A data screening and processing method and apparatus

Abstract

This invention provides a data screening and processing method and apparatus. The method includes: receiving data to be screened, the data to be screened including at least one of the following: customer information, account information; obtaining supplementary data for the data to be screened by comparing it with the full data in a data lake, the supplementary data including basic data and related data corresponding to the data to be screened; generating a relationship graph of the data to be screened based on the data to be screened and the supplementary data; and generating a data screening result for the data to be screened based on the relationship graph. This invention can solve the problem in related technologies where the ex-post supervision and control mechanism, which is mainly based on experience rules, cannot predict risks in advance for abnormal data. By using a relationship graph for data screening, it provides an intuitive and convenient query method and can predict anomalies in advance.

Description

Technical Field

[0001] This invention relates to the field of data processing, and more specifically, to a data screening and processing method and apparatus. Background Technology

[0002] With the rapid development of technology, abnormal transaction chains have broken through spatial and physical limitations, becoming intertwined with the massive amounts of transaction data in daily operations, making them difficult to identify clearly and intuitively. The financial industry's ex-post supervision and control mechanisms, which are mainly based on traditional experience and rules, are constantly being challenged.

[0003] No solution has yet been proposed for the problem that the ex-post monitoring and control mechanism based on empirical rules in related technologies cannot predict risks in advance regarding abnormal data. Summary of the Invention

[0004] This invention provides a data screening and processing method and apparatus to at least solve the problem in related technologies where ex-post monitoring and control mechanisms based on empirical rules cannot predict risks in advance for abnormal data.

[0005] According to an embodiment of the present invention, a data screening and processing method is provided, comprising:

[0006] Upon receiving data to be investigated, the data to be excluded includes at least one of the following: customer information, account information;

[0007] Supplementary data for the data to be investigated is obtained by comparing the data to be investigated with the full data in the data lake. The supplementary data includes the basic data and related data corresponding to the data to be investigated.

[0008] A relationship graph of the data to be investigated is generated based on the data to be investigated and the supplementary data;

[0009] Data investigation results are generated based on the relationship graph.

[0010] Optionally, generating a relationship graph of the data to be investigated based on the data to be investigated and the supplementary data includes:

[0011] Obtain multiple index information of the data to be investigated and the basic data;

[0012] According to the pre-set graph analysis rules, the hit results corresponding to the multiple index information are determined from the associated data, wherein the hit results include hits that satisfy the graph analysis rules and misses that do not satisfy the graph analysis rules;

[0013] The relationship graph is generated by combining the data to be investigated, the supplementary data, and the hit results corresponding to the multiple index information.

[0014] Optionally, generating the relationship graph from the data to be investigated, the supplementary data, and the hit results corresponding to the multiple index information includes:

[0015] The multiple index information is classified to obtain multiple types of information;

[0016] The relationship graph is generated by using the customer information or account information as the central node, the multiple types of information as child nodes of the central node, and the information contained in the multiple types of information as leaf nodes of the child nodes, wherein each type of information corresponds to one child node.

[0017] Optionally, the index information includes at least one of the following: document address, account address, office address, registered address, contact address, business transaction frequency, transaction amount, Internet Protocol (IP) address, Media Access Control (MAC) address, communication number, document number, kinship information, account name, responsible person, manager, business agent, authorized agent, frequently transacting account, account with transaction amount exceeding a preset value, business initiator, business recipient, account opening time, and account opening branch; the multiple types of information include: address information, account information, customer information, transaction information, and communication information, wherein,

[0018] The address information includes: document address, account address, office address, registered address, and contact address;

[0019] The account information includes: account name, responsible person or manager, business agent, authorized agent, account opening time, and account opening location;

[0020] Customer information includes: contact number, identification number, and family information;

[0021] The transaction information includes: business transaction frequency, transaction amount, accounts with frequent transactions, accounts with transaction amounts exceeding a preset value, business initiator, and business recipient;

[0022] Communication information includes: IP address, MAC address, and communication number.

[0023] Optionally, the spectral analysis rules include at least one of the following:

[0024] The address is the same as or has a distance difference of less than a preset distance from the address on the identification document, the account address, the office address, the registered address, or the contact address.

[0025] The business transaction frequency of the account corresponding to the business application data is greater than or equal to a preset frequency;

[0026] The transaction limit of the account corresponding to the business application data is greater than or equal to the preset limit;

[0027] The IP address or MAC address of the account corresponding to the business application data is the same;

[0028] The communication number or identification number of the account corresponding to the business application data is the same;

[0029] The person in charge, manager, agent, or authorized representative of the account corresponding to the business application data is a relative;

[0030] The account name, responsible person, manager, business agent, or authorized agent are the same as the account corresponding to the business application data;

[0031] Frequent trading accounts have more transactions than the preset limit;

[0032] Accounts with transaction amounts exceeding the preset limit;

[0033] The account corresponding to the business application data has the same business initiator or business recipient;

[0034] The account opening time is the same as or the time difference between the account and the business application data is less than a preset time.

[0035] The account opening location corresponding to the business application data is the same as or the distance difference is less than a preset distance.

[0036] Optionally, the data investigation results generated based on the relationship graph include:

[0037] For individual accounts, the data screening results generated based on the relationship graph include at least the following: the number of hits of the graph analysis rules, document type, account nature, total number of debit transactions in the account, account opening information, and the regions to which all IP addresses used by the account belong;

[0038] For corporate accounts, the data screening results generated based on the relationship graph include at least the following: the number of hits of the graph analysis rules, account opening institution information, the total number of debit transactions of the account, account opening information, and the regions to which all IP addresses used by the account belong.

