Financial account monitoring method and device, electronic equipment and storage medium

Abstract

The invention discloses a financial account monitoring method and device, electronic equipment and a storage medium, and the method comprises the steps: building a transaction network based on collected transaction data, inputting the transaction network into a preset semi-supervised model, outputting a predicted value and a first feature representation of each financial account, and obtaining a first feature representation of each financial account; and inputting the transaction network to a preset unsupervised model, outputting a second feature representation of each financial account to obtain a second feature representation set, and determining the financial account corresponding to the predicted value as an abnormal account to obtain an abnormal account set when the predicted value is greater than a preset abnormal threshold, and screening a second feature representation matched with the first feature representation indicated by the abnormal account in the abnormal account set from the second feature representation set, and adding the financial account indicated by the second feature representation into the abnormal account set. According to the invention, the technical problem that the early warning timeliness of the abnormal account is poor due to the fact that the financial account cannot be effectively monitored in the related technology is solved.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence, and in particular to a method for monitoring a financial account, a device thereof, an electronic device and a storage medium. Background Art

[0003] The monitoring of financial accounts usually relies on manually defined rules and patterns, and has a weak ability to respond to new illegal financial activities and variant forms of illegal financial activities, and it is difficult to detect new fraud methods and patterns in a timely manner. In addition, illegal financial activities often involve multiple entities, cross-border transactions and complex network structures, while the monitoring methods of financial accounts in related technologies usually analyze a single entity, which has certain limitations in analyzing complex associations and patterns, and it is difficult to capture complex associations and transaction patterns between multiple entities. It has limited effect in discovering and mining illegal accounts of multiple entities, which limits the comprehensive monitoring and early warning capabilities of financial transactions.

[0004] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0005] The embodiments of the present invention provide a method and device for monitoring a financial account, an electronic device and a storage medium, so as to at least solve the technical problem in the related art that a financial account cannot be effectively monitored, resulting in poor timeliness of early warning for abnormal accounts.

[0006] According to one aspect of an embodiment of the present invention, a method for monitoring financial accounts is provided, comprising: collecting transaction data, and constructing a transaction network based on the transaction data, wherein nodes in the transaction network are financial accounts; inputting the transaction network into a preset semi-supervised model, outputting a predicted value and a first feature representation of each of the financial accounts, and inputting the transaction network into a preset unsupervised model, outputting a second feature representation of each of the financial accounts, and obtaining a second feature representation set; when the predicted value is greater than a preset abnormal threshold, determining that the financial account corresponding to the predicted value is an abnormal account, and obtaining an abnormal account set; screening from the second feature representation set the second feature representation that matches the first feature representation indicated by the abnormal account in the abnormal account set, and adding the financial account indicated by the second feature representation to the abnormal account set.

[0007] Optionally, the step of constructing a transaction network based on the transaction data includes: preprocessing the transaction data to obtain target transaction data, wherein the target transaction data at least includes: account information and transaction information, the account information includes: an account identifier of a financial account, and the transaction information includes: transaction records, transaction amounts, and transaction times; characterizing the financial accounts as nodes, wherein the nodes are associated with the account identifiers; determining transaction relationships between the financial accounts based on the transaction records, and characterizing the transaction relationships as edges; determining the weight of each edge based on the transaction amount and the transaction time; and constructing the transaction network based on the nodes, the edges, and the weights of the edges.

[0008] Optionally, the step of inputting the transaction network into a preset semi-supervised model and outputting a predicted value of each of the financial accounts and a first feature representation includes: determining a neighbor node set of each of the nodes in the transaction network, wherein the neighbor node set includes: a plurality of neighbor nodes, the neighbor node is another node connected to the node via a preset edge, and the preset edge is an edge having a weight greater than a preset weight threshold; selecting a preset number of neighbor nodes from the neighbor node set of the node, and constructing a neighbor subgraph of the node based on all the selected neighbor nodes; aggregating the feature representations of all the neighbor nodes in the neighbor subgraph to obtain an aggregated feature representation of the node; updating the feature representation of the node based on the aggregated feature representation to obtain the first feature representation; and processing the first feature representation using the preset semi-supervised model to obtain the predicted value.

