A method for detecting financial crime gangs based on graph neural networks

Abstract

This invention discloses a method for detecting financial crime gangs based on a graph neural network. The method comprises the following steps: 1) extracting feature fields from electronic fund transaction data to be detected; 2) normalizing the digital feature fields; applying a language model to the natural language feature fields to obtain text vectors; and constructing a criminal feature matrix based on the obtained results; 3) generating virtual criminals for each small criminal gang based on the criminal feature matrix and the criminal characteristics of several known small criminal gangs, and establishing virtual connections between each virtual criminal and the original network to generate an enhanced criminal network; the original network is a fund transaction network constructed based on the detected electronic fund transaction data; 4) performing feature perturbation and edge perturbation on the criminal feature matrix using a graph perturbation module; and 5) using a graph neural network to learn the fund transaction network from the two obtained views, obtaining a feature embedding representation of the criminals and performing gang detection.

Description

Technical Field

[0001] The present invention relates to a method for detecting financial crime gangs based on graph neural networks, and belongs to the field of computer technology applications. Background Art

[0002] With economic development, financial crimes are becoming more frequent, with the amounts involved reaching new highs. The methods used are becoming more intelligent, diversified, and covert. Financial crime analysis models based on electronic funds and the reconstruction of the criminal process are key elements in the prosecutorial review of financial crime evidence. Leveraging next-generation information technologies such as big data and artificial intelligence, integrating the expertise of law enforcement agencies, and advancing breakthroughs in financial big data graph computing to investigate, prosecute, and adjudicate financial crimes from massive amounts of data has become a key topic in the development of smart justice and a future trend in this field.

[0003] Financial crime networks are typically composed of numerous criminal gangs. Criminals engage in activities collectively defined by gang leaders, and their followers carry out the goals set by their leaders. These tasks are performed by criminals with similar characteristics or skills. Financial crime networks are social groups. Therefore, members of such networks possess unique traits, behaviors, skills, and personalities, which often lead to identifiable communities within the network. Financial crime networks typically have a small number of leaders, with many followers loyal to them. However, some followers' loyalty is strongly tied to a specific leader within the gang, while others are less so, leading to the formation of community clusters. In addition to loyalty, the personalities or skill sets of criminals can easily create communities within the network, as shared skills within a network may determine the types of activities they engage in. All of these factors underscore the necessity of community detection research within financial crime networks. Research specifically in network analysis considers community identification a key task, as it provides solutions to real-time problems.

[0004] Existing methods have proven their value in detecting criminal gangs. However, most of them rely on either modularity-based approaches or topology-based criminal network analysis. These methods are insufficient for effectively detecting small criminal gangs and fail to fully utilize the characteristics of criminals. Furthermore, criminals often disguise themselves as discrete individuals to evade detection, often including the gang's leaders. This phenomenon can lead to low accuracy in criminal investigations.

[0005] Some methods utilize modularity-based approaches to criminal network analysis. Due to resolution limitations, these methods cannot identify community structures below a specific characteristic scale, and they may fail to detect small communities that are "small" for the network, making dense communities more difficult to analyze. Topology-based network analysis also fails to fully utilize characteristic information about criminals (such as the number and frequency of criminal transactions). For example, if a counterparty always trades at a specific time (between midnight and 6 a.m.), the likelihood is very high. Meanwhile, if a counterparty frequently interacts with multiple individuals at a specific time, they are likely to be the leader of a criminal gang. Summary of the Invention

[0006] In order to overcome the shortcomings of the existing technology, the present invention provides a financial crime gang detection method based on graph neural network, which has the advantages of high detection accuracy and easy positioning of small criminal gangs.

[0007] The technical solution adopted by the present invention to solve its technical problem is:

[0008] A method for detecting financial crime gangs based on graph neural networks, comprising the following steps:

[0009] 1) Preprocess the electronic transaction data from an actual money laundering case and analyze and process the transaction data using expert knowledge to construct feature fields. A transaction network is constructed from the electronic transaction data as the original network. Each node in the network represents a transacting party. If a transaction exists between two transacting parties, there is an edge between the two nodes.

[0010] 2) Normalize the digital feature fields; use the trained language model to obtain a text vector representation of the natural language feature fields. The normalized digital feature fields and text vector representation together form a criminal feature matrix;

[0011] 3) Using graph-based structural enhancement, we generate virtual criminals for small criminal gangs and create virtual connections between these virtual criminals and the original network, creating an enhanced criminal network to balance the distribution of members of financial crime gangs. Small criminal gangs are known networks with known characteristics of each member. We use the criminal feature matrix to generate virtual criminals for these small criminal gangs.