[0039] Optionally, the method further includes:

[0040] Acquire full data of personal business information and corporate business information, wherein the personal business information includes at least: personal customer information and personal account information, and the corporate business information includes at least: corporate customer information and corporate account information;

[0041] The full dataset is stored in the data lake according to a preset format.

[0042] Optionally, after generating the data investigation results of the data to be investigated based on the relationship graph, the method further includes:

[0043] The data screening results are broken down into general business units and sub-business units;

[0044] The total business unit is distributed according to the total data distribution path corresponding to the total business unit;

[0045] The sub-business units are distributed according to the sub-data distribution paths corresponding to the sub-business units.

[0046] According to another embodiment of the present invention, a data screening and processing apparatus is also provided, comprising:

[0047] The receiving module is used to receive data to be investigated, wherein the data to be investigated includes at least one of the following: customer information and account information;

[0048] The acquisition module is used to acquire supplementary data of the data to be investigated by comparing the data to be investigated with the full data in the data lake. The supplementary data includes the basic data and related data corresponding to the data to be investigated.

[0049] The first generation module is used to generate a relationship graph of the data to be investigated based on the data to be investigated and the supplementary data;

[0050] The second generation module is used to generate data investigation results of the data to be investigated based on the relationship graph.

[0051] Optionally, the first generation module includes:

[0052] The acquisition submodule is used to acquire multiple index information of the data to be investigated and the basic data;

[0053] The determination submodule is used to determine the hit results corresponding to the multiple index information from the associated data according to the pre-set graph analysis rules, wherein the hit results include hits that satisfy the graph analysis rules and misses that do not satisfy the graph analysis rules;

[0054] A generation submodule is used to generate the relationship graph from the data to be investigated, the supplementary data, and the hit results corresponding to the multiple index information.

[0055] Optionally, the generation submodule is further configured to classify the multiple index information to obtain multiple types of information; using the customer information or account information as the central node of the relationship graph, the multiple types of information as child nodes of the central node, and the information contained in the multiple types of information as leaf nodes of the child nodes to generate the relationship graph, wherein each type of information corresponds to one child node.

[0056] Optionally, the index information includes at least one of the following: document address, account address, office address, registered address, contact address, transaction frequency, transaction amount, IP address, MAC address, communication number, document number, family information, account name, responsible person, manager, business agent, authorized agent, frequently transacting account, account with transaction amount exceeding a preset value, business initiator, business recipient, account opening time, and account opening branch; the multiple types of information include: address information, account information, customer information, transaction information, and communication information, wherein...

[0057] The address information includes: document address, account address, office address, registered address, and contact address;

[0058] The account information includes: account name, responsible person or manager, business agent, authorized agent, account opening time, and account opening location;

[0059] Customer information includes: contact number, identification number, and family information;

[0060] The transaction information includes: business transaction frequency, transaction amount, accounts with frequent transactions, accounts with transaction amounts exceeding a preset value, business initiator, and business recipient;

[0061] Communication information includes: IP address, MAC address, and communication number.

[0062] Optionally, the spectral analysis rules include at least one of the following:

[0063] The address is the same as or has a distance difference of less than a preset distance from the address on the identification document, the account address, the office address, the registered address, or the contact address.

[0064] The business transaction frequency of the account corresponding to the business application data is greater than or equal to a preset frequency;

[0065] The transaction limit of the account corresponding to the business application data is greater than or equal to the preset limit;

[0066] The IP address or MAC address of the account corresponding to the business application data is the same;

[0067] The communication number or identification number of the account corresponding to the business application data is the same;

[0068] The person in charge, manager, agent, or authorized representative of the account corresponding to the business application data is a relative;

[0069] The account name, responsible person, manager, business agent, or authorized agent are the same as the account corresponding to the business application data;

[0070] Frequent trading accounts have more transactions than the preset limit;

[0071] Accounts with transaction amounts exceeding the preset limit;

[0072] The account corresponding to the business application data has the same business initiator or business recipient;

[0073] The account opening time is the same as or the time difference between the account and the business application data is less than a preset time.

[0074] The account opening location corresponding to the business application data is the same as or the distance difference is less than a preset distance.

[0075] Optionally, the second generation module is further configured to, for personal accounts, generate data screening results based on the relationship graph that include at least the following: the number of hits of the graph analysis rules, document type, account nature, total number of debit transactions, account opening information, and the regions to which all IP addresses used by the account belong; and for corporate accounts, generate data screening results based on the relationship graph that include at least the following: the number of hits of the graph analysis rules, account opening institution information, total number of debit transactions, account opening information, and the regions to which all IP addresses used by the account belong.

[0076] Optionally, the device further includes:

[0077] The acquisition module is used to acquire full data of personal business information and corporate business information. The personal business information includes at least personal customer information and personal account information, and the corporate business information includes at least corporate customer information and corporate account information.

[0078] The storage module is used to store the full amount of data into the data lake according to a preset format.

[0079] Optionally, the device further includes:

[0080] The splitting module is used to split the data screening results into a total business unit and sub-business units;

[0081] The first distribution module is used to distribute the total business unit according to the total data distribution path corresponding to the total business unit;

[0082] The second distribution module is used to distribute the sub-business unit according to the sub-data distribution path corresponding to the sub-business unit.

