Illegal fund transfer identification method and device, electronic device and storage medium

Abstract

The present invention discloses a method for identifying illegal fund transfers, a device thereof, an electronic device, and a storage medium, and relates to the field of financial technology. The method comprises: obtaining information on multiple accounts, constructing a directed graph based on the account information, calculating similarities between nodes with connecting edges based on customer information and account attribute information, calculating weight parameters for the connecting edges based on the similarities, constructing an adjacency matrix based on the weight parameters, constructing a feature set of the directed graph based on the adjacency matrix, and inputting the feature set into a preset integrated model for identification to obtain an identification result. The present invention solves the technical problem in related arts of being unable to extract appropriate features for complex illegal fund transfers, resulting in low accuracy in identifying illegal fund transfers.

Description

Technical Field

[0001] The present invention relates to the field of financial technology, and in particular to a method for identifying illegal fund transfers, a device thereof, an electronic device, and a storage medium. Background Art

[0002] Illegal fund transfer is a process of concealing the illegal source of funds obtained or generated by criminal activities in order to cover up the connection between the funds and the original criminal activities. Currently, a large amount of illegal funds are laundered every year. Illegal fund transferors use profits to cover up criminal clues and try to further separate the funds from their sources.

[0003] In related technologies, some clustering algorithms, such as clustering, decision tree, and neural network, are used to identify illegal fund transfers. However, most of the time, the identification of illegal fund transfers still requires manual judgment by financial practitioners, which is time-consuming and laborious. Existing methods for identifying illegal fund transfers have the following defects: (1) It is impossible to extract appropriate features for illegal fund transfers that cover up their source and destination through frequent and complex transfer transactions. Clustering and ordinary neural network algorithms only consider the transfer information between two accounts. However, for frequent transfer transactions, when the transaction link is relatively long, deeper transaction information cannot be captured through the transaction between two accounts. (2) Illegal fund transferors often choose to transfer small amounts between multiple accounts. Judging from the transfer records between two accounts alone, it is consistent with normal transfer transactions, which easily leads to low accuracy in identifying illegal fund transfers. (3) For professional financial practitioners, manual judgment is inefficient in identifying illegal fund transfers in the face of massive financial transaction data.

[0004] To address the above-mentioned problems, no effective solutions have been proposed so far. Summary of the Invention

[0005] The embodiments of the present invention provide a method for identifying illegal fund transfers, a device thereof, an electronic device, and a storage medium, so as to at least solve the technical problem in the related art that appropriate features cannot be extracted for complex illegal fund transfers, resulting in a low accuracy rate in identifying illegal fund transfer behaviors.

[0006] According to one aspect of an embodiment of the present invention, a method for identifying illegal fund transfer is provided, comprising: obtaining a plurality of account information, and constructing a directed graph based on the account information, wherein the account information includes at least customer information, account attribute information, and transfer information, the directed graph uses accounts as nodes, and in the case where the transfer information exists between accounts, establishing connecting edges between the nodes representing the accounts; calculating the similarity between the nodes with connecting edges based on the customer information and the account attribute information; calculating weight parameters of the connecting edges based on the similarity, and constructing an adjacency matrix based on the weight parameters; constructing a feature set of the directed graph based on the adjacency matrix, and inputting the feature set into a preset integrated model for identification to obtain an identification result, wherein the identification result is used to indicate whether illegal fund transfer occurs between accounts.

[0007] Optionally, the step of constructing a directed graph based on the account information includes: taking the account as a node in the directed graph; judging whether there is a transfer record between every two accounts based on the transfer information in the account information; and establishing connecting edges between the nodes represented by the account in the case where there is a transfer record between the accounts, to obtain the directed graph.

[0008] Optionally, the step of calculating the similarity between nodes with connecting edges based on the customer information and the account attribute information includes: classifying the characteristic variables in the customer information and the characteristic variables in the account attribute information to obtain discrete variables and continuous variables; when the type of the characteristic variable is a discrete variable, using a first calculation formula to calculate the first similarity between nodes with connecting edges; when the type of the characteristic variable is a continuous variable, using a second calculation formula to calculate the second similarity between nodes with connecting edges; and combining the first similarity and the second similarity to obtain the similarity between nodes with connecting edges.

[0009] Optionally, after constructing the directed graph based on the account information, the method further includes: removing loops in the directed graph to obtain a directed graph without loops.

[0010] Optionally, after removing the loop in the directed graph to obtain a loop-free directed graph, the method further includes: determining whether there is historical transfer information between the accounts indicated by the nodes with connecting edges within a preset historical time period; if there is historical transfer information between the accounts indicated by the nodes with connecting edges within a preset historical time period, calculating a third similarity between the current transfer information and the historical transfer information; and if the third similarity is greater than a first preset threshold, removing the connecting edges between the nodes representing the accounts.

[0011] Optionally, after removing the loop in the directed graph to obtain a directed graph without loops, the method further includes: calculating the account balance difference between the accounts indicated by the nodes with connecting edges; and when the account balance difference is less than a second preset threshold, removing the connecting edges between the nodes representing the accounts.

