Method, device and electronic equipment for identifying abnormal virtual resource transfer transaction

Abstract

The application discloses a kind of identification method and device of abnormal virtual resource transfer transaction.Therein, the method includes: obtaining the transaction data corresponding to multiple to-be-tested transaction links;Determine the transaction index information corresponding to transaction data based on transaction data;According to transaction index information, select multiple target transaction links from multiple to-be-tested transaction links, wherein the link starting point and link endpoint of multiple target transaction links are the same;Based on multiple target transaction links, construct target equation, wherein target equation is used to determine the total amount of abnormal fund transfer corresponding to multiple target transaction links;According to target equation, determine the abnormal virtual resource transfer transaction link that exists abnormal virtual resource transfer transaction behavior from multiple target transaction links.The present application solves the technical problems of low recognition efficiency and limited application scope in the related art identification method of abnormal virtual resource transfer transaction.

Description

Technical Field

[0001] This invention relates to the field of financial technology, and more specifically, to a method, apparatus, storage medium, and electronic device for identifying abnormal virtual resource transfer transactions. Background Technology

[0002] Currently, instances of seeking personal gain through abnormal virtual resource transfer transactions (such as those involving illegal or improper transactions) occur frequently, making the effective identification of such transactions a pressing issue. Current booking-type virtual resource transfer transactions are mainly divided into three stages: the disposal stage, the separation stage, and the fusion stage. Existing methods for identifying illegal or improper virtual resource transfer transactions primarily focus on the separation stage. For example, in separation scenarios, inner joins using Structured Query Language (SQL) are used to progressively associate transactions that satisfy time and transaction amount requirements. However, this method can only handle single-link queries in separation scenarios, and its query depth is limited, failing to effectively address abnormal fund transfer behaviors in other scenarios (such as splitting scenarios).

[0003] There is currently no effective solution to the above problems. Summary of the Invention

[0004] This invention provides a method, apparatus, storage medium, and electronic device for identifying abnormal virtual resource transfer transactions, thereby at least solving the technical problems of low identification efficiency and limited applicability of related methods for identifying abnormal virtual resource transfer transactions.

[0005] According to one aspect of the present invention, a method for identifying abnormal virtual resource transfer transactions is provided, comprising: acquiring transaction data corresponding to multiple transaction links to be tested; determining transaction index information corresponding to the transaction data based on the transaction data; selecting multiple target transaction links that meet predetermined conditions from the multiple transaction links to be tested according to the transaction index information, wherein the starting point and ending point of the multiple target transaction links are the same; constructing a target equation based on the multiple target transaction links, wherein the target equation is used to determine the total amount of abnormal fund transfers corresponding to the multiple target transaction links; and determining, according to the target equation, the abnormal virtual resource transfer transaction links with abnormal virtual resource transfer transaction behavior from the multiple target transaction links.

[0006] Optionally, the aforementioned transaction data includes vertex information and edge information. The determination of the transaction index information corresponding to the aforementioned transaction data based on the aforementioned transaction data includes: constructing an adjacency matrix based on the aforementioned transaction data; performing iterative calculations on the aforementioned adjacency matrix to obtain calculation results, wherein the number of iterations in the iterative calculations is the target search depth of the transaction link to be tested; determining the link start point and the link end point of the transaction link to be tested based on the calculation results, wherein the link start point corresponds to a debit account and the link end point corresponds to a credit account; and determining the transaction index information in the target format based on the link start point, the link end point, and the aforementioned edge information.

[0007] Optionally, the above-mentioned construction of the adjacency matrix based on the above-mentioned transaction data includes: adding a timestamp field to the above-mentioned transaction data to obtain processed transaction data; and constructing the above-mentioned adjacency matrix based on the processed transaction data.

[0008] Optionally, determining multiple target transaction links that meet preset conditions based on the transaction index information includes: determining the starting point of the link based on the transaction index information; using the starting point of the link as the search starting point, responding to the iterative search operation on the transaction index information, determining whether the transaction time corresponding to the currently searched transaction is within a preset time range, and whether the transaction value corresponding to the currently searched transaction is within a preset amount range; if the transaction time corresponding to the currently searched transaction is within the preset time range, and the transaction value corresponding to the currently searched transaction is not within the preset amount range, then the currently searched transaction is taken as an intermediate node; if the transaction time corresponding to the currently searched transaction is within the preset time range, and the transaction value corresponding to the currently searched transaction is within the preset amount range, then the currently searched transaction is taken as the ending point of the link; based on the starting point of the link, the intermediate node, and the ending point of the link, the multiple target transaction links are determined.

[0009] Optionally, the process of identifying the abnormal virtual resource transfer transaction link with abnormal virtual resource transfer behavior from the multiple target transaction links based on the above objective equation includes: calculating a feasible solution to the above objective equation, wherein the feasible solution corresponds to at least one abnormal fund transfer amount corresponding to the multiple target transaction links; determining the total abnormal fund transfer amount in the feasible solution; calculating the total transaction amount of multiple intermediate nodes corresponding to the multiple target transaction links respectively; and determining the abnormal virtual resource transfer transaction link based on the total abnormal fund transfer amount and the total transaction amount.

[0010] Optionally, the total transaction amount includes the total revenue amount and the total expenditure amount. Determining the abnormal virtual resource transfer transaction link based on the abnormal fund transfer amount and the total transaction amount includes: determining whether the total transaction amount of the intermediate nodes included in the target transaction link is within a preset range of the abnormal fund transfer amount, and whether the total expenditure amount is greater than the total revenue amount; if the total transaction amount of the intermediate nodes included in the target transaction link is within the preset range of the abnormal fund transfer amount, and the total expenditure amount is not greater than the total revenue amount, then the target transaction link is taken as the abnormal virtual resource transfer transaction link.