[0083] According to yet another embodiment of the present invention, a computer-readable storage medium is also provided, wherein a computer program is stored therein, wherein the computer program is configured to perform the steps in any of the above method embodiments when executed.

[0084] According to yet another embodiment of the present invention, an electronic device is also provided, including a memory and a processor, wherein the memory stores a computer program and the processor is configured to run the computer program to perform the steps in any of the above method embodiments.

[0085] This invention receives data to be investigated, wherein the data to be excluded includes at least one of the following: customer information and account information; supplementary data for the data to be investigated is obtained by comparing the data to be investigated with the full data in the data lake, wherein the supplementary data includes basic data and related data corresponding to the data to be investigated; a relationship graph of the data to be investigated is generated based on the data to be investigated and the supplementary data; and a data investigation result of the data to be investigated is generated based on the relationship graph. This invention can solve the problem in related technologies where the ex-post supervision and control mechanism, which is mainly based on experience rules, cannot predict risks in advance for abnormal data. By using the relationship graph for data investigation, an intuitive and convenient query method is provided, and anomalies can be predicted in advance. Attached Figure Description

[0086] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, illustrate exemplary embodiments of the invention and, together with their description, serve to explain the invention and do not constitute an undue limitation thereof. In the drawings:

[0087] Figure 1 This is a hardware structure block diagram of a mobile terminal for the data screening and processing method according to an embodiment of the present invention.

[0088] Figure 2 This is a flowchart of a data screening and processing method according to an embodiment of the present invention;

[0089] Figure 3 This is a flowchart of the data screening and processing based on the relationship graph according to this embodiment;

[0090] Figure 4 This is a block diagram of a data screening and processing apparatus according to an embodiment of the present invention. Detailed Implementation

[0091] The present invention will be described in detail below with reference to the accompanying drawings and embodiments. It should be noted that, unless otherwise specified, the embodiments and features described in the present application can be combined with each other.

[0092] It should be noted that the terms "first," "second," etc., in the specification, claims, and drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0093] Example 1

[0094] The method embodiment provided in Embodiment 1 of this application can be executed on a mobile terminal, computer terminal, or similar computing device. Taking its operation on a mobile terminal as an example, Figure 1 This is a hardware structure block diagram of a mobile terminal for the data screening and processing method according to an embodiment of the present invention, as shown below. Figure 1 As shown, a mobile terminal may include one or more ( Figure 1 Only one is shown in the diagram. A processor 102 (which may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.) and a memory 104 for storing data are also shown. Optionally, the mobile terminal may further include a transmission device 106 for communication functions and an input / output device 108. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the mobile terminal described above. For example, the mobile terminal may also include components that are more... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0095] The memory 104 can be used to store computer programs, such as application software programs and modules, like the computer program corresponding to the data screening and processing method in this embodiment of the invention. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, thereby implementing the above-described method. The memory 104 may include high-speed random access memory and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the mobile terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0096] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the mobile terminal's communication provider. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module used for wireless communication with the Internet.

[0097] This embodiment provides a data screening and processing method operating on the aforementioned mobile terminal or network architecture. Figure 2 This is a flowchart of a data screening and processing method according to an embodiment of the present invention, such as... Figure 2 As shown, the process includes the following steps:

[0098] Step S202: Receive data to be investigated, wherein the data to be excluded includes at least one of the following: customer information, account information;

[0099] Step S204: Obtain supplementary data for the data to be investigated by comparing it with the full data in the data lake. The supplementary data includes the basic data and related data corresponding to the data to be investigated.

[0100] Step S206: Generate a relationship graph of the data to be investigated based on the data to be investigated and the supplementary data;

[0101] Step S208: Generate the data investigation results of the data to be investigated based on the relationship graph.

[0102] Through the above steps S202 to S208, the problem that the ex-post supervision and control mechanism based on empirical rules in related technologies cannot predict risks in advance for abnormal data can be solved. By using relationship graphs to screen data, an intuitive and convenient query method is provided, which can predict anomalies in advance.

[0103] In this embodiment of the invention, step S206 may specifically include: acquiring multiple index information of the data to be investigated and the basic data; determining the hit results corresponding to the multiple index information from the associated data according to a pre-set graph analysis rule, wherein the hit results include hits that satisfy the graph analysis rule and misses that do not satisfy the graph analysis rule; generating the relationship graph from the data to be investigated, the supplementary data, and the hit results corresponding to the multiple index information; further, classifying the multiple index information to obtain multiple types of information; generating the relationship graph with the customer information or account information as the central node of the relationship graph, the multiple types of information as child nodes of the central node, and the information contained in the multiple types of information as leaf nodes of the child nodes, wherein each type of information corresponds to one child node.

[0104] The index information in this embodiment of the invention includes at least one of the following: document address, account address, office address, registered address, contact address, transaction frequency, transaction amount, IP address, MAC address, communication number, document number, family information, account name, responsible person, manager, business agent, authorized agent, frequently transacting account, account with transaction amount exceeding a preset value, business initiator, business recipient, account opening time, and account opening branch; the multiple types of information include: address information, account information, customer information, transaction information, and communication information, wherein,

[0105] The address information includes: document address, account address, office address, registered address, and contact address;

[0106] The account information includes: account name, responsible person or manager, business agent, authorized agent, account opening time, and account opening location;

[0107] Customer information includes: contact number, identification number, and family information;

[0108] The transaction information includes: business transaction frequency, transaction amount, accounts with frequent transactions, accounts with transaction amounts exceeding a preset value, business initiator, and business recipient;

[0109] Communication information includes: IP address, MAC address, and communication number.