[0009] Optionally, based on the aggregated features, the feature representation of the node is updated to obtain the first feature representation, comprising: concatenating the initial feature representation of the node with the aggregated feature representation to obtain a new aggregated feature representation, wherein the initial feature representation is a feature representation generated by the preset semi-supervised model based on the transaction data associated with the node; representing the new aggregated feature identifier as the initial feature representation, and repeatedly performing the updating step until all hidden layers in the preset semi-supervised model are executed to obtain the first feature representation, wherein the hidden layer is used to update the feature representation of the node, and the updating step comprises: selecting the preset number of neighbor nodes from the neighbor node set of the node, and constructing the neighbor subgraph of the node based on all the selected neighbor nodes; aggregating the feature representations of all the neighbor nodes in the neighbor subgraph to obtain the aggregated feature representation of the node; and concatenating the initial feature representation of the node with the aggregated feature representation to obtain a new aggregated feature representation.

[0010] Optionally, the monitoring method also includes: obtaining historical transaction data, wherein the historical transaction data includes: multiple historical transaction records; selecting a preset number of the historical transaction records for labeling to obtain a labeled transaction record set, and using the labeled transaction record set and all other historical transaction records in the historical transaction data as training data, wherein each labeled transaction record in the labeled transaction record set corresponds to an outlier, and the other historical transaction records are the historical transaction records in the historical transaction data other than the labeled transaction record; constructing an initial semi-supervised model, wherein the model structure of the initial semi-supervised model includes at least: a preset number of hidden layers, and the initial semi-supervised model is used to output an initial prediction value; adjusting the preset number of layers using the training data until the loss value calculated by the loss function belongs to a preset loss threshold range to obtain a target number of layers, wherein the loss function is constructed based on the initial prediction value and the outlier; adjusting the initial semi-supervised model based on the target number of layers to obtain the preset semi-supervised model.

[0011] Optionally, the step of inputting the transaction network into a preset unsupervised model and outputting a second feature representation of each of the financial accounts includes: sampling the transaction network to generate a node sequence for each of the nodes; selecting a node subsequence matching a preset window size from the node sequence as context information of the node; mapping the context information to a preset vector space to generate structural information and semantic information of the node; and generating the second feature representation of the node based on the structural information and the semantic information of the node.

[0012] Optionally, the step of screening the second feature representation that matches the first feature representation indicated by the abnormal account in the abnormal account set from the second feature representation set includes: determining a similarity value between the first feature representation indicated by the abnormal account and each of the second feature representations in the second feature representation set; and when the similarity value is greater than a preset similarity threshold, determining that the second feature indicated by the similarity value is the screened second feature representation.

[0013] According to another aspect of an embodiment of the present invention, there is further provided a monitoring device for a financial account, comprising: a construction unit, configured to collect transaction data, and construct a transaction network based on the transaction data, wherein the nodes in the transaction network are financial accounts; an output unit, configured to input the transaction network into a preset semi-supervised model, output a predicted value and a first feature representation of each of the financial accounts, and input the transaction network into a preset unsupervised model, output a second feature representation of each of the financial accounts, and obtain a second feature representation set; a determination unit, configured to determine, when the predicted value is greater than a preset abnormal threshold, that the financial account corresponding to the predicted value is an abnormal account, and obtain an abnormal account set; and a screening unit, configured to screen, from the second feature representation set, the second feature representation that matches the first feature representation indicated by the abnormal account in the abnormal account set, and add the financial account indicated by the second feature representation to the abnormal account set.

[0014] Optionally, the construction unit includes: a first processing module, used to pre-process the transaction data to obtain target transaction data, wherein the target transaction data at least includes: account information, transaction information, the account information includes: account identification of the financial account, and the transaction information includes: transaction record, transaction amount, transaction time; a first characterization module, used to characterize the financial account as the node, wherein the node is associated with the account identification; a first determination module, used to determine the transaction relationship between the financial accounts based on the transaction record, and characterize the transaction relationship as an edge; a second determination module, used to determine the weight of each edge based on the transaction amount and the transaction time; a first construction module, used to construct the transaction network based on the nodes, the edges and the weights of the edges.

[0015] Optionally, the output unit includes: a third determination module, used to determine the neighbor node set of each of the nodes in the transaction network, wherein the neighbor node set includes: multiple neighbor nodes, the neighbor node is another node connected to the node through a preset edge, and the preset edge is an edge with a weight greater than a preset weight threshold; a second construction module, used to select a preset number of neighbor nodes from the neighbor node set of the node, and construct a neighbor subgraph of the node based on all the selected neighbor nodes; a first aggregation module, used to aggregate the feature representations of all the neighbor nodes in the neighbor subgraph to obtain the aggregated feature representation of the node; a first update module, used to update the feature representation of the node based on the aggregated feature representation to obtain the first feature representation; a second processing module, used to process the first feature representation using the preset semi-supervised model to obtain the predicted value.