[0011] Optionally, determining the abnormal virtual resource transfer transaction link based on the total amount of abnormal fund transfers and the total transaction amount includes: identifying the transaction link among the multiple target transaction links where the total transaction amount of the intermediate nodes included in the target transaction link is within a preset range of the total amount of abnormal fund transfers, and the total expenditure amount is not greater than the total revenue amount, as the final transaction link; determining whether there are duplicate transaction links in the final transaction link; and if there are duplicate transaction links in the final transaction link, performing deduplication processing on the final transaction link, and using the deduplicated final transaction link as the abnormal virtual resource transfer transaction link.

[0012] According to another aspect of the present invention, an identification device for abnormal virtual resource transfer transactions is also provided, comprising: an acquisition module for acquiring transaction data corresponding to multiple transaction links to be tested; a first determination module for determining transaction index information corresponding to the transaction data based on the transaction data; a selection module for selecting multiple target transaction links that meet predetermined conditions from the multiple transaction links to be tested according to the transaction index information, wherein the starting point and ending point of the multiple target transaction links are the same; a construction module for constructing a target equation based on the multiple target transaction links, wherein the target equation is used to determine the total amount of abnormal fund transfers corresponding to the multiple target transaction links; and a second determination module for determining, according to the target equation, the abnormal virtual resource transfer transaction links that exhibit abnormal virtual resource transfer transaction behavior from the multiple target transaction links.

[0013] According to another aspect of the present invention, a storage medium is also provided, the storage medium including a stored program, wherein, when the program is running, it controls the device where the storage medium is located to execute any of the above-described methods for identifying abnormal virtual resource transfer transactions.

[0014] According to another aspect of the present invention, a processor is also provided, which is used to run a program, wherein the program executes any one of the above-described methods for identifying abnormal virtual resource transfer transactions.

[0015] In this embodiment of the invention, an abnormal virtual resource transfer transaction identification method is adopted. This involves acquiring transaction data corresponding to multiple test transaction links; determining transaction index information corresponding to the transaction data; selecting multiple target transaction links that meet predetermined conditions from the multiple test transaction links based on the transaction index information, wherein the starting and ending points of the multiple target transaction links are the same; constructing a target equation based on the multiple target transaction links, wherein the target equation is used to determine the total amount of abnormal fund transfers corresponding to the multiple target transaction links; and identifying abnormal virtual resource transfer transaction links with abnormal virtual resource transfer behavior from the multiple target transaction links based on the target equation. This achieves the goal of quickly identifying abnormal virtual resource transfer transactions while narrowing the transaction search range, thereby improving the identification efficiency and applicability of abnormal virtual resource transfer transactions. This solves the technical problems of low identification efficiency and limited applicability of related abnormal virtual resource transfer transaction identification methods. Attached Figure Description

[0016] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, illustrate exemplary embodiments of the invention and, together with their description, serve to explain the invention and do not constitute an undue limitation thereof. In the drawings:

[0017] Figure 1 This is a flowchart of a method for identifying abnormal virtual resource transfer transactions according to an embodiment of the present invention;

[0018] Figure 2 This is a schematic diagram of an optional structure for constructing an adjacency matrix M according to an embodiment of the present invention;

[0019] Figure 3 This is a schematic diagram of an optional abnormal virtual resource transfer transaction link according to an embodiment of the present invention;

[0020] Figure 4 This is a schematic diagram of another optional abnormal virtual resource transfer transaction link according to an embodiment of the present invention;

[0021] Figure 5 This is a flowchart of an optional method for identifying abnormal virtual resource transfer transactions according to an embodiment of the present invention;

[0022] Figure 6This is a schematic diagram of the structure of an identification device for abnormal virtual resource transfer transactions according to an embodiment of the present invention;

[0023] Figure 7 This is a schematic diagram of the structure of an electronic device used to implement a method for identifying abnormal virtual resource transfer transactions according to an embodiment of the present invention. Detailed Implementation

[0024] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0025] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0026] First, to facilitate understanding of the embodiments of the present invention, some terms or nouns involved in the present invention will be explained below:

[0027] Adjacency matrix: A matrix representing the relationships between points; a two-dimensional 0-1 square matrix A represents the data of the relationships between points. In a directed graph, if A(i,j) is 0, it means that there is no relationship between points i and j; if A(i,j) is 1, it means that there is an edge from point i to point j.

[0028] Anomaly fund transfer activities are divided into three stages: 1) Disposal: The payer / initiator places the funds into the financial system. Direct transfers to the final recipient are avoided to evade detection. 2) Separation: This stage involves creating complex layers of financial transactions to conceal audit clues and hide identities, thereby separating the abnormal proceeds from their source. Splitting is a special case of separation, keeping funds below the threshold for AML (Anti-Money Laundering) reporting of digital assets. 3) Integration: The funds reach the intended recipient.

[0029] A brief introduction to "separation" and "splitting":

[0030] 1) Example of a separation scenario:

[0031] 1. Disposal: Payment 1 - A pays B, amount X

[0032] 2. Separation 1: Payment 2 - From B to C, amount X (there may be slight differences in the amount).

[0033] 3. Separation 2: Payment 3 - from C to D, amount X (there may be slight differences in the amount).

[0034] 4. Separation 3: Payment of Amount X by Item 4-D to Item E (there may be slight differences in the amount)

[0035] 5. Integration: Payment 5-E pays F amount X (there may be slight differences in the amount).

[0036] By tracing payments of similar amounts, the relationship between A and F can be discovered, and the payment chain can be identified.

[0037] 2) Example of splitting a scenario:

[0038] Disposal 1: Payment 1 – A pays B, amount 0.2 * Y

[0039] Solution 2: Payment 2 – A pays C, amount 0.8 * Y (there may be a slight difference in the amount).

[0040] Merge 1: Payment 3 – B pays F, amount 0.2 * Y (there may be slight differences in the amount).

[0041] Analysis 1: Payment 4 – C pays D, amount 0.4 * Y (there may be slight differences in the amount).

[0042] Analysis 2: Payment 5 – C pays E, amount 0.4 * Y (there may be slight differences in the amount).