[0110] Optionally, the spectral analysis rules include at least one of the following:

[0111] The address is the same as or has a distance difference of less than a preset distance from the address on the identification document, the account address, the office address, the registered address, or the contact address.

[0112] The business transaction frequency of the account corresponding to the business application data is greater than or equal to a preset frequency;

[0113] The transaction limit of the account corresponding to the business application data is greater than or equal to the preset limit;

[0114] The IP address or MAC address of the account corresponding to the business application data is the same;

[0115] The communication number or identification number of the account corresponding to the business application data is the same;

[0116] The person in charge, manager, agent, or authorized representative of the account corresponding to the business application data is a relative;

[0117] The account name, responsible person, manager, business agent, or authorized agent are the same as the account corresponding to the business application data;

[0118] Frequent trading accounts have more transactions than the preset limit;

[0119] Accounts with transaction amounts exceeding the preset limit;

[0120] The account corresponding to the business application data has the same business initiator or business recipient;

[0121] The account opening time is the same as or the time difference between the account and the business application data is less than a preset time.

[0122] The account opening location corresponding to the business application data is the same as or the distance difference is less than a preset distance.

[0123] In this embodiment of the invention, step S208 may specifically include: for personal accounts, generating data screening results based on the relationship graph that include at least the following: the number of hits of the graph analysis rules, document type, account nature, total number of debit transactions, account opening information, and the regions to which all IP addresses used by the account belong; for corporate accounts, generating data screening results based on the relationship graph that include at least the following: the number of hits of the graph analysis rules, account opening institution information, total number of debit transactions, account opening information, and the regions to which all IP addresses used by the account belong.

[0124] In an optional embodiment, the method further includes: acquiring full data of personal business information and corporate business information, wherein the personal business information includes at least: personal customer information and personal account information, and the corporate business information includes at least: corporate customer information and corporate account information; and storing the full data in the data lake according to a preset format.

[0125] In another optional embodiment, after step S208 above, the method further includes: splitting the data screening result into a total business unit and sub-business units; distributing the total business unit according to the total data distribution path corresponding to the total business unit; and distributing the sub-business units according to the sub-data distribution paths corresponding to the sub-business units.

[0126] Based on the goal of improving the efficiency of risk prevention and control of transaction accounts, identification and monitoring of transaction fraud, and providing headquarters and branches with an intuitive and convenient way to analyze the relationship between involved and suspicious accounts, the present invention mainly involves the design and implementation of functions such as basic data preparation, data transmission channel construction, analysis of the relationship network of data to be investigated, generation of investigation data tables, and data distribution.

[0127] Figure 3 This is a flowchart of the data screening and processing based on the relationship graph according to this embodiment, such as... Figure 3 As shown, it includes:

[0128] Step S301: Data preparation for the data lake, including all data on corporate and personal accounts and transactions within the bank.

[0129] For personal business, including:

[0130] Customer Information: Customer ID, Account Name, ID Type, ID Number, ID Address, Province / City / District of ID Address, Age, Gender, Online Banking Version

[0131] Account Information: Opening Institution Code, Branch, Opening Outlet, Province / City / District of Opening Institution, Account Type (Class I, Class II, Class III, Credit Card), Account Status (Normal, Freezing Only, Amount Frozen, Closed Freezing, Forced Note, Suspended Non-Counter Transactions, Note), Control Date, Number of Debit Transactions from Opening Date to Investigation Date, Debit Transaction Amount, Number of Credit Transactions, Credit Transaction Amount, Number of Counter Transactions, Account Balance on Investigation Date, Opening Date, Account Opening Transaction Number, Opening Channel (Counter, Smart Counter, V) The following information is required: TM, external PAD, online channels), card opening method (single card opening, batch card opening), whether the card was opened by the cardholder, the highest facial recognition score (7835) corresponding to the Japanese national ID number used for account opening, agent's name, document type, document number, the highest facial recognition score (7835) corresponding to the agent's ID number on the account opening date, all dates with records of 7835 after the account opening date and their facial recognition scores, account closing date, accounts traced from the same IP address, accounts traced from the same phone number, and accounts traced from the same ID number. Whether suspicious anti-money laundering transactions are reported, whether large anti-money laundering transactions are reported, whether the anti-money laundering risk rating is adjusted, and whether post-supervision and supervisory warnings and their types are triggered on the supervision and management platform.

[0132] For corporate business, including:

[0133] Customer Information: Customer Number, Account Name, Unified Social Credit Code, Organization Code, Business License Registered Address, Registered Address Province / City / District, Legal Representative Name, Document Type, Document Number, Document Address, Document Address Province / City / District, Age, Gender, Online Banking Version, Daily Cumulative Transaction Amount under Online Banking Control, Daily Cumulative Transaction Count, Annual Cumulative Transaction Amount.