[0012] Optionally, the step of constructing the feature set of the directed graph based on the adjacency matrix includes: normalizing the adjacency matrix to obtain a normalized weight parameter; multiplying the feature vector of the account indicated by each node in the directed graph by the normalized weight parameter to obtain a target feature vector; and combining the target feature vectors of all accounts to obtain the feature set.

[0013] According to another aspect of an embodiment of the present invention, a device for identifying illegal fund transfer is also provided, including: a first construction unit, used to obtain multiple account information, and construct a directed graph based on the account information, wherein the account information includes at least: customer information, account attribute information, and transfer information, the directed graph uses accounts as nodes, and when the transfer information exists between accounts, connecting edges are established between the nodes representing the accounts; a first calculation unit, used to calculate the similarity between nodes with connecting edges based on the customer information and the account attribute information; a second calculation unit, used to calculate the weight parameters of the connecting edges based on the similarity, and construct an adjacency matrix based on the weight parameters; a second construction unit, used to construct a feature set of the directed graph based on the adjacency matrix, and input the feature set into a preset integrated model for identification to obtain an identification result, wherein the identification result is used to indicate whether there is illegal fund transfer between accounts.

[0014] Optionally, the first construction unit includes: a first representation module, used to take the account as a node in the directed graph; a first judgment module, used to judge whether there is a transfer record between every two accounts based on the transfer information in the account information; and a first establishment module, used to establish connecting edges between the nodes of the account representation when there is a transfer record between accounts, so as to obtain the directed graph.

[0015] Optionally, the first calculation unit includes: a first classification module, used to classify the characteristic variables in the customer information and the characteristic variables in the account attribute information to obtain discrete variables and continuous variables; a first calculation module, used to use a first calculation formula to calculate the first similarity between nodes with connecting edges when the type of the characteristic variable is a discrete variable; a second calculation module, used to use a second calculation formula to calculate the second similarity between nodes with connecting edges when the type of the characteristic variable is a continuous variable; a first combination module, used to combine the first similarity and the second similarity to obtain the similarity between nodes with connecting edges.

[0016] Optionally, the identification device further includes: a first removal module, configured to remove loops in the directed graph after constructing the directed graph based on the account information, so as to obtain a directed graph without loops.

[0017] Optionally, the identification device also includes: a second judgment module, which is used to determine whether there is historical transfer information between the accounts indicated by the nodes with connecting edges within a preset historical time period after removing the loop in the directed graph to obtain a directed graph without loops; a third calculation module, which is used to calculate a third similarity between the current transfer information and the historical transfer information when there is historical transfer information between the accounts indicated by the nodes with connecting edges within a preset historical time period; and a second removal module, which is used to remove the connecting edges between the nodes representing the accounts when the third similarity is greater than a first preset threshold.

[0018] Optionally, the identification device further includes: a fourth calculation module, configured to calculate the account balance difference between the accounts indicated by the nodes with connecting edges after removing the loop in the directed graph to obtain a directed graph without loops; and a third removal module, configured to remove the connecting edges between the nodes representing the accounts when the account balance difference is less than a second preset threshold.

[0019] Optionally, the second construction unit includes: a first processing module, used to normalize the adjacency matrix to obtain a normalized weight parameter; a first output module, used to multiply the feature vector of the account indicated by each node in the directed graph by the normalized weight parameter to obtain a target feature vector; and a second output module, used to integrate the target feature vectors of all accounts to obtain the feature set.

[0020] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is further provided, wherein the computer-readable storage medium includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute the above-mentioned method for identifying illegal funds transfer.

[0021] According to another aspect of an embodiment of the present invention, an electronic device is also provided, comprising one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the above-mentioned method for identifying illegal funds transfer.

[0022] In the present disclosure, multiple account information is obtained, and based on the account information, a directed graph is constructed. Based on the customer information and account attribute information, the similarity between nodes with connecting edges is calculated. Based on the similarity, the weight parameters of the connecting edges are calculated. Based on the weight parameters, an adjacency matrix is ​​constructed. Based on the adjacency matrix, a feature set of the directed graph is constructed, and the feature set is input into a preset integrated model for identification to obtain an identification result. In the present application, a directed graph between accounts associated with transfers can be constructed. Based on the account information of the accounts in the directed graph, the weight parameters of the connecting edges are calculated, and an adjacency matrix is ​​constructed, thereby constructing a feature set of the directed graph. The feature set is input into a preset integrated model for illegal fund transfer identification. It is possible to extract appropriate features from illegal fund transfer methods that frequently transfer funds, improve the accuracy of identifying illegal fund transfer behaviors, and thus solve the technical problem in the related art that appropriate features cannot be extracted for complex illegal fund transfers, resulting in a low accuracy rate in identifying illegal fund transfer behaviors. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0024] Figure 1 is a flow chart of an optional method for identifying illegal funds transfer according to an embodiment of the present invention;

[0025] Figure 2 is a schematic diagram of optional attribute information of an account node according to an embodiment of the present invention;