[0012] 4) Utilize the graph perturbation module to learn and enrich the criminal's feature representation, including feature perturbation and edge perturbation. Feature perturbation adds a random noise matrix to the criminal's feature matrix to make the criminal's feature representation more discriminative. Edge perturbation uses edge removal and graph diffusion to obtain two views of the financial transaction network.

[0013] 5) The twin graph encoder and dual correlation reduction module are used to learn the financial transaction network under the two views to obtain the feature embedding representation of the criminals and perform gang detection.

[0014] Furthermore, pre-processing the electronic fund transaction data includes: ignoring fund transaction records and transaction parties that are missing key information.

[0015] Furthermore, feature fields are constructed including: total transaction amount, total number of transactions, bank card account opening address, etc., totaling 81 dimensions, and features are extracted from electronic data of fund transactions based on the fields.

[0016] Furthermore, the method for processing a feature field in digital form includes: mapping the data value to [0, 1] by linear normalization.

[0017] Furthermore, the method for processing feature fields in natural language form includes: converting them into fixed-length sentence vectors through a pre-trained SBERT model.

[0018] Furthermore, the original capital transaction network is enhanced based on the graph structure to obtain the enhanced criminal network, which includes two steps: generating virtual criminals and generating virtual connections for small criminal gangs.

[0019] Furthermore, virtual criminals are generated for small criminal gangs through the following steps:

[0020] 1) For any criminal in all small financial crime gangs, find the criminal closest to him in the same gang by measuring the Euclidean distance in the embedding space;

[0021] 2) Generate a feature embedding representation of the virtual criminal node based on the embedding space representation of the criminal and its nearest neighbors;

[0022] 3) The generated virtual criminals are given a label of the small financial crime gang.

[0023] Furthermore, a virtual connection is generated between the virtual criminal and the original financial transaction network through the following steps:

[0024] 1) Using the connections in the original network as training data, the edge generator predicts which virtual criminals are connected to the original network and trains the edge generator by adopting weighted inner product;

[0025] 2) By using an edge generator and a specific threshold to control virtual connections, if the weighted inner product of the connection is greater than the specific threshold, the connection is added to the original transaction network; that is, the weighted inner product is calculated between the virtual criminal and each node in the original network, and if it is greater than the specific threshold, an edge is added between the virtual criminal and the node.

[0026] Furthermore, by generating virtual criminals and virtual connections, an enhanced criminal network is constructed based on the original capital transaction network, and the enhanced criminal feature matrix and connection matrix are obtained.

[0027] Furthermore, the feature perturbation includes: sampling a random noise matrix that satisfies a Gaussian distribution to perform feature perturbation on the enhanced criminal feature matrix to obtain a perturbed feature matrix.

[0028] Furthermore, the following steps are performed to remove edges and obtain a transaction network:

[0029] 1) Calculate the pairwise cosine similarity of the transaction parties based on the criminal feature matrix;

[0030] 2) Based on the similarity, the 10% edges with the lowest cosine similarity in the network are removed to generate the transaction network under the first view.

[0031] Furthermore, graph diffusion includes: converting the connection matrix into a graph diffusion matrix through a personalized page ranking algorithm (Personalized PageRank, PPR) to obtain a transaction network under another view.

[0032] Furthermore, through the following steps, for the transaction networks under the two obtained views, the twin graph encoder is used to obtain the encoded feature matrix, and then the dual correlation reduction module is used to generate the criminal feature embedding representation and perform gang detection:

[0033] 1) For sample-level correlation reduction, we first calculate the cross-view sample correlation matrix, where the matrix elements Represents the cosine similarity between the i-th criminal in the first view and the j-th criminal in the second view, and then controls the loss function to make the cross-view sample correlation matrix S N Try to be equal to an identity matrix I∈R N×N ;

[0034] 2) For feature-level correlation reduction, the node embedding representation under the first view is And the node embedding representation under the second view Through a mapping function R(·):R d×N →R d×K Mapping to group-level embeddings and Where N is the number of network nodes, K is the number of gangs, and R(·) can be used to map the embedded representation to the gang level by averaging the characteristic representations of criminals in the same gang. and The cosine similarity between them is S F ,in Represents the similarity between the i-th dimension feature in one view and the j-th dimension feature in another view, and controls the loss function to make the cross-view sample correlation matrix S F Try to be equal to an identity matrix I∈R d×d ;

[0035] 3) Decorrelate latent embeddings from two views and Through linear combination, we can get the embedded representation Z∈R of the criminal N×d , and then clustering is performed through K-means to obtain the gang detection results.

