Abnormal Transaction Account Identification Method, Device, and Computer-Readable Storage Medium

Abstract

The present application discloses a method, apparatus, and computer-readable storage medium for identifying abnormal trading accounts, which relate to the field of financial technology or other related fields. Among them, the method includes: obtaining a fund transaction graph; generating a set of node features based on the fund transaction graph; inputting each node feature vector into a pre-trained graph attention network model to obtain a prediction result corresponding to each node, where the prediction result is used to characterize whether the account corresponding to each node is an abnormal fund trading account, and the graph attention network model is trained based on a graph different from the fund transaction graph. The present application solves the technical problem of the low prediction efficiency of the existing graph neural network model for new abnormal trading accounts.

Description

Technical Field

[0001] The present application relates to the field of fintech or other related fields. Specifically, it relates to a method, device, and computer-readable storage medium for identifying abnormal transaction accounts. Background Art

[0002] In the financial field, abnormal fund transaction behaviors will seriously disrupt the normal operation of financial institutions and endanger social security. Therefore, cracking down on abnormal fund transaction behaviors is an important strategy for maintaining national long-term stability. Among them, abnormal fund transaction behaviors can be understood as the process of covering up and concealing the sources and natures of the proceeds of illegal and criminal activities through various means and transaction methods.

[0003] Among them, with the rapid development of the Internet finance industry, transaction methods and economic activities have become more complex and diverse, which further increases the difficulty of identifying abnormal fund transaction behaviors. Existing technologies usually use a graph neural network model to find abnormal transaction accounts that have carried out abnormal fund transaction behaviors from multiple accounts. However, the existing graph neural network model is good at dealing with direct-push learning tasks, that is, all training data and test data need to be considered simultaneously during the learning process, and both the training stage and the test stage are online. In other words, when the existing graph neural network model identifies an abnormal transaction account, if the graph neural network model is trained based on training graph A, then the graph neural network model can only make predictions based on training graph A and identify the abnormal nodes representing abnormal transaction accounts in training graph A. However, the graph neural network model cannot make predictions based on the nodes in other graphs. If it is necessary to make predictions on the nodes in other graphs, a new graph neural network model can only be constructed according to other graphs.

[0004] It can be seen that for the continuously dynamically changing fund transaction graph, it is impossible to use the existing graph neural network model to make predictions on new nodes in real time, that is, the prediction efficiency for new abnormal transaction accounts is relatively low. Summary of the Invention

[0005] Embodiments of the present application provide a method, device, and computer-readable storage medium for identifying abnormal transaction accounts, so as to at least solve the technical problem that the existing graph neural network model has a low prediction efficiency for new abnormal transaction accounts.

[0006] According to one aspect of the embodiments of the present application, a method for identifying abnormal transaction accounts is provided, including: obtaining a fund transaction graph, where the fund transaction graph consists of nodes and edges, the nodes represent account data of the accounts corresponding to the nodes, and the edges between two nodes represent the transaction flow between the two nodes; generating a node feature set based on the fund transaction graph, where the node feature set consists of at least one node feature vector, and each node feature vector corresponds to a node in the fund transaction graph; inputting each node feature vector into a pre-trained graph attention network model to obtain a prediction result corresponding to each node, where the prediction result is used to represent whether the account corresponding to each node is an abnormal account for fund transactions, and the graph attention network model is trained based on a graph different from the fund transaction graph.

[0007] Further, the method for identifying abnormal transaction accounts further includes: before inputting each node feature vector into the pre-trained graph attention network model to obtain the prediction result corresponding to each node, obtaining historical transaction data, where the historical transaction data at least includes multiple abnormal accounts, multiple normal accounts, and the account labels of each account, the account label of an abnormal account represents that the abnormal account has had abnormal fund transaction behaviors, and the account label of a normal account represents that the normal account has not had abnormal fund transaction behaviors; constructing a training graph based on the historical transaction data; generating a first feature set and a second feature set based on the training graph, where the first feature set contains multiple historical node feature vectors, and the second feature set contains multiple historical edge feature vectors, each historical node feature vector corresponds to a training node in the training graph, and each historical edge feature vector corresponds to a training edge in the training graph; training the graph attention network model according to the first feature set and the second feature set.

[0008] Further, the method for identifying abnormal transaction accounts further includes: Step 1: Determine a target edge in the training graph and two target nodes associated with the target edge, where the target edge is any training edge in the training graph; Step 2: Obtain the first node feature vector corresponding to the target node from the first feature set, and obtain the first edge feature vector corresponding to the target edge from the second feature set; Step 3: Perform a superposition process on the first node feature vector and the first edge feature vector to obtain the second edge feature vector corresponding to the target edge; Step 4: Perform a non-linearization process on the second edge feature vector to obtain the target edge feature vector corresponding to the target edge; Step 5: Repeat the above Steps 1 to 4 to obtain the target edge feature vector corresponding to each training edge in the training graph; Step 6: Train the graph attention network model according to the target edge feature vector corresponding to each training edge in the training graph.

[0009] Furthermore, the method for identifying abnormal trading accounts further includes: based on the training graph, determining at least one first training edge connected to each training node; determining the first target edge feature vector corresponding to the first training edge; determining the attention coefficient corresponding to the first target edge feature vector; performing an aggregation process on at least one first target edge feature vector based on the attention coefficient to obtain the second node feature vector corresponding to each training node; and training a graph attention network model according to the second node feature vector corresponding to each training node.

[0010] Furthermore, the method for identifying abnormal trading accounts further includes: performing a superposition process on the second node feature vector corresponding to each training node and the historical node feature vector corresponding to the training node to obtain the third node feature vector corresponding to each training node; performing a non-linearization process on the third node feature vector to obtain the target node feature vector corresponding to each training node; and training a graph attention network model according to the target node feature vector and the account label corresponding to the target node feature vector.

[0011] Furthermore, the method for identifying abnormal trading accounts further includes: obtaining a target fund trading graph, where the target fund trading graph at least includes a plurality of nodes to be confirmed and at least one abnormal node in the fund trading graph, where the account corresponding to the abnormal node is a fund trading abnormal account, and the plurality of nodes to be confirmed are nodes that do not appear in the fund trading graph; and constructing a social network model based on the target fund trading graph, where in the social network model, the larger the trading amount between two nodes, the greater the social relationship weight value between the two nodes, and the closer the social relationship between the two nodes.

[0012] Furthermore, the method for identifying abnormal trading accounts further includes: after constructing a social network model based on the fund trading graph, determining a trading node that has had a fund trading behavior with the abnormal node among the plurality of nodes to be confirmed; determining the similarity between the trading node and the abnormal node according to the social relationship weight value between the abnormal node and the trading node in the social network model; and determining the trading node as a candidate node when the similarity is greater than a preset similarity, where the candidate node is a node with a fund trading risk.