[0026] Figure 3 is a schematic diagram of an optional directed graph with a loop according to an embodiment of the present invention;

[0027] Figure 4 is a schematic diagram of an optional directed graph with loops removed according to an embodiment of the present invention;

[0028] Figure 5 is a schematic diagram of an optional sample balancing according to an embodiment of the present invention;

[0029] Figure 6is a schematic diagram of an optional method for constructing a feature set according to an embodiment of the present invention;

[0030] Figure 7 is a schematic diagram of an optional model structure according to an embodiment of the present invention;

[0031] Figure 8 is a schematic diagram of an optional device for identifying illegal funds transfer according to an embodiment of the present invention;

[0032] Figure 9 The figure is a hardware structure block diagram of an electronic device (or mobile device) for an identification method of illegal fund transfer according to an embodiment of the present invention. DETAILED DESCRIPTION

[0033] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of the present invention.

[0034] It should be noted that the terms "first", "second", etc. in the description and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0035] It should be noted that the method and device for identifying illegal fund transfers in the present disclosure can be used in the field of financial technology to identify illegal fund transfers, and can also be used in any field other than the field of financial technology to identify illegal fund transfers. The present disclosure does not limit the application field of the method and device for identifying illegal fund transfers.

[0036] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for display, data for analysis, etc.) involved in this disclosure are all information and data authorized by the user or fully authorized by all parties.

[0037] The following embodiments of the present invention can be applied to various systems, applications, and devices for identifying illegal fund transfers. The present invention uses graph convolution methods and integrated algorithms to identify illegal fund transfers that conceal their source and destination through frequent and complex transfers. By using each account as a node, edges are established between accounts with transfers to construct a directed graph. Based on the account information in the directed graph, weight parameters for connecting edges are calculated, and an adjacency matrix is ​​constructed to obtain a feature set for the directed graph. This feature set is then input into a pre-set integrated model for illegal fund transfer identification. The graph structure is used to capture chain-like features in transfers, and an integrated algorithm is used to identify these features, effectively improving the accuracy of identifying illegal fund transfers.

[0038] The present invention will be described in detail below with reference to various embodiments.

[0039] Example 1

[0040] According to an embodiment of the present invention, an embodiment of a method for identifying illegal fund transfer is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0041] Figure 1 is a flow chart of an optional method for identifying illegal fund transfer according to an embodiment of the present invention, such as Figure 1 As shown, the method includes the following steps:

[0042] Step S101: Acquire multiple account information and construct a directed graph based on the account information, wherein the account information includes at least: customer information, account attribute information, and transfer information. The directed graph uses accounts as nodes. When transfer information exists between accounts, connecting edges are established between the nodes representing the accounts.

[0043] Step S102 : Calculate the similarity between nodes with connecting edges based on the customer information and account attribute information.

[0044] Step S103: Calculate the weight parameters of the connecting edges based on the similarity, and construct an adjacency matrix based on the weight parameters.

[0045] Step S104: construct a feature set of the directed graph based on the adjacency matrix, and input the feature set into a preset integrated model for recognition to obtain a recognition result, wherein the recognition result is used to indicate whether there is illegal fund transfer between accounts.

[0046] Through the above steps, multiple account information can be obtained, and based on the account information, a directed graph can be constructed. Based on the customer information and account attribute information, the similarity between nodes with connecting edges is calculated. Based on the similarity, the weight parameters of the connecting edges are calculated. Based on the weight parameters, an adjacency matrix is ​​constructed. Based on the adjacency matrix, a feature set of the directed graph is constructed, and the feature set is input into a preset integrated model for identification to obtain an identification result. In an embodiment of the present invention, a directed graph between accounts associated with transfers can be constructed. Based on the account information of the accounts in the directed graph, the weight parameters of the connecting edges are calculated, and an adjacency matrix is ​​constructed, thereby constructing a feature set of the directed graph. The feature set is input into a preset integrated model for illegal fund transfer identification, which can extract appropriate features from illegal fund transfer methods with frequent transfers, improve the accuracy of identifying illegal fund transfer behaviors, and thus solve the technical problem in the related art that appropriate features cannot be extracted for complex illegal fund transfers, resulting in a low accuracy rate in identifying illegal fund transfer behaviors.

[0047] The embodiment of the present invention is described in detail below in conjunction with the above steps.

[0048] Step S101: Acquire multiple account information and construct a directed graph based on the account information, wherein the account information includes at least: customer information, account attribute information, and transfer information. The directed graph uses accounts as nodes. When transfer information exists between accounts, connecting edges are established between the nodes representing the accounts.

[0049] In an embodiment of the present invention, account information can be obtained first. The account information may include: customer information (for example, gender, age, place of residence, etc.), account attribute information (for example, account opening address, bank, account type, account opening time, etc.), and transfer information (for example, amount, date, transfer method (such as mobile phone, ATM, counter, etc.)). In this embodiment, accounts can be used as nodes. When there is transfer information between accounts, connecting edges between nodes representing accounts are established, thereby obtaining a directed graph, in which account nodes can contain some attribute information.