[0016] Optionally, the first updating module includes: a first splicing submodule, used to splice the initial feature representation of the node with the aggregated feature representation to obtain a new aggregated feature representation, wherein the initial feature representation is a feature representation generated by the preset semi-supervised model based on the transaction data associated with the node; a first execution submodule, used to characterize the new aggregated feature identifier as the initial feature representation, and repeatedly execute the updating step until all hidden layers in the preset semi-supervised model are executed to obtain the first feature representation, wherein the hidden layer is used to update the feature representation of the node, and the updating step includes: selecting the preset number of neighbor nodes from the neighbor node set of the node, and constructing the neighbor subgraph of the node based on all the selected neighbor nodes; aggregating the feature representations of all the neighbor nodes in the neighbor subgraph to obtain the aggregated feature representation of the node; splicing the initial feature representation of the node with the aggregated feature representation to obtain a new aggregated feature representation.

[0017] Optionally, the monitoring device also includes: a first acquisition module, used to acquire historical transaction data, wherein the historical transaction data includes: multiple historical transaction records; a first selection module, used to select a preset number of historical transaction records for annotation, obtain a set of annotated transaction records, and use the set of annotated transaction records and all other historical transaction records in the historical transaction data as training data, wherein each annotated transaction record in the set of annotated transaction records corresponds to an outlier, and the other historical transaction records are the historical transaction records in the historical transaction data other than the annotated transaction record; a third construction module, used to construct an initial semi-supervised model, wherein the model structure of the initial semi-supervised model includes at least: a preset number of hidden layers, and the initial semi-supervised model is used to output an initial prediction value; a first training module, used to adjust the preset number of layers using the training data until the loss value calculated by the loss function belongs to a preset loss threshold range, and obtain a target number of layers, wherein the loss function is constructed based on the initial prediction value and the outlier; a first adjustment module, used to adjust the initial semi-supervised model based on the target number of layers to obtain the preset semi-supervised model.

[0018] Optionally, the output unit also includes: a first generation module, used to sample the transaction network and generate a node sequence for each of the nodes; a second selection module, used to select a node subsequence matching a preset window size from the node sequence as the context information of the node; a first mapping module, used to map the context information to a preset vector space and generate structural information and semantic information of the node; and a second generation module, used to generate the second feature representation of the node based on the structural information and the semantic information of the node.

[0019] Optionally, the screening unit includes: a fourth determination module, used to determine a similarity value between the first feature representation indicated by the abnormal account and each of the second feature representations in the second feature representation set; and a fifth determination module, used to determine that the second feature indicated by the similarity value is the screened second feature representation when the similarity value is greater than a preset similarity threshold.

[0020] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is further provided, wherein the computer-readable storage medium includes a stored computer program, wherein when the computer program is executed, the device where the computer-readable storage medium is located is controlled to execute any one of the above-mentioned financial account monitoring methods.

[0021] According to another aspect of an embodiment of the present invention, there is also provided an electronic device, comprising one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement any one of the above-mentioned methods for monitoring a financial account.

[0022] In the present disclosure, transaction data is collected, and based on the transaction data, a transaction network is constructed, the transaction network is input into a preset semi-supervised model, a predicted value and a first feature representation of each financial account are output, and the transaction network is input into a preset unsupervised model, a second feature representation of each financial account is output, and a second feature representation set is obtained. When the predicted value is greater than a preset abnormal threshold, the financial account corresponding to the predicted value is determined to be an abnormal account, and an abnormal account set is obtained. A second feature representation that matches the first feature representation indicated by the abnormal account in the abnormal account set is screened from the second feature representation set, and the financial account indicated by the second feature representation is added to the abnormal account set. In the present disclosure, a transaction network can be constructed based on the collected transaction data, and then the transaction network can be input into a preset semi-supervised model to obtain a predicted value and a first feature representation of each financial account, and the transaction network can be input into a preset unsupervised model to obtain a second feature representation of each financial account. If there is a predicted value greater than a preset abnormal threshold, the financial account corresponding to the predicted value can be determined as an abnormal account, and then the second feature representation matching the first feature representation indicated by the abnormal account can be screened, and the financial account indicated by the second feature representation can be determined as an abnormal account to obtain an abnormal account set. By combining the semi-supervised model and the unsupervised model, abnormal accounts can be more comprehensively and accurately mined, which improves the timeliness of early warning for abnormal accounts, thereby solving the technical problem in the related art that financial accounts cannot be effectively monitored, resulting in poor timeliness of early warning for abnormal accounts. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0024] Figure 1 is a flow chart of an optional financial account monitoring method according to an embodiment of the present invention;