[0036] Compared with the prior art, the present invention has the following significant advantages:

[0037] 1) This paper designs a twin graph encoder to capture criminal feature information and network structure, and uses a graph perturbation module and a dual information correlation reduction module to enrich the criminal feature representation;

[0038] 2) This paper proposes a graph-based structural enhancement method that generates virtual criminals and edges to balance the distribution of criminal gang members, thereby alleviating the representation collapse problem during graph neural network training and making the criminal characteristics of small criminal gangs more expressive. As a result, the model can overcome resolution limitations and effectively locate small criminal gangs. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 This is the overall flow chart of the present invention for detecting financial crime gangs.

[0040] Figure 2 It is a flowchart for constructing the criminal characteristics matrix.

[0041] Figure 3 An example graph showing how structural enhancement improves the detection accuracy of small criminal gangs.

[0042] Figure 4 This is the framework diagram of the twin graph encoder. DETAILED DESCRIPTION

[0043] In order to make the objectives, technical solutions, and advantages of the present invention more clearly understood, the present invention is further described in detail below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are intended only to illustrate the present invention and are not intended to limit the present invention. In addition, the technical features involved in the various embodiments of the present invention described below may be combined with each other as long as they do not conflict with each other.

[0044] The software defect report dispatching method of the present invention has a flow chart as shown below: Figure 1 As shown, the following steps are included:

[0045] Step 1: Preprocess the electronic data of fund transactions and construct feature fields based on expert knowledge;

[0046] Step 2: Normalize the feature fields in digital form; use the trained language model to obtain text vector representation for the feature fields in natural language form;

[0047] Step 3: Using graph-based structural enhancement, generate virtual criminals and virtual connections for small criminal gangs to balance the distribution of members of financial crime gangs;

[0048] Step 4: Use the graph perturbation module to learn rich neighbor representations, including feature perturbation and edge perturbation. The edge perturbation obtains the capital transaction network under two views through edge removal and graph diffusion.

[0049] Step 5: Use the twin graph encoder and dual correlation reduction module to learn the financial transaction network under two views, obtain the feature embedding representation of the criminals and perform gang detection.

[0050] Step 1: Preprocess the electronic data of fund transactions and construct 81 feature fields based on expert knowledge. The specific steps are as follows:

[0051] Step 11: Pre-process the electronic data of fund transactions. If there are meaningless characters or garbled characters in the fund transaction information or the personal information of the fund transaction parties, delete the record;

[0052] Step 12: Combine expert knowledge to construct feature fields with a total of 81 dimensions, including total transaction amount, total number of transactions, etc.

[0053] Step 2: Normalize the feature fields in digital form; use the trained language model to obtain text vector representations for the feature fields in natural language form. The specific steps are as follows:

[0054] Step 21: For numerical feature fields, such as the ratio of transactions in a specific time period to the total number of transactions, linear normalization is used to map the data values ​​to the range [0, 1].

[0055] Step 22: For natural language feature fields, such as "bank account opening address", convert them into fixed-length sentence vectors using the pre-trained SBERT model;

[0056] Step 23: Integrate the digital feature field, the fixed-length vector converted from the natural language feature field, and the communication information between criminals into a criminal feature vector.

[0057] Step 3: Using graph-based structural enhancement, generate virtual criminals and virtual connections for small criminal gangs to balance the distribution of members of financial crime gangs;

[0058] Step 31: The specific steps for generating virtual criminals for small criminal gangs are as follows:

[0059] Step 311: For a specific small financial crime gang C v Members of v , by measuring the Euclidean distance in the embedding space, find the nearest criminal n from the same gang c (v), the distance measurement can be formalized as:

[0060]

[0061] Step 312: Based on the specific criminal n v The embedding space representation of the virtual criminal node and its nearest neighbor nc(v) generates the feature embedding representation h vc , formalized as:

[0062]

[0063] Step 313: assign the generated virtual criminal a label of the small financial crime gang.

[0064] Step 32: Generate virtual connections for virtual criminals for small criminal gangs. The specific steps are as follows:

[0065] Step 321: Use the weighted inner product to train the edge generator using the criminals and edges in the original network, E v,u represents the predicted relationship information between criminals v and u, and P is the parameter matrix that controls the interaction between nodes, which is formalized as:

[0066] E v,u =softmax(σ(h v ·P·h u ))

[0067] Step 322: The loss function for training the edge generator is formalized as:

[0068]

[0069] Step 322: Generate virtual connections by using an edge generator and a specific threshold, formalized as:

[0070]

[0071] Step 33: By generating virtual criminals and edge generators, the obtained virtual criminal features are represented as h vc Add the feature matrix and add the generated virtual criminals and edges to the original network to obtain the feature matrix and connection matrix of the enhanced criminal network and

[0072] Step 4: Use the graph perturbation module to learn rich neighbor representations, including feature perturbation and edge perturbation. The edge perturbation obtains the capital transaction network under two views through edge removal and graph diffusion.