[0134] Account Information: Opening Institution Number, Branch, Opening Outlet, Province / City / District of Opening Institution, Account Type (Basic, General, Temporary, Special), Account Status (Normal, Freezing Only, Amount Frozen, Closed Freezing, Forced Note, Suspended Non-Counter Services, Note), Control Date, Number of Debit Transactions from Opening Date to Investigation Date, Debit Transaction Amount, Number of Credit Transactions, Credit Transaction Amount, Number of Counter Transactions, Account Balance on Investigation Date, Opening Date, Account Opening Transaction Number, Whether the Legal Representative Handled the Account in Person, Highest Facial Recognition Score (7835) Corresponding to the Legal Representative's ID Number on the Opening Date, Agent's Name, ID Type, ID Number, Highest Facial Recognition Score (7835) Corresponding to the Agent's ID Number on the Opening Date, All Dates with Records of 7835 and Facial Recognition Scores After the Opening Date, Account Closure Date, Reverse Lookup Accounts with the Same IP Address, Reverse Lookup Accounts with the Same Legal Representative's Phone Number, Reverse Lookup Accounts with the Same Account Name. Whether suspicious anti-money laundering transactions are reported, whether large anti-money laundering transactions are reported, whether the anti-money laundering risk rating is adjusted, and whether the post-supervision and guidance warnings of the supervision and management platform are triggered and the types of warnings.

[0135] Step S302: The regulatory agency issues the data to be investigated;

[0136] Step S303: Organize the data to generate a query table and submit the data to the data lake;

[0137] The data transmission channel supports the transmission of confidential or sensitive data within the bank. This includes converting externally provided tabular data into internal business application data, delivering this data to the graph analysis platform, generating and delivering graph analysis results, and distributing them to designated head office and branch application directories upon request.

[0138] Externally provided table data is converted into internal business application data: the initial list organization or relationship definition is done manually, and an automatic data conversion function is developed later as needed.

[0139] Data delivery for internal business applications: Business personnel upload data application content to the graph through the MIS system.

[0140] Step S304: Data lake comparison. Specifically, the data to be investigated is compared with the full data in the data lake one by one to find supplementary data for the data to be investigated.

[0141] Step S305: Supplement the data information to be investigated;

[0142] Step S306: Generate a relationship graph, specifically by generating a relationship graph of the data to be investigated based on the data to be investigated and the supplementary data;

[0143] Step S307: Generate the associated data table;

[0144] Generate and deliver spectral analysis results: Establish a delivery channel to support result transmission.

[0145] The application is distributed to the designated head office and branch office application directories based on the application results. The results are then broken down into head office and branch office business units and distributed according to the specified paths.

[0146] Network analysis of the data to be investigated involves supplementing relevant business elements based on the index information of the data to be investigated, and analyzing related data and extracting relevant data information related to the case based on the relationships in the graph index. Graph analysis rules include:

[0147] The address on the legal entity's identification document is similar to the address on the legal entity's identification document of the account in question;

[0148] The business license address is similar to the address of the account involved in the case;

[0149] The reserved office address is similar to the office address or registered address of the account involved in the case;

[0150] Frequent direct transactions with the accounts involved, or frequent indirect transactions with the accounts involved after one or two layers of transfers;

[0151] Transactions were related to the accounts involved in the case, and the transaction amounts were substantial (a single transaction exceeding 10 million yuan);

[0152] Excluded accounts: internal bank accounts, customer loan principal and overdue interest accounts, etc.

[0153] The account in question uses the same IP address or MAC address as the account in question;

[0154] The same phone number was used for the account in question;

[0155] The identification number is the same as that of the private account involved in the case;

[0156] There is a familial relationship between the individuals and the private accounts involved in the case;

[0157] The contact address is the same as or similar to that of the private accounts involved in the case (including the address registered on the ID card, contact address, residential address, work address, etc.);

[0158] The account name is the same as that of the corporate account involved in the case;

[0159] The legal representative or financial officer or account manager 1 or account manager 2 of the corporate account involved in the case are the same person, or they are related by kinship;

[0160] The accounts involved in the case have the same business agents or authorized personnel.

[0161] There were frequent financial transactions or large-scale financial transactions between the legal representative or financial officer of the account in question, or account manager 1 or account manager 2.

[0162] The accounts involved in the case share the same remitter or the same recipient.

[0163] The account opening time and location were the same as or similar to those of several private accounts involved in the case.

[0164] The analysis results are compiled, and based on the results, suspected accounts or customers involved in the case are identified, and a results table is generated. The table must include the following information:

[0165] For private accounts or clients, including the following:

[0166] The following suspicious features were detected: customer number, account name, card number (or other medium number), current account number in the card, branch number, branch name, branch to which the account belongs, and the province, city, and district where the account opening institution is located.

[0167] Customer's document type, document number, document address, province, city, district where the document address is located, age, and gender;

[0168] Account type (Class I, Class II, Class III, Credit Card), Account status (Normal, Freezing for receiving but not paying out, Amount frozen, Closed freezing, Forced note, Suspended non-counter services, Notes).