[0025] Figure 2 is a schematic diagram of a sampling and aggregation process of an optional GraphSAGE model according to an embodiment of the present invention;

[0026] Figure 3 is a schematic diagram of an optional Struc2Vec model learning process according to an embodiment of the present invention;

[0027] Figure 4 is a schematic diagram of an optional financial account monitoring device according to an embodiment of the present invention;

[0028] Figure 5 It is a hardware structure block diagram of an electronic device (or mobile device) for a financial account monitoring method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0029] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0030] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0031] To facilitate those skilled in the art to understand the present invention, some terms or nouns involved in the embodiments of the present invention are explained below:

[0032] The GraphSAGE (Graph Sample and Aggregated) model is a semi-supervised learning model for graph data.

[0033] The Struc2vec model is an unsupervised model.

[0034] It should be noted that the relevant information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this disclosure are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0035] The present invention proposes a financial transaction monitoring model for multiple subjects, which can use big data and machine learning technology to mine the associated transaction network between multiple subjects, identify potential illegal financial activities, and conduct timely warning and intervention. The model combines graph algorithms, deep learning, and statistical models to extract features from transaction data and construct transaction networks. By analyzing the transaction patterns, correlations, and abnormal behaviors between multiple subjects, it can achieve comprehensive monitoring of financial transaction activities. By using deep learning models (for example, GraphSAGE models and Struc2vec models), richer feature representations can be learned from graph data to improve the model's ability to identify abnormal accounts and accuracy.

[0036] The multi-subject financial transaction monitoring model in the present invention has broad application prospects and can help financial institutions better monitor and warn financial transaction activities, reduce financial risks and losses. At the same time, the model can also provide strong data support for law enforcement agencies, assist in combating illegal financial activities, and maintain social and economic order and financial security. By comprehensively monitoring the financial transactions of multiple subjects, the model is expected to reveal the operating laws and evolution trends of illegal financial activities, help promote the improvement of the prevention and control level of illegal financial activities, and make positive contributions to the establishment of a safe and stable financial system.

[0037] The present invention adopts a combination of semi-supervised models and unsupervised models, which can mine abnormal accounts of multiple entities and find similar transaction networks. It can improve the monitoring model's ability to identify and analyze complex multi-subject transaction relationships, thereby more accurately discovering potential illegal financial activities.

[0038] In the present invention, through the semi-supervised model, partial data with labels can be used for supervised learning, feature representations of financial accounts can be learned, and semi-supervised learning can be performed on unlabeled data to further improve the generalization ability and prediction accuracy of the model. The unsupervised model can learn the representation of the graph structure from unlabeled data, cluster similar transaction networks together, and reveal potential similar relationships. In addition, by fusing the semi-supervised model and the unsupervised model, their respective advantages can be comprehensively utilized to fully explore similar transaction networks between multi-subject abnormal accounts, improve the monitoring model's ability to identify abnormal accounts, better cope with the complexity and concealment of illegal financial activities, effectively improve the performance and accuracy of the monitoring model, and thus enhance the risk prevention and control capabilities of financial institutions.

[0039] The present invention is described in detail below in conjunction with various embodiments.

[0040] Embodiment 1

[0041] According to an embodiment of the present invention, an embodiment of a method for monitoring a financial account is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0042] Figure 1 is a flow chart of an optional financial account monitoring method according to an embodiment of the present invention, such as Figure 1 As shown, the method comprises the following steps:

[0043] Step S101, collecting transaction data, and building a transaction network based on the transaction data, wherein the nodes in the transaction network are financial accounts.

[0044] Step S102: input the transaction network into a preset semi-supervised model, output the predicted value and the first feature representation of each financial account, and input the transaction network into a preset unsupervised model, output the second feature representation of each financial account, and obtain a second feature representation set.

[0045] Step S103: when the predicted value is greater than the preset abnormal threshold, the financial account corresponding to the predicted value is determined to be an abnormal account, and an abnormal account set is obtained.

