be a large graph composed of multiple subgraphs centered on super nodes. It cannot obtain the relationship or closeness between users, and has no contribution to subsequent graph mining work. At this time, the network formed according to the transaction relationship cannot obtain suspicious gangs after subgraph division.

[0068] Therefore, in order to ensure effective gang mining in various business scenes, the present application proposes a gang mining method, please refer to Figure 2 , Figure 2 The flowchart of the gang mining method in the embodiment of the present application, the method mainly includes the following steps:

[0069] S101, receiving user transaction data;

[0070] Obtain user transaction data from the anti-money laundering data warehouse, the user transaction data mainly including customer attribute information, transaction data in a period of time (determine the period according to the order of magnitude of daily transaction flow, and the period is 1-2 months), etc., after receiving the user transaction data, start step S102.

[0071] S102, determine the group drawing mode according to the transaction type in the business scenario corresponding to the user transaction data;

[0072] When a group is mined, the traditional scheme is to use transaction relationships to draw groups and construct a directed graph. However, there are also business scenarios in which private transactions do not exist or the proportion of private transactions is low, or the money laundering of a single node customer in a private business may be low. For this, the present application proposes to analyze the business scenario for each group mining to analyze the transaction type in the business scenario, such as only containing public transactions, only containing private transactions, or containing both public transactions and private transactions, so as to further match the corresponding group drawing mode according to the transaction type, thereby realizing adaptive adjustment of the group drawing mode to meet the needs of different application scenarios.

[0073] Among them, the transaction type can be divided into public transaction (referring to the transaction between the user and the merchant) and private transaction (referring to the transaction between the user and the user), and the group drawing mode can be divided into: transaction relationship group drawing and other relationship group drawing (in the present application, it refers to the relationship group drawing mode other than transaction relationship). The transaction relationship group drawing is: each transaction is composed of the payer and the payee, the transaction time, the location, the amount and other information data, then the two parties of the transaction can be taken as nodes (vertices), the transaction relationship is taken as an edge, the payer is pointed to the payee, and the kenen location, the amount and other information are taken as the attribute data of the edge, and then multiple transactions can form a network (graph); other relationship group drawing is: using the relationship other than transaction to draw a network and then mine a group. Group drawing is: the customer (user or merchant) is taken as a node (vertex), and a certain relationship between the customers is taken as an edge, and the graph (network) composed of the node and the edge.

[0074] And specifically, the implementation method of determining the group drawing mode according to the transaction type in the business scenario corresponding to the user transaction data is not limited in the present embodiment, which can be determined according to the risk transaction type in the risk business scenario, or the main risk transaction type in the main business scenario, or the main transaction type in the risk business scenario, or the risk transaction type in the main business scenario. The corresponding relationship between the determined to-be-detected transaction type and the group drawing mode is: private transaction corresponds to transaction relationship group drawing, and public transaction corresponds to other relationship group drawing.

[0075] S103, if it is determined that the group drawing mode is transaction relationship group drawing, construct an association network according to the transaction relationship of the user transaction data;

[0076] The construction of the association network using the transaction relationship can refer to the implementation manners of the related art, which is not limited herein. Specifically, two schemes can be used. One scheme is to directly use the transaction data to construct a graph, and the obtained is a transaction link graph. Through visual analysis, subgraph division, community discovery and the like of the transaction link graph, suspicious money laundering modes can be found, such as dispersed transfer-in and centralized transfer-out, centralized transfer-in and dispersed transfer-out, fast-in and fast-out or frequent in-out, chain transaction structure, ring transaction structure, nested ring transaction structure and the like, a pivot customer or a key suspicious customer connecting multiple subgraphs can be mined, and the fund movement and the close contact node can be analyzed;

[0077] Another scheme is to filter the transaction and the node (customer of the transaction) according to the amount, the number of transactions, the transaction time period, the transaction location, the transaction scenario, the customer attribute and the like, to screen out customers with a larger suspicious degree of money laundering. After the suspicious customers are graphed, the suspicious customers with close contact are mined as a gang case. The suspicious customers with close contact mined as a gang case are as follows: in the constructed graph (association network), subgraph division is performed, (strong) connected subgraphs are analyzed, community discovery technology is applied, a preliminary suspicious gang candidate set is obtained, and after the suspicious gang candidate set and the customers in the gang are filtered through a series of rules and strategies, the gang case is warned.