[0050] Figure 2 is a schematic diagram of optional attribute information of an account node according to an embodiment of the present invention, such as Figure 2 As shown, the account node may include attribute information such as customer basic information, account basic information, and transfer basic information. Among them, customer basic information includes: gender, age, registered residence, etc.; account basic information includes: account opening address, bank, account type, account opening time, etc.; transfer basic information includes: amount, date, transfer method, etc.

[0051] Optionally, the step of constructing a directed graph based on the account information includes: treating the account as a node in the directed graph; judging whether there is a transfer record between every two accounts based on the transfer information in the account information; and establishing connecting edges between the nodes represented by the accounts when there is a transfer record between the accounts to obtain a directed graph.

[0052] In an embodiment of the present invention, an account can be used as a node in a directed graph, and based on the transfer information in the account information, it is determined whether there is a transfer record between each two accounts. If there is a transfer record between the accounts, a connecting edge is established between the nodes represented by the account, thereby obtaining a directed graph.

[0053] Optionally, after constructing the directed graph based on the account information, the method further includes: removing loops in the directed graph to obtain a directed graph without loops.

[0054] In an embodiment of the present invention, using transfer actions as edges can easily cause loops in the graph. When using the adjacency matrix for feature calculation, a graph with loops can easily generate a large amount of repeated calculations. It is necessary to remove the corresponding edges based on the transfer information features between accounts to avoid the generation of loops.

[0055] In this embodiment, in order to avoid the ineffective computation caused by loops, loops in the directed graph are removed to obtain a directed graph without loops.

[0056] Figure 3 is a schematic diagram of an optional directed graph with a loop according to an embodiment of the present invention, such as Figure 3 As shown, it includes: account 1 to account 7, among which there is a loop between account 4 and account 3, a loop between account 3 and account 2, and connecting edges between account 5 and account 3, account 2 and account 1, account 6 and account 2, and account 7 and account 6.

[0057] Figure 4 is a schematic diagram of an optional directed graph with loop removed according to an embodiment of the present invention, such as Figure 4 As shown, it includes: account 1 to account 7, among which there are connecting edges between account 4 and account 3, account 3 and account 2, account 5 and account 3, account 2 and account 1, account 6 and account 2, and account 7 and account 6. Figure 4 is by Figure 3 The directed graph without cycles is obtained by removing the cycles in .

[0058] Optionally, after removing the loop in the directed graph to obtain a directed graph without loops, it also includes: determining whether there is historical transfer information between the accounts indicated by the nodes with connecting edges within a preset historical time period; if there is historical transfer information between the accounts indicated by the nodes with connecting edges within a preset historical time period, calculating the third similarity between the current transfer information and the historical transfer information; if the third similarity is greater than a first preset threshold, removing the connecting edges between the nodes representing the accounts.

[0059] In an embodiment of the present invention, after removing loops from a directed graph, some non-suspicious transfers can be removed, with more attention paid to suspicious transfers to reduce computational complexity. In this embodiment, a calculation can be performed to determine whether a current edge (the connecting edge between two account nodes currently having transfer records) has a transfer record in history (i.e., determining whether there is historical transfer information between the accounts indicated by the nodes with the connecting edge within a preset historical time period). If there is historical transfer information between the accounts indicated by the nodes with the connecting edge within the preset historical time period, the similarity (i.e., a third similarity) between the two transfers (i.e., the current transfer information and the historical transfer information) is calculated. If the third similarity is greater than a first preset threshold (which can be set based on actual circumstances), it indicates that the two accounts have frequently transferred to each other and may be trusted accounts. The suspiciousness of the current transfer between the two accounts has decreased, and the connecting edge between the nodes representing the two accounts can be removed.

[0060] Optionally, after removing the loop in the directed graph to obtain a directed graph without loops, it also includes: calculating the account balance difference between the accounts indicated by the nodes with connecting edges; when the account balance difference is less than a second preset threshold, removing the connecting edges between the nodes representing the accounts.

[0061] In an embodiment of the present invention, the balance difference between two accounts at the time of transfer can be calculated (i.e., the account balance difference between the accounts indicated by the nodes with connecting edges is calculated). The purpose of illegal fund transfer is to aggregate the amount. The smaller the balance difference between the two accounts, the less suspicious it is. When the account balance difference is less than a second preset threshold (which can be set according to actual conditions), the connecting edges between the nodes representing the accounts can be removed.

[0062] Step S102 : Calculate the similarity between nodes with connecting edges based on the customer information and account attribute information.

[0063] Optionally, the step of calculating the similarity between nodes with connecting edges based on customer information and account attribute information includes: classifying the characteristic variables in the customer information and the characteristic variables in the account attribute information to obtain discrete variables and continuous variables; when the type of the characteristic variable is a discrete variable, using a first calculation formula to calculate the first similarity between the nodes with connecting edges; when the type of the characteristic variable is a continuous variable, using a second calculation formula to calculate the second similarity between the nodes with connecting edges; and combining the first similarity and the second similarity to obtain the similarity between the nodes with connecting edges.