[0169] Total number of debit transactions in the account (account opening date -), total amount of debit transactions in the account (account opening date -), total number of credit transactions in the account (account opening date -), total amount of credit transactions in the account (account opening date -), number of over-the-counter transactions (account opening date -), account balance;

[0170] Account opening date, account opening channel (counter, smart counter, VTM, external PAD, online channel), account opening serial number, card opening method (single card opening, batch card opening), whether it was handled by the person in charge, the highest facial recognition score (7835) corresponding to the person's ID number at the time of account opening, agent's name (if any), document type, document number, the highest facial recognition score (7835) corresponding to the agent's ID number at the time of account opening, all dates and facial recognition scores with 7835 recorded after the account opening date, and account cancellation date;

[0171] The country and region of all IP addresses used by the account, reverse lookup accounts with the same IP address, reverse lookup accounts with the same phone number, and reverse lookup accounts with the same ID number;

[0172] Whether suspicious anti-money laundering transactions are reported, whether large anti-money laundering transactions are reported, whether the anti-money laundering risk rating is adjusted, and whether the post-supervision and guidance warnings of the supervision and management platform are triggered and the types of warnings.

[0173] Corporate accounts or clients, including the following:

[0174] The following suspicious characteristics were detected: customer number, account name, account number, unified social credit code, organization code, business license registered address, province, city, and district where the registered address is located, legal representative's name, document type, document number, document address, province, city, and district where the document address is located, age, gender, online banking version, daily cumulative transaction amount under online banking control, daily cumulative number of transactions, and annual cumulative transaction amount.

[0175] Institution number, branch name, branch of the institution, province, city, district where the institution is located, account type (basic, general, temporary, special), account status (normal, frozen for receiving but not paying, frozen amount, closed and frozen, forced note, suspended non-counter service, note), control date;

[0176] Total number of debit transactions in the account (account opening date -), total amount of debit transactions in the account (account opening date -), total number of credit transactions in the account (account opening date -), total amount of credit transactions in the account (account opening date -), number of over-the-counter transactions (account opening date -), account balance;

[0177] Account opening date, account opening serial number, whether the legal representative handled the account in person, the highest facial recognition score (7835) corresponding to the legal representative's ID number on the account opening date, agent's name (if any), document type, document number, the highest facial recognition score (7835) corresponding to the agent's ID number on the account opening date, all dates and facial recognition scores with a record of 7835 after the account opening date, and account closing date.

[0178] The country / region of all IP addresses used by the account, reverse lookup accounts with the same IP address, reverse lookup accounts with the same legal representative's phone number, and reverse lookup accounts with the same account name.

[0179] The data investigation table is generated by combining the related data of the case obtained from the graph analysis with the supplementary basic data to be investigated.

[0180] Step S308: Data distribution. Data is distributed to the designated head office and branch office application directories according to the application. Based on the result information, it is broken down into head office and branch office business units and distributed according to the specified paths.

[0181] In each business data request process, the data distribution path is confirmed, including the head office path and the branch path. After receiving the intelligent graph analysis data results, based on the branch to which the account data belongs, the table information is split into one table for each branch, one summary table for each branch, and one summary table for the head office. After splitting, the data is distributed according to the specified directory, with the directory granularity at the branch level.

[0182] This invention enables direct display of relationship distributions, including but not limited to counterparty relationship distributions and abnormal contact person distributions, allowing branch office users to intuitively and conveniently query account and customer relationships. The functionality is flexible and fully configurable, allowing for adjustments based on subsequent regulatory requirements to support querying information needed for regulatory feedback.

[0183] According to another embodiment of the present invention, a data screening and processing apparatus is also provided. Figure 4 This is a block diagram of a data screening and processing apparatus according to an embodiment of the present invention, such as... Figure 4 As shown, it includes:

[0184] Receiving module 42 is used to receive data to be investigated, wherein the data to be investigated includes at least one of the following: customer information, account information;

[0185] The acquisition module 44 is used to acquire supplementary data of the data to be investigated by comparing the data to be investigated with the full data in the data lake, wherein the supplementary data includes basic data and related data corresponding to the data to be investigated;

[0186] The first generation module 46 is used to generate a relationship graph of the data to be investigated based on the data to be investigated and the supplementary data;

[0187] The second generation module 48 is used to generate data investigation results of the data to be investigated based on the relationship graph.

[0188] Optionally, the first generation module 46 includes:

[0189] The acquisition submodule is used to acquire multiple index information of the data to be investigated and the basic data;

[0190] The determination submodule is used to determine the hit results corresponding to the multiple index information from the associated data according to the pre-set graph analysis rules, wherein the hit results include hits that satisfy the graph analysis rules and misses that do not satisfy the graph analysis rules;

[0191] A generation submodule is used to generate the relationship graph from the data to be investigated, the supplementary data, and the hit results corresponding to the multiple index information.

[0192] Optionally, the generation submodule is further configured to classify the multiple index information to obtain multiple types of information; using the customer information or account information as the central node of the relationship graph, the multiple types of information as child nodes of the central node, and the information contained in the multiple types of information as leaf nodes of the child nodes to generate the relationship graph, wherein each type of information corresponds to one child node.

[0193] Optionally, the index information includes at least one of the following: document address, account address, office address, registered address, contact address, transaction frequency, transaction amount, IP address, MAC address, communication number, document number, family information, account name, responsible person, manager, business agent, authorized agent, frequently transacting account, account with transaction amount exceeding a preset value, business initiator, business recipient, account opening time, and account opening branch; the multiple types of information include: address information, account information, customer information, transaction information, and communication information, wherein...