[0078] Only the above two ways of constructing an association network using a transaction relationship are introduced in this embodiment, and other construction ways based on a transaction relationship can refer to the introduction of this embodiment, which is not described herein again.

[0079] In S104, if it is determined that the graphing manner is other relationship graphing, the customer association relationship in the user transaction data is extracted.

[0080] If it is determined that the group graph mode is other relationship group graph, the customer association relationship other than transaction is obtained. The customer association relationship is an intermediary that can connect two customers (nodes). In addition to the transaction relationship, the common customer association relationship also includes device and device fingerprint, bank card number, mobile phone number, IP, location (actual transaction location, identity card residence, IP residence, mobile phone number residence, delivery address, and receiving address), transaction scene or transaction type, customer attribute (various addresses or residence, occupation (unit), user portrait, payment person, close association customer, and the like), and the like. Through analysis of the data (analysis of the data obtained from the database, including customer attribute data and transaction data, and extraction of the relationship that can connect two customers from the data, such as the same mobile phone number, the same IP, and the same receiving address, and the two customers that have conducted transactions), a candidate set of group graph relationships in the user transaction data is selected.

[0081] S105, screening the customer association relationship according to the group network rule to obtain a candidate group network relationship;

[0082] After all the customer association relationships in the user transaction data are extracted, the set group network screening rule is called to screen the customer association relationship. The set group network screening rule in the application refers to a rule for screening a group network relationship that is suitable for group network analysis, has strong distinguishability, and has a suitable order of magnitude. The set group network screening rule can be set according to the actual business scene, and is not limited herein.

[0083] After screening, a large number of customer association relationships that lack distinguishability and are not suitable for group network analysis can be filtered out. The screened relationship is used as a candidate group network relationship. It should be noted that the candidate group network relationship can be one or multiple, and is not limited herein.

[0084] In addition, to avoid interference of abnormal data on group network analysis and improve analysis accuracy, after the customer association relationship is screened according to the group network rule to obtain the candidate group network relationship, before the following step of constructing the association network, the abnormal values in the candidate group network relationship can be further removed, and specific values in the candidate relationship can be screened. For example, when the candidate group network relationship is an IP relationship, public IP addresses, local area network addresses, values of a customer order that are extremely high and exceed the server capacity, and values of a customer order that are extremely small can be removed. Of course, this step can also not be performed, and the application is not limited to this embodiment.

[0085] S106, if the candidate group network relationship is a strong relationship group graph, an association network is constructed for the user transaction data according to the candidate group network relationship;

[0086] It is judged whether the candidate network relationship screened is a strong relationship. If it is a strong relationship, step S106 is executed. If it is a weak relationship, step S107 is executed. The strong relationship refers to a relationship that can explicitly connect two nodes, such as a transaction relationship, a family relationship, and the like, and is a close connection. If the candidate network relationship is a strong relationship group graph, it indicates that the candidate network relationship has the ability to closely connect user transaction data for network formation, and the candidate network relationship can be directly used for group graph formation. The group graph scheme can be a directed graph or an undirected graph (a graph in which all edges are undirected) formed according to the relationship, or a directed graph or an undirected graph formed after suspicious nodes are screened. The specific scheme can be selected as appropriate, and is not limited herein.