[0013] Further, the method for identifying an abnormal trading account further includes: after determining that a trading node is a candidate node, determining a fourth node feature vector corresponding to the abnormal node from the node feature set; generating a fifth node feature vector corresponding to the candidate node based on the target fund trading graph; determining the covariance and variance between the fourth node feature vector and the fifth node feature vector; determining the correlation coefficient between the candidate node and the abnormal node according to the covariance and variance; when the correlation coefficient is greater than a preset threshold, determining that the candidate node is a new abnormal node, and the account corresponding to the candidate node is also an abnormal account for fund trading.

[0014] According to another aspect of the embodiments of the present application, there is also provided an apparatus for identifying an abnormal trading account, including: an acquisition module, configured to acquire a fund trading graph, where the fund trading graph is composed of nodes and edges, the nodes represent account data of the accounts corresponding to the nodes, and the edges between two nodes represent the trading flow directions between the two nodes; a generation module, configured to generate a node feature set based on the fund trading graph, where the node feature set is composed of at least one node feature vector, and each node feature vector corresponds to a node in the fund trading graph; an input module, configured to input each node feature vector into a pre-trained graph attention network model to obtain a prediction result corresponding to each node, where the prediction result is used to represent whether the account corresponding to each node is an abnormal account for fund trading, and the graph attention network model is trained based on a graph different from the fund trading graph.

[0015] According to another aspect of the embodiments of the present application, there is also provided a computer-readable storage medium, in which a computer program is stored, where the computer program is configured to execute the above-mentioned method for identifying an abnormal trading account when running.

[0016] According to another aspect of the embodiments of the present application, there is also provided an electronic device, including one or more processors and a memory, where the memory is used to store one or more programs, and when the one or more programs are executed by the one or more processors, the one or more processors are caused to implement the above-mentioned method for identifying an abnormal trading account.

[0017] In the embodiments of the present application, a method is adopted in which the prediction results corresponding to each node are predicted through a pre-trained graph attention network model. By obtaining a fund transaction graph and generating a set of node features based on the fund transaction graph, where the set of node features consists of at least one node feature vector, and each node feature vector corresponds to a node in the fund transaction graph. The fund transaction graph is composed of nodes and edges. The nodes represent the account data of the accounts corresponding to the nodes, and the edge between two nodes represents the transaction flow direction between the two nodes. Finally, each node feature vector is input into the pre-trained graph attention network model to obtain the prediction result corresponding to each node, where the prediction result is used to represent whether the account corresponding to each node is an abnormal account for fund transactions. The graph attention network model is trained based on a graph different from the fund transaction graph.

[0018] As can be seen from the above, the present application does not use a traditional graph neural network model, but predicts the fund transaction graph through a graph attention network model to obtain the prediction results corresponding to each node. Since the graph attention network model is trained based on a graph different from the fund transaction graph, in other words, the graph used by the graph attention network model in the training stage is different from the fund transaction graph. Therefore, on this basis, the present application achieves the effect of separating and processing training data and test data. Thus, after training a graph attention network model, any fund transaction graph can be predicted through this graph attention network model to cope with the constantly changing fund transaction graph, and further solves the problem that the existing graph neural network model cannot predict new nodes in real time, and improves the prediction efficiency for new abnormal transaction accounts.

[0019] It can be seen that through the technical solution of the present application, the purpose of real-time prediction for the dynamically changing fund transaction graph is achieved, the effect of improving the prediction timeliness rate of abnormal transaction accounts is realized, and the problem that the prediction efficiency of the existing technology for new abnormal transaction accounts is relatively low is solved. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation to the present application. In the drawings:

[0021] Figure 1 is a flowchart of an optional method for identifying abnormal transaction accounts according to an embodiment of the present application;

[0022] Figure 2 is a flowchart of an optional method for identifying abnormal transaction accounts according to an embodiment of the present application;

[0023] Figure 3 It is a schematic diagram of an optional abnormal transaction account identification device according to an embodiment of the present application;

[0024] Figure 4 It is a schematic diagram of an optional electronic device according to an embodiment of the present application. Detailed implementation manners

[0025] In order to enable those skilled in the art to better understand the solution of the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present application.

[0026] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and do not necessarily need to be used to describe a specific order or sequence. It should be understood that such data can be interchanged under appropriate circumstances so that the embodiments of the present application described herein can be implemented in an order different from those illustrated or described herein. In addition, the terms "comprising" and "having" and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, system, product or device including a series of steps or units does not necessarily have to be limited to those steps or units clearly listed, but may include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0027] In addition, it should also be noted that the relevant information (including but not limited to user equipment information, user personal information, etc.) and data (including but not limited to data for display, data for analysis, etc.) involved in the present disclosure are all information and data authorized by the user or fully authorized by all parties. For example, an interface is provided between the present system and relevant users or institutions. Before obtaining relevant information, a request for acquisition needs to be sent to the aforementioned users or institutions through the interface, and after receiving the consent information feedback from the aforementioned users or institutions, the relevant information can be obtained.

[0028] Embodiment 1

[0029] According to an embodiment of the present application, an embodiment of a method for identifying an abnormal transaction account is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that here.

[0030] It should be noted that an abnormal account identification system can be the execution entity of the abnormal transaction account identification method in the embodiments of the present application. Among them, the abnormal account identification system can run on an electronic device.

[0031] Figure 1 is a flowchart of an optional abnormal transaction account identification method according to the embodiments of the present application, as Figure 1 shown, the method includes the following steps:

[0032] Step S101, obtain a fund transaction graph.

[0033] In step S101, the fund transaction graph is composed of nodes and edges. The nodes represent the account data of the accounts corresponding to the nodes, and the edges between two nodes represent the transaction flow directions between the two nodes.

[0034] Among them, the fund transaction graph is constructed based on test data. The test data can be the transaction data to be predicted. For each transaction data, the abnormal account identification system will assign a transaction ID (identity document, unique identifier) to it, and at the same time collect its source user information (including user ID, age, occupation, gender), source account ID, transaction time, transaction type (including electronic payment for shopping, POS (point of sales) machine payment for shopping, atm (automated teller machine) cash withdrawal, atm cash deposit, bank counter cash deposit, electronic transfer, atm paper transfer, etc.), beneficiary account ID, and beneficiary ID. Among them, the source account can be understood as the payment account in this transaction, the source user can be understood as the holder of the source account, the beneficiary account can be understood as the receiving account in this transaction, and the beneficiary can be understood as the holder of the beneficiary account.

[0035] After obtaining the transaction data and obtaining the above information for each transaction data, the abnormal account identification system constructs a fund transaction graph with each user as a node and the transaction flow direction as a directed edge. Among them, in the present application, the fund transaction graph can be represented by G(V, E), where V represents the set of nodes and E represents the set of edges between nodes.

[0036] Step S102, generate a node feature set based on the fund transaction graph.

[0037] In step S102, the node feature set is composed of at least one node feature vector, and each node feature vector corresponds to a node in the fund transaction graph.