[0043] Merge 2: Payment 6 – D pays F, amount 0.4 * Y (there may be slight differences in the amount)

[0044] Merge 3: Payment 7 – E pays F, amount 0.4 * Y (there may be slight differences in the amount).

[0045] A payment chain must have at least one sub-chain; if there are more than three payment chains between the parties, it is defined as suspicious behavior. In the example above, at least three payment chains are required between A and F. According to an embodiment of the present invention, a method for identifying abnormal virtual resource transfer transactions is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0046] Figure 1 This is a flowchart of a method for identifying abnormal virtual resource transfer transactions according to an embodiment of the present invention, such as... Figure 1 As shown, the method includes the following steps:

[0047] Step S102: Obtain transaction data corresponding to multiple transaction links to be tested;

[0048] Step S104: Determine the transaction index information corresponding to the transaction data based on the above transaction data;

[0049] Step S106: Select multiple target transaction links that meet the predetermined conditions from the multiple test transaction links based on the above transaction index information, wherein the starting point and ending point of the multiple target transaction links are the same.

[0050] Step S108: Construct a target equation based on the above multiple target transaction links;

[0051] Step S110: Based on the above objective equation, identify the abnormal virtual resource transfer transaction links with abnormal virtual resource transfer transaction behavior from the above multiple target transaction links.

[0052] Optionally, the aforementioned abnormal virtual resource transfer transactions may include, but are not limited to, virtual resource transfer transactions involving violations or improper means. The aforementioned transaction data includes at least: vertex information and edge information, wherein the vertex information includes at least: debit account and credit account, and the edge information includes at least: transaction time, transaction value (e.g., transaction amount), and transaction ID.

[0053] Optionally, based on the above transaction data, the adjacency matrix iteration method is used to determine the transaction index information corresponding to the above transaction data.

[0054] Optionally, the aforementioned predetermined conditions may be, but are not limited to, time conditions and transaction value conditions. That is, a transaction link consisting of a link start point, a link end point, and multiple intermediate nodes that satisfy the preset time conditions and preset transaction value conditions is considered as the aforementioned multiple target transaction links. For example, first, the link start point is determined; transactions whose transaction time is within a preset time range and whose transaction value is not within a preset amount range are designated as intermediate nodes; transactions whose transaction time is within the aforementioned preset time range and whose transaction value is within the aforementioned preset amount range are designated as link end points; based on the aforementioned link start point, the aforementioned intermediate nodes, and the aforementioned link end points, the aforementioned multiple target transaction links are determined.

[0055] Optionally, the objective equation described above may be, but is not limited to, a binary multivariate equation, used to determine the total amount of abnormal fund transfers corresponding to the above multiple target transaction links.

[0056] In this embodiment of the invention, an abnormal virtual resource transfer transaction identification method is adopted. This involves acquiring transaction data corresponding to multiple test transaction links; determining transaction index information corresponding to the transaction data; selecting multiple target transaction links that meet predetermined conditions from the multiple test transaction links based on the transaction index information, wherein the starting and ending points of the multiple target transaction links are the same; constructing a target equation based on the multiple target transaction links, wherein the target equation is used to determine the total amount of abnormal fund transfers corresponding to the multiple target transaction links; and identifying abnormal virtual resource transfer transaction links with abnormal virtual resource transfer behavior from the multiple target transaction links based on the target equation. This achieves the goal of quickly identifying abnormal virtual resource transfer transactions while narrowing the transaction search range, thereby improving the identification efficiency and applicability of abnormal virtual resource transfer transactions. This solves the technical problems of low identification efficiency and limited applicability of related abnormal virtual resource transfer transaction identification methods.

[0057] In an optional embodiment, the transaction data includes vertex information and edge information, and the determination of transaction index information corresponding to the transaction data based on the transaction data includes:

[0058] Step S112: Based on the above transaction data, construct an adjacency matrix;

[0059] Step S114: Iteratively calculate the above adjacency matrix to obtain the calculation result, wherein the number of iterations of the above iterative calculation is the target search depth of the above-tested transaction link;

[0060] Step S116: Based on the above calculation results, determine the starting point and ending point of the above-mentioned transaction link to be tested, wherein the starting point of the link corresponds to the debit account and the ending point of the link corresponds to the credit account.

[0061] Step S118: Based on the above-mentioned link start point, the above-mentioned link end point, and the above-mentioned edge information, determine the above-mentioned transaction index information in the target format.

[0062] Optionally, the vertex information mentioned above includes at least: debit account and credit account, and the edge information mentioned above includes at least: transaction time, transaction value and transaction address ID. Based on the above transaction data, the transaction table shown in Table 1 is obtained.

[0063] Table 1

[0064] Id Debit account Trading hours Transaction value Credit account 1 A 2020 / 1 / 1 20 B 2 A 2020 / 1 / 2 300 B 3 A 2020 / 1 / 3 180 B 4 B 2020 / 1 / 3 40 C 5 B 2020 / 1 / 3 500 C 6 B 2020 / 1 / 4 10 C 7 B 2020 / 1 / 3 150 D 8 C 2020 / 1 / 4 50 E 9 D 2020 / 1 / 4 150 E

[0065] In one optional embodiment, the above-mentioned construction of the adjacency matrix based on the transaction data includes: adding a timestamp field to the transaction data to obtain processed transaction data; and constructing the adjacency matrix based on the processed transaction data. By adding a timestamp field to the transaction data to obtain processed transaction data, and sorting the processed transaction data according to the time order corresponding to the timestamp field, the adjacency matrix is ​​constructed.

[0066] Optionally, the above debit and credit accounts are converted into integer representations and numbered sequentially from 0 according to their order of appearance. A timestamp field is added to the transaction data based on the transaction time. At the same time, a timestamp field is set for the next transaction corresponding to the debit and credit accounts, resulting in the converted transaction table shown in Table 2.