[0064] In an embodiment of the present invention, the similarity between the basic customer information and the basic account information in adjacent nodes can be calculated to obtain the similarity between nodes with connecting edges (i.e., the similarity between nodes with connecting edges is calculated based on the customer information and the account attribute information). Specifically, the feature variables in the customer information and the feature variables in the account attribute information can be divided into discrete variables and continuous variables. Discrete variables can be variables that can be discretized, such as gender and account opening address, and continuous variables can be variables that can be quantified, such as age. For discrete variables, the formula for calculating similarity is: (That is, the first calculation formula is used to calculate the first similarity between nodes with connecting edges, where x is the feature vector of one of the accounts (composed of the discrete variables of the account), y is the feature vector of the other account (composed of the discrete variables of the account), and n is the length of the feature vector). For continuous variables, the formula for calculating similarity can be the reciprocal of the Euclidean distance plus one. (That is, the second calculation formula is used to calculate the second similarity between nodes with connecting edges, where x is the characteristic vector of one of the accounts (composed of the continuous variables of the account), and y is the characteristic vector of the other account (composed of the continuous variables of the account)). Afterwards, the first similarity and the second similarity can be combined to obtain the similarity D between the nodes with connecting edges (that is, the formula D=D1+kD2 is used to calculate the similarity D, where K is a hyperparameter. Adding the hyperparameter k to the calculation of D can make the smaller the similarity between the two accounts, the greater the weight of the constructed edge through training).

[0065] Step S103: Calculate the weight parameters of the connecting edges based on the similarity, and construct an adjacency matrix based on the weight parameters.

[0066] In an embodiment of the present invention, the more dissimilar the account attributes are, the greater the possibility that the transfer is illegal funds transfer (the similarity can be judged based on the account attributes, for example, whether the opening bank is in the same city, whether the customer basic information is in the same region, whether it is across banks, etc.). In this embodiment, the weight parameter of the connecting edge can be calculated based on the calculated similarity (that is, the actual proportional coefficient can be calculated based on the actual situation, so that the less similar the two accounts are, the greater the weight of the constructed edge). Afterwards, the adjacency matrix can be constructed based on the weight parameter.

[0067] Table 1 is an optional adjacency matrix constructed based on account 1 to account 4. As shown in Table 1, it shows that the similarity between account 3 and account 3 is the smallest.

[0068] Table 1

[0069]

[0070]

[0071] Alternatively, after constructing the adjacency matrix (i.e., the similarity matrix D), the attention matrix can be calculated. The specific calculation formula is as follows:

[0072]

[0073]

[0074]

[0075]

[0076] Among them, Z is the latent vector matrix obtained by the similarity matrix D and the input feature h, is obtained by using the nonlinear function σ through the current node and its adjacent nodes, i represents the i-th account node, j represents the j-th account node, l represents the current layer, and Calculate the attention matrix After obtaining the attention matrix, the next layer of features is calculated n represents the number of all adjacent account nodes of a certain account node, k represents the current k-th adjacent account node, and w represents the shared parameter matrix.

[0077] Step S104: construct a feature set of the directed graph based on the adjacency matrix, and input the feature set into a preset integrated model for recognition to obtain a recognition result, wherein the recognition result is used to indicate whether there is illegal fund transfer between accounts.

[0078] In an embodiment of the present invention, when the nodes and edges in the graph are constructed (i.e., after the directed graph is constructed), an integrated model can be trained to identify illegal fund transfer behaviors, for example, Figure 4 In the example, assuming that the transfer from account 2 to account 1 is an illegal fund transfer, a series of account features (i.e., the feature set of the accounts involved in each link) of the relevant transfer links (i.e., from account 4 to account 3 to account 2 to account 1, from account 5 to account 3 to account 2 to account 1, from account 7 to account 6 to account 2 to account 1, etc.) are obtained through the constructed directed graph structure to identify the features of the current transfer. The results can then be identified using the LGB (Light Gradient Boosting Machine) algorithm in the integrated algorithm.

[0079] In this embodiment, a feature set of a directed graph can be constructed based on the adjacency matrix, and then the feature set can be input into a preset integrated model for identification, thereby identifying whether there is illegal fund transfer between accounts.

[0080] Optionally, before recognition, the samples can be balanced (for example, using the Bootstrap (a statistical estimation method) algorithm). Specifically, the samples that correctly predict positive examples in the prediction model can be taken out separately, Gaussian noise is added to the data, and the data is re-introduced into the training set for training. The main purposes of sample balancing are twofold: (1) to balance the training samples to avoid imbalances in precision and recall caused by an imbalance in the number of positive and negative examples; (2) to increase the generalization ability of the model by adding noise to the correctly predicted positive examples and re-training them.

[0081] Figure 5 is a schematic diagram of an optional sample balancing according to an embodiment of the present invention, such as Figure 5 As shown in the figure, the anti-money laundering data features obtained by graph convolution are input into the Boosting integrated prediction model for prediction (i.e., identification is performed in the preset integrated model, where the Boosting integrated prediction model is an optional integrated model) to determine whether the positive example is correctly predicted. After that, Gaussian noise is added and graph convolution is performed again to obtain the anti-money laundering data features.