[0038] In an optional embodiment, according to the constructed fund transaction graph, the abnormal account identification system can generate an adjacency matrix H, where hij is the element in the i-th row and j-th column of the adjacency matrix. If there is a transaction initiated by user i to user j, then h ij = 1. If there is a transaction initiated by user j to user i, then h ji = 1. Secondly, the abnormal account recognition system can characterize the features of each node in the fund transaction graph through the node feature vector, and can also characterize the features of each edge in the fund transaction graph through the edge feature vector. For example, the node feature vector of user i can be expressed as f i , and the edge feature vector of the transaction initiated by user i to user j can be expressed as f ij . Among them, the features of the user (i.e., the features of each node) at least include user ID, age, occupation, gender, etc. In addition, the abnormal account recognition system can also use one-hot encoding to numericalize the features of the user. For example, gender "male" is represented as "10", and gender "female" is represented as "01"; occupations ["actor", "chef", "civil servant", "engineer", "lawyer"] are encoded as ["10000", "01000", "00100", "00010", "00001"] in turn. The features of the transaction (i.e., the features of each edge) at least include the source user ID, source account ID, transaction time, transaction type, beneficiary account ID, and beneficiary ID. Similarly, for the features of the transaction, the abnormal account recognition system also uses one-hot encoding to numericalize them.

[0039] It should be noted that whether it is the features of the transaction or the features of the user, they are all discrete features in themselves. For example, the occupation of the user is doctor, teacher, etc. These discrete features need to be mapped to the Euclidean space through one-hot encoding before they can be used in machine learning algorithms such as regression, classification, and clustering. Because the calculation of the distance or similarity between features in machine learning is calculated in the Euclidean space, the discrete features need to be transformed.

[0040] After encoding the features of each node and each edge through one-hot encoding, the node feature vector corresponding to each node and the edge feature vector corresponding to each edge are obtained. The abnormal account recognition system combines all the node feature vectors into a node feature set and combines all the edge feature vectors into an edge feature set. For example, if there are m nodes and ε edges in the fund transaction graph, the node feature set generated by the abnormal account recognition system is expressed as F V ={f1, f2, …, f m}, where n represents the dimension of the node feature vector, is an n-dimensional vector space. The edge feature set generated by the abnormal account recognition system is expressed as F E ={f 11 , f 12, …, f mm} , where e represents the dimension of the edge feature vector, representing a vector space of e dimensions.

[0041] Step S103: Input each node feature vector into a pre-trained graph attention network model to obtain the prediction result corresponding to each node.

[0042] In step S103, the prediction result is used to characterize whether the account corresponding to each node is an abnormal fund transaction account. The graph attention network model is trained based on a graph different from the fund transaction graph.

[0043] In an optional embodiment, the graph attention network model first updates each edge feature vector in the edge feature set according to an update function, and then aggregates the updated edge feature vectors onto each node feature vector according to an aggregation function to obtain the aggregated node feature vectors. Since there are multiple nodes in the fund transaction graph, there are also multiple aggregated node feature vectors. Subsequently, the graph attention network model updates the multiple aggregated node feature vectors according to the update function to obtain multiple node feature vectors to be predicted. For example, for a certain node feature vector f i in the node feature set, a node feature vector to be predicted is finally generated The graph attention network model uses the multiple node feature vectors to be predicted as the input of a multi-layer perceptron, and generates the probability distribution of each node with respect to the corresponding label through a softmax (normalized exponential function) layer. Among them, the loss function of the graph attention network model uses a cross-entropy function and adds L2 regularization to prevent the graph attention network model from overfitting. The formula of the loss function is as follows:

[0044]

[0045] where y ij is the corresponding label of the node; p ij is the probability value of the category corresponding to the node predicted by the model; λ||θ|| 2 is the regularization term. The label can be a normal account label and an abnormal account label. The normal account label indicates that the account corresponding to the node has not had any abnormal fund transaction behavior, and the abnormal account label indicates that the account corresponding to the node has had abnormal fund transaction behavior. If the probability of the normal account label of the node is greater than the probability of the abnormal account label of the node, it means that the account corresponding to the node is an abnormal fund transaction account.

[0046] It should be noted that, compared with traditional graph neural network models, graph attention network models can handle inductive tasks. An inductive task means that the graphs processed in the training phase and the testing phase are different. Usually, inductive tasks only need to be performed on subgraphs in the training phase, while in the testing phase, unknown graphs need to be processed. Based on this feature, the present application uses a graph attention network model to process the constantly changing fund transaction graph, so as to achieve real-time detection of each node in the fund transaction graph, and solve the problem that traditional graph neural network models cannot predict new nodes in real time.

[0047] Based on the content of the above steps S101 to S103, it can be seen that in the embodiment of the present application, the method of predicting the prediction result corresponding to each node by using a pre-trained graph attention network model is adopted. By obtaining the fund transaction graph and generating a node feature set based on the fund transaction graph, where the node feature set is composed of at least one node feature vector, and each node feature vector corresponds to a node in the fund transaction graph. The fund transaction graph is composed of nodes and edges. The node represents the account data of the account corresponding to the node, and the edge between two nodes represents the transaction flow direction between the two nodes. Finally, each node feature vector is input into the pre-trained graph attention network model to obtain the prediction result corresponding to each node, where the prediction result is used to represent whether the account corresponding to each node is an abnormal account for fund transactions. The graph attention network model is trained based on a graph different from the fund transaction graph.

[0048] From the above content, it can be seen that the present application does not use a traditional graph neural network model, but predicts the fund transaction graph through a graph attention network model to obtain the prediction result corresponding to each node. Since the graph attention network model is trained based on a graph different from the fund transaction graph, in other words, the graph used by the graph attention network model in the training phase is different from the fund transaction graph. Therefore, on this basis, the present application achieves the effect of separating the training data and the testing data. Thus, after training a graph attention network model, any fund transaction graph can be predicted through this graph attention network model, and thus deal with the constantly changing fund transaction graph, and further solve the problem that the existing graph neural network model cannot predict new nodes in real time, and improve the prediction efficiency for new abnormal transaction accounts.

[0049] It can be seen that through the technical solution of the present application, the purpose of real-time prediction for the dynamically changing fund transaction graph is achieved, the effect of improving the prediction timeliness rate of abnormal transaction accounts is realized, and the problem that the prediction efficiency of the existing technology for new abnormal transaction accounts is relatively low is solved.

[0050] In an alternative embodiment, before inputting each node feature vector into the pre-trained graph attention network model to obtain the prediction result corresponding to each node, the abnormal account recognition system first needs to train the graph attention network model. Specifically, the abnormal account recognition system first obtains historical transaction data, where the historical transaction data at least includes a plurality of abnormal accounts, a plurality of normal accounts, and the account label of each account. The account label of an abnormal account represents that the abnormal account has had abnormal fund transaction behaviors, and the account label of a normal account represents that the normal account has not had abnormal fund transaction behaviors. Then, the abnormal account recognition system constructs a training graph based on the historical transaction data, and based on the training graph, generates a first feature set and a second feature set, where the first feature set contains a plurality of historical node feature vectors, and the second feature set contains a plurality of historical edge feature vectors. Each historical node feature vector corresponds to a training node in the training graph, and each historical edge feature vector corresponds to a training edge in the training graph. Finally, the abnormal account recognition system trains the graph attention network model according to the first feature set and the second feature set.