[0087] It should be noted that there can be more than one candidate network relationship screened. If the candidate network relationship includes both a strong relationship group graph and a weak relationship group graph, the user transaction data can be constructed in the manner of S106 and in the manner of S107, and step S108 can be started according to the two associated networks. Alternatively, the multiple relationships can be placed on one graph, and a label can be given to each relationship, and the value of the label can be taken as the value of the edge attribute. In this embodiment, only the above two manners are introduced as examples, and other implementation manners can be implemented according to the introduction of this embodiment, and are not described herein again.

[0088] S107, if the candidate network relationship is a weak relationship group graph, suspicious customers in the user transaction data are screened according to the candidate network relationship to construct an associated network.

[0089] The weak relationship refers to a collective relationship of a large size, such as the same company, the same province or city, and the same community. It is obvious that all people in the weak relationship are not closely connected. In this method, suspicious customers in the user transaction data are screened according to the candidate network relationship, and an associated network is constructed according to the screened suspicious customers, so as to construct an effective associated network that can mine suspicious gangs.

[0090] S108, suspicious customers and gang network analysis are performed according to the associated network, and a gang mining result is obtained.

[0091] In the associated relationship network (graph), subgraph division is performed, (strong) connected subgraphs are analyzed, community discovery technology is applied, a preliminary suspicious gang candidate set is obtained, and after a series of rules and strategies are used to screen the suspicious gang candidate set and customers in the gang, a gang case is warned.

[0092] The screening of the suspicious gang candidate set and the customers in the gang mentioned in the scheme can refer to the implementation mode in the related art, and can be specifically screened from the average transaction amount, the average transaction number, the risk transaction number, the amount of the gang, the age, the occupation, the account number, the account number of the customers of the gang, the transaction number, the amount of the account number of the customers, and the like. The GCN (graph convolutional neural network) and other deep learning algorithms can be used to mine the suspicious gang. The clustering algorithm can also be used to mine the close contacts of the suspicious customers to form a gang, or the cluster with high suspicious degree and high money laundering risk is taken as a gang case. Only the above three implementation modes are taken as examples for introduction, and will not be described in detail herein.

[0093] Based on the above introduction, the technical scheme provided by the embodiment of the application provides a gang mining scheme suitable for various application scenarios. The scheme discards the traditional fixed networking analysis mode based on transaction relationship, and analyzes from the business type to determine the corresponding networking mode. For the case where transaction relationship cannot be used for group drawing, the data relationship is analyzed according to the corresponding business scenario, the networking relationship is obtained, the availability of the networking relationship is analyzed, the relationship that can be used for networking is then screened, the suspicious transaction node is screened, and finally the suspicious transaction gang is mined according to the selected networking relationship for group drawing. The scheme describes the implementation process of selecting candidate networking relationship, analyzing candidate relationship, determining group drawing relationship, and using the selected relationship for group drawing. The most effective group drawing mode under different business scenarios is mined, and the universal gang mining networking analysis is realized.

[0094] It should be noted that based on the above embodiment, the embodiment of the application also provides a corresponding improvement scheme. The steps in the preferred / modified embodiment can be mutually referred to, and the corresponding beneficial effects can also be mutually referred to. The preferred / modified embodiment will not be described one by one herein.

[0095] The implementation method of determining the group drawing mode according to the transaction type in the business scenario corresponding to the user transaction data in the above embodiment is not limited in the embodiment, and the embodiment mainly introduces an implementation method, which specifically includes the following steps:

[0096] (1) If there is only private transaction in the business scenario corresponding to the user transaction data, it is determined as transaction relationship group drawing;

[0097] (2) If there is only public transaction in the business scenario corresponding to the user transaction data, it is determined as other relationship group drawing;

[0098] Investigate the business scenario. If the business scenario only has private transaction, transaction relationship can be selected for group drawing. If the business scenario only has public transaction, relationship other than transaction can be selected for group drawing.

[0099] (3) If the user transaction data corresponds to a business scenario that includes private transactions and public transactions, determine the main transaction type of the risk transaction scenario in the business scenario; if the main transaction type is private transactions, determine the transaction relationship group graph; if the main transaction type is public transactions, determine the other relationship group graph.