[0067] Table 2

[0068] Id Debit account Trading hours Transaction value Credit account Timestamp Timestamp lag 1 0 2020 / 1 / 1 20 1 7305 7306 2 0 2020 / 1 / 2 300 1 7306 7307 3 0 2020 / 1 / 3 180 1 7307 Inf 4 1 2020 / 1 / 3 40 2 7307 7307 5 1 2020 / 1 / 3 500 2 7307 7308 6 1 2020 / 1 / 4 10 2 7308 Inf 7 1 2020 / 1 / 3 150 2 7307 Inf 8 2 2020 / 1 / 4 50 4 7308 Inf 9 3 2020 / 1 / 4 150 4 7308 Inf

[0069] Optionally, based on the transformed transaction table corresponding to the above transaction data, the following can be obtained: Figure 2 The adjacency matrix M is constructed as shown. Iterative calculations are performed on this adjacency matrix to obtain the results. The number of iterations (e.g., N) represents the target search depth of the transaction link under test. For example, the data in each row of matrix M is summed to obtain the corresponding value s = sum(M, coordinate axis = 1); and s = Ms is iteratively calculated. The index information corresponding to the transaction data where s is not 0 is output, and this is used as the starting number of the transaction link of length N that spatially conforms to abnormal fund transfer (i.e., the starting point of the link).

[0070] Optionally, based on the aforementioned link start point, link end point, and edge information, the aforementioned transaction index information in the target format is determined. The target format may, but is not limited to, […].<key,value> The format is as follows: The key is the starting point number corresponding to the starting point of the above link (i.e., the debit account), the value is the ending point number corresponding to the ending point of the above link (i.e., the credit account), and the edge features corresponding to the edge information. The edge features may include, but are not limited to, ID, timestamp, the timestamp lag of the next transaction, and the transaction value. For example, the index information in the target format obtained based on debit account A in the table is as follows:

[0071]

[0072] In this structure, the 0 to the left of the colon represents the key, which is the ID of debit account A. The value to the right of the colon is a 2D tuple. The first element of the tuple is the credit account ID; for example, if all transactions are with credit account B, the corresponding ID is 1. The second element is an ndarray containing all the edges between debit account A and credit account B. The second element is the endpoint ID corresponding to the credit account of each edge. Here, there are 3 transactions starting from debit account A, with all transactions with credit account B. Therefore, the first array `array` has 3 rows: the first column is the transaction ID, the second column is the timestamp, the third column is the timestamp `lag` of the next transaction, and the fourth column is the transaction amount.

[0073] It should be noted that, through transaction index information, the embodiments of the present invention can remove irrelevant transactions, reduce the search space of transactions (i.e., edge information), and accelerate the search speed. Furthermore, by establishing an index on vertex information (i.e., the aforementioned debit and credit accounts) and edge data (such as transaction time, transaction value, and transaction address), the embodiments of the present invention can achieve fast queries without depth restrictions, thereby improving the identification efficiency of abnormal virtual resource transfer transactions.

[0074] In an optional embodiment, determining multiple target transaction links that meet preset conditions based on the transaction index information includes:

[0075] Step S122: Determine the starting point of the link based on the transaction index information.

[0076] Step S124: Taking the above-mentioned link starting point as the search starting point, respond to the iterative search operation on the above-mentioned transaction index information, and determine whether the transaction time corresponding to the current search transaction is within the preset time range and whether the transaction value corresponding to the current search transaction is within the preset amount range.

[0077] Step S126: If the transaction time corresponding to the current search transaction is within the preset time range and the transaction value corresponding to the current search transaction is not within the preset amount range, then the current search transaction is taken as an intermediate node.

[0078] Step S128: If the transaction time corresponding to the current search transaction is within the preset time range and the transaction value corresponding to the current search transaction is within the preset amount range, then the current search transaction is taken as the endpoint of the link.

[0079] Step S130: Based on the above-mentioned link start point, the above-mentioned intermediate node and the above-mentioned link end point, the above-mentioned multiple target transaction links are determined.

[0080] Optionally, the preset time range for the above search can be, but is not limited to, within 7 days, that is, the next transaction will occur within seven days after the occurrence of the event corresponding to the starting point of the link.

[0081] Optionally, the search for the above-mentioned preset amount range may be, but is not limited to, a range in which the relative error between the transaction value corresponding to the above-mentioned link start point and the above-mentioned link end point is within a preset range (e.g., the relative error is within 0.05, i.e., similar to the transaction value corresponding to the above-mentioned link start point and the above-mentioned link end point).

[0082] Optionally, a depth-first strategy is adopted, using the starting point of the aforementioned link as the starting point for iterative search operations on the aforementioned transaction index information. First, transactions that meet the time sequence condition are searched, i.e., the next transaction's time is within seven days after the transaction time of the currently searched transaction. When the current search depth k of the current searched transaction is less than the target search depth N, transactions that satisfy the following time conditions will be selected:

[0083] Degree(k+1).begine=Degree(k).end

[0084] min(Degree(0).time+7,Degree(k).lag)>Degree(k+1).time>=Degree(k).time

[0085] Where Degree represents the search depth, the above formula means that the starting point of the next search layer (k+1) is the starting point of the current search layer k. The transaction time of the next search layer is after the time of the current search layer (i.e., the current search depth), and within 7 days of the transaction time of the first search layer or before the next transaction time of the current search layer (i.e., the transaction time corresponding to the timestamp lag).

[0086] Optionally, it can be further determined whether the transaction value corresponding to the transaction that meets the time condition is similar to the transaction value at the starting point of the link. If the determination result is similar, the transaction is taken as the end point of the link; otherwise, the transaction is taken as an intermediate node. The starting point of the link, the intermediate node, and the ending point of the link ultimately form the multiple target transaction links.

[0087] In an optional embodiment, the process of identifying the abnormal virtual resource transfer transaction link exhibiting abnormal virtual resource transfer transaction behavior from the plurality of target transaction links according to the aforementioned objective equation includes:

[0088] Step S142: Calculate the feasible solution of the above objective equation, wherein the feasible solution corresponds to at least one abnormal fund transfer amount corresponding to the above multiple target transaction links;

[0089] Step S144: Determine the total amount of the abnormal fund transfers in the above feasible solutions;

[0090] Step S146: Calculate the total transaction amount of the multiple intermediate nodes corresponding to the above multiple target transaction links;

[0091] Step S148: Based on the total amount of the abnormal fund transfers and the total amount of the transactions, determine the abnormal virtual resource transfer transaction chain.