[0051] Optionally, the abnormal account recognition system can select the transaction data within a historical time period from the database as the historical transaction data. The historical transaction data at least includes abnormal accounts and normal accounts, and includes the account information of each account, the information of the account holder, the transaction details information, and the account label of the account. Among them, the account label can be a manually labeled label or an automatically labeled label through machine learning. After obtaining the historical transaction data, the abnormal account recognition system constructs a training graph based on the historical transaction data, and at the same time, based on the training graph, performs one-hot encoding on the historical node features corresponding to each training node, and performs one-hot encoding on the historical nodes corresponding to each training edge to obtain historical node feature vectors and historical edge feature vectors. Since there are a plurality of training nodes and a plurality of training edges in the training graph, the abnormal account recognition system will obtain a plurality of historical node feature vectors and a plurality of historical edge feature vectors based on the training graph. The abnormal account recognition system will generate a first feature set based on the plurality of historical node feature vectors and a second feature set based on the plurality of historical edge feature vectors.

[0052] In an alternative embodiment, since the transaction features between transaction nodes can fully reflect the user's transaction behaviors and fund flows, when using the graph attention network for feature aggregation, not only the features of the nodes and the simple topological structure between the nodes should be considered, but also the features of the edges should be considered when embedding the nodes. On this basis, when training the graph attention network model in this application, the features of the training edges should also be considered. Specifically, in order to aggregate the features of the training edges to each training node, the following steps are required:

[0053] Step 1: Determine the target edge from the training graph spectrum and two target nodes associated with the target edge, where the target edge is any training edge in the training graph spectrum; Step 2: Obtain the first node feature vector corresponding to the target node from the first feature set and the first edge feature vector corresponding to the target edge from the second feature set; Step 3: Perform superposition processing on the first node feature vector and the first edge feature vector to obtain the second edge feature vector corresponding to the target edge; Step 4: Perform non-linear processing on the second edge feature vector to obtain the target edge feature vector corresponding to the target edge; Step 5: Loop through the above Steps 1 to 4 to obtain the target edge feature vector corresponding to each training edge in the training graph spectrum; Step 6: Train a graph attention network model based on the target edge feature vector corresponding to each training edge in the training graph spectrum.

[0054] Optionally, taking the first feature set as F V ={f1,f2,…,f m}, and the second feature set as F E ={f 11 ,f 12 ,…,f mm} as an example for illustration, the embedding process of the graph attention network nodes can be as shown in Algorithm 1 below:

[0055] Input: G(V,E),F V ,F E ;

[0056] Output: F′ V ={f′1,f′2,…,f′ m};

[0057] For k∈{1,...,ε} do;

[0058] Update the attributes of the edge

[0059] End for;

[0060] For h∈{1,...,m} do;

[0061] let F′ Eh ={f′ h1 ,f′ h2 ,...,f′ hm};

[0062] Aggregate the attributes of the edge to each node

[0063] Update the node attributes

[0064] End for;

[0065] Let F′ V ={f′1,f′2,...,f′ m};

[0066] let F′ E ={f′ 11 ,f′ 12 ,...,f′ mm};

[0067] Aggregate the attributes of global edges

[0068] Aggregate the attributes of global nodes

[0069] Return(F′ E ,F′ V )

[0070] Where, in Algorithm 1, ρ is the aggregation function, is the update function. In the graph attention network, the self-attention mechanism is implemented for each node, and the mechanism is The attention coefficient is e ij =a[Wf i ||Wf j ). The correlation between node i and node j in the self-attention mechanism is as follows:

[0071]

[0072] In the formula: α ij is the attention coefficient from node j to node i; N(i) is the neighbor of node i; is the weight matrix to be trained, which represents the relationship between the input n features and the output n′ features, and is used to transform the node features into higher-level features. Use LeakyReLU as the activation function and normalize through the softmax function, where || represents vector concatenation. Therefore, the aggregation function in Algorithm 1 is expressed as follows:

[0073] f′ j =σ(∑ j∈N(i) α ij Wf j )

[0074] In an alternative embodiment, the first edge feature vector corresponding to the target edge described above may be f ij in Algorithm 1, and the first node feature vector may be f i , f j . in Algorithm 1 ij represents that according to the update function, f ij and fi , f j Superimpose these three to obtain the second edge feature vector, and then perform non-linear processing on the second edge feature vector to obtain the target edge feature vector f'. ij . In Algorithm 1, by executing the for loop, the target edge feature vector corresponding to each training edge can be obtained.

[0075] In an alternative embodiment, after obtaining the target edge feature vector corresponding to each training edge, the abnormal account recognition system determines at least one first training edge connected to each training node based on the training graph, determines the first target edge feature vector corresponding to the first training edge, and determines the attention coefficient corresponding to the first target edge feature vector. Then, the abnormal account recognition system performs an aggregation process on at least one first target edge feature vector based on the attention coefficient to obtain the second node feature vector corresponding to each training node, and trains a graph attention network model according to the second node feature vector corresponding to each training node.

[0076] Among them, as shown in Algorithm 1, For h ∈ {1,..., m} do means selecting a training node h from m training nodes; let F' Eh = {f' h1 , f' h2 ,..., f' hm} means determining the first target edge feature vectors corresponding to at least one training edge connected to the training node h, that is, f' h1 , f' h2 ,..., f' hm ; represents performing an aggregation process on at least one first target edge feature vector according to the aggregation function ρ to obtain the second node feature vector corresponding to the training node h Among them, the aggregation function ρ contains attention coefficients.

[0077] In an alternative embodiment, after obtaining the second node feature vector corresponding to each training node, the abnormal account recognition system performs a superimposition process on the second node feature vector corresponding to each training node and the historical node feature vector corresponding to the training node to obtain the third node feature vector corresponding to each training node, and performs non-linear processing on the third node feature vector to obtain the target node feature vector corresponding to each training node. Finally, a graph attention network model is trained according to the target node feature vector and the account label corresponding to the target node feature vector.