[0194] The address information includes: document address, account address, office address, registered address, and contact address;

[0195] The account information includes: account name, responsible person or manager, business agent, authorized agent, account opening time, and account opening location;

[0196] Customer information includes: contact number, identification number, and family information;

[0197] The transaction information includes: business transaction frequency, transaction amount, accounts with frequent transactions, accounts with transaction amounts exceeding a preset value, business initiator, and business recipient;

[0198] Communication information includes: IP address, MAC address, and communication number.

[0199] Optionally, the spectral analysis rules include at least one of the following:

[0200] The address is the same as or has a distance difference of less than a preset distance from the address on the identification document, the account address, the office address, the registered address, or the contact address.

[0201] The business transaction frequency of the account corresponding to the business application data is greater than or equal to a preset frequency;

[0202] The transaction limit of the account corresponding to the business application data is greater than or equal to the preset limit;

[0203] The IP address or MAC address of the account corresponding to the business application data is the same;

[0204] The communication number or identification number of the account corresponding to the business application data is the same;

[0205] The person in charge, manager, agent, or authorized representative of the account corresponding to the business application data is a relative;

[0206] The account name, responsible person, manager, business agent, or authorized agent are the same as the account corresponding to the business application data;

[0207] Frequent trading accounts have more transactions than the preset limit;

[0208] Accounts with transaction amounts exceeding the preset limit;

[0209] The account corresponding to the business application data has the same business initiator or business recipient;

[0210] The account opening time is the same as or the time difference between the account and the business application data is less than a preset time.

[0211] The account opening location corresponding to the business application data is the same as or the distance difference is less than a preset distance.

[0212] Optionally, the second generation module 48 is further configured to, for personal accounts, generate data screening results based on the relationship graph that include at least the following: the number of hits of the graph analysis rules, document type, account nature, total number of debit transactions, account opening information, and the regions to which all IP addresses used by the account belong; and for corporate accounts, generate data screening results based on the relationship graph that include at least the following: the number of hits of the graph analysis rules, account opening institution information, total number of debit transactions, account opening information, and the regions to which all IP addresses used by the account belong.

[0213] Optionally, the device further includes:

[0214] The acquisition module is used to acquire full data of personal business information and corporate business information. The personal business information includes at least personal customer information and personal account information, and the corporate business information includes at least corporate customer information and corporate account information.

[0215] The storage module is used to store the full amount of data into the data lake according to a preset format.

[0216] Optionally, the device further includes:

[0217] The splitting module is used to split the data screening results into a total business unit and sub-business units;

[0218] The first distribution module is used to distribute the total business unit according to the total data distribution path corresponding to the total business unit;

[0219] The second distribution module is used to distribute the sub-business unit according to the sub-data distribution path corresponding to the sub-business unit.

[0220] It should be noted that the above modules can be implemented by software or hardware. For the latter, they can be implemented in the following ways, but are not limited to: all the above modules are located in the same processor; or, the above modules are located in different processors in any combination.

[0221] Embodiments of the present invention also provide a computer-readable storage medium storing a computer program configured to perform the steps in any of the above method embodiments when executed.

[0222] Optionally, in this embodiment, the storage medium may be configured to store a computer program for performing the following steps:

[0223] S1, receive data to be investigated, wherein the data to be excluded includes at least one of the following: customer information, account information;

[0224] S2, supplementary data of the data to be investigated is obtained by comparing the data to be investigated with the full data in the data lake, wherein the supplementary data includes the basic data and related data corresponding to the data to be investigated;

[0225] S3, Generate a relationship graph of the data to be investigated based on the data to be investigated and the supplementary data;

[0226] S4, Generate the data investigation results of the data to be investigated based on the relationship graph.

[0227] Optionally, in this embodiment, the storage medium may include, but is not limited to, various media capable of storing computer programs, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0228] Embodiments of the present invention also provide an electronic device including a memory and a processor, the memory storing a computer program and the processor being configured to run the computer program to perform the steps in any of the above method embodiments.

[0229] Optionally, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor and the input / output device is connected to the processor.

[0230] Optionally, in this embodiment, the processor can be configured to perform the following steps via a computer program:

[0231] S1, receive data to be investigated, wherein the data to be excluded includes at least one of the following: customer information, account information;

[0232] S2, supplementary data of the data to be investigated is obtained by comparing the data to be investigated with the full data in the data lake, wherein the supplementary data includes the basic data and related data corresponding to the data to be investigated;

[0233] S3, Generate a relationship graph of the data to be investigated based on the data to be investigated and the supplementary data;

[0234] S4, Generate the data investigation results of the data to be investigated based on the relationship graph.

[0235] Optionally, specific examples in this embodiment can refer to the examples described in the above embodiments and optional implementations, and will not be repeated here.

[0236] It is obvious to those skilled in the art that the modules or steps of the present invention described above can be implemented using general-purpose computing devices. They can be centralized on a single computing device or distributed across a network of multiple computing devices. Optionally, they can be implemented using computer-executable program code, thereby storing them in a storage device for execution by a computing device. In some cases, the steps shown or described can be performed in a different order than those presented herein, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, the present invention is not limited to any particular combination of hardware and software.