[0046] Step S104, selecting a second feature representation that matches the first feature representation indicated by an abnormal account in the abnormal account set from the second feature representation set, and adding the financial account indicated by the second feature representation to the abnormal account set.

[0047] Through the above steps, transaction data can be collected, and based on the transaction data, a transaction network can be constructed, the transaction network can be input into a preset semi-supervised model, the predicted value and the first feature representation of each financial account can be output, and the transaction network can be input into a preset unsupervised model, the second feature representation of each financial account can be output, and a second feature representation set can be obtained. When the predicted value is greater than a preset abnormal threshold, the financial account corresponding to the predicted value is determined to be an abnormal account, and an abnormal account set is obtained. A second feature representation that matches the first feature representation indicated by the abnormal account in the abnormal account set is screened from the second feature representation set, and the financial account indicated by the second feature representation is added to the abnormal account set. In an embodiment of the present invention, a transaction network can be constructed based on the collected transaction data, and then the transaction network can be input into a preset semi-supervised model to obtain a predicted value and a first feature representation of each financial account, and the transaction network can be input into a preset unsupervised model to obtain a second feature representation of each financial account. If there is a predicted value greater than a preset abnormal threshold, the financial account corresponding to the predicted value can be determined as an abnormal account, and then the second feature representation matching the first feature representation indicated by the abnormal account can be screened, and the financial account indicated by the second feature representation can be determined as an abnormal account to obtain an abnormal account set. By combining the semi-supervised model with the unsupervised model, abnormal accounts can be more comprehensively and accurately mined, thereby improving the timeliness of early warning for abnormal accounts, thereby solving the technical problem in the related art that financial accounts cannot be effectively monitored, resulting in poor timeliness of early warning for abnormal accounts.

[0048] The embodiment of the present invention is described in detail below in combination with the above steps.

[0049] Step S101, collecting transaction data, and building a transaction network based on the transaction data, wherein the nodes in the transaction network are financial accounts.

[0050] Optionally, the step of constructing a transaction network based on transaction data includes: preprocessing the transaction data to obtain target transaction data, wherein the target transaction data includes at least account information and transaction information, the account information includes an account identifier of a financial account, and the transaction information includes transaction records, transaction amounts, and transaction times; representing financial accounts as nodes, wherein nodes are associated with account identifiers; determining transaction relationships between financial accounts based on transaction records, and representing the transaction relationships as edges; determining the weight of each edge based on the transaction amount and transaction time; and constructing a transaction network based on nodes, edges, and edge weights.

[0051] In an embodiment of the present invention, transaction data may be collected first, and then a transaction network may be constructed based on the collected transaction data. Specifically, data collection may be performed first (for example, relevant transaction data may be obtained from the transaction flow of a financial institution, including account information, transaction amount, transaction time, etc.), and then the collected transaction data may be preprocessed (for example, unifying the data format, deleting redundant data, etc.), and a unique identifier of the financial account may be identified, so as to define nodes in the transaction network (i.e., the transaction data may be preprocessed to obtain target transaction data, which may include account information, transaction information, etc. The account information may include an account identifier and an account name of the financial account, etc. The transaction information may include transaction records, transaction amount, transaction time, etc., and then the financial account may be represented as a node, and each node may be associated with an account identifier). Afterwards, the transaction relationship between financial accounts can be established based on the transaction records. Each financial account can be regarded as a node, and the transaction record can be regarded as an edge (that is, based on the transaction record, the transaction relationship between financial accounts is determined, and the transaction relationship is represented as an edge). The weight of the edge is determined based on the transaction amount, transaction time and other information (for example, if the amount of each transaction is large and the transaction time is the most recent, the weight of the edge between the two nodes is large. If the weight is greater than a certain weight threshold (which can be set according to actual conditions), the path distance between the two nodes is 1). Construct a transaction network based on nodes, edges and edge weights.

[0052] Step S102: input the transaction network into a preset semi-supervised model, output the predicted value and the first feature representation of each financial account, and input the transaction network into a preset unsupervised model, output the second feature representation of each financial account, and obtain a second feature representation set.

[0053] In the embodiment of the present invention, the semi-supervised model and the unsupervised model can be combined to mine transaction networks similar to abnormal accounts and identify potential suspicious abnormal groups.