[0078] Optionally, as shown in Algorithm 1 represents updating the second node feature vector corresponding to the training node h according to the update function The historical node feature vector f corresponding to the training node h h First, perform a superposition process to obtain the third node feature vector corresponding to the training node h, and then perform a non-linearization process on the third node feature vector to obtain the target node feature vector corresponding to the training node h. It should be noted that in this application, only the feature update and feature aggregation of the node feature vector of the training node are performed, and the number of node feature vectors and the corresponding relationship of the account labels are not changed. In other words, if the first feature set is F V ={f1, f2, …, f m}, then the target node feature vector set is F' V ={f'1, f'2, …, f' m}, where the target node feature vector f'1 corresponds to the historical node feature vector f1, and the account label corresponding to f'1 is the account label corresponding to f1; the target node feature vector f' m corresponds to the historical node feature vector f m , and the account label corresponding to f' m is the account label corresponding to f m . On this basis, according to the obtained target node feature vector and the account label corresponding to the target node feature vector, the abnormal account recognition system can train to obtain a graph attention network model.

[0079] Optionally, let F' in Algorithm 1 V ={f'1, f'2,..., f' m}, aggregating the attributes of global points means looping to obtain the target node feature vector corresponding to each training node and performing secondary aggregation on multiple target node feature vectors. Let F' in Algorithm 1 E ={f' 11 , f' 12 ,..., f' mm}, aggregating the attributes of global edges means looping to obtain the target edge feature vector corresponding to each training edge and performing secondary aggregation on multiple target edge feature vectors. However, in this application, only F' V needs to be obtained, that is, the target node feature vector corresponding to each training edge.

[0080] In an alternative embodiment, after each node feature vector is input into a pre-trained graph attention network model to obtain the prediction result corresponding to each node, the abnormal account recognition system may further obtain a target fund transaction graph, where the target fund transaction graph includes at least multiple nodes to be confirmed and at least one abnormal node in the fund transaction graph. The account corresponding to the abnormal node is an abnormal fund transaction account, and the multiple nodes to be confirmed are nodes that do not appear in the fund transaction graph. Then, the abnormal account recognition system constructs a social network model based on the target fund transaction graph. In the social network model, the greater the transaction amount between two nodes, the greater the social relationship weight value between the two nodes, and the closer the social relationship between the two nodes.

[0081] Optionally, the present application also provides another method for detecting abnormal fund transaction accounts. Based on the abnormal nodes already identified by the graph attention network model, if there are abnormal nodes corresponding to the accounts in a batch of new transaction data, then this batch of new transaction data may have new abnormal fund transaction accounts. In other words, there may be new abnormal nodes associated with the abnormal nodes in the new transaction data. To find these new abnormal nodes faster and determine their association with the already discovered abnormal nodes, the abnormal account recognition system in the present application may first construct a target fund transaction graph according to this batch of new transaction data, and then construct a social network model G′(V, E, ω) based on the target fund transaction graph. Among them, in the social network model, the fund transaction relationship between nodes is mapped into a social relationship, and the transaction amount between two nodes is normalized into the social relationship weight value ω between the two nodes. The greater the transaction amount, the greater the social relationship weight value ω, indicating that the social relationship between the two nodes is closer. In addition, v∈V is the set of nodes, e∈E is the set of edges, and ω ij ∈ω is the set of weights. For the normalized weight, its calculation formula is as follows:

[0082]

[0083] where N(i) represents all neighbor nodes of node i, and N ij represents the amount of funds transferred from node i to node j.

[0084] In an alternative embodiment, after constructing a social network model based on the fund transaction graph, the abnormal account recognition system first determines the transaction nodes that have had fund transaction behaviors with the abnormal nodes among the multiple nodes to be confirmed, then determines the similarity between the transaction nodes and the abnormal nodes according to the social relationship weight value between the abnormal nodes and the transaction nodes in the social network model, and finally determines the transaction nodes as candidate nodes when the similarity is greater than the preset similarity. The candidate nodes are nodes with potential fund transaction risks.

[0085] Optionally, since multiple abnormal fund trading accounts involved in the same abnormal fund trading behavior usually split a large amount of funds into small amounts and then conduct multiple transfer operations through multiple intermediate nodes in order to avoid the identification rules of abnormal fund trading behavior set in the supervision system, in most cases, the abnormal nodes involved in the same abnormal fund trading behavior usually have similar characteristics. On this basis, the present application first finds the trading nodes that have had fund trading behavior with the abnormal nodes according to the determined abnormal nodes, and then calculates the similarity between these trading nodes and the abnormal nodes. The following is the calculation formula for calculating the similarity between nodes in combination with the degree of closeness of social relationships in the present application:

[0086]

[0087] where j ∈ N(i), and N(i) represents all trading nodes related to node i.

[0088] In an optional embodiment, after determining that the trading node is a candidate node, the abnormal account identification system determines the fourth node feature vector corresponding to the abnormal node from the node feature set, generates the fifth node feature vector corresponding to the candidate node based on the target fund trading graph, then determines the covariance and variance between the fourth node feature vector and the fifth node feature vector, and determines the correlation coefficient between the candidate node and the abnormal node according to the covariance and variance. Finally, when the correlation coefficient is greater than the preset threshold, the abnormal account identification system determines that the candidate node is a new abnormal node, and the account corresponding to the candidate node is also an abnormal fund trading account.

[0089] In the actual application process, a high similarity between a trading node and a similar node does not fully prove that the trading node is also an abnormal node. Therefore, after determining the candidate nodes with a similarity greater than the preset similarity from the trading nodes, the present application will also use correlation analysis to deeply explore the correlation relationship between the candidate nodes and the abnormal nodes. The correlation coefficient is defined as:

[0090]

[0091] where j is the candidate node with a similarity higher than the preset similarity to the abnormal node i, cov(f i ,f j ) is the covariance of the feature vectors of node i and node j, D(f i ) and D(f j) They are the variances of the feature vectors of node i and node j respectively. The value of the correlation coefficient ρ ranges from [-1, 1]. The closer the absolute value of ρ is to 1, the higher the linear correlation between node i and node j. The closer it is to 0, the lower the correlation. Finally, if the correlation coefficient of node j is greater than the preset threshold, the abnormal account recognition system will identify node j as a new abnormal node and add node j to the set M of abnormal accounts of fund transactions associated with node i i In

[0092] In an alternative embodiment, as Figure 2 shown, when identifying abnormal fund transaction accounts through the technical means of this application, first obtain transaction data, and then preprocess the transaction data. For example, assign a transaction ID to each transaction data, collect source user information, source account ID, transaction time, transaction type, beneficiary account ID, and beneficiary ID. Construct a fund transaction graph based on the preprocessed transaction data, and then use the fund transaction graph to obtain the node feature vector of each node. Input the node feature vector into a pre-trained graph attention network model. The graph attention network model generates a prediction result based on the account labels of the multi-layer perceptron to obtain abnormal nodes. After determining the abnormal nodes, if there is a target fund transaction graph containing abnormal nodes, this application will determine the transaction nodes with transaction behaviors with the abnormal nodes from the target fund transaction graph, determine candidate nodes by comparing the similarity between the transaction nodes and the abnormal nodes, and then determine whether the candidate nodes are new abnormal nodes by calculating the correlation coefficient between the candidate nodes and the abnormal nodes, so as to achieve the purpose of mining all abnormal accounts of fund transactions