[0100] If the user transaction data corresponds to a business scenario that includes private transactions and public transactions, the main transaction type of the risk transaction scenario in the business scenario can be determined, which can be determined by business analysis of the transaction data to determine the risk transaction scenario, and then numerical analysis of the transaction data in the risk transaction scenario. Among them, the purpose of business analysis is to determine the risk transaction scenario, and a transaction scenario can contain both private transactions and public transactions, and the purpose of numerical analysis is to analyze the main transaction type in the transaction scenario.

[0101] First, business analysis is performed, which generally includes anti-money laundering expert personnel evaluating the risk of money laundering scenarios (whether high risk or strong control, strong supervision business, whether the business has money laundering loopholes, etc.), investigating the past audit reporting of the business scenario involved, investigating the risk level of the business scenario involved, the risk event customer level, the customer level of hitting various risk lists, etc. Through one or more of the above factors, the risk business scenario is evaluated to obtain the risk business scenario.

[0102] Then, numerical analysis is performed on the risk business scenario obtained by business analysis, which includes obtaining the proportion of private transactions, the number of reported customers for historical private transactions, and the number of high-risk customers involved in private transactions. Among them, obtaining the proportion of private transactions includes the ratio of the number of private transactions to the total number of transactions, the ratio of the amount of private transactions to the total amount, etc., and the ratio of the amount of private transactions is evaluated through one or more of the above factors. If the ratio is around 0.5 (indicating that the amount of public transactions and private transactions is balanced) or the number of reported customers or high-risk customers involved in private transactions reaches the set threshold (which can be set by business personnel or audit experts, or professional anti-money laundering personnel can judge whether there is a possibility of a money laundering gang in the private and public business scenario), it is indicated that the possibility of the existence of a money laundering gang in the private and public business scenario is relatively high. Private and public transactions can be grouped according to different relationships. If the ratio is around 1, the transaction relationship group graph can be used; if the ratio is around 0, the relationship group graph other than transactions can be selected. If only one scenario has a money laundering gang risk, go to the corresponding step of the scenario, go to the other relationship group graph for public scenarios, and go to the transaction relationship group graph for private scenarios.

[0103] It should be noted that only the determination method of the main transaction type of the above risk transaction scenario is introduced as an example in this embodiment. The risk factors considered by the above method are complete, and the transaction type analysis is comprehensive, which can ensure the accurate determination of the main transaction type of the risk transaction scenario. Other implementation manners can refer to the introduction of this embodiment, and will not be described here.

[0104] The specific screening rules for screening the customer association relationship according to the networking screening rule in the above embodiment are not limited. In order to deepen the understanding, a relationship screening method is proposed in this embodiment, which can be implemented according to the following steps:

[0105] (1) Eliminate the non-discriminative relationship in the customer association relationship to obtain a first relationship;

[0106] Filter the non-discriminative relationship. Here, non-discriminative means that there is no difference between two groups of customers that can be achieved through the relationship. For example, the company name relationship, all customers are connected by one or several white-listed or trusted company names, and the relationship has no discrimination, and it is impossible to determine whether the group aggregated by the company relationship has money laundering risk.

[0107] The specific rule definition of non-discriminative is not limited in this embodiment, and can be defined according to the experience, social relationship, legal relationship cognition of technical personnel or anti-money laundering business personnel, which will not be described here.

[0108] (2) Determine the transaction data amount corresponding to each first relationship, eliminate the relationship whose transaction data amount is not in the first range, and obtain a second relationship;

[0109] In the selected transaction data, the relationship whose transaction data amount is not in the first range in the first relationship is obtained. Here, the first range is a transaction data amount screening range defined by human, that is, the purpose of this step is to select the relationship whose transaction data amount is suitable for group drawing. If the transaction data amount is too large, it will bring a large analysis burden to the machine, and if the transaction data amount is too small, the discrimination accuracy is low. The transaction proportion of non-empty is selected, and the relationship with a ratio less than a certain threshold value is filtered. The threshold value can be continuously detected according to the actual business scene, the order of magnitude of the transaction, the research and development manpower, etc. Generally, the relationships can be sorted according to the ratio, and the relationships with high ranking are selected for the following steps according to the research and development manpower and the type of the relationship (such as hitting the same user portrait blacklist (specified website run score gambling blacklist)). Even if the transaction proportion is not very high, we generally choose to retain such relationships.

