Anti-money laundering detection method and device based on knowledge graph, equipment and storage medium

Abstract

The invention relates to data analysis and artificial intelligence, and provides an anti-money laundering detection method, device and equipment and a storage medium, the method comprises the following steps: constructing a plurality of first knowledge maps corresponding to different time nodes based on association relationship data among a plurality of accounts, the association relationship data comprising time node data; comparing the nodes in the plurality of first knowledge maps corresponding to the different time nodes to determine a plurality of target accounts with duplication; constructing a plurality of second knowledge maps corresponding to different time nodes based on the association relationship data of the plurality of target accounts; identifying nodes in the plurality of second knowledge maps by using a preset suspicious transaction identification model so as to determine a plurality of suspicious accounts with money laundering tendency; and delineating nodes in the plurality of second knowledge maps based on a preset community discovery algorithm and the plurality of suspicious accounts to obtain a money laundering community group. The invention aims to reduce the calculation cost of anti-money laundering detection.

Description

Technical Field

[0001] The present application relates to the technical field of data analysis, and in particular to an anti-money laundering detection method, apparatus, device and storage medium based on a knowledge graph. Background Art

[0002] With the accelerated development of the Internet and the extensive application of financial technology, money laundering methods have become more covert and complex. Money laundering activities are characterized by a high degree of organization, a large number of participants, and a dense fund transfer network. The requirements for the effectiveness of anti-money laundering monitoring are increasing day by day.

[0003] However, faced with increasingly organized, large-scale and professional money laundering gangs, the methods of money laundering crimes are constantly changing. The traditional method of manually constructing risk control rules requires more computing resources due to excessive transaction data, so the computing cost of anti-money laundering detection is high.

[0004] Therefore, how to reduce the computational cost of anti-money laundering detection is an urgent problem to be solved. Summary of the invention

[0005] The main purpose of this application is to provide an anti-money laundering detection method, device, equipment and storage medium based on knowledge graph, aiming to save computing resources for anti-money laundering detection and thus reduce computing costs.

[0006] In the first aspect, the present application provides an anti-money laundering detection method based on a knowledge graph, comprising:

[0007] Acquire association relationship data between multiple accounts, wherein the association relationship data includes time node data;

[0008] Based on the association relationship data between the multiple accounts, construct multiple first knowledge graphs corresponding to different time nodes;

[0009] Comparing the nodes in the first knowledge graph corresponding to different time nodes to determine whether there are multiple repeated target accounts;

[0010] Based on the association relationship data of the multiple target accounts, construct multiple second knowledge graphs corresponding to different time nodes;

[0011] Using a preset suspicious transaction identification model to identify multiple nodes in the second knowledge graph to determine multiple suspicious accounts with money laundering tendencies;

[0012] Based on a preset community discovery algorithm and the multiple suspicious accounts, multiple nodes in the second knowledge graph are circled to obtain a money laundering community group.

[0013] In a second aspect, the present application further provides an anti-money laundering detection device, the anti-money laundering detection device comprising:

[0014] An acquisition module, used to acquire association relationship data between multiple accounts, wherein the association relationship data includes time node data;

[0015] A construction module, configured to construct a plurality of first knowledge graphs corresponding to different time nodes based on the association relationship data between the plurality of accounts;

[0016] A comparison module, used for comparing the nodes in the first knowledge graph corresponding to different time nodes to determine whether there are multiple repeated target accounts;

[0017] The construction module is further used to construct a plurality of second knowledge graphs corresponding to different time nodes based on the association relationship data of the plurality of target accounts;

[0018] An identification module, used to identify multiple nodes in the second knowledge graph using a preset suspicious transaction identification model to determine multiple suspicious accounts with money laundering tendencies;

[0019] The delineation module is used to delineate the nodes in the plurality of the second knowledge graphs based on a preset community discovery algorithm and the plurality of suspicious accounts to obtain money laundering community groups.

[0020] In a third aspect, the present application also provides a computer device, comprising a processor, a memory, and a computer program stored in the memory and executable by the processor, wherein when the computer program is executed by the processor, the steps of the anti-money laundering detection method as described above are implemented.

[0021] In a fourth aspect, the present application further provides a computer-readable storage medium, on which a computer program is stored, wherein when the computer program is executed by a processor, the steps of the anti-money laundering detection method as described above are implemented.

[0022] The present application provides an anti-money laundering detection method, device, equipment and storage medium based on a knowledge graph. The anti-money laundering detection method in the present application constructs multiple first knowledge graphs corresponding to different time nodes, and compares the nodes in the multiple first knowledge graphs corresponding to different time nodes to determine the existence of multiple repeated target accounts. Furthermore, based on the association relationship data of the multiple target accounts, multiple second knowledge graphs corresponding to different time nodes are constructed, and the nodes in the multiple second knowledge graphs are identified using a preset suspicious transaction identification model to determine multiple suspicious accounts with money laundering tendencies. Finally, based on the preset community discovery algorithm and multiple suspicious accounts, the nodes in the multiple second knowledge graphs are circled to obtain money laundering community groups. The embodiment of the present application constructs multiple first knowledge graphs and multiple second knowledge graphs corresponding to different time nodes, thereby introducing time series features to identify accounts at different time nodes, which can effectively improve the accuracy and efficiency of locating money laundering community groups. In addition, through the layer-by-layer screening and identification of target accounts, suspicious accounts, and money laundering community groups, there is no need to perform anti-money laundering detection on all accounts, and the required computing resources are relatively small, which can greatly reduce the computing cost of anti-money laundering detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0024] Figure 1 A schematic diagram of the steps of an anti-money laundering detection method provided in an embodiment of the present application;

[0025] Figure 2 for Figure 1 A schematic diagram of the sub-steps of the anti-money laundering detection method in FIG.

[0026] Figure 3 A schematic diagram of a scenario for implementing the anti-money laundering detection method provided in this embodiment;

[0027] Figure 4 A schematic block diagram of an anti-money laundering detection device provided in an embodiment of the present application;

[0028] Figure 5 for Figure 4 A schematic block diagram of a submodule of an anti-money laundering detection device;

[0029] Figure 6 A schematic block diagram of another anti-money laundering detection device provided in an embodiment of the present application;

[0030] Figure 7 A schematic block diagram of the structure of a computer device provided in an embodiment of the present application.

[0031] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0032] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0033] The flowcharts shown in the accompanying drawings are only examples and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps may also be decomposed, combined or partially merged, so the actual execution order may change according to actual conditions.