[0092] In an optional embodiment, determining the abnormal virtual resource transfer transaction chain based on the total amount of the abnormal fund transfers and the total transaction amount includes:

[0093] Step S152: Determine whether the total transaction amount of the intermediate nodes included in the target transaction links is within the preset range of the total amount of abnormal fund transfers, and whether the total expenditure amount is greater than the total income amount.

[0094] Step S154: If the total transaction amount of the intermediate nodes included in the target transaction link is within the preset range of the total amount of abnormal fund transfers, and the total amount of expenditure is not greater than the total amount of income, then the target transaction link is designated as the abnormal virtual resource transfer transaction link.

[0095] Optional, such as Figure 3 As shown in the diagram, the starting point of the chain involves two lending transactions, and the ending point involves three lending transactions, but only two of these transactions are involved in abnormal fund transfer activities (such as...). Figure 3 (As shown by the dashed line). This embodiment of the invention establishes a binary multivariate equation and verifies whether this equation has a feasible solution to filter out transaction chains exhibiting abnormal fund transfer behavior. The specific formula is as follows:

[0096] ∑σ×Degree(0).amount≈∑σ×Degree(N).amount

[0097]

[0098] Among them, the branching method (or backtracking method) is used to solve for the feasible solution σ. * And calculate the amount of abnormal fund transfers in all feasible solutions: Amount = ∑σ * ×Degree(N).amount, further filtering, the links whose total transaction amount of the intermediate nodes in each layer is approximately equal to the total amount of the above abnormal fund transfers (Amount) are considered as the above abnormal virtual resource transfer transaction links, that is, satisfying ∑δ * Degree(k).amount ≈ Amount. Here, k is the level greater than 1 and less than N. We still use branching or backtracking to find a feasible solution σ. * .

[0099] Pseudocode for backtracking:

[0100] Define a function dfs, whose input variables are list L, index k, and amount_sum:

[0101] Define dfs(L,k,amount):

[0102] When amount_sum > Amount:

[0103] termination

[0104] When amount_sum = Amount:

[0105] Storage list L

[0106] For i from k to n:

[0107] Recursive dfs(L+[i],i+1,amount_sum+amount(i))

[0108] If there are n transactions in the current layer, where amount(i) represents the amount of the i-th transaction. Given the total amount of abnormal fund transfers Amount and the transaction sequence {amount(i)}, with an initial value L of empty, a subscript of 0, and amount_sum of 0, the function dfs(L,k,amount_sum) can be executed to obtain all feasible transaction combinations L, whose total transaction amount is equal to Amount.

[0109] In an optional embodiment, determining the abnormal virtual resource transfer transaction chain based on the total amount of the abnormal fund transfers and the total transaction amount includes:

[0110] Step S162: The transaction link in which the total transaction amount of the intermediate nodes included in the target transaction link is within the preset range of the total amount of abnormal fund transfers and the total amount of expenditure is not greater than the total amount of income is taken as the final transaction link.

[0111] Step S164: Determine whether there are duplicate transaction links in the above final transaction link;

[0112] Step S166: If there are duplicate transaction links in the final transaction link, the final transaction link is deduplicated and the deduplicated final transaction link is used as the abnormal virtual resource transfer transaction link.

[0113] Optionally, the total transaction amount of each intermediate node in the above multiple target transaction links is approximately equal to the total amount of abnormal fund transfers (Amount), and the total expenditure amount is not greater than the total revenue amount, and it is guaranteed that the current total expenditure amount of each intermediate node is not greater than its current total revenue amount. The target transaction link in which all intermediate nodes meet the above two conditions is taken as the final transaction link.

[0114] Optional, as before Figure 3 As shown in the diagram, the starting point of the chain involves two lending transactions, and the ending point involves three lending transactions, but only two of these transactions are involved in abnormal fund transfer activities (such as...). Figure 3 (As shown by the dashed line). In this embodiment of the invention, a binary multivariate equation is established and the existence of a feasible solution is verified to screen out transaction links suspected of complex and abnormal fund transfer behavior (i.e., the aforementioned final transaction links). That is, among the multiple target transaction links, the transaction links in which the total transaction amount of the intermediate nodes included in the target transaction link is within a preset range of the total amount of abnormal fund transfer, and the total expenditure amount is not greater than the total income amount, are selected as the final transaction links.

[0115] Optionally, but not limited to, determining whether there are duplicate transaction links in the final transaction links can be done as follows: Sort all the final transaction links in descending order of the number of edges; place all transaction address IDs corresponding to the final transaction link with the most edges in the same set, and use this as the starting comparison set; start by subtracting the first set of transaction IDs corresponding to the final transaction link with fewer edges from the second set of transaction IDs corresponding to the final transaction link with more edges. If the difference result is an empty set, then the final transaction link with fewer edges is considered a subset of the final transaction link with more edges, i.e., a duplicate link exists, and the final transaction link with fewer edges needs to be removed (i.e., deduplication); if the difference result is not an empty set, then the final transaction link with fewer edges is considered an independent link, and the link is retained and placed in the comparison pool; the links in the final comparison pool are the abnormal virtual resource transfer transaction links. Figure 4 As shown in the figure, the link formed by the dashed line is actually a sub-link of the entire link, and the aforementioned sub-link can be removed as a duplicate link.

[0116] As an optional embodiment, Figure 5 This is a flowchart of an optional method for identifying abnormal virtual resource transfer transactions according to an embodiment of the present invention, such as... Figure 5 As shown, the method includes the following steps:

[0117] Step S502: Obtain transaction data corresponding to multiple transaction links to be tested. The transaction data includes at least vertex information and edge information. The vertex information includes at least debit account and credit account. The edge information includes at least transaction time, transaction value and transaction address ID.