[0110] (3) Determine the value set of each second relationship, eliminate the relationship whose value set is not in the second range, and obtain a third relationship;

[0111] In the filtered relationship, for each set of relationships, the size of the set of values that a single customer has for a certain relationship is viewed, and the size of the number of customers that a certain relationship value has is viewed, to filter out relationships with a suitable size of the set of relationship values. Specifically, the magnitude of the set of values can be viewed by viewing one: the magnitude of the different values that a single customer has for the relationship at most; viewing two: the magnitude of the number of customers that each value of the relationship has; and selecting relationships with a magnitude in a certain interval. The boundary threshold of the interval needs to be continuously detected according to the type of relationship, the server (cluster) used for research and development, and the computing and storage capacity of the server, to filter out relationships that exceed the server capacity and relationships in which the number of customers that each value has is small. In this embodiment, only the above two viewing methods are introduced as examples, and other viewing methods can be referred to the introduction of this embodiment, which will not be repeated here.

[0112] (4) Eliminate the undifferentiated value set in the third relationship to obtain the fourth relationship;

[0113] (5) The fourth relationship is used as a candidate networking relationship.

[0114] Most of the values in the filtered relationship do not have distinguishing characteristics. For example, most IP relationships are local area networks, so the IP relationship is not available at this time.

[0115] It should be noted that only the above filtering conditions are introduced as examples in this embodiment, and the remaining filtering conditions in actual business can be set according to specific business scenarios, which will not be repeated here.

[0116] In the above embodiments, the specific implementation manner of constructing an association network according to the candidate networking relationship to screen suspicious customers in user transaction data is not limited, and for a better understanding, an implementation manner is introduced in this embodiment, which specifically includes the following steps:

[0117] (1) Screen suspicious customers in user transaction data to obtain a suspicious customer set;

[0118] Screen suspicious customers (nodes) according to the set rules to form a suspicious customer set. The screening method of suspicious customers is not limited in this embodiment, and specific methods are as follows: 1. Use high-risk customers; 2. Use customers warned by rule models and AI models; 3. Use processing rules to screen suspicious customers from customer attribute information features and transaction features. Generally, considering the number of suspicious customers and trying to monitor more suspicious customers, scheme 3 can be used, in which screening suspicious customers also involves adjusting the threshold of the processed features, and the scheme for screening suspicious customers can be selected according to specific business scenarios, which will not be repeated here.

[0119] (2) Determine whether the total amount of the suspicious customer set is greater than a threshold; if yes, perform the following step (3); if no, perform the following step (4);

[0120] Determine if the total number of suspicious customers exceeds a threshold. If it does, it indicates a large number of suspicious customers to be analyzed, requiring detailed data mining to identify weak connections between large amounts of messy data. If it does not exceed the threshold, it indicates a small number of suspicious customers to be analyzed, making data mining relatively easier.

[0121] In this embodiment, an adaptive mapping method is adopted for different application scenarios (different suspicious customer volumes) to improve the overall accuracy of data mining.

[0122] (3) Use strong relationship networking to construct an associated network as the original graph; perform community mining on the original graph to obtain a set of suspected communities; and construct an associated network in the set of suspected communities using candidate networking relationships.

[0123] If the set of suspicious customers is large, first use transaction relationships or other available strong relationships to form a large graph, then perform subgraph partitioning and community mining (common community mining algorithms include Louvain's algorithm, etc.) to obtain a set of suspicious communities, and then use candidate network relationships (weak relationships) in the set of suspicious communities to form a graph.