[0034] Traditional anti-money laundering detection methods can identify suspicious transactions through knowledge graphs, but they cannot accurately determine the flow of funds with time series characteristics such as inflow before outflow, which can easily cause deviations in anti-money laundering detection results. Traditional anti-money laundering detection methods can mine money laundering community groups through knowledge graphs, but due to the large amount of transaction data, more computing resources are required, so the computational cost of anti-money laundering detection is high.

[0035] In view of this situation, the embodiment of the present application specifically introduces time series features to identify accounts at different time nodes, avoiding information errors caused by the lack of time series features in the knowledge graph path. At the same time, with the help of the association relationship data between accounts, the target accounts of repeated transactions and suspicious accounts of suspicious transactions are identified through knowledge graph related technologies. Furthermore, the community changes caused by different time series changes are identified through the community discovery algorithm, thereby identifying the final money laundering community group.

[0036] The embodiments of the present application provide an anti-money laundering detection method, device, equipment and storage medium. The anti-money laundering detection method can be applied to a terminal device or a server. The terminal device can be an electronic device such as a mobile phone, a tablet computer, a laptop computer, a desktop computer, a personal digital assistant and a wearable device; the server can be a single server or a server cluster composed of multiple servers. The following is an explanation of the anti-money laundering detection method applied to a server as an example.

[0037] In conjunction with the accompanying drawings, some embodiments of the present application are described in detail below. In the absence of conflict, the following embodiments and features in the embodiments can be combined with each other.

[0038] Please refer to Figure 1 , Figure 1 A schematic diagram of the steps of an anti-money laundering detection method provided in an embodiment of the present application.

[0039] like Figure 1 As shown, the anti-money laundering detection method includes steps S101 to S106.

[0040] Step S101: Acquire association relationship data between multiple accounts, wherein the association relationship data includes time node data.

[0041] Among them, accounts may include personal accounts, joint accounts, corporate accounts, etc. Association relationship data may include transaction flow relationships, account ownership relationships, corporate equity structures, natural person kinship relationships, etc. Association relationship data may also include static association relationships and dynamic association relationships. Static association relationships include corporate equity relationships, kinship relationships between people, etc., and dynamic association relationships include transfer relationships, loan relationships, etc.

[0042] In one embodiment, the association relationship data between multiple accounts include transaction flow relationships, account ownership relationships, corporate equity structures, and natural person kinship relationships; the association relationship data between multiple accounts are preprocessed, and the corresponding account nodes, individual customer nodes, corporate nodes, and transaction flow relationships between accounts, ownership relationships between accounts and customer companies, equity relationships between customers and companies, and kinship relationships between natural persons, etc. By introducing multiple static and dynamic association relationships involved in financial scenarios, the knowledge graph constructed subsequently is closer to reality.

[0043] In one embodiment, multiple preset time nodes can be set, and the preset time nodes are used to select transaction data; target transaction data matching the multiple preset time nodes are obtained from the multiple transaction data; the account to be checked is parsed from the target transaction data, and the association relationship data of the account to be checked is obtained.

[0044] That is, the association relationship data between the multiple accounts can be obtained according to the multiple preset time nodes that are preset, wherein the multiple preset time nodes can be continuous, and the time intervals between the multiple preset time nodes can be the same or different.

[0045] For example, multiple preset time nodes are determined to be September 1, September 3, and September 5; the transaction data of September 1, September 3, and September 5 are pulled from the database storing transaction data; the transaction data of September 1, September 3, and September 5 are parsed, and the transaction objects obtained by the parsing are used as the accounts to be checked; the transaction flow relationship, account ownership relationship, corporate equity structure, natural person kinship relationship, etc. of the account to be checked are searched to obtain the association relationship data between multiple accounts.

[0046] In one embodiment, the time node data corresponding to the association relationship data between each account is determined, and the corresponding time node data is added to each association relationship data. Among them, the dynamic association relationship in the association relationship data can have a time attribute, that is, different association relationship data can occur at different time nodes, such as transfer time, etc. Therefore, the corresponding time node data can be determined according to the time attribute of the dynamic association relationship. In addition, the time node data corresponding to the static association relationship can be set according to the actual situation.

[0047] It should be noted that adding the corresponding time node data to each associated relationship data makes the associated relationship data include the time node data, thereby introducing the time attribute into the associated relationship data such as the transaction flow relationship, which can deeply trace the upstream and downstream of the transaction, trace the entire flow of funds, and reveal the relationship between customers, accounts, fund transactions and other attributes, and then grasp the entire transaction network, so as to discover the global money laundering pattern and money laundering gangs with a more comprehensive perspective.

[0048] It should be noted that in order to further ensure the privacy and security of the above-mentioned association relationship data and other related information, the above-mentioned association relationship data and other related information can also be stored in a node of a blockchain. The technical solution of the present application can also be applied to adding other data files stored on the blockchain. The blockchain referred to in this application is a new application model of computer technologies such as distributed data storage, point-to-point transmission, consensus mechanism, and encryption algorithm.

[0049] Step S102: Based on the association relationship data between multiple accounts, construct multiple first knowledge graphs corresponding to different time nodes.

[0050] There are multiple first knowledge graphs, and the multiple first knowledge graphs correspond to different time nodes. In other words, one time node corresponds to one first knowledge graph. Through multiple first knowledge graphs corresponding to different time nodes, the temporal characteristics of the association relationship data between multiple accounts can be reflected, which is conducive to deep tracing of the upstream and downstream of the transaction.

[0051] In one embodiment, multiple association relationship data are classified according to the time node data in the association relationship data to obtain multiple types of association relationship data; in each type of association relationship data, a knowledge graph is constructed with multiple accounts as nodes and the association relationship data between the multiple accounts as edges to obtain a first knowledge graph corresponding to each type of association relationship data. The nodes in the first knowledge graph are used to represent different accounts. Each type of association relationship data corresponds to each time node data, that is, each type of association relationship data includes multiple association relationship data of the same time node.

[0052] It should be noted that after the multiple association relationship data are classified according to different time node data, the corresponding first knowledge graphs are generated for each type of association relationship data, so multiple first knowledge graphs with time attributes introduced can be obtained.

[0053] Step S103: compare the nodes in the multiple first knowledge graphs corresponding to different time nodes to determine whether there are multiple repeated target accounts.

[0054] It should be noted that the same nodes may exist in multiple first knowledge graphs, and the same nodes indicate that the corresponding accounts have transactions at different time nodes, so the money laundering risk may be greater. If a node in a first knowledge graph is different from the nodes in other first knowledge graphs, it means that the transaction behavior of the node is less or the transaction frequency is not high, so the money laundering risk may be smaller. By comparing the nodes in multiple first knowledge graphs corresponding to different time nodes, the same nodes in multiple first knowledge graphs can be determined, so that the existence of multiple repeated target accounts can be accurately determined based on the same nodes.