[0054] In an embodiment of the present invention, the constructed transaction network can be input into a preset semi-supervised model (such as the GraphSAGE semi-supervised model) to learn the representation of each node in the transaction network in the graph structure (i.e., the first feature representation) so as to perform tasks such as node classification, link prediction, and graph attribute prediction (i.e., obtain the predicted value of each financial account).

[0055] In an embodiment of the present invention, the constructed transaction network can also be input into a preset unsupervised model (such as the Struc2vec unsupervised model) to learn the representation of each node in the transaction network (i.e., the second feature representation) to obtain a second feature representation set. The unsupervised model captures the structural and semantic information between nodes by mapping the graph structure to a continuous vector space.

[0056] Optionally, the step of inputting the transaction network into a preset semi-supervised model, and outputting the predicted value of each financial account and the first feature representation includes: determining a neighbor node set of each node in the transaction network, wherein the neighbor node set includes: multiple neighbor nodes, a neighbor node is another node connected to the node through a preset edge, and the preset edge is an edge with a weight greater than a preset weight threshold; selecting a preset number of neighbor nodes from the neighbor node set of the node, and constructing a neighbor subgraph of the node based on all the selected neighbor nodes; aggregating the feature representations of all neighbor nodes in the neighbor subgraph to obtain an aggregated feature representation of the node; based on the aggregated feature representation, updating the feature representation of the node to obtain a first feature representation; and using a preset semi-supervised model to process the first feature representation to obtain a predicted value.

[0057] Alternatively, based on the aggregated features, the feature representation of the node is updated to obtain a first feature representation, comprising: concatenating the initial feature representation of the node with the aggregated feature representation to obtain a new aggregated feature representation, wherein the initial feature representation is a feature representation generated by a preset semi-supervised model based on transaction data associated with the node; representing the new aggregated feature identifier as the initial feature representation, and repeatedly performing the updating step until all hidden layers in the preset semi-supervised model are executed to obtain a first feature representation, wherein the hidden layer is used to update the feature representation of the node, and the updating step comprises: selecting a preset number of neighbor nodes from the node's neighbor node set, and constructing a neighbor subgraph of the node based on all the selected neighbor nodes; aggregating the feature representations of all neighbor nodes in the neighbor subgraph to obtain an aggregated feature representation of the node; and concatenating the initial feature representation of the node with the aggregated feature representation to obtain a new aggregated feature representation.

[0058] In the embodiment of the present invention, the preset semi-supervised model mainly performs sampling and aggregation processing on the input transaction network, obtains local subgraphs by sampling the neighboring nodes of each node, and uses these local subgraphs to learn node representation. The specific steps are as follows:

[0059] (1) Sampling neighbor nodes: For each node, a certain number of nodes are randomly sampled from its neighbor nodes to obtain the local neighbor subgraph of each node (i.e., determine the neighbor node set of each node in the transaction network (the neighbor node set includes: multiple neighbor nodes, a neighbor node is another node connected to the node through a preset edge, and the preset edge is an edge with a weight greater than a preset weight threshold (which can be set according to actual conditions), for example, if the path distance between two nodes is 1, they are called neighbor nodes), then select a preset number of neighbor nodes (which can be set according to actual conditions) from the node's neighbor node set, and build the node's neighbor subgraph based on all the selected neighbor nodes).

[0060] (2) Aggregate neighbor features: For each node’s neighbor subgraph, a fixed-dimensional aggregate feature is generated by aggregating the feature information of neighbor nodes (i.e., the feature representations of all neighbor nodes in the neighbor subgraph are aggregated to obtain the aggregate feature representation of the node). The aggregation operation can be operations such as mean pooling, maximum pooling, or attention mechanism.

[0061] (3) Update node representation: The original features of each node are concatenated or combined with the aggregated features to obtain a new representation of the node (i.e., the initial feature representation of the node is concatenated with the aggregated feature representation to obtain a new aggregated feature representation, where the initial feature representation is a feature representation generated by a preset semi-supervised model based on the transaction data associated with the node). The node representation can be updated through a neural network or a graph convolutional network.