[0073] Step 41: Sample a random noise matrix NO∈R that satisfies the Gaussian distribution M×D Perform feature perturbation to obtain the perturbed criminal feature matrix, where * represents the Hadamard product, which is formalized as;

[0074]

[0075] Step 42: By removing edges, a transaction network is obtained in a certain view. The specific steps are as follows:

[0076] Step 421: Calculate the sample pairwise cosine similarity in the latent space:

[0077] Step 422: Generate a mask matrix MS∈R based on the similarity M×M , where 10% of the edges have been removed and the connectivity matrix of the criminal network has been enhanced Normalize to get the new adjacency matrix Where * represents the Hadamard product, I is the identity matrix, and D is the degree matrix, which can be formalized as:

[0078]

[0079] Step 43: The normalized adjacency matrix is ​​converted into a graph diffusion matrix through the Personalized PageRank (PPR) algorithm to obtain another view of the transaction network, where θ is the transmission probability set to 0.2, I is the identity matrix, and D is the degree matrix, which is formalized as follows:

[0080]

[0081] Step 5: Use the twin graph encoder and dual correlation reduction module to learn the financial transaction network under the two views, obtain the criminal feature embedding representation and perform gang detection. The specific steps are as follows:

[0082] Step 51: Obtain node embedding representations under two views through the twin graph encoder and For sample-level correlation reduction, we first calculate the cross-view sample correlation matrix S N ∈R N×N , formalized as follows:

[0083]

[0084] in represents the cosine similarity between the i-th criminal in the first view and the j-th criminal in the second view.

[0085] Step 52: Then make the cross-view sample correlation matrix S by controlling the loss function N Try to be equal to an identity matrix I∈R N×N , formalized as follows:

[0086]

[0087] The first one encourages S N The diagonal elements in are equal to 1, which indicates that the embedding of the same criminal in two different views is controlled to be as consistent as possible. The second term makes S N The off-diagonal elements in are equal to 0 to minimize the consistency between the embeddings of different criminals in the two views. This decorrelation operation can help our network reduce the redundant information between nodes in the latent space, making the learned criminal feature embedding more discriminative.

[0088] Step 53: For feature-level correlation reduction, first obtain the node embedding representation under two views and Through a mapping function R(·):R d×N →R d×K Mapping to group-level embedding, K represents the number of groups in the network, which can be formalized as follows:

[0089]

[0090] Step 54: Calculate and The cosine similarity between , is formalized as follows:

[0091]

[0092] in It represents the similarity between the i-th dimension feature in one view and the j-th dimension feature in another view.

[0093] Step 55: Similar to feature-level correlation reduction, the cross-view sample correlation matrix S is made by controlling the loss function F Try to be equal to an identity matrix I∈R d×d The formalization is as follows:

[0094]

[0095] Where d is the potential embedding dimension, the embedding representations of features of the same dimension in two augmented views are brought closer, while those of different dimensions make them more discriminative.

[0096] Step 53: Decorrelate the latent embeddings from both views and The embedded representation Z∈R of the criminal is obtained by linear combination N×d , then conduct community detection to obtain the results, which are formalized as follows;

[0097]

[0098] Step 54: Tune the model hyperparameters, such as the number of layers of the linear classifier, the parameters of Dropout, etc., and evaluate the prediction accuracy of the model on the test set, and finally save the optimal model.

[0099] To illustrate the performance advantages of the present invention, the present invention uses Louvain, Kmeans, SDCN, DAEGC, MVGRL, ARGA, DFCN, and Bahulkar models as benchmarks for comparative experiments. After 5 repeated experiments and averaging the results, the Louvain method had an accuracy of 60.46% and an F1 of 8.55%, the Kmeans method had an accuracy of 57.05% and an F1 of 21.05%, the SDCN method had an accuracy of 72.28% and an F1 of 9.6%, the DAEGC method had an accuracy of 72.28% and an F1 of 9.6%, the MVGRL method had an accuracy of 50.62% and an F1 of 10.52%, the ARGA method had an accuracy of 23.32% and an F1 of 8.75%, the DFCN method had an accuracy of 35.64% and an F1 of 19.94%, and the Bahulkar method had an accuracy of 84.65% and an F1 of 25.29%. The method for detecting financial crime gangs based on graph neural networks proposed in this invention had the highest detection accuracy and F1, which were 84.90% and 74.04% respectively.