[0093] It can be seen that through the technical solution of this application, not only can real-time prediction be performed on the dynamic fund transaction graph to solve the problem that the existing graph neural network model cannot predict abnormal fund transaction accounts in real time, but also the technical solution of this application can obtain the association relationship between multiple abnormal nodes by establishing a social network model, thereby further improving the recognition efficiency of abnormal fund transaction accounts, and further achieving the purpose of fully identifying all abnormal accounts of fund transactions

[0094] Embodiment 2

[0095] According to the embodiment of this application, an identification device for abnormal transaction accounts is further provided, where Figure 3 is a schematic diagram of an alternative identification device for abnormal transaction accounts according to the embodiment of this application, as Figure 3As shown in the figure, the device includes: an acquisition module 301, configured to acquire a fund transaction graph, where the fund transaction graph consists of nodes and edges, the nodes represent account data of the accounts corresponding to the nodes, and the edge between two nodes represents the transaction flow between the two nodes; a generation module 302, configured to generate a node feature set based on the fund transaction graph, where the node feature set consists of at least one node feature vector, and each node feature vector corresponds to a node in the fund transaction graph; an input module 303, configured to input each node feature vector into a pre-trained graph attention network model to obtain a prediction result corresponding to each node, where the prediction result is used to represent whether the account corresponding to each node is an abnormal account for fund transactions, and the graph attention network model is trained based on a graph different from the fund transaction graph.

[0096] It should be noted that the above acquisition module 301, generation module 302, and input module 303 correspond to steps S101 to S103 in the above embodiment 1. The examples and application scenarios implemented by the three modules and the corresponding steps are the same, but are not limited to the content disclosed in the above embodiment 1.

[0097] Optionally, the abnormal transaction account identification device further includes: a first acquisition module, a construction module, a first generation module, and a training module. Among them, the first acquisition module is configured to acquire historical transaction data, where the historical transaction data at least includes multiple abnormal accounts, multiple normal accounts, and the account labels of each account. The account label of an abnormal account represents that the abnormal account has had abnormal fund transaction behaviors, and the account label of a normal account represents that the normal account has not had abnormal fund transaction behaviors; the construction module is configured to construct a training graph according to the historical transaction data; the first generation module is configured to generate a first feature set and a second feature set based on the training graph, where the first feature set contains multiple historical node feature vectors, and the second feature set contains multiple historical edge feature vectors. Each historical node feature vector corresponds to a training node in the training graph, and each historical edge feature vector corresponds to a training edge in the training graph; the training module is configured to train a graph attention network model according to the first feature set and the second feature set.

[0098] Optionally, the above training module further includes: a first execution module, a second execution module, a third execution module, a fourth execution module, a fifth execution module, and a sixth execution module. Among them, the first execution module is configured to execute Step 1: determine a target edge and two target nodes associated with the target edge from the training graph, where the target edge is any training edge in the training graph; the second execution module is configured to execute Step 2: obtain the first node feature vector corresponding to the target node from the first feature set and obtain the first edge feature vector corresponding to the target edge from the second feature set; the third execution module is configured to execute Step 3: perform a superposition process on the first node feature vector and the first edge feature vector to obtain the second edge feature vector corresponding to the target edge; the fourth execution module is configured to execute Step 4: perform a non-linearization process on the second edge feature vector to obtain the target edge feature vector corresponding to the target edge; the fifth execution module is configured to execute Step 5: loop the above Steps 1 to 4 to obtain the target edge feature vector corresponding to each training edge in the training graph; the sixth execution module is configured to execute Step 6: train a graph attention network model according to the target edge feature vector corresponding to each training edge in the training graph.

[0099] Optionally, the above sixth execution module further includes: a first determination module, a second determination module, a third determination module, an aggregation module, and a first training module. Among them, the first determination module is configured to determine at least one first training edge connected to each training node based on the training graph; the second determination module is configured to determine the first target edge feature vector corresponding to the first training edge; the third determination module is configured to determine the attention coefficient corresponding to the first target edge feature vector; the aggregation module is configured to perform an aggregation process on at least one first target edge feature vector based on the attention coefficient to obtain the second node feature vector corresponding to each training node; the first training module is configured to train a graph attention network model according to the second node feature vector corresponding to each training node.

[0100] Optionally, the above first training module further includes: a first superposition processing module, a first non-linearization processing module, and a second training module. Among them, the first superposition processing module is configured to perform a superposition process on the second node feature vector corresponding to each training node and the historical node feature vector corresponding to the training node to obtain the third node feature vector corresponding to each training node; the first non-linearization processing module is configured to perform a non-linearization process on the third node feature vector to obtain the target node feature vector corresponding to each training node; the second training module is configured to train a graph attention network model according to the target node feature vector and the account label corresponding to the target node feature vector.

[0101] Optionally, the identification device for abnormal transaction accounts further includes: a second acquisition module and a first construction module. The second acquisition module is configured to acquire a target fund transaction graph, where the target fund transaction graph includes at least a plurality of nodes to be confirmed and at least one abnormal node in the fund transaction graph, and the account corresponding to the abnormal node is an abnormal fund transaction account, and the plurality of nodes to be confirmed are nodes that do not appear in the fund transaction graph; the first construction module is configured to construct a social network model based on the target fund transaction graph, where in the social network model, the greater the transaction amount between two nodes, the greater the social relationship weight value between the two nodes, and the closer the social relationship between the two nodes.

[0102] Optionally, the identification device for abnormal transaction accounts further includes: a fourth determination module, a fifth determination module, and a sixth determination module. The fourth determination module is configured to determine a transaction node that has had a fund transaction behavior with the abnormal node among the plurality of nodes to be confirmed; the fifth determination module is configured to determine the similarity between the transaction node and the abnormal node according to the social relationship weight value between the abnormal node and the transaction node in the social network model; the sixth determination module is configured to determine the transaction node as a candidate node when the similarity is greater than a preset similarity, where the candidate node is a node with a fund transaction risk.

[0103] Optionally, the identification device for abnormal transaction accounts further includes: a seventh determination module, a second generation module, an eighth determination module, a ninth determination module, and a tenth determination module. The seventh determination module is configured to determine a fourth node feature vector corresponding to the abnormal node from the node feature set; the second generation module is configured to generate a fifth node feature vector corresponding to the candidate node based on the target fund transaction graph; the eighth determination module is configured to determine the covariance and variance between the fourth node feature vector and the fifth node feature vector; the ninth determination module is configured to determine the correlation coefficient between the candidate node and the abnormal node according to the covariance and variance; the tenth determination module is configured to determine the candidate node as a new abnormal node when the correlation coefficient is greater than a preset threshold, and the account corresponding to the candidate node is also an abnormal fund transaction account.

[0104] Embodiment 3

[0105] According to an embodiment of the present application, there is also provided a computer-readable storage medium storing a computer program, where the computer program is configured to execute the identification method for abnormal transaction accounts in the above Embodiment 1 when running.