[0055] In one embodiment, nodes in every two first knowledge graphs in the plurality of first knowledge graphs are compared to obtain node comparison results in every two first knowledge graphs; the node comparison result is determined to be a target node that is the same as the comparison result, and the account corresponding to the target node is determined to be a duplicate target account. The comparison method may be determined based on a node identifier, and the node identifier may be a corresponding account identifier.

[0056] For example, in two first knowledge graphs, there may be two nodes with the same identifier. The node comparison result of the two nodes with the same identifier is the same, so the two nodes with the same identifier are target nodes. The two nodes with the same identifier may be entities generated based on the same account, so the account is the duplicate target account.

[0057] It should be noted that the nodes in the multiple first knowledge graphs corresponding to different time nodes are compared to determine the existence of multiple repeated target accounts. The target accounts may have a high risk of money laundering, so they can be screened out for backup, so there is no need to perform anti-money laundering detection on all accounts, and the required computing resources are less, which can greatly reduce the computing cost of anti-money laundering detection.

[0058] Step S104: Based on the association relationship data of multiple target accounts, construct multiple second knowledge graphs corresponding to different time nodes.

[0059] There are multiple second knowledge graphs, and the multiple second knowledge graphs correspond to different time nodes. In other words, one time node corresponds to one second knowledge graph. Through multiple second knowledge graphs corresponding to different time nodes, the temporal characteristics of the association relationship data between multiple target accounts can be reflected, which is conducive to deep tracing of the upstream and downstream of the transaction.

[0060] In one embodiment, the association relationship data of multiple target accounts are classified according to the time node data in the association relationship data of the target accounts to obtain the association relationship data of multiple categories of target accounts; in the association relationship data of each category of target accounts, a knowledge graph is constructed with the multiple target accounts as nodes and the association relationship data between the multiple target accounts and other accounts as edges to obtain a second knowledge graph corresponding to the association relationship data of each category of target accounts.

[0061] The nodes in the second knowledge graph are used to represent different target accounts. The association data of each target account corresponds to the data of each time node, that is, the association data of each target account includes the association data of multiple target accounts at the same time node.

[0062] It should be noted that after the association relationship data of multiple target accounts are classified according to different time node data, corresponding second knowledge graphs are generated for the association relationship data of each type of target accounts, so multiple second knowledge graphs with time attributes introduced can be obtained.

[0063] In the embodiment of the present application, the first knowledge graph and the second knowledge graph may correspond to each other, or the time node corresponding to the first knowledge graph is the same as the time node corresponding to the second knowledge graph. Compared with the multiple first knowledge graphs, the multiple second knowledge graphs have a smaller amount of data, so the required computing resources are less, which can greatly reduce the computing cost of anti-money laundering detection.

[0064] Step S105: Use a preset suspicious transaction identification model to identify multiple nodes in the second knowledge graph to determine multiple suspicious accounts with money laundering tendencies.

[0065] The preset suspicious transaction identification model may include graph-based models, etc., and may also be a machine learning model suitable for money laundering identification, such as a classifier, a clustering algorithm, or a graph neural network. Multiple second knowledge graphs are input into the preset suspicious transaction identification model for processing, and suspicious nodes in each second knowledge graph can be identified, so as to determine that the accounts corresponding to the suspicious nodes are multiple suspicious accounts with money laundering tendencies.

[0066] It should be noted that in the anti-money laundering scenario, if an account A has an obvious tendency to launder money, then the account B associated with it is more likely to launder money than other accounts, and there is a high possibility that AB belong to the same money laundering gang. Therefore, with the help of a preset suspicious transaction identification model, multiple nodes in the second knowledge graph are identified to determine multiple suspicious accounts with money laundering tendencies, which can effectively improve the accuracy and efficiency of locating money laundering community groups.

[0067] In one embodiment, a preset suspicious transaction identification model is used to identify nodes in multiple second knowledge graphs to determine suspicious nodes in each second knowledge graph; the account corresponding to the suspicious node is determined as a suspicious account with a tendency to money laundering, and the suspicious account is marked.

[0068] In one embodiment, after identifying the nodes in multiple second knowledge graphs using a preset suspicious transaction identification model to determine multiple suspicious accounts with money laundering tendencies, it also includes: setting the edge weights of two adjacent nodes in each second knowledge graph according to the first node used to characterize the suspicious account in each second knowledge graph. Specifically, the first node used to characterize the suspicious account in the second knowledge graph is identified; the account attributes of the first node in the second knowledge graph are determined, and the account attributes include the transfer-in account and the transfer-out account; and the edge weights of two adjacent nodes in the second knowledge graph are set according to the identification and account attributes of the two adjacent nodes in each second knowledge graph.

[0069] It should be noted that the traditional knowledge graph used for anti-money laundering detection may have too small a weight difference due to too much transaction data, which may lead to a slow convergence of the subsequent community discovery algorithm and a high computational cost. The embodiment of the present application sets the edge weights of two adjacent nodes in each second knowledge graph according to the first node used to characterize suspicious accounts in each second knowledge graph, which can make the community analysis of subsequent community discovery more focused and save computing resources.

[0070] Step S106: Based on a preset community discovery algorithm and multiple suspicious accounts, multiple nodes in the second knowledge graphs are circled to obtain money laundering community groups.

[0071] The community discovery algorithm is used to identify whether there is money laundering behavior in the nodes in the multiple second knowledge graphs. If so, the relevant nodes in the multiple second knowledge graphs are circled to obtain the money laundering community group. The community discovery algorithm may include the GN algorithm (Girvan-Newman algorithm), the Fast Unfolding algorithm, the Spectral Clustering method, the Modularity Maximization algorithm, the SLPA algorithm (Speaker-Listener Label Propagation Algorithm), etc.

[0072] It should be noted that the money laundering community group may include multiple suspicious accounts, and the money laundering community group may also include multiple first nodes for representing suspicious accounts. In multiple second knowledge graphs, there are nodes corresponding to multiple suspicious accounts. Based on the preset community discovery algorithm, the nodes in the multiple second knowledge graphs can be quickly and effectively circled to obtain the money laundering community group.

[0073] In one embodiment, if Figure 2 As shown, step S106 includes: sub-steps S1061 to S1063.

[0074] Sub-step S1061: according to the first node in each second knowledge graph used to characterize the suspicious account, set the edge weights of two adjacent nodes in each second knowledge graph.