[0124] (4) Construct an associated network for the suspicious customer set based on the candidate network relationship.

[0125] If the set of suspicious customers is small, then a network of associations can be constructed within the set of suspicious customers using candidate network relationships (weak relationships), forming an undirected graph or a directed graph (generally an undirected graph).

[0126] It should be noted that this embodiment only uses the above implementation steps as an example to introduce the construction of an association network for screening suspicious customers in user transaction data based on candidate network relationships. Other implementation methods can refer to the description in this embodiment, and will not be repeated here.

[0127] Figure 3 This is a schematic diagram of the overall design of a gang detection mapping scheme in an embodiment of the present invention. Based on the overall scheme architecture proposed in the first embodiment, this diagram reuses the method proposed in this embodiment for filtering suspicious customers in user transaction data and constructing an associated network according to candidate network relationships, as well as the mapping method determination method proposed in the above embodiments. It embodies an overall collaborative scheme; other specific implementation methods can be referred to. Figure 3 The details of its introduction will not be repeated here.

[0128] Corresponding to the above method embodiments, this invention also provides a gang excavation device, which can be referred to in correspondence with the gang excavation method described above.

[0129] See Figure 4 As shown, the device includes the following modules:

[0130] The data receiving unit 110 is mainly used for receiving user transaction data;

[0131] The group picture mode determining unit 120 is mainly used for determining a group picture mode according to a transaction type in a business scenario corresponding to the user transaction data;

[0132] The transaction relationship group picture unit 130 is mainly used for constructing an association network for the user transaction data according to transaction relationships if it is determined that the group picture mode is a transaction relationship group picture;

[0133] The other relationship determining unit 140 is mainly used for extracting a customer association relationship in the user transaction data if it is determined that the group picture mode is an other relationship group picture;

[0134] The relationship screening unit 150 is mainly used for screening the customer association relationship according to a group networking rule to obtain a candidate group networking relationship;

[0135] The strong relationship group picture unit 160 is mainly used for constructing an association network for the user transaction data according to the candidate group networking relationship if the candidate group networking relationship is a strong relationship group picture;

[0136] The weak relationship group picture unit 170 is mainly used for constructing an association network for suspicious customers in the user transaction data according to the candidate group networking relationship if the candidate group networking relationship is a weak relationship group picture;

[0137] The association network analysis unit 180 is mainly used for performing group networking analysis on suspicious customers and their gangs according to the association network to obtain a gang mining result.

[0138] In one specific embodiment of the present application, the group picture mode determining unit comprises:

[0139] A private transaction determining subunit is configured to determine a transaction relationship group picture if there is only private transaction in the business scenario corresponding to the user transaction data;

[0140] A public transaction determining subunit is configured to determine an other relationship group picture if there is only public transaction in the business scenario corresponding to the user transaction data;

[0141] A mixed transaction determining subunit is configured to determine a main transaction type of a risk transaction scenario in the business scenario if the business scenario corresponding to the user transaction data comprises private transaction and public transaction, determine a transaction relationship group picture if the main transaction type is private transaction, and determine an other relationship group picture if the main transaction type is public transaction.

[0142] In one specific embodiment of the present application, the relationship screening unit comprises:

[0143] A first processing subunit is configured to eliminate a non-distinctive relationship in the customer association relationship to obtain a first relationship;

[0144] The second processing subunit is configured to determine the transaction data volume corresponding to each first relationship, eliminate the relationships whose transaction data volume is not within the first range, and obtain second relationships;

[0145] The third processing subunit is configured to determine the value set of each second relationship, eliminate the relationships whose value set is not within the second range, and obtain third relationships;

[0146] The fourth processing subunit is configured to eliminate the value set without distinction in the third relationships, and obtain fourth relationships.

[0147] The determining subunit is configured to take the fourth relationships as candidate networking relationships.