[0082] Optionally, the step of constructing a feature set of a directed graph based on the adjacency matrix includes: normalizing the adjacency matrix to obtain a normalized weight parameter; multiplying the feature vector of the account indicated by each node in the directed graph by the normalized weight parameter to obtain a target feature vector; and combining the target feature vectors of all accounts to obtain a feature set.

[0083] In an embodiment of the present invention, the adjacency matrix can be normalized to obtain a normalized weight parameter, and then the feature vector of the account indicated by each node in the directed graph is multiplied by the normalized weight parameter to obtain a target feature vector. After that, the target feature vectors of all accounts are combined to obtain a feature set (i.e., a multi-dimensional vector is compressed into a one-dimensional vector). The obtained feature set is input into the integrated model for identification to determine whether the current transfer behavior is an illegal fund transfer behavior. For example, Figure 4 Taking the fund transfer path from account 4 to account 3 to account 2 to account 1 in the example, explain in detail how to obtain the feature set of the directed graph.

[0084] Figure 6 is a schematic diagram of an optional feature set construction according to an embodiment of the present invention, such as Figure 6 As shown, Figure 4 To construct a feature set from the directed graph of the fund transfer path from account 4 to account 3 to account 2 to account 1, the feature set of account 4 (i.e., the feature set of the attribute information included in the account) can be multiplied by the edge weight 4->3 (i.e., the weight parameter of the connection edge between account node 4 and account node 3), the feature set of account 3 (i.e., the feature set of the attribute information included in the account) can be multiplied by the edge weight 3->2 (i.e., the weight parameter of the connection edge between account node 3 and account node 2), the feature set of account 2 (i.e., the feature set of the attribute information included in the account) can be multiplied by the edge weight 2->1 (i.e., the weight parameter of the connection edge between account node 2 and account node 1), and the feature set of account 1 (i.e., the feature set of the attribute information included in the account) can be summed to obtain the recognition model input features (i.e., the feature set, which is used to input into the integrated model for recognition).

[0085] Another optional step of constructing a predicted feature set includes: for each anti-money laundering transfer process, there is a flow of funds between a series of accounts. When money laundering behavior is discovered, the current transfer funds have already circulated through multiple accounts. For this, the relationship between accounts is constructed according to the graph structure of nodes and edges. The features are calculated and extracted through the graph attention convolutional neural network. The account transfer features obtained through graph convolution include the account features of the series of fund transfer operations with it. The account chains of these transfers form a sequence. Based on the characteristics of the sequence, this article uses the long short term memory (LSTM) model to model and predict money laundering behavior.

[0086] Figure 7 is a schematic diagram of an optional model structure according to an embodiment of the present invention, such as Figure 7 As shown in the model structure, the symbol σ corresponds to the sigmoid function, and τ corresponds to the tanh function. is matrix addition, is the matrix dot product, ft represents the function of choosing to forget certain past information, it represents the function of remembering certain present information, C~t represents the function of merging past and present memories, and ot represents the output function. When the transfer from "account-1", "account-2" to "account-n" constitutes money laundering, when the LSTM model is used for modeling and prediction, each account will generate two variables c and h after the calculation of the nonlinear function (where c represents the transfer information from the previous account to the current account parameter; h represents the hidden variable of the current account feature after the nonlinear function parameter). The hn of the last account is taken as the final prediction feature of the current money laundering sequence data, and a simple fully connected network is used for prediction (i.e., DDIs predict). The prediction of the LSTM model can transfer the more important features of the money laundering sequence data from the beginning account to the features of the last account when making predictions, which can improve the accuracy of the prediction.

[0087] In an embodiment of the present invention, a directed graph constructed using account information can effectively capture the features of frequently transferred illegal funds transfer methods. The extracted features can improve the accuracy of identifying frequently transferred illegal funds transfer methods, thereby avoiding more financial crimes.

[0088] Example 2

[0089] The device for identifying illegal fund transfer provided in this embodiment includes multiple implementation units, each of which corresponds to each implementation step in the above-mentioned embodiment 1.

[0090] Figure 8 is a schematic diagram of an optional device for identifying illegal funds transfer according to an embodiment of the present invention, such as Figure 8 As shown, the recognition device may include: a first construction unit 80, a first calculation unit 81, a second calculation unit 82, and a second construction unit 83, wherein:

[0091] A first construction unit 80 is configured to obtain multiple account information and construct a directed graph based on the account information, wherein the account information includes at least customer information, account attribute information, and transfer information. The directed graph uses accounts as nodes, and when transfer information exists between accounts, edges are established between the nodes representing the accounts.

[0092] A first calculation unit 81 is configured to calculate similarities between nodes having connecting edges based on customer information and account attribute information;

[0093] The second calculation unit 82 is used to calculate the weight parameters of the connecting edges based on the similarity, and construct an adjacency matrix based on the weight parameters;

[0094] The second construction unit 83 is used to construct a feature set of a directed graph based on the adjacency matrix, and input the feature set into a preset integrated model for recognition to obtain a recognition result, wherein the recognition result is used to indicate whether there is illegal fund transfer between accounts.