[0075] Among them, the edge weight of two adjacent nodes in each second knowledge graph can be determined according to the first node used to characterize suspicious accounts in the corresponding second knowledge graph. For example, when two adjacent nodes include the first node used to characterize suspicious accounts, the edge weight of the two adjacent nodes is higher. When two adjacent nodes do not include the first node used to characterize suspicious accounts, the edge weight of the two adjacent nodes is lower. In other words, the edge weight of two adjacent nodes is positively correlated with the number of first nodes in the two adjacent nodes.

[0076] Exemplarily, the representation of the second knowledge graph is G = (V, E), the number of nodes is n = [V], and the number of edges is m = [E]. According to the first node used to characterize the suspicious account in each second knowledge graph, after setting the edge weights of two adjacent nodes in each second knowledge graph, the representation of the second knowledge graph is G = (V, E, W), where W represents the relative weight of E. In the embodiment of the present application, W is set or modified by whether the connected account node is the first node.

[0077] In one embodiment, according to the first node in each second knowledge graph used to characterize a suspicious account, the edge weight of two adjacent nodes in each second knowledge graph is set, including: identifying the first node in the second knowledge graph used to characterize a suspicious account; determining the account attributes of the first node in the second knowledge graph, the account attributes including a transfer-in account and a transfer-out account; according to the identification and account attributes of the two adjacent nodes in each second knowledge graph, the edge weight of the two adjacent nodes in the second knowledge graph is set.

[0078] Among them, the first node used to characterize the suspicious account in the second knowledge graph is identified, which can be marked by the suspicious transaction identification model in the aforementioned embodiment, or it can be marked in real time. In the traditional knowledge graph used for anti-money laundering detection, the edge weight is generally represented by the standardization of attributes such as transaction amount, transaction frequency, and transaction method (transfer, loan). In other words, the weight processing of the edge by the general community discovery algorithm depends on the attributes of the edge itself (such as transaction amount, transaction frequency), while ignoring the attributes of the nodes associated with it.

[0079] In the embodiments of the present application, the identifiers and account attributes of two adjacent nodes in each second knowledge graph can represent the risk characteristics of the two adjacent nodes. Therefore, the edge weights of the two adjacent nodes in the second knowledge graph are set according to the identifiers and account attributes of the two adjacent nodes in each second knowledge graph. This can comprehensively consider the risk characteristics associated with the two adjacent nodes, and can more effectively identify accounts associated with suspicious accounts, thereby effectively improving the accuracy of locating money laundering community groups.

[0080] In one embodiment, the edge weights of two adjacent nodes in the second knowledge graph are set according to the identifiers and account attributes of two adjacent nodes in each second knowledge graph, including: if the two adjacent nodes in the second knowledge graph are both identifier nodes, the edge weights of the two adjacent nodes are determined to be the first weight; if the two adjacent nodes in the second knowledge graph include an identifier node, and the account attribute of the identifier node is a transfer-out account, the edge weights of the two adjacent nodes are determined to be the second weight; if the two adjacent nodes in the second knowledge graph include an identifier node, and the account attribute of the identifier node is a transfer-in account, the edge weights of the two adjacent nodes are determined to be the third weight; if the two adjacent nodes in the second knowledge graph do not include an identifier node, the edge weights of the two adjacent nodes are determined to be the fourth weight; wherein the first weight is greater than the second weight, the second weight is greater than the third weight, and the third weight is greater than the fourth weight.

[0081] It should be noted that in the embodiment of the present application, the edge weight of two adjacent nodes is modified by whether the connected account node is marked, which is generally divided into four situations: a1) Both adjacent nodes are identification nodes, indicating that both the transfer-in and transfer-out nodes are suspicious accounts, a2) Two adjacent nodes include an identification node, the transfer-in is a normal account, and the transfer-out is a suspicious account, a3) Two adjacent nodes include an identification node, the transfer-in is a suspicious account, and the transfer-out is a normal account, a4) Two adjacent nodes do not include an identification node, indicating that both the transfer-in and transfer-out are normal accounts, and their risk weights are set to a1>a2>a3>a4. According to the identification and account attributes of the two adjacent nodes in each second knowledge graph, the edge weights of the two adjacent nodes in the second knowledge graph are set, which is more effective and easier to identify money laundering accounts under the same circumstances, and is more in line with business needs. It can not only improve the accuracy of locating money laundering community groups, but also reduce the misidentification of money laundering accounts.

[0082] Sub-step S1062: Based on the community discovery algorithm optimized for modularity, the edge weights between two adjacent nodes in each second knowledge graph are calculated to obtain the modularity gain of two adjacent nodes in each second knowledge graph.

[0083] Among them, the modularity-optimized community discovery algorithm is a type of algorithm that uses modularity as an indicator to find community structures. The modularity-optimized community discovery algorithm may include but is not limited to the TD-Louvain algorithm, which is specifically used for community discovery in temporal networks, so that community discovery is not only based on the structural characteristics of the network, but also takes into account temporal dynamics. TD-Louvain introduces temporal characteristics into the traditional Louvain algorithm, which is more suitable for the discovery of money laundering gangs and reduces false positives and false negatives.

[0084] In one embodiment, each node and its adjacent nodes in each second knowledge graph are merged together as a community, and the modularity gain of two adjacent nodes is calculated. The modularity gain calculation formula obtained by moving to a community C is:

[0085]

[0086] Where ΔQ represents the modularity gain, ∑tot is the sum of the edge weights associated with the nodes in community C, ki is the sum of the edge weights associated with node i, and k i，in is the sum of the edge weights connecting node i to nodes in community C, m is the sum of all edge weights in the second knowledge graph, and γ represents a set constant.

[0087] Sub-step S1063: According to the modularity gain of two adjacent nodes in each second knowledge graph, the nodes in each second knowledge graph are merged to form a money laundering community group.

[0088] In one embodiment, the nodes in each second knowledge graph are merged according to the modularity gain of two adjacent nodes in each second knowledge graph to obtain the subcommunity groups corresponding to each second knowledge graph; the edge weight between two adjacent subcommunity groups is determined, and the modularity gain of the two adjacent subcommunity groups is calculated according to the edge weight between the two adjacent subcommunity groups; according to the modularity gain of the two adjacent subcommunity groups, the subcommunity groups corresponding to each second knowledge graph are merged to obtain the money laundering community group.

[0089] It should be noted that the edge weight between two adjacent sub-community groups may be the sum of the edge weights of all nodes in the corresponding two second knowledge graphs. The specific method of calculating the modularity gain of two adjacent sub-community groups according to the edge weight between two adjacent sub-community groups can be calculated with reference to the aforementioned modularity gain calculation formula, which will not be described in detail in the embodiments of this application.