[0118] Step S504: Add a timestamp field to the above transaction data and convert the account names in the above transaction data into integer numbers to obtain the processed transaction data. The above account names include: the name of the above debit account and the name of the above credit account.

[0119] Step S506: Construct an adjacency matrix based on the processed transaction data, and perform an iterative search operation on the adjacency matrix to confirm the starting point of the link corresponding to the transaction link to be tested.

[0120] Step S508: Convert the processed transaction data into a predefined index format and store it to obtain transaction index information;

[0121] Step S510: Iteratively search the transaction index information according to the preset time conditions to select intermediate nodes;

[0122] Step S512: By constructing and solving binary equations, multiple target transaction links that meet the conditions for link start and link end are determined. The multiple target transaction links consist of a link start, a link end, and multiple intermediate nodes.

[0123] Step S514: Further select the transaction links with the total transaction amount of multiple intermediate nodes corresponding to the above multiple target transaction links as the final transaction links.

[0124] Step S516: Use the "edge set difference method" to reduce the deduplication of the final transaction link to obtain the abnormal virtual resource transfer transaction link.

[0125] It should be noted that the embodiments of the present invention can be applied to any abnormal fund transfer chain with "disjunction" and "splitting" patterns, and there is no limitation on the chain search depth, which can effectively identify abnormal fund transfer behavior. Furthermore, the embodiments of the present invention can use the scientific computing library scipy module to store and iteratively operate on the sparse adjacency matrix (i.e., the aforementioned adjacency matrix), and use the numerical computing extended numpy module to build an array index for the edges. The aforementioned scipy module and numpy module can also be replaced by the machine learning library PyTorch module, and the graphics processing unit GPU module can be used to accelerate the computation. The specific implementation process of the above-mentioned method for identifying abnormal virtual resource transfer transactions can be implemented using Python tools and PySpark tools.

[0126] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that the present invention is not limited to the described order of actions, because according to the present invention, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to the present invention.

[0127] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods of the various embodiments of the present invention.

[0128] This embodiment also provides a device for identifying abnormal virtual resource transfer transactions. This device is used to implement the above embodiments and preferred embodiments, and details already described will not be repeated. As used below, the terms "unit" and "device" can refer to a combination of software and / or hardware that performs a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0129] According to an embodiment of the present invention, an apparatus embodiment for implementing the above-described method for identifying abnormal virtual resource transfer transactions is also provided. Figure 6 This is a schematic diagram of the structure of an identification device for abnormal virtual resource transfer transactions according to an embodiment of the present invention, as shown below. Figure 6 As shown, the aforementioned device for identifying abnormal virtual resource transfer transactions includes: an acquisition module 600, a first determination module 602, a selection module 604, a construction module 606, and a second determination module 608, wherein:

[0130] The aforementioned acquisition module 600 is used to acquire transaction data corresponding to multiple transaction links to be tested;

[0131] The first determining module 602 is connected to the obtaining module 600 and is used to determine the transaction index information corresponding to the transaction data based on the transaction data.

[0132] The selection module 604 is connected to the first determination module 602 and is used to select multiple target transaction links that meet predetermined conditions from the multiple test transaction links according to the transaction index information, wherein the starting point and ending point of the multiple target transaction links are the same.

[0133] The aforementioned construction module 606 is connected to the aforementioned selection module 604 and is used to construct a target equation based on the aforementioned multiple target transaction links, wherein the aforementioned target equation is used to determine the total amount of abnormal fund transfers corresponding to the aforementioned multiple target transaction links;

[0134] The second determining module 608 is connected to the construction module 606 and is used to determine, based on the target equation, the abnormal virtual resource transfer transaction link that exhibits abnormal virtual resource transfer transaction behavior from the multiple target transaction links.

[0135] It should be noted that the above modules can be implemented by software or hardware. For example, for the latter, it can be implemented in the following ways: the above modules can be located in the same processor; or the above modules can be located in different processors in any combination.

[0136] It should be noted that the aforementioned acquisition module 600, first determination module 602, selection module 604, construction module 606, and second determination module 608 correspond to steps S102 to S110 in the embodiments. The instances and application scenarios implemented by the above modules and corresponding steps are the same, but are not limited to the content disclosed in the above embodiments. It should be noted that the above modules, as part of the device, can run in a computer terminal.

[0137] It should be noted that the optional or preferred implementation methods of this embodiment can be found in the relevant descriptions in the embodiments, and will not be repeated here.

[0138] The aforementioned device for identifying abnormal virtual resource transfer transactions may also include a processor and a memory. The aforementioned acquisition module 600, first determination module 602, selection module 604, construction module 606, and second determination module 608 are all stored in the memory as program units, and the processor executes the aforementioned program units stored in the memory to realize the corresponding functions.

[0139] The processor contains a core that retrieves corresponding program units from memory. One or more cores may be configured. Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory includes at least one memory chip.

[0140] According to an embodiment of this application, an embodiment of a non-volatile storage medium is also provided. Optionally, in this embodiment, the non-volatile storage medium includes a stored program, wherein, when the program is running, it controls the device where the non-volatile storage medium is located to execute any of the above-mentioned methods for identifying abnormal virtual resource transfer transactions.

[0141] Optionally, in this embodiment, the non-volatile storage medium may be located in any computer terminal in a group of computer terminals in a computer network, or in any mobile terminal in a group of mobile terminals, and the non-volatile storage medium includes stored programs.

[0142] Optionally, during program execution, the device containing the non-volatile storage medium performs the following functions: acquiring transaction data corresponding to multiple transaction links under test; determining transaction index information corresponding to the transaction data based on the transaction data; selecting multiple target transaction links that meet predetermined conditions from the multiple transaction links under test according to the transaction index information, wherein the starting point and ending point of the multiple target transaction links are the same; constructing a target equation based on the multiple target transaction links, wherein the target equation is used to determine the total amount of abnormal fund transfers corresponding to the multiple target transaction links; and identifying abnormal virtual resource transfer transaction links with abnormal virtual resource transfer transaction behavior from the multiple target transaction links according to the target equation.