[0106] Embodiment 4

[0107] According to an embodiment of the present application, there is also provided an embodiment of an electronic device, where Figure 4 is a schematic diagram of an optional electronic device according to an embodiment of the present application, asFigure 4 As shown, the electronic device includes a processor, a memory, and a program stored in the memory and executable on the processor. When the processor executes the program, the following steps are implemented:

[0108] Obtain a fund transaction graph, where the fund transaction graph consists of nodes and edges. The nodes represent account data of the accounts corresponding to the nodes, and the edges between two nodes represent the transaction flow between the two nodes; based on the fund transaction graph, generate a node feature set, where the node feature set consists of at least one node feature vector, and each node feature vector corresponds to a node in the fund transaction graph; input each node feature vector into a pre-trained graph attention network model to obtain a prediction result corresponding to each node, where the prediction result is used to represent whether the account corresponding to each node is an abnormal account for fund transactions, and the graph attention network model is trained based on a graph different from the fund transaction graph.

[0109] Optionally, when the processor executes the program, the following steps are also implemented: before inputting each node feature vector into the pre-trained graph attention network model to obtain a prediction result corresponding to each node, obtain historical transaction data, where the historical transaction data at least includes multiple abnormal accounts, multiple normal accounts, and the account labels of each account. The account label of an abnormal account represents that the abnormal account has had abnormal fund transaction behaviors, and the account label of a normal account represents that the normal account has not had abnormal fund transaction behaviors; construct a training graph based on the historical transaction data; based on the training graph, generate a first feature set and a second feature set, where the first feature set contains multiple historical node feature vectors, and the second feature set contains multiple historical edge feature vectors. Each historical node feature vector corresponds to a training node in the training graph, and each historical edge feature vector corresponds to a training edge in the training graph; train the graph attention network model according to the first feature set and the second feature set.

[0110] Optionally, when the processor executes the program, the following steps are also implemented: Step 1: Determine a target edge and two target nodes associated with the target edge from the training graph, where the target edge is any training edge in the training graph; Step 2: Obtain the first node feature vector corresponding to the target node from the first feature set, and obtain the first edge feature vector corresponding to the target edge from the second feature set; Step 3: Perform superposition processing on the first node feature vector and the first edge feature vector to obtain the second edge feature vector corresponding to the target edge; Step 4: Perform non-linear processing on the second edge feature vector to obtain the target edge feature vector corresponding to the target edge; Step 5: Loop the above Steps 1 to 4 to obtain the target edge feature vector corresponding to each training edge in the training graph; Step 6: Train a graph attention network model according to the target edge feature vector corresponding to each training edge in the training graph.

[0111] Optionally, when the processor executes the program, the following steps are also implemented: Based on the training graph, determine at least one first training edge connected to each training node; Determine the first target edge feature vector corresponding to the first training edge; Determine the attention coefficient corresponding to the first target edge feature vector; Aggregate at least one first target edge feature vector based on the attention coefficient to obtain the second node feature vector corresponding to each training node; Train a graph attention network model according to the second node feature vector corresponding to each training node.

[0112] Optionally, when the processor executes the program, the following steps are also implemented: Perform superposition processing on the second node feature vector corresponding to each training node and the historical node feature vector corresponding to the training node to obtain the third node feature vector corresponding to each training node; Perform non-linear processing on the third node feature vector to obtain the target node feature vector corresponding to each training node; Train a graph attention network model according to the target node feature vector and the account label corresponding to the target node feature vector.

[0113] Optionally, when the processor executes the program, the following steps are also implemented: Obtain a target fund transaction graph, where the target fund transaction graph contains at least multiple nodes to be confirmed and at least one abnormal node in the fund transaction graph, where the account corresponding to the abnormal node is a fund transaction abnormal account, and the multiple nodes to be confirmed are nodes that do not appear in the fund transaction graph; Based on the target fund transaction graph, construct a social network model, where in the social network model, the larger the transaction amount between two nodes, the greater the social relationship weight value between the two nodes, and the closer the social relationship between the two nodes.

[0114] Optionally, when the processor executes the program, the following steps are also implemented: after constructing the social network model based on the fund transaction graph, determining the transaction nodes that have had fund transaction behaviors with the abnormal nodes among multiple nodes to be confirmed; determining the similarity between the transaction nodes and the abnormal nodes according to the social relationship weight values of the abnormal nodes and the transaction nodes in the social network model; and when the similarity is greater than the preset similarity, determining the transaction nodes as candidate nodes, where the candidate nodes are nodes with fund transaction risks.

[0115] Optionally, when the processor executes the program, the following steps are also implemented: after determining the transaction nodes as candidate nodes, determining the fourth node feature vector corresponding to the abnormal nodes from the node feature set; generating the fifth node feature vector corresponding to the candidate nodes based on the target fund transaction graph; determining the covariance and variance between the fourth node feature vector and the fifth node feature vector; determining the correlation coefficient between the candidate nodes and the abnormal nodes according to the covariance and variance; and when the correlation coefficient is greater than the preset threshold, determining the candidate nodes as new abnormal nodes, and the accounts corresponding to the candidate nodes are also abnormal fund transaction accounts.

[0116] The serial numbers of the embodiments of the present application above are only for description and do not represent the advantages and disadvantages of the embodiments.

[0117] In the above embodiments of the present application, the descriptions of the various embodiments have their own emphases. For the parts not detailed in a certain embodiment, reference may be made to the relevant descriptions of other embodiments.

[0118] In several embodiments provided by the present application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only illustrative. For example, the division of units can be a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the displayed or discussed couplings or direct couplings or communication connections to each other can be through some interfaces. The indirect couplings or communication connections of units or modules can be in electrical or other forms.

[0119] The units described as separate components may or may not be physically separated. The components displayed as units may or may not be physical units, that is, they can be located in one place or distributed to multiple units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0120] In addition, each functional unit in various embodiments of the present application may be integrated into one processing unit, may exist physically alone for each unit, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of a software functional unit.

[0121] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it may be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of the present application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, may be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods in various embodiments of the present application. The foregoing storage medium includes: various media such as USB flash drives, read-only memories (ROMs), random access memories (RAMs), mobile hard disks, magnetic disks, or optical discs that can store program codes.

[0122] The above are only the preferred embodiments of the present application. It should be noted that for those of ordinary skill in the art, without departing from the principle of the present application, several improvements and refinements can be made, and these improvements and refinements should also be regarded as the protection scope of the present application.