[0090] According to the modularity gain of two adjacent nodes in each second knowledge graph, each node is merged with its adjacent nodes in each second knowledge graph as a community, and multiple subcommunity groups can be obtained, each subcommunity group corresponds to each second knowledge graph. According to the modularity gain of two adjacent subcommunity groups, the subcommunity groups corresponding to each second knowledge graph are merged to obtain a money laundering community group. Through the modularity optimized community discovery algorithm, the nodes in each second knowledge graph are merged to form a money laundering community group, so that time series features can be introduced to identify accounts at different time nodes, which can effectively improve the accuracy and efficiency of locating money laundering community groups, and the required computing resources are less, which can greatly reduce the computing cost of anti-money laundering detection.

[0091] In one embodiment, the nodes in each second knowledge graph are merged according to the modularity gain of two adjacent nodes in each second knowledge graph to obtain a subcommunity group corresponding to each second knowledge graph, including: determining a maximum modularity gain from multiple modularity gains corresponding to a node in the second knowledge graph; when the maximum modularity gain is greater than a set gain threshold, merging two adjacent nodes corresponding to the maximum modularity gain; continuing to perform the step of determining the maximum modularity gain from multiple modularity gains corresponding to any node in the second knowledge graph; when the maximum modularity gains corresponding to all nodes in the second knowledge graph are less than the set gain threshold, determining the merged multiple nodes as the subcommunity group corresponding to the second knowledge graph.

[0092] Among them, the gain threshold is set to, for example, zero, and after merging the two adjacent nodes corresponding to the maximum modularity gain, the step of determining the maximum modularity gain from the multiple modularity gains corresponding to any node in the second knowledge graph can be continued, thereby iterating the algorithm until the communities to which all nodes belong no longer change, that is, the maximum modularity gains corresponding to all nodes in the second knowledge graph are less than the set gain threshold. At this time, the merged multiple nodes can be determined as the subcommunity group corresponding to the second knowledge graph.

[0093] It should be noted that the embodiment of the present application introduces time series features (corresponding to multiple second knowledge graphs at different time nodes) and risk features (edge ​​weights of two adjacent nodes in the second knowledge graph) based on the original community discovery algorithm, which can actively discover possible money laundering structures in the transaction network, thereby effectively helping business personnel to locate and identify money laundering gangs.

[0094] Exemplarily, in each second knowledge graph, each node and its adjacent nodes are merged together as a community in turn, and the modularity gain of two adjacent nodes is calculated; it is determined whether the maximum modularity gain of two adjacent nodes is greater than 0. If it is greater than 0, the node is placed in the community where the adjacent node with the largest modularity gain is located. The modularity gain of two adjacent nodes is continued to be calculated, and when the maximum modularity gain of two adjacent nodes is greater than 0, the node is placed in the community where the adjacent node with the largest modularity gain is located. The iteration is stopped when the maximum modularity gain of two adjacent nodes is less than or equal to 0, and the subcommunity group corresponding to the second knowledge graph is obtained, and the subcommunity group includes multiple merged nodes.

[0095] In one embodiment, the method also includes: calculating the average transaction time of multiple transactions of the money laundering community group within a set time period; determining the information entropy corresponding to the multiple transactions based on the absolute value of the difference between the transaction time of the multiple transactions and the average transaction time; and determining the risk level of the money laundering community group based on the number of suspicious accounts in the money laundering community group and the information entropy corresponding to the multiple transactions.

[0096] It should be noted that the set time period can be determined based on the time node data corresponding to multiple nodes in the money laundering community group. The quantitative parameters of the risk level are: a) the number of suspicious accounts marked in the money laundering community group; b) the transaction time entropy within the money laundering community group during this period of time, that is, the information entropy corresponding to the degree of dispersion of each transaction from the average transaction time. The degree of dispersion can be the absolute value of the difference between the transaction time of multiple transactions and the average transaction time. The risk level of the money laundering community group can indicate the risk level of the relevant node, and improve the risk interpretability by quantitatively evaluating its risk level.

[0097] In one embodiment, a risk level calculation formula is used to calculate the number of suspicious accounts in a money laundering community group and the information entropy corresponding to multiple transactions to obtain the risk level of the money laundering community group.

[0098] Exemplarily, the risk level calculation formula is:

[0099]

[0100] The value range of condition A is the edge weights of two adjacent nodes, such as the first to fourth weights {a1, a2, a3, a4}, and N is the number of suspicious accounts; p i (A) is the information entropy corresponding to all transactions during that period, for example:

[0101]

[0102] Among them, Pj is the proportion of transactions in the interval divided by the absolute value of the difference between each transaction and the average transaction time to the total transactions in the community, and M represents the total number of transactions.

[0103] Please refer to Figure 3 , Figure 3 A schematic diagram of a scenario for implementing the anti-money laundering detection method provided in this embodiment.

[0104] like Figure 3 As shown, the association relationship data between multiple accounts are obtained, wherein the association relationship data includes time node data. Based on the association relationship data between multiple accounts, multiple first knowledge graphs 10 corresponding to different time nodes are constructed, and the nodes in the multiple first knowledge graphs 10 corresponding to different time nodes are compared to determine the existence of multiple repeated target accounts. Furthermore, based on the association relationship data of multiple target accounts, multiple second knowledge graphs 20 corresponding to different time nodes are constructed, and the nodes in the multiple second knowledge graphs 20 are identified using a preset suspicious transaction identification model to determine multiple suspicious accounts with money laundering tendencies. Finally, based on the preset community discovery algorithm and multiple suspicious accounts, the nodes in the multiple second knowledge graphs 20 are circled to obtain a money laundering community group 30.

[0105] The anti-money laundering detection method provided in the above embodiment constructs multiple first knowledge graphs corresponding to different time nodes, and compares the nodes in the multiple first knowledge graphs corresponding to different time nodes to determine the existence of multiple repeated target accounts. Further, based on the association relationship data of the multiple target accounts, multiple second knowledge graphs corresponding to different time nodes are constructed, and the nodes in the multiple second knowledge graphs are identified using a preset suspicious transaction identification model to determine multiple suspicious accounts with money laundering tendencies. Finally, based on the preset community discovery algorithm and multiple suspicious accounts, the nodes in the multiple second knowledge graphs are circled to obtain money laundering community groups. The embodiment of the present application constructs multiple first knowledge graphs and multiple second knowledge graphs corresponding to different time nodes, so that time series features can be introduced to identify accounts at different time nodes, which can effectively improve the accuracy and efficiency of locating money laundering community groups, and through the layered screening and identification of target accounts, suspicious accounts, and money laundering community groups, there is no need to perform anti-money laundering detection on all accounts, and the required computing resources are relatively small, thereby greatly reducing the computing cost of anti-money laundering detection. .