[0143] Optionally, during program execution, the device containing the non-volatile storage medium performs the following functions: constructing an adjacency matrix based on the aforementioned transaction data; performing iterative calculations on the aforementioned adjacency matrix to obtain calculation results, wherein the number of iterations in the aforementioned iterative calculations is the target search depth of the aforementioned transaction link to be tested; determining the aforementioned link start point and the aforementioned link end point of the aforementioned transaction link to be tested based on the aforementioned calculation results, wherein the aforementioned link start point corresponds to the debit account and the aforementioned link end point corresponds to the credit account; and determining the aforementioned transaction index information in the target format based on the aforementioned link start point, the aforementioned link end point, and the aforementioned edge information.

[0144] Optionally, during program execution, the device containing the non-volatile storage medium may be controlled to perform the following functions: add a timestamp field to the above transaction data to obtain the processed transaction data; and construct the above adjacency matrix based on the processed transaction data.

[0145] Optionally, during program execution, the device containing the non-volatile storage medium performs the following functions: determining the starting point of the link based on the transaction index information; using the starting point of the link as the search starting point, responding to the iterative search operation on the transaction index information, determining whether the transaction time corresponding to the currently searched transaction is within a preset time range, and whether the transaction value corresponding to the currently searched transaction is within a preset amount range; if the transaction time corresponding to the currently searched transaction is within the preset time range, and the transaction value corresponding to the currently searched transaction is not within the preset amount range, then the currently searched transaction is taken as an intermediate node; if the transaction time corresponding to the currently searched transaction is within the preset time range, and the transaction value corresponding to the currently searched transaction is within the preset amount range, then the currently searched transaction is taken as the ending point of the link; based on the starting point of the link, the intermediate node, and the ending point of the link, the multiple target transaction links are determined.

[0146] Optionally, during program execution, the device containing the non-volatile storage medium is controlled to perform the following functions: calculate a feasible solution to the above objective equation, wherein the feasible solution corresponds to at least one abnormal fund transfer amount corresponding to the above multiple target transaction links; determine the total amount of the above abnormal fund transfer in the feasible solution; calculate the total transaction amount of multiple intermediate nodes corresponding to the above multiple target transaction links respectively; and determine the above abnormal virtual resource transfer transaction link based on the above abnormal fund transfer amount and the above total transaction amount.

[0147] Optionally, during program execution, the device containing the non-volatile storage medium is controlled to perform the following functions: determine whether the total transaction amount of the intermediate nodes included in the target transaction links is within a preset range of the total amount of abnormal fund transfers, and whether the total expenditure amount is greater than the total revenue amount; if the total transaction amount of the intermediate nodes included in the target transaction links is within the preset range of the total amount of abnormal fund transfers, and the total expenditure amount is not greater than the total revenue amount, then the target transaction link is designated as the abnormal virtual resource transfer transaction link.

[0148] Optionally, during program execution, the device containing the non-volatile storage medium may perform the following functions: designate a transaction link among the multiple target transaction links whose total transaction amount of intermediate nodes is within a preset range of the total amount of abnormal fund transfers, and whose total revenue is not greater than the total expenditure as the final transaction link; determine whether there are duplicate transaction links in the final transaction link; if there are duplicate transaction links in the final transaction link, perform deduplication processing on the final transaction link, and designate the deduplicated final transaction link as the abnormal virtual resource transfer transaction link.

[0149] According to an embodiment of this application, an embodiment of a processor is also provided. Optionally, in this embodiment, the processor is used to run a program, wherein the program executes any of the above-described methods for identifying abnormal virtual resource transfer transactions.

[0150] According to an embodiment of this application, an embodiment of a computer program product is also provided, which, when executed on a data processing device, is adapted to execute a program that initializes the identification method steps for any of the above-described abnormal virtual resource transfer transactions.

[0151] Optionally, when the aforementioned computer program product is executed on a data processing device, it is suitable to execute an initialization program with the following method steps: acquiring transaction data corresponding to multiple transaction links to be tested; determining transaction index information corresponding to the transaction data based on the transaction data; selecting multiple target transaction links that meet predetermined conditions from the multiple transaction links to be tested according to the transaction index information, wherein the starting point and ending point of the multiple target transaction links are the same; constructing a target equation based on the multiple target transaction links, wherein the target equation is used to determine the total amount of abnormal fund transfers corresponding to the multiple target transaction links; and determining, from the multiple target transaction links, abnormal virtual resource transfer transaction links that exhibit abnormal virtual resource transfer transaction behavior according to the target equation.

[0152] According to embodiments of this application, an embodiment of an electronic device is also provided, such as... Figure 7 As shown, the electronic device 10 includes a processor, a memory, and a program stored in the memory and executable on the processor. When the processor executes the program, it performs the following steps: acquiring transaction data corresponding to multiple transaction links to be tested; determining transaction index information corresponding to the transaction data based on the transaction data; selecting multiple target transaction links that meet predetermined conditions from the multiple transaction links to be tested according to the transaction index information, wherein the starting point and ending point of the multiple target transaction links are the same; constructing a target equation based on the multiple target transaction links, wherein the target equation is used to determine the total amount of abnormal fund transfers corresponding to the multiple target transaction links; and identifying abnormal virtual resource transfer transaction links with abnormal virtual resource transfer transaction behavior from the multiple target transaction links according to the target equation.