Claims

1. A method for identifying abnormal trading accounts, characterized in that, Including: Obtain a fund transaction graph, where the fund transaction graph is composed of nodes and edges. The nodes represent account data of the accounts corresponding to the nodes, and the edge between two nodes represents the transaction flow between the two nodes. Based on the fund transaction graph, generate a node feature set, where the node feature set is composed of at least one node feature vector, and each node feature vector corresponds to a node in the fund transaction graph. Input each node feature vector into a pre-trained graph attention network model to obtain a prediction result corresponding to each node, where the prediction result is used to represent whether the account corresponding to each node is an abnormal fund transaction account, and the graph attention network model is trained based on a graph different from the fund transaction graph. After obtaining the prediction result corresponding to each node, it includes: Obtain a target fund transaction graph, where the target fund transaction graph contains at least multiple nodes to be confirmed and at least one abnormal node in the fund transaction graph. The account corresponding to the abnormal node is the abnormal fund transaction account, and the multiple nodes to be confirmed are nodes that do not appear in the fund transaction graph. Based on the target fund transaction graph, construct a social network model. In the social network model, the larger the transaction amount between two nodes, the greater the social relationship weight value between the two nodes, and the closer the social relationship between the two nodes. Determine the transaction nodes that have had fund transaction behaviors with the abnormal nodes among the multiple nodes to be confirmed, and calculate the similarity between the transaction nodes and the abnormal nodes through the social network model. When the similarity is greater than the preset similarity, obtain the feature vectors corresponding to the abnormal node and the transaction node respectively. Analyze the covariance and variance between the feature vectors corresponding to the abnormal node and the transaction node respectively to confirm whether the transaction node is a new abnormal fund transaction account.

2. The method according to claim 1, wherein Before inputting each node feature vector into a pre-trained graph attention network model to obtain a prediction result corresponding to each node, the method further includes: Obtain historical transaction data, where the historical transaction data includes at least multiple abnormal accounts, multiple normal accounts, and the account labels of each account. The account label of the abnormal account represents that the abnormal account has had abnormal fund transaction behaviors, and the account label of the normal account represents that the normal account has not had the abnormal fund transaction behaviors. Construct a training graph according to the historical transaction data. Based on the training graph, generate a first feature set and a second feature set, where the first feature set contains multiple historical node feature vectors, and the second feature set contains multiple historical edge feature vectors. Each historical node feature vector corresponds to a training node in the training graph, and each historical edge feature vector corresponds to a training edge in the training graph. Train the graph attention network model according to the first feature set and the second feature set.

3. The method according to claim 2, wherein Training the graph attention network model according to the first feature set and the second feature set includes: Step 1: Determine a target edge and two target nodes associated with the target edge from the training graph, where the target edge is any one of the training edges in the training graph; Step 2: Obtain the first node feature vector corresponding to the target node from the first feature set, and obtain the first edge feature vector corresponding to the target edge from the second feature set; Step 3: Perform a superposition process on the first node feature vector and the first edge feature vector to obtain the second edge feature vector corresponding to the target edge; Step 4: Perform a non-linearization process on the second edge feature vector to obtain the target edge feature vector corresponding to the target edge; Step 5: Repeat the above steps 1 to 4 to obtain the target edge feature vector corresponding to each training edge in the training graph; Step 6: Train the graph attention network model according to the target edge feature vector corresponding to each training edge in the training graph.

4. The method according to claim 3, characterized in that, Training the graph attention network model according to the target feature vector corresponding to each training edge in the training graph includes: Based on the training graph, determine at least one first training edge connected to each training node; Determine the first target edge feature vector corresponding to the first training edge; Determine the attention coefficient corresponding to the first target edge feature vector; Perform an aggregation process on at least one of the first target edge feature vectors based on the attention coefficient to obtain the second node feature vector corresponding to each training node; Train the graph attention network model according to the second node feature vector corresponding to each training node.

5. The method according to claim 4, wherein Training the graph attention network model according to the second node feature vector corresponding to each training node includes: Perform a superposition process on the second node feature vector corresponding to each training node and the historical node feature vector corresponding to the training node to obtain the third node feature vector corresponding to each training node; Perform a non-linearization process on the third node feature vector to obtain the target node feature vector corresponding to each training node; Train the graph attention network model according to the target node feature vector and the account label corresponding to the target node feature vector.

6. The method according to claim 1, wherein After constructing the social network model based on the fund transaction graph, the method further includes: Determine the similarity between the transaction node and the abnormal node according to the social relationship weight value between the abnormal node and the transaction node in the social network model; In the case where the similarity is greater than a preset similarity, determine the transaction node as a candidate node, where the candidate node is a node with a risk of fund transaction.

7. The method according to claim 6, wherein After determining the transaction node as a candidate node, the method further includes: Determine the fourth node feature vector corresponding to the abnormal node from the node feature set; Generate the fifth node feature vector corresponding to the candidate node based on the target fund transaction graph; Determine the covariance and variance between the fourth node feature vector and the fifth node feature vector; Determine the correlation coefficient between the candidate node and the abnormal node according to the covariance and the variance; When the correlation coefficient is greater than a preset threshold, determine that the candidate node is a new abnormal node, and the account corresponding to the candidate node is also the abnormal fund trading account.

8. An identification device for abnormal trading accounts, characterized in that, It includes: An acquisition module for acquiring a fund trading graph, where the fund trading graph is composed of nodes and edges, the nodes represent the account data of the accounts corresponding to the nodes, and the edges between two nodes represent the trading flows between the two nodes; A generation module for generating a node feature set based on the fund trading graph, where the node feature set is composed of at least one node feature vector, and each node feature vector corresponds to a node in the fund trading graph; An input module for inputting each node feature vector into a pre-trained graph attention network model to obtain the prediction result corresponding to each node, where the prediction result is used to represent whether the account corresponding to each node is an abnormal fund trading account, and the graph attention network model is trained based on a graph different from the fund trading graph; It further includes: a second acquisition module for acquiring a target fund trading graph, where the target fund trading graph at least includes multiple nodes to be confirmed and at least one abnormal node in the fund trading graph, where the account corresponding to the abnormal node is an abnormal fund trading account, and the multiple nodes to be confirmed are nodes that do not appear in the fund trading graph; a first construction module for constructing a social network model based on the target fund trading graph, where in the social network model, the larger the trading amount between two nodes, the greater the social relationship weight value between the two nodes, and the closer the social relationship between the two nodes; It further includes: determining a trading node that has had a fund trading behavior with the abnormal node among the multiple nodes to be confirmed, and calculating the similarity between the trading node and the abnormal node through the social network model; When the similarity is greater than a preset similarity, obtain the feature vectors corresponding to the abnormal node and the trading node respectively; Analyze the covariance and variance between the feature vectors corresponding to the abnormal node and the trading node respectively to confirm whether the trading node is a new abnormal fund trading account.

9. A computer-readable storage medium, characterized in that, A computer program is stored in the computer-readable storage medium, where the computer program is set to execute the identification method of the abnormal trading account described in any one of claims 1 to 7 when running.

10. An electronic device, characterized in that, It includes one or more processors and a memory, and the memory is used to store one or more programs, where when the one or more programs are executed by the one or more processors, the one or more processors implement the identification method of the abnormal trading account described in any one of claims 1 to 7.

Images