[0106] Please refer to Figure 4 , Figure 4 A schematic block diagram of an anti-money laundering detection device provided in an embodiment of the present application.

[0107] like Figure 4 As shown, the anti-money laundering detection device 200 includes:

[0108] The acquisition module 201 is used to acquire association relationship data between multiple accounts, wherein the association relationship data includes time node data;

[0109] A construction module 202, configured to construct a plurality of first knowledge graphs corresponding to different time nodes based on the association relationship data between the plurality of accounts;

[0110] A comparison module 203 is used to compare the nodes in the first knowledge graph corresponding to different time nodes to determine whether there are multiple repeated target accounts;

[0111] The construction module 202 is further used to construct a plurality of second knowledge graphs corresponding to different time nodes based on the association relationship data of the plurality of target accounts;

[0112] An identification module 204 is used to identify multiple nodes in the second knowledge graph using a preset suspicious transaction identification model to determine multiple suspicious accounts with money laundering tendencies;

[0113] The delineation module 205 is used to delineate the nodes in the plurality of second knowledge graphs based on a preset community discovery algorithm and the plurality of suspicious accounts to obtain a money laundering community group.

[0114] In one embodiment, Figure 5 As shown, the delineation module 205 includes:

[0115] The setting submodule 2051 is used to set the edge weights of two adjacent nodes in each of the second knowledge graphs according to the first node used to characterize the suspicious account in each of the second knowledge graphs.

[0116] The calculation submodule 2052 is used to calculate the edge weight between two adjacent nodes in each of the second knowledge graphs based on the community discovery algorithm optimized by modularity, and obtain the modularity gain of two adjacent nodes in each of the second knowledge graphs.

[0117] The merging submodule 2053 is used to merge the nodes in each of the second knowledge graphs according to the modularity gain of two adjacent nodes in each of the second knowledge graphs to form a money laundering community group.

[0118] In one embodiment, the delineation module 205 is further configured to:

[0119] Identifying a first node in the second knowledge graph that is used to represent the suspicious account;

[0120] Determine an account attribute of the first node in the second knowledge graph, where the account attribute includes a transfer-in account and a transfer-out account;

[0121] The edge weights of two adjacent nodes in the second knowledge graph are set according to the identifiers and account attributes of each of the two adjacent nodes in the second knowledge graph.

[0122] In one embodiment, the delineation module 205 is further configured to:

[0123] If two adjacent nodes in the second knowledge graph are both identification nodes, determining the edge weight of the two adjacent nodes to be the first weight;

[0124] If two adjacent nodes in the second knowledge graph include an identification node, and the account attribute of the identification node is a transfer-out account, determining the edge weight of the two adjacent nodes to be the second weight;

[0125] If two adjacent nodes in the second knowledge graph include an identification node, and the account attribute of the identification node is a transfer-in account, determining the edge weight of the two adjacent nodes to be a third weight;

[0126] If the two adjacent nodes in the second knowledge graph do not include an identification node, determining the edge weight of the two adjacent nodes to be a fourth weight;

[0127] Among them, the first weight is greater than the second weight, the second weight is greater than the third weight, and the third weight is greater than the fourth weight.

[0128] In one embodiment, the delineation module 205 is further configured to:

[0129] According to the modularity gain of two adjacent nodes in each of the second knowledge graphs, the nodes in each of the second knowledge graphs are merged to obtain subcommunity groups corresponding to each of the second knowledge graphs;

[0130] Determining an edge weight between two adjacent subcommunity groups, and calculating the modularity gain of the two adjacent subcommunity groups according to the edge weight between the two adjacent subcommunity groups;

[0131] According to the modularity gains of two adjacent sub-community groups, the sub-community groups corresponding to the second knowledge graphs are merged to obtain a money laundering community group.

[0132] In one embodiment, the delineation module 205 is further configured to:

[0133] Determining a maximum modularity gain from a plurality of modularity gains corresponding to a node in the second knowledge graph;

[0134] When the maximum modularity gain is greater than a set gain threshold, merging two adjacent nodes corresponding to the maximum modularity gain;

[0135] Continue to perform the step of determining the maximum modularity gain from a plurality of modularity gains corresponding to any node in the second knowledge graph;

[0136] When the maximum modularity gains corresponding to all nodes in the second knowledge graph are less than the set gain threshold, the merged multiple nodes are determined as a subcommunity group corresponding to the second knowledge graph.

[0137] In one embodiment, Figure 6 As shown, the anti-money laundering detection device 200 further includes a determination module 206, which is used to:

[0138] Calculate the average transaction time of multiple transactions of the money laundering community group within a set time period;

[0139] Determining information entropy corresponding to the multiple transactions according to absolute values ​​of differences between the transaction times of the multiple transactions and the average transaction time;

[0140] The risk level of the money laundering community group is determined according to the number of suspicious accounts in the money laundering community group and the information entropy corresponding to the multiple transactions.

[0141] It should be noted that those skilled in the art can clearly understand that, for the convenience and simplicity of description, the specific working process of the above-described device and each module and unit can refer to the corresponding process in the aforementioned anti-money laundering detection method embodiment, and will not be repeated here.

[0142] The apparatus provided in the above embodiment may be implemented in the form of a computer program. The computer program may be Figure 7 Runs on the computer device shown.

[0143] See also Figure 7 , Figure 7 A schematic block diagram of the structure of a computer device provided in an embodiment of the present application.

[0144] like Figure 7 As shown, the computer device includes a processor, a memory and a network interface connected via a system bus, wherein the memory may include a storage medium and an internal memory, and the storage medium may be non-volatile or volatile.

[0145] The storage medium can store an operating system and a computer program. The computer program includes program instructions, and when the program instructions are executed, the processor can execute any anti-money laundering detection method.

[0146] The processor is used to provide computing and control capabilities and support the operation of the entire computer equipment.

[0147] The internal memory provides an environment for the operation of the computer program in the storage medium. When the computer program is executed by the processor, the processor can execute any anti-money laundering detection method.