[0095] The above-mentioned identification device can obtain multiple account information through the first construction unit 80, and construct a directed graph based on the account information. The first calculation unit 81 calculates the similarity between nodes with connecting edges based on customer information and account attribute information. The second calculation unit 82 calculates the weight parameters of the connecting edges based on the similarity, and constructs an adjacency matrix based on the weight parameters. The second construction unit 83 constructs a feature set of the directed graph based on the adjacency matrix, and inputs the feature set into a preset integrated model for identification to obtain an identification result. In an embodiment of the present invention, a directed graph between accounts associated with transfers can be constructed, and the weight parameters of the connecting edges are calculated based on the account information of the accounts in the directed graph, and an adjacency matrix is ​​constructed, thereby constructing a feature set of the directed graph. The feature set is input into the preset integrated model for illegal fund transfer identification. It can extract appropriate features from illegal fund transfer methods with frequent transfers, improve the accuracy of identifying illegal fund transfer behavior, and thus solve the technical problem in the related art that it is impossible to extract appropriate features for complex illegal fund transfers, resulting in low accuracy in identifying illegal fund transfer behavior.

[0096] Optionally, the first construction unit includes: a first representation module, used to treat the account as a node in a directed graph; a first judgment module, used to determine whether there is a transfer record between each two accounts based on the transfer information in the account information; and a first establishment module, used to establish connecting edges between the nodes of the account representation when there is a transfer record between the accounts, to obtain a directed graph.

[0097] Optionally, the first calculation unit includes: a first classification module, used to classify the characteristic variables in the customer information and the characteristic variables in the account attribute information to obtain discrete variables and continuous variables; a first calculation module, used to use a first calculation formula to calculate the first similarity between nodes with connecting edges when the type of the characteristic variable is a discrete variable; a second calculation module, used to use a second calculation formula to calculate the second similarity between nodes with connecting edges when the type of the characteristic variable is a continuous variable; a first combination module, used to combine the first similarity and the second similarity to obtain the similarity between nodes with connecting edges.

[0098] Optionally, the identification device further includes: a first removal module, configured to remove loops in the directed graph after constructing the directed graph based on the account information, so as to obtain a directed graph without loops.

[0099] Optionally, the identification device also includes: a second judgment module, which is used to determine whether there is historical transfer information between the accounts indicated by the nodes with connecting edges within a preset historical time period after removing the loop in the directed graph to obtain a directed graph without loops; a third calculation module, which is used to calculate the third similarity between the current transfer information and the historical transfer information when there is historical transfer information between the accounts indicated by the nodes with connecting edges within a preset historical time period; and a second removal module, which is used to remove the connecting edges between the nodes representing the accounts when the third similarity is greater than a first preset threshold.

[0100] Optionally, the identification device also includes: a fourth calculation module, used to calculate the account balance difference between the accounts indicated by the nodes with connecting edges after removing the loop in the directed graph to obtain a directed graph without loops; and a third removal module, used to remove the connecting edges between the nodes representing the accounts when the account balance difference is less than a second preset threshold.

[0101] Optionally, the second construction unit includes: a first processing module, used to normalize the adjacency matrix to obtain a normalized weight parameter; a first output module, used to multiply the feature vector of the account indicated by each node in the directed graph by the normalized weight parameter to obtain a target feature vector; and a second output module, used to integrate the target feature vectors of all accounts to obtain a feature set.

[0102] The above-mentioned recognition device may also include a processor and a memory. The above-mentioned first construction unit 80, first calculation unit 81, second calculation unit 82, second construction unit 83, etc. are all stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to realize corresponding functions.

[0103] The processor includes a kernel, which retrieves the corresponding program unit from the memory. One or more kernels can be provided, and the kernel parameters are adjusted to input the feature set into the preset integrated model for recognition, thereby obtaining the recognition result.

[0104] The above-mentioned memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0105] The present application also provides a computer program product, which, when executed on a data processing device, is suitable for executing a program initialized with the following method steps: obtaining multiple account information, and based on the account information, constructing a directed graph, based on the customer information and account attribute information, calculating the similarity between nodes with connecting edges, based on the similarity, calculating the weight parameters of the connecting edges, and based on the weight parameters, constructing an adjacency matrix, based on the adjacency matrix, constructing a feature set of the directed graph, and inputting the feature set into a preset integrated model for recognition to obtain a recognition result.

[0106] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is provided, which includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute the above-mentioned method for identifying illegal funds transfer.

[0107] According to another aspect of an embodiment of the present invention, an electronic device is also provided, comprising one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by one or more processors, the one or more processors implement the above-mentioned method for identifying illegal funds transfer.

[0108] Figure 9 FIG. 1 is a hardware structure diagram of an electronic device (or mobile device) for an identification method for illegal fund transfer according to an embodiment of the present invention. Figure 9 As shown, the electronic device may include one or more (illustrated as 102a, 102b, ..., 102n in the figure) processors 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 104 for storing data. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the I / O interface), a network interface, a keyboard, a power supply and / or a camera. It will be understood by those skilled in the art that Figure 9 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 9 More or fewer components than shown, or with Figure 9 Different configurations shown.