[0148] Corresponding to the above method embodiments, the embodiments of the present application also provide a computer device. The computer device described below can be correspondingly referred to the gang mining method described above.

[0149] The computer device includes:

[0150] The memory is configured to store a computer program.

[0151] The processor is configured to execute the computer program to implement the steps of the gang mining method of the above method embodiments.

[0152] Specifically, please refer to Figure 5 A specific structural diagram of a computer device provided by the embodiments is shown in the figure. The computer device can have great differences due to different configurations or performances, and can include one or more than one central processing unit (CPU) 322 (for example, one or more than one processor) and a memory 332. The memory 332 stores one or more than one computer application program 342 or data 344. The memory 332 can be temporary storage or persistent storage. The program stored in the memory 332 can include one or more than one module (not shown in the figure), and each module can include a series of instruction operations in the data processing device. Further, the central processing unit 322 can be configured to communicate with the memory 332 and execute a series of instruction operations in the memory 332 on the computer device 301.

[0153] The computer device 301 can also include one or more than one power supply 326, one or more than one wired or wireless network interface 350, one or more than one input and output interface 358, and / or one or more than one operating system 341.

[0154] The steps in the gang mining method described above can be implemented by the structure of the computer device.

[0155] Corresponding to the above method embodiments, the embodiments of the present application also provide a readable storage medium. The readable storage medium described below can be used in combination with the gang mining method described above.

[0156] A readable storage medium, wherein the readable storage medium stores a computer program, and the computer program is executed by a processor to implement the steps of the gang mining method of the method embodiments.

[0157] The readable storage medium can be a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, or various readable storage media that can store program codes.

[0158] Those skilled in the art can further realize that the units and algorithm steps of each example described in combination with the embodiments disclosed herein can be realized in electronic hardware, computer software or a combination of both. In order to clearly illustrate the interchangeability of hardware and software, the components and steps of each example have been described in the above description in a general manner. Whether the functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

Claims

1. A method for uncovering organized crime groups, characterized in that, include: Receive user transaction data; The chart grouping method is determined based on the transaction type in the business scenario corresponding to the user transaction data; If the graph grouping method is determined to be a transaction relationship graph, an association network is constructed for the user transaction data based on the transaction relationships. If the graph grouping method is determined to be another relationship graph grouping method, extract the customer association relationships from the user transaction data; The customer relationships are filtered according to the networking rules to obtain candidate networking relationships; If the candidate network relationship is a strong relationship graph, construct an association network for the user transaction data based on the candidate network relationship; If the candidate network relationship is a weak relationship graph, a related network is constructed by filtering suspicious customers in the user transaction data based on the candidate network relationship. Based on the aforementioned network of connections, a network analysis of suspicious customers and their groups is conducted to obtain the group discovery results. The filtering of customer relationships according to network filtering rules includes: Remove the indistinguishable relationships from the customer relationships to obtain the first relationship; Determine the transaction data volume corresponding to each of the first relationships, and eliminate relationships whose transaction data volume is not within the first range to obtain the second relationship; Determine the value set for each of the second relations, and remove relations whose magnitude is not within the second range to obtain the third relation; The fourth relation is obtained by removing the set of indistinguishable values ​​from the third relation; The fourth relationship is used as the candidate networking relationship.

2. The method for uncovering criminal gangs according to claim 1, characterized in that, The method of determining the grouping method based on the transaction type in the business scenario corresponding to the user transaction data includes: If the business scenario corresponding to the user transaction data only involves private transactions, it is determined to be the transaction relationship group diagram; If the business scenario corresponding to the user transaction data only involves corporate transactions, it is determined to be one of the other relationship groups. If the business scenario corresponding to the user transaction data includes both private and corporate transactions, determine the main transaction type of the risky transaction scenario in the business scenario; if the main transaction type is a private transaction, determine it as the transaction relationship diagram; if the main transaction type is a corporate transaction, determine it as the other relationship diagram.