[0153] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0154] In the above embodiments of the present invention, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0155] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units described above can be a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0156] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0157] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0158] If the aforementioned integrated units are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable non-volatile storage medium. Based on this understanding, the technical solution of this invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a non-volatile storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this invention. The aforementioned non-volatile storage medium includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0159] The above are merely preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for identifying abnormal virtual resource transfer transactions, characterized in that, include: Obtain transaction data corresponding to multiple transaction links to be tested, wherein the transaction data includes: vertex information and edge information; Determining transaction index information corresponding to the transaction data based on the transaction data includes: constructing an adjacency matrix based on the transaction data; performing iterative calculations on the adjacency matrix to obtain calculation results, wherein the number of iterations in the iterative calculation is the target search depth of the transaction link to be tested; determining the link start point and link end point of the transaction link to be tested based on the calculation results, wherein the link start point corresponds to a debit account and the link end point corresponds to a credit account; and determining the transaction index information in a target format based on the link start point, the link end point, and the edge information. Based on the transaction index information, multiple target transaction links that meet predetermined conditions are selected from the multiple test transaction links, wherein the starting point and the ending point of the multiple target transaction links are the same; A target equation is constructed based on the multiple target transaction links, wherein the target equation is used to determine the total amount of abnormal fund transfers corresponding to the multiple target transaction links, and the target equation is a binary multivariate equation; Based on the objective equation, identifying abnormal virtual resource transfer transaction links from the multiple target transaction links that exhibit abnormal virtual resource transfer behavior includes: calculating a feasible solution to the objective equation, wherein the feasible solution corresponds to at least one abnormal fund transfer amount corresponding to the multiple target transaction links; determining the total abnormal fund transfer amount in the feasible solution; calculating the total transaction amount of multiple intermediate nodes corresponding to the multiple target transaction links respectively; and determining the abnormal virtual resource transfer transaction link based on the total abnormal fund transfer amount and the total transaction amount.

2. The method according to claim 1, characterized in that, The process of constructing an adjacency matrix based on the transaction data includes: Add a timestamp field to the transaction data to obtain the processed transaction data; The adjacency matrix is ​​constructed based on the processed transaction data.

3. The method according to claim 1, characterized in that, The step of determining multiple target transaction links that meet preset conditions based on the transaction index information includes: The starting point of the link is determined based on the transaction index information; Taking the starting point of the link as the search starting point, responding to the iterative search operation on the transaction index information, it determines whether the transaction time corresponding to the current search transaction is within a preset time range, and whether the transaction value corresponding to the current search transaction is within a preset amount range; If the transaction time corresponding to the current search transaction is within the preset time range, and the transaction value corresponding to the current search transaction is not within the preset amount range, then the current search transaction is taken as an intermediate node; If the transaction time corresponding to the current search transaction is within the preset time range, and the transaction value corresponding to the current search transaction is within the preset amount range, then the current search transaction will be taken as the endpoint of the link. Based on the link start point, the intermediate node, and the link end point, the multiple target transaction links are determined.

4. The method according to claim 1, characterized in that, The total transaction amount includes total revenue and total expenditure. Determining the abnormal virtual resource transfer transaction chain based on the total abnormal fund transfer amount and the total transaction amount includes: Determine whether the total transaction amount of the intermediate nodes included in the multiple target transaction links is within the preset range of the total amount of abnormal fund transfers, and whether the total expenditure amount is greater than the total income amount; If the total transaction amount of the intermediate nodes included in the target transaction link is within the preset range of the total amount of abnormal fund transfers, and the total expenditure amount is not greater than the total income amount, then the target transaction link is designated as the abnormal virtual resource transfer transaction link.

5. The method according to claim 4, characterized in that, The step of determining the abnormal virtual resource transfer transaction chain based on the total amount of the abnormal fund transfer and the total transaction amount includes: The transaction link in which the total transaction amount of the intermediate nodes included in the target transaction link is within the preset range of the total amount of abnormal fund transfer, and the total expenditure amount is not greater than the total income amount, is taken as the final transaction link. Determine whether there are duplicate transaction links in the final transaction link; If there are duplicate transaction links in the final transaction link, the final transaction link is deduplicated, and the deduplicated final transaction link is used as the abnormal virtual resource transfer transaction link.

6. A device for identifying abnormal virtual resource transfer transactions, characterized in that, include: The acquisition module is used to acquire transaction data corresponding to multiple transaction links to be tested, wherein the transaction data includes: vertex information and edge information; The first determining module is used to determine transaction index information corresponding to the transaction data based on the transaction data, including: constructing an adjacency matrix based on the transaction data; performing iterative calculation on the adjacency matrix to obtain a calculation result, wherein the number of iterations of the iterative calculation is the target search depth of the transaction link to be tested; determining the link start point and link end point of the transaction link to be tested based on the calculation result, wherein the link start point corresponds to a debit account and the link end point corresponds to a credit account; and determining the transaction index information in a target format based on the link start point, the link end point, and the edge information. The selection module is used to select multiple target transaction links that meet predetermined conditions from the multiple test transaction links according to the transaction index information, wherein the starting point and the ending point of the multiple target transaction links are the same; A construction module is used to construct a target equation based on the multiple target transaction links, wherein the target equation is used to determine the total amount of abnormal fund transfers corresponding to the multiple target transaction links, and the target equation is a binary multivariate equation; The second determining module is used to determine, based on the target equation, an abnormal virtual resource transfer transaction link with abnormal virtual resource transfer behavior from the multiple target transaction links, including: calculating a feasible solution to the target equation, wherein the feasible solution corresponds to at least one abnormal fund transfer amount corresponding to the multiple target transaction links; determining the total abnormal fund transfer amount in the feasible solution; calculating the total transaction amount of multiple intermediate nodes corresponding to the multiple target transaction links respectively; and determining the abnormal virtual resource transfer transaction link based on the total abnormal fund transfer amount and the total transaction amount.

7. A non-volatile storage medium, characterized in that, The non-volatile storage medium stores multiple instructions, which are adapted to be loaded by a processor and executed by the method for identifying abnormal virtual resource transfer transactions as described in any one of claims 1 to 5.

8. An electronic device comprising a memory and a processor, characterized in that, The memory stores a computer program, and the processor is configured to run the computer program to perform the method for identifying abnormal virtual resource transfer transactions as described in any one of claims 1 to 5.

Images