[0109] The serial numbers of the above embodiments of the present invention are for description only and do not represent the advantages or disadvantages of the embodiments.

[0110] In the above embodiments of the present invention, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0111] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only exemplary. For example, the division of the units can be a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0112] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0113] In addition, the functional units in the various embodiments of the present invention may be integrated into a single processing unit, each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0114] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk, etc. Various media that can store program codes.

[0115] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as within the scope of protection of the present invention.

Claims

1. A method for identifying illegal fund transfer, characterized in that: include: Acquire multiple account information and construct a directed graph based on the account information, wherein the account information includes at least customer information, account attribute information, and transfer information. The directed graph uses accounts as nodes, and when the transfer information exists between accounts, establish connecting edges between the nodes representing the accounts. Removing loops from the directed graph to obtain a loop-free directed graph; Determine whether there is historical transfer information between accounts indicated by nodes with connecting edges within a preset historical time period; When there is historical transfer information between the accounts indicated by the nodes having the connecting edge within a preset historical time period, calculating a third similarity between the current transfer information and the historical transfer information; When the third similarity is greater than a first preset threshold, removing the connection edges between the nodes of the account representation; Calculating similarities between nodes having connecting edges based on the customer information and the account attribute information; Calculating weight parameters of the connecting edges based on the similarities, and constructing an adjacency matrix based on the weight parameters; Based on the adjacency matrix, a feature set of the directed graph is constructed, and the feature set is input into a preset integrated model for recognition to obtain a recognition result, wherein the recognition result is used to indicate whether there is illegal fund transfer between accounts.

2. The identification method according to claim 1, characterized in that The step of constructing a directed graph based on the account information includes: Treat the account as a node in the directed graph; Based on the transfer information in the account information, determining whether there is a transfer record between every two accounts; In the case where there are transfer records between accounts, connecting edges are established between the nodes represented by the accounts to obtain the directed graph.

3. The identification method according to claim 1, characterized in that The step of calculating the similarity between nodes having connecting edges based on the customer information and the account attribute information includes: Classifying the characteristic variables in the customer information and the characteristic variables in the account attribute information to obtain discrete variables and continuous variables; In a case where the type of the feature variable is a discrete variable, a first calculation formula is used to calculate a first similarity between nodes having connecting edges; In the case where the type of the feature variable is a continuous variable, a second calculation formula is used to calculate the second similarity between the nodes having connecting edges; The first similarity and the second similarity are combined to obtain the similarity between the nodes having the connecting edge.

4. The identification method according to claim 1, wherein: After removing the loop in the directed graph to obtain a loop-free directed graph, the method further includes: Calculate the difference in account balances between the accounts indicated by the nodes with connected edges; When the account balance difference is less than a second preset threshold, the connection edges between the nodes representing the account are removed.

5. The identification method according to claim 1, characterized in that The step of constructing a feature set of the directed graph based on the adjacency matrix includes: Normalizing the adjacency matrix to obtain normalized weight parameters; Multiplying the feature vector of the account indicated by each node in the directed graph by the normalized weight parameter to obtain a target feature vector; The target feature vectors of all accounts are combined to obtain the feature set.

6. A device for identifying illegal fund transfers, characterized in that: include: A first construction unit is configured to obtain a plurality of account information and construct a directed graph based on the account information, wherein the account information includes at least customer information, account attribute information, and transfer information. The directed graph uses accounts as nodes, and when the transfer information exists between accounts, edges are established between the nodes representing the accounts. a first removal module configured to, after constructing a directed graph based on the account information, remove loops in the directed graph to obtain a directed graph without loops; A second determination module is configured to, after removing loops from the directed graph to obtain a loop-free directed graph, determine whether there is historical transfer information between accounts indicated by nodes having connecting edges within a preset historical time period; a third calculation module, configured to calculate a third similarity between the current transfer information and the historical transfer information when there is historical transfer information between the accounts indicated by the nodes having the connecting edge within a preset historical time period; A second removal module, configured to remove the connection edges between the nodes of the account representation when the third similarity is greater than a first preset threshold; a first calculation unit, configured to calculate similarities between nodes having connecting edges based on the customer information and the account attribute information; A second calculation unit is used to calculate the weight parameters of the connecting edges based on the similarity, and construct an adjacency matrix based on the weight parameters; The second construction unit is used to construct a feature set of the directed graph based on the adjacency matrix, and input the feature set into a preset integrated model for recognition to obtain a recognition result, wherein the recognition result is used to indicate whether there is illegal fund transfer between accounts.

7. A computer-readable storage medium, characterized in that The computer-readable storage medium includes a stored computer program, wherein when the computer program is executed, the device where the computer-readable storage medium is located is controlled to execute the method for identifying illegal fund transfer according to any one of claims 1 to 5.

8. An electronic device, characterized in that: The invention comprises one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the method for identifying illegal fund transfer according to any one of claims 1 to 5.

Images