[0062] (4) Repeat the sampling and aggregation process: Repeat the above steps, sample and aggregate the neighbor subgraph multiple times, gradually integrate more node information, and enrich the node representation. That is, based on the aggregated feature representation, update the feature representation of the node to obtain a first feature representation, specifically: characterize the new aggregated feature identifier as the initial feature representation, repeat the update step until all hidden layers in the preset semi-supervised model are executed (that is, until all hidden layers in the adjusted model are executed), and obtain the first feature representation. In this embodiment, the hidden layer is used to update the feature representation of the node, and the update step includes: selecting a preset number of neighbor nodes from the node's neighbor node set, and constructing the node's neighbor subgraph based on all the selected neighbor nodes; aggregating the feature representations of all neighbor nodes in the neighbor subgraph to obtain the node's aggregated feature representation; splicing the node's initial feature representation with the aggregated feature representation to obtain a new aggregated feature representation.

[0063] In the embodiment of the present invention, the semi-supervised model can be used to learn the representation of nodes in the graph structure. These representations capture the local neighbor information of the nodes, which is helpful for tasks such as node classification and link prediction. Semi-supervised learning enables the model to use some labeled nodes for supervised learning, thereby improving the generalization ability and prediction accuracy of the model.

[0064] Figure 2 is a schematic diagram of a sampling and aggregation process of an optional GraphSAGE model according to an embodiment of the present invention, such as Figure 2 As shown, the following process is included:

[0065] (1) Perform community sampling, and sample nodes of K = 1 or K = 2, where K is the path distance between nodes;

[0066] (2) Aggregate the feature information of neighbors and the node feature information of the sampling node to obtain aggregated information;

[0067] (3) Use aggregated information to predict graph context and labels, that is, predict the context structure and label of the node through the aggregated result information.

[0068] Optionally, the monitoring method also includes: obtaining historical transaction data, wherein the historical transaction data includes: multiple historical transaction records; selecting a preset number of historical transaction records for labeling to obtain a labeled transaction record set, and using the labeled transaction record set and all other historical transaction records in the historical transaction data as training data, wherein each labeled transaction record in the labeled transaction record set corresponds to an outlier, and other historical transaction records are historical transaction records in the historical transaction data other than the labeled transaction records; constructing an initial semi-supervised model, wherein the model structure of the initial semi-supervised model includes at least: a preset number of hidden layers, and the initial semi-supervised model is used to output an initial prediction value; using the training data to adjust the preset number of layers until the loss value calculated by the loss function belongs to a preset loss threshold range to obtain a target number of layers, wherein the loss function is constructed based on the initial prediction value and the outlier; adjusting the initial semi-supervised model based on the target number of layers to obtain a preset semi-supervised model.

[0069] In an embodiment of the present invention, a semi-supervised model may be trained first to obtain the optimal number of hidden layers. Specifically, historical transaction data (the historical transaction data includes: multiple historical transaction records) may be obtained first, and then a preset number of historical transaction records (which may be set according to actual conditions) may be selected for annotation (for example, the score of the transaction record is annotated), and a set of annotated transaction records may be obtained (each annotated transaction record in the set of annotated transaction records corresponds to an outlier), and the set of annotated transaction records and all other historical transaction records in the historical transaction data (i.e., historical transaction records in the historical transaction data other than the annotated transaction record) may be used as training data. Then, an initial semi-supervised model is constructed, and the model structure of the initial semi-supervised model includes: a preset number of hidden layers, and the initial semi-supervised model is used to output an initial prediction value. Afterwards, the preset number of layers is adjusted using training data until the loss value calculated by the loss function (which may be constructed based on the initial prediction value and the outlier value) belongs to the preset loss threshold range, and the target number of layers (i.e., the optimal number of hidden layers) is obtained, and then the initial semi-supervised model is adjusted according to the target number of layers to obtain a preset semi-supervised model.

[0070] For example, extract transactions with counterparties in the past three years, summarize the transaction amounts between any two accounts with transactions to construct a transaction network, establish a GraphSAGE semi-supervised model, and arbitrarily select 50% of the nodes to assign labels to train the semi-supervised model, such as randomly initialize an embedding matrix with a dimension of 5 and use it as input features, set 2 hidden layers, and set the number of nodes in each hidden layer to 16 to complete model training.

[0071] Optionally, the step of inputting the transaction network into a preset unsupervised model and outputting a second feature representation of each financial account includes: sampling the transaction network to generate a node sequence for each node; selecting a node subsequence matching a preset window size from the node sequence as context information of the node; mapping the context information to a preset vector space to generate structural information and semantic information of the node; and generating a second feature representation of the node based on the structural information and semantic information of the node.