[0148] The network interface is used for network communication, such as sending assigned tasks, etc. Those skilled in the art will understand that Figure 7 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0149] It should be understood that the processor may be a central processing unit (CPU), and the processor may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Among them, the general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0150] In one embodiment, the processor is used to run a computer program stored in the memory to implement the following steps:

[0151] Acquire association relationship data between multiple accounts, wherein the association relationship data includes time node data;

[0152] Based on the association relationship data between the multiple accounts, construct multiple first knowledge graphs corresponding to different time nodes;

[0153] Comparing the nodes in the first knowledge graph corresponding to different time nodes to determine whether there are multiple repeated target accounts;

[0154] Based on the association relationship data of the multiple target accounts, construct multiple second knowledge graphs corresponding to different time nodes;

[0155] Using a preset suspicious transaction identification model to identify multiple nodes in the second knowledge graph to determine multiple suspicious accounts with money laundering tendencies;

[0156] Based on a preset community discovery algorithm and the multiple suspicious accounts, multiple nodes in the second knowledge graph are circled to obtain a money laundering community group.

[0157] In one embodiment, when the processor implements the preset community discovery algorithm and the plurality of suspicious accounts to delineate the nodes in the plurality of second knowledge graphs to obtain the money laundering community group, it is used to implement:

[0158] According to the first node in each of the second knowledge graphs used to characterize the suspicious account, setting the edge weights of two adjacent nodes in each of the second knowledge graphs;

[0159] Based on a community discovery algorithm optimized for modularity, the edge weights between two adjacent nodes in each of the second knowledge graphs are calculated to obtain the modularity gain of two adjacent nodes in each of the second knowledge graphs;

[0160] According to the modularity gain of two adjacent nodes in each of the second knowledge graphs, the nodes in each of the second knowledge graphs are merged to form a money laundering community group.

[0161] In one embodiment, when the processor implements setting the edge weights of two adjacent nodes in each of the second knowledge graphs according to the first node used to characterize the suspicious account in each of the second knowledge graphs, it is configured to implement:

[0162] Identifying a first node in the second knowledge graph that is used to represent the suspicious account;

[0163] Determine an account attribute of the first node in the second knowledge graph, where the account attribute includes a transfer-in account and a transfer-out account;

[0164] The edge weights of two adjacent nodes in the second knowledge graph are set according to the identifiers and account attributes of each of the two adjacent nodes in the second knowledge graph.

[0165] In one embodiment, when the processor implements setting the edge weights of two adjacent nodes in the second knowledge graph according to the identifiers and account attributes of the two adjacent nodes in the second knowledge graph, it is used to implement:

[0166] If two adjacent nodes in the second knowledge graph are both identification nodes, determining the edge weight of the two adjacent nodes to be the first weight;

[0167] If two adjacent nodes in the second knowledge graph include an identification node, and the account attribute of the identification node is a transfer-out account, determining the edge weight of the two adjacent nodes to be the second weight;

[0168] If two adjacent nodes in the second knowledge graph include an identification node, and the account attribute of the identification node is a transfer-in account, determining the edge weight of the two adjacent nodes to be a third weight;

[0169] If the two adjacent nodes in the second knowledge graph do not include an identification node, determining the edge weight of the two adjacent nodes to be a fourth weight;

[0170] Among them, the first weight is greater than the second weight, the second weight is greater than the third weight, and the third weight is greater than the fourth weight.

[0171] In one embodiment, when the processor implements the step of merging the nodes in each of the second knowledge graphs according to the modularity gain of two adjacent nodes in each of the second knowledge graphs to form a money laundering community group, the processor is used to implement:

[0172] According to the modularity gain of two adjacent nodes in each of the second knowledge graphs, the nodes in each of the second knowledge graphs are merged to obtain subcommunity groups corresponding to each of the second knowledge graphs;

[0173] Determining an edge weight between two adjacent subcommunity groups, and calculating the modularity gain of the two adjacent subcommunity groups according to the edge weight between the two adjacent subcommunity groups;

[0174] According to the modularity gains of two adjacent sub-community groups, the sub-community groups corresponding to the second knowledge graphs are merged to obtain a money laundering community group.

[0175] In one embodiment, when the processor implements the step of merging the nodes in each of the second knowledge graphs according to the modularity gain of two adjacent nodes in each of the second knowledge graphs to obtain the subcommunity groups corresponding to each of the second knowledge graphs, it is configured to implement:

[0176] Determining a maximum modularity gain from a plurality of modularity gains corresponding to a node in the second knowledge graph;

[0177] When the maximum modularity gain is greater than a set gain threshold, merging two adjacent nodes corresponding to the maximum modularity gain;

[0178] Continue to perform the step of determining the maximum modularity gain from a plurality of modularity gains corresponding to any node in the second knowledge graph;

[0179] When the maximum modularity gains corresponding to all nodes in the second knowledge graph are less than the set gain threshold, the merged multiple nodes are determined as a subcommunity group corresponding to the second knowledge graph.

[0180] In one embodiment, the processor is further configured to implement:

[0181] Calculate the average transaction time of multiple transactions of the money laundering community group within a set time period;

[0182] Determining information entropy corresponding to the multiple transactions according to absolute values ​​of differences between the transaction times of the multiple transactions and the average transaction time;

[0183] The risk level of the money laundering community group is determined according to the number of suspicious accounts in the money laundering community group and the information entropy corresponding to the multiple transactions.

[0184] It should be noted that those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the computer device described above can refer to the corresponding process in the aforementioned anti-money laundering detection method embodiment, and will not be repeated here.

[0185] The present application can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc. The present application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present application can also be practiced in distributed computing environments, in which tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media including storage devices.

[0186] An embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored. The computer program includes program instructions. The method implemented when the program instructions are executed can refer to the various embodiments of the anti-money laundering detection method of the present application.

[0187] The computer-readable storage medium may be an internal storage unit of the computer device described in the foregoing embodiment, such as a hard disk or memory of the computer device. The computer-readable storage medium may also be an external storage device of the computer device, such as a plug-in hard disk, a smart memory card (SmartMedia Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc., equipped on the computer device.

[0188] Furthermore, the computer-usable storage medium may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function, etc.; the data storage area may store data created according to the use of blockchain nodes, etc. The blockchain referred to in this application is a new application model of computer technologies such as distributed data storage, point-to-point transmission, consensus mechanism, and encryption algorithm. Blockchain is essentially a decentralized database, a string of data blocks generated by cryptographic methods, each of which contains a batch of network transaction information, which is used to verify the validity of its information (anti-counterfeiting) and generate the next block. The blockchain may include the underlying blockchain platform, the platform product service layer, and the application service layer.

[0189] It should be understood that the terms used in this application specification are only for the purpose of describing specific embodiments and are not intended to limit the application. As used in this application specification and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include plural forms.