3. The method for uncovering criminal gangs according to claim 1, characterized in that, The step of filtering suspicious customers from the user transaction data based on the candidate network relationships and constructing an association network includes: Suspicious customers are filtered out from the user transaction data to obtain a set of suspicious customers; Determine whether the total number of the suspicious customer set is greater than a threshold; If so, construct the associated network using a strong relationship networking method as the original graph; perform community mining on the original graph to obtain a set of suspected communities; and construct an associated network in the set of suspected communities using the candidate networking relationships. If not, construct an associated network for the set of suspicious customers based on the candidate network relationships.

4. The method for uncovering criminal gangs according to claim 1, characterized in that, After filtering the customer association relationships according to the networking rules to obtain candidate networking relationships, the method further includes: removing abnormal values ​​from the candidate networking relationships.

5. A gang-related excavation device, characterized in that, include: The data receiving unit is used to receive user transaction data; The image grouping method determination unit is used to determine the image grouping method based on the transaction type in the business scenario corresponding to the user transaction data. The transaction relationship graph unit is used to construct an association network for the user transaction data based on the transaction relationships if the graphing method is determined to be a transaction relationship graph. Other relationship determination unit, used to extract customer association relationships from the user transaction data if the grouping method is determined to be other relationship grouping; The relationship filtering unit is used to filter the customer association relationships according to the networking rules to obtain candidate networking relationships; A strong relationship graph unit is used to construct an association network for the user transaction data based on the candidate network relationship if the candidate network relationship is a strong relationship graph. The weak-relationship graph unit is used to filter suspicious customers in the user transaction data and construct an association network based on the candidate network relationship if the candidate network relationship is a weak-relationship graph. The association network analysis unit is used to perform network analysis of suspicious customers and their gangs based on the association network to obtain gang mining results; The relationship filtering unit is further configured to: eliminate indistinguishable relationships among the customer associations to obtain a first relationship; determine the transaction data volume corresponding to each first relationship, eliminate relationships whose transaction data volume is not within a first range to obtain a second relationship; determine the value set of each second relationship, eliminate relationships whose value set magnitude is not within a second range to obtain a third relationship; eliminate indistinguishable value sets in the third relationship to obtain a fourth relationship; and use the fourth relationship as the candidate networking relationship.

6. The gang excavation device according to claim 5, characterized in that, The unit for determining the grouping method includes: The private transaction determination subunit is used to determine the transaction relationship group diagram if there are only private transactions in the business scenario corresponding to the user transaction data. The corporate transaction determination subunit is used to determine the other relationship group if the business scenario corresponding to the user transaction data only involves corporate transactions. The hybrid determination subunit is used to determine the main transaction type of the risky transaction scenario in the business scenario if the business scenario corresponding to the user transaction data includes both private and corporate transactions; if the main transaction type is a private transaction, it is determined as the transaction relationship group diagram; if the main transaction type is a corporate transaction, it is determined as the other relationship group diagram.

7. The gang excavation device according to claim 5, characterized in that, The relationship filtering unit includes: The first processing subunit is used to remove indistinguishable relationships from the customer association relationships to obtain the first relationship; The second processing subunit is used to determine the transaction data volume corresponding to each of the first relations, eliminate relations whose transaction data volume is not within the first range, and obtain the second relations. The third processing subunit is used to determine the value set of each of the second relations, remove relations whose magnitude is not within the second range, and obtain the third relation; The fourth processing subunit is used to remove the set of indistinguishable values ​​from the third relation to obtain the fourth relation; A subunit is determined for using the fourth relationship as the candidate networking relationship.

8. A computer device, characterized in that, include: Memory, used to store computer programs; A processor, configured to implement the steps of the gang-hunting method as described in any one of claims 1 to 4 when executing the computer program.

9. A readable storage medium, characterized in that, The readable storage medium stores a computer program that, when executed by a processor, implements the steps of the gang-hunting method as described in any one of claims 1 to 4.

Images