[0100] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for detecting financial crime gangs based on graph neural networks, comprising the following steps: 1) Extracting characteristic fields from the electronic data of fund transactions to be detected, including characteristic fields in digital form and characteristic fields in natural language form; 2) Normalize the feature fields in digital form; The feature fields in natural language form are subjected to a language model to obtain a text vector; the obtained text vector and the normalized feature fields in digital form are combined into a criminal feature matrix; 3) Based on the criminal characteristic matrix and the criminal characteristics of several known small criminal gangs, a virtual criminal is generated for each of the small criminal gangs, and a virtual connection is established between each virtual criminal and the original network to generate an enhanced criminal network; the original network is a capital transaction network constructed based on the detected electronic data of capital transactions, where each node is a transaction party and each edge represents a transaction between two transaction parties; the method for generating a virtual criminal for each of the small criminal gangs is as follows: 31) For each transaction party in the criminal feature matrix, find the criminal in the i-th small criminal gang that is closest to the transaction party based on the Euclidean distance between the feature vector of the transaction party and the feature vector of each criminal in the i-th small criminal gang; 32) Generate a virtual criminal and its feature embedding representation based on the embedding space representation of the criminal and his / her counterparty; 33) assigning each generated virtual criminal a label of the i-th small criminal gang; The method for generating the enhanced criminal network is as follows: using the connections existing in the original network as training data to input into the edge generator, calculating the weighted inner product between each virtual criminal and each transaction party in the original network, and if the weighted inner product is greater than a set threshold, establishing a virtual connection between the virtual criminal and the corresponding transaction party to generate the enhanced criminal network; 4) Using a graph perturbation module, the criminal feature matrix is ​​subjected to feature perturbation and edge perturbation in sequence; the feature perturbation is performed by adding a random noise matrix to the criminal feature matrix to make the criminal feature representation more discriminative; the edge perturbation is performed by performing edge removal and graph diffusion on the feature-perturbed criminal feature matrix, respectively, to obtain two views of the capital transaction network; 5) Use graph neural networks to learn the financial transaction networks obtained from the two views, obtain the feature embedding representation of criminals, and perform gang detection.

2. The method according to claim 1, characterized in that The feature perturbation includes: sampling a random noise matrix that satisfies Gaussian distribution to perform feature perturbation on the criminal feature matrix to obtain a disturbed criminal feature matrix.

3. The method according to claim 1, characterized in that The transaction network under the first view is obtained by edge removal, wherein the method is as follows: the similarity between two transaction parties is calculated based on the criminal feature matrix; and several edges with the lowest similarity in the original network are removed based on the similarity to generate the transaction network under the first view.

4. The method according to claim 1, wherein Graph diffusion is performed on the criminal feature matrix after feature perturbation to obtain a fund transaction network under a second view; the graph diffusion method includes: converting the connection matrix in the enhanced criminal network into a graph diffusion matrix through a PPR algorithm to obtain a transaction network under the second view.

5. The method according to claim 1, wherein The node corresponding to each criminal in the first view is embedded in the representation And the node embedding representation corresponding to each criminal in the second view Perform linear combination to obtain the embedded representation Z of the criminals, and then perform community detection based on the embedded representation Z of each criminal to determine whether there is a criminal gang.

6. The method according to claim 5, characterized in that Use the trained twin network to get the node embedding representation corresponding to each criminal in the first view And the node embedding representation corresponding to each criminal in the second view The training method of the twin network is: 51) Calculate the cross-view sample correlation matrix S for each sample in the sample training set N , where the matrix elements Represents the similarity between the i-th criminal in the first view of the sample and the j-th criminal in the second view of the sample; then the cross-view sample correlation matrix S is made by controlling the loss function N tends to an identity matrix; 52) Embed the node corresponding to each criminal in the first view And the node embedding representation Z corresponding to each criminal in the second view v2 Mapped to group-level embedding through a mapping function R(·) and calculate and The similarity between them is used to obtain the cross-view sample correlation matrix S F ,in Represents the similarity between the i-th dimension feature in the first view and the j-th dimension feature in the second view; then the cross-view sample correlation matrix S is made by controlling the loss function F approaches an identity matrix.

7. A server, characterized in that: The method comprises a memory and a processor, wherein the memory stores a computer program, the computer program is configured to be executed by the processor, and the computer program includes instructions for executing the steps of the method according to any one of claims 1 to 6.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images