[0190] It should also be understood that the term "and / or" used in the specification of this application and the appended claims refers to any combination of one or more of the associated listed items and all possible combinations, including these combinations. It should be noted that, in this article, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "including a..." does not exclude the presence of other identical elements in the process, method, article or system including the element.

[0191] The serial numbers of the embodiments of the present application are for description only and do not represent the advantages and disadvantages of the embodiments. The above description is only a specific implementation mode of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in the present application, and these modifications or replacements should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. An anti-money laundering detection method based on knowledge graph, characterized in that: include: Acquire association relationship data between multiple accounts, wherein the association relationship data includes time node data; Based on the association relationship data between the multiple accounts, construct multiple first knowledge graphs corresponding to different time nodes; Comparing the nodes in the first knowledge graph corresponding to different time nodes to determine whether there are multiple repeated target accounts; Based on the association relationship data of the multiple target accounts, construct multiple second knowledge graphs corresponding to different time nodes; Using a preset suspicious transaction identification model to identify multiple nodes in the second knowledge graph to determine multiple suspicious accounts with money laundering tendencies; Based on a preset community discovery algorithm and the multiple suspicious accounts, multiple nodes in the second knowledge graph are circled to obtain a money laundering community group.

2. The anti-money laundering detection method according to claim 1, characterized in that: Based on the preset community discovery algorithm and the plurality of suspicious accounts, the plurality of nodes in the second knowledge graph are delineated to obtain a money laundering community group, including: According to the first node in each of the second knowledge graphs used to characterize the suspicious account, setting the edge weights of two adjacent nodes in each of the second knowledge graphs; Based on a community discovery algorithm optimized for modularity, the edge weights between two adjacent nodes in each of the second knowledge graphs are calculated to obtain the modularity gain of two adjacent nodes in each of the second knowledge graphs; According to the modularity gain of two adjacent nodes in each of the second knowledge graphs, the nodes in each of the second knowledge graphs are merged to form a money laundering community group.

3. The anti-money laundering detection method according to claim 2, characterized in that: The step of setting the edge weights of two adjacent nodes in each of the second knowledge graphs according to the first node used to characterize the suspicious account in each of the second knowledge graphs includes: Identifying a first node in the second knowledge graph that is used to represent the suspicious account; Determine an account attribute of the first node in the second knowledge graph, where the account attribute includes a transfer-in account and a transfer-out account; The edge weights of two adjacent nodes in the second knowledge graph are set according to the identifiers and account attributes of each of the two adjacent nodes in the second knowledge graph.

4. The anti-money laundering detection method according to claim 3, characterized in that: The step of setting the edge weights of two adjacent nodes in the second knowledge graph according to the identifiers and account attributes of the two adjacent nodes in the second knowledge graph comprises: If two adjacent nodes in the second knowledge graph are both identification nodes, determining the edge weight of the two adjacent nodes to be the first weight; If two adjacent nodes in the second knowledge graph include an identification node, and the account attribute of the identification node is a transfer-out account, determining the edge weight of the two adjacent nodes to be the second weight; If two adjacent nodes in the second knowledge graph include an identification node, and the account attribute of the identification node is a transfer-in account, determining the edge weight of the two adjacent nodes to be a third weight; If the two adjacent nodes in the second knowledge graph do not include an identification node, determining the edge weight of the two adjacent nodes to be a fourth weight; Among them, the first weight is greater than the second weight, the second weight is greater than the third weight, and the third weight is greater than the fourth weight.

5. The anti-money laundering detection method according to claim 2, characterized in that: The merging of nodes in each of the second knowledge graphs according to the modularity gain of two adjacent nodes in each of the second knowledge graphs to form a money laundering community group includes: According to the modularity gain of two adjacent nodes in each of the second knowledge graphs, the nodes in each of the second knowledge graphs are merged to obtain subcommunity groups corresponding to each of the second knowledge graphs; Determining an edge weight between two adjacent subcommunity groups, and calculating the modularity gain of the two adjacent subcommunity groups according to the edge weight between the two adjacent subcommunity groups; According to the modularity gains of two adjacent sub-community groups, the sub-community groups corresponding to the second knowledge graphs are merged to obtain a money laundering community group.

6. The anti-money laundering detection method according to claim 5, characterized in that: The step of merging the nodes in each of the second knowledge graphs according to the modularity gain of two adjacent nodes in each of the second knowledge graphs to obtain the subcommunity groups corresponding to each of the second knowledge graphs includes: Determining a maximum modularity gain from a plurality of modularity gains corresponding to a node in the second knowledge graph; When the maximum modularity gain is greater than a set gain threshold, merging two adjacent nodes corresponding to the maximum modularity gain; Continue to perform the step of determining the maximum modularity gain from a plurality of modularity gains corresponding to any node in the second knowledge graph; When the maximum modularity gains corresponding to all nodes in the second knowledge graph are less than the set gain threshold, the merged multiple nodes are determined as a subcommunity group corresponding to the second knowledge graph.

7. The anti-money laundering detection method according to any one of claims 1 to 6, characterized in that: The method further comprises: Calculate the average transaction time of multiple transactions of the money laundering community group within a set time period; Determining information entropy corresponding to the multiple transactions according to absolute values ​​of differences between the transaction times of the multiple transactions and the average transaction time; The risk level of the money laundering community group is determined according to the number of suspicious accounts in the money laundering community group and the information entropy corresponding to the multiple transactions. 8.An anti-money laundering detection device, characterized in that: The anti-money laundering detection device comprises: An acquisition module, used to acquire association relationship data between multiple accounts, wherein the association relationship data includes time node data; A construction module, configured to construct a plurality of first knowledge graphs corresponding to different time nodes based on the association relationship data between the plurality of accounts; A comparison module, used for comparing the nodes in the first knowledge graph corresponding to different time nodes to determine whether there are multiple repeated target accounts; The construction module is further used to construct a plurality of second knowledge graphs corresponding to different time nodes based on the association relationship data of the plurality of target accounts; An identification module, used to identify multiple nodes in the second knowledge graph using a preset suspicious transaction identification model to determine multiple suspicious accounts with money laundering tendencies; The delineation module is used to delineate the nodes in the plurality of the second knowledge graphs based on a preset community discovery algorithm and the plurality of suspicious accounts to obtain money laundering community groups.

9. A computer device, characterized in that: The computer device includes a processor, a memory, and a computer program stored in the memory and executable by the processor, wherein when the computer program is executed by the processor, the anti-money laundering detection method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein when the computer program is executed by a processor, the anti-money laundering detection method according to any one of claims 1 to 7 is implemented.

Images