[0237] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, or improvements made within the principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A data screening and processing method, characterized in that, include: The system receives data to be investigated, wherein the data to be investigated includes at least one of the following: customer information and account information; Supplementary data for the data to be investigated is obtained by comparing the data to be investigated with the full data in the data lake. The supplementary data includes the basic data and related data corresponding to the data to be investigated. A relationship graph of the data to be investigated is generated based on the data to be investigated and the supplementary data; Data investigation results of the data to be investigated are generated based on the relationship graph; The generation of a relationship graph of the data to be investigated based on the data to be investigated and the supplementary data includes: Obtain multiple index information of the data to be investigated and the basic data; According to the pre-set graph analysis rules, the hit results corresponding to the multiple index information are determined from the associated data, wherein the hit results include hits that satisfy the graph analysis rules and misses that do not satisfy the graph analysis rules; The relationship graph is generated by combining the data to be investigated, the supplementary data, and the hit results corresponding to the multiple index information.

2. The method according to claim 1, characterized in that, Generating the relationship graph from the data to be investigated, the supplementary data, and the hit results corresponding to the multiple index information includes: The multiple index information is classified to obtain multiple types of information; The relationship graph is generated by using the customer information or account information as the central node, the multiple types of information as child nodes of the central node, and the information contained in the multiple types of information as leaf nodes of the child nodes, wherein each type of information corresponds to one child node.

3. The method according to claim 2, characterized in that, The index information includes at least one of the following: document address, account address, office address, registered address, contact address, business transaction frequency, transaction amount, Internet Protocol IP address, Media Access Control (MAC) address, communication number, document number, family information, account name, responsible person, manager, business agent, authorized agent, frequently transacting account, account with transaction amount exceeding the preset value, business initiator, business recipient, account opening time, and account opening branch; The various types of information include: address information, account information, customer information, transaction information, and communication information, among which, The address information includes: document address, account address, office address, registered address, and contact address; The account information includes: account name, responsible person or manager, business agent, authorized agent, account opening time, and account opening location; Customer information includes: contact number, identification number, and family information; The transaction information includes: business transaction frequency, transaction amount, accounts with frequent transactions, accounts with transaction amounts exceeding a preset value, business initiator, and business recipient; Communication information includes: IP address, MAC address, and communication number.

4. The method according to claim 3, characterized in that, The spectral analysis rules include at least one of the following: The address is the same as or has a distance difference of less than a preset distance from the address on the identification document, the account address, the office address, the registered address, or the contact address. The business transaction frequency of the account corresponding to the business application data is greater than or equal to a preset frequency; The transaction limit of the account corresponding to the business application data is greater than or equal to the preset limit; The IP address or MAC address of the account corresponding to the business application data is the same; The communication number or identification number of the account corresponding to the business application data is the same; The person in charge, manager, agent, or authorized representative of the account corresponding to the business application data is a relative; The account name, responsible person, manager, business agent, or authorized agent are the same as the account corresponding to the business application data; Frequent trading accounts have more transactions than the preset limit; Accounts with transaction amounts exceeding the preset limit; The account corresponding to the business application data has the same business initiator or business recipient; The account opening time is the same as or the time difference between the account and the business application data is less than a preset time. The account opening location corresponding to the business application data is the same as or the distance difference is less than a preset distance.

5. The method according to claim 3, characterized in that, The data screening results generated based on the relationship graph include: For individual accounts, the data screening results generated based on the relationship graph include at least the following: the number of hits of the graph analysis rules, document type, account nature, total number of debit transactions in the account, account opening information, and the regions to which all IP addresses used by the account belong; For corporate accounts, the data screening results generated based on the relationship graph include at least the following: the number of hits of the graph analysis rules, account opening institution information, the total number of debit transactions of the account, account opening information, and the regions to which all IP addresses used by the account belong.

6. The method according to any one of claims 1 to 5, characterized in that, The method further includes: Acquire full data of personal business information and corporate business information, wherein the personal business information includes at least: personal customer information and personal account information, and the corporate business information includes at least: corporate customer information and corporate account information; The full dataset is stored in the data lake according to a preset format.

7. The method according to any one of claims 1 to 5, characterized in that, After generating the data investigation results of the data to be investigated based on the relationship graph, the method further includes: The data screening results are broken down into general business units and sub-business units; The total business unit is distributed according to the total data distribution path corresponding to the total business unit; The sub-business units are distributed according to the sub-data distribution paths corresponding to the sub-business units.

8. A data screening and processing device, characterized in that, include: A receiving module is used to receive data to be investigated, wherein the data to be investigated includes at least one of the following: customer information and account information; The acquisition module is used to acquire supplementary data of the data to be investigated by comparing the data to be investigated with the full data in the data lake. The supplementary data includes the basic data and related data corresponding to the data to be investigated. The first generation module is used to generate a relationship graph of the data to be investigated based on the data to be investigated and the supplementary data; The second generation module is used to generate data investigation results of the data to be investigated based on the relationship graph; The first generation module includes: The acquisition submodule is used to acquire multiple index information of the data to be investigated and the basic data; The determination submodule is used to determine the hit results corresponding to the multiple index information from the associated data according to the pre-set graph analysis rules, wherein the hit results include hits that satisfy the graph analysis rules and misses that do not satisfy the graph analysis rules; A generation submodule is used to generate the relationship graph from the data to be investigated, the supplementary data, and the hit results corresponding to the multiple index information.

9. A computer-readable storage medium, characterized in that, The storage medium stores a computer program, wherein the computer program is configured to execute the method described in any one of claims 1 to 7 when it is run.

10. An electronic device comprising a memory and a processor, characterized in that, The memory stores a computer program, and the processor is configured to run the computer program to perform the method of any one of claims 1 to 7.

Images