[0072] In an embodiment of the present invention, the transaction network may be input into a preset unsupervised model (e.g., a Struc2Vec model) to obtain a second feature representation of each financial account, specifically:

[0073] (1) Random walk sampling: Through the random walk sampling strategy, the node sequence of each node in the trading network is randomly generated (that is, the trading network is sampled to generate the node sequence of each node). Random walk can explore different paths in the trading network and capture the structural information between nodes;

[0074] (2) Feature extraction: For each node sequence, the context information of the node is extracted using a window sliding method (i.e., a node subsequence matching the preset window size is selected from the node sequence as the context information of the node). For example, for node v, with v as the center, nodes with a window size of w are selected from the node sequence as its context;

[0075] (3) Learning node representation, using Word2Vec (i.e., word embedding) or other embedding methods to learn the context of the node and map the node into a low-dimensional continuous vector space (i.e., mapping the context information into a preset vector space to generate the structural information and semantic information of the node);

[0076] (4) Embedding integration: By combining the structural information and semantic information of the node, the node representation is integrated to obtain the final node embedding vector (i.e., the second feature representation of the node is generated based on the structural information and semantic information of the node).

[0077] In an embodiment of the present invention, by utilizing the graph structure and node semantic information, richer and more expressive node representations can be learned, and these node representations can be applied to a variety of graph analysis tasks, such as node classification, graph clustering, link prediction, etc.

[0078] Figure 3 is a schematic diagram of an optional Struc2Vec model learning process according to an embodiment of the present invention, such as Figure 3As shown, vertex u and vertex v have similar spatial structures. The degree of vertex u is 5 (respectively: a, b, c, d, e), connecting 3 triangular structures (respectively: triangular structures composed of abu, bcu, and deu), and connected to the rest of the network (netwoek) through 2 vertices (d, e); the degree of vertex v is 4 (respectively: x, t, z, w, where y is a node that has no direct connection with v), connecting 2 triangular structures (respectively: triangular structures composed of wxv and ztv), and connected to the rest of the network (netwoek) through 2 vertices (w, x).

[0079] Step S103: when the predicted value is greater than the preset abnormal threshold, the financial account corresponding to the predicted value is determined to be an abnormal account, and an abnormal account set is obtained.

[0080] In an embodiment of the present invention, if there is a predicted value greater than a preset abnormal threshold (which can be set according to actual conditions), the financial account corresponding to the predicted value can be regarded as an abnormal account, thereby obtaining an abnormal account set and issuing timely warnings to these abnormal accounts.

[0081] Step S104, selecting a second feature representation that matches the first feature representation indicated by an abnormal account in the abnormal account set from the second feature representation set, and adding the financial account indicated by the second feature representation to the abnormal account set.

[0082] Optionally, the step of screening out a second feature representation that matches a first feature representation indicated by an abnormal account in an abnormal account set from a second feature representation set includes: determining a similarity value between the first feature representation indicated by the abnormal account and each second feature representation in the second feature representation set; and when the similarity value is greater than a preset similarity threshold, determining that the second feature indicated by the similarity value is the screened out second feature representation.

[0083] In an embodiment of the present invention, a second feature representation that matches the first feature representation indicated by an abnormal account in the abnormal account set can be screened from the second feature representation set, and the financial account indicated by the second feature representation can be added to the abnormal account set. Specifically, a similarity value between the first feature representation indicated by the abnormal account and each second feature representation in the second feature representation set can be determined first (for example, the similarity between the feature representations is calculated using a similarity measurement algorithm). If there is a similarity value greater than a preset similarity threshold (which can be set according to actual conditions), it can be determined that the second feature indicated by the similarity value is the screened second feature representation, that is, the financial account corresponding to the screened second feature representation is also an abnormal account.

[0084] In the embodiment of the present invention, the output features of the semi-supervised model and the output features of the unsupervised model can be hierarchically fused. First, the two models are used to mine financial accounts to obtain their respective similar transaction networks. Then, the two networks are fused, and graph matching, similarity measurement and other methods can be used to find common nodes or similar subgraphs in the network. Finally, the features of the common nodes or similar subgraphs are combined to obtain the final fusion result, so as to find the related abnormal account set through the mined abnormal accounts.

[0085] In an embodiment of the present invention, transactions with counterparties in the past three years can be extracted, and the transaction amounts between any two accounts with transactions can be statistically summarized to construct a transaction network. A Struc2vec unsupervised model is established, and initial parameters are set. For example, the step size is 8, the maximum number of random walk steps is 80, and the embedding dimension is 128. Then, the embedding representation of each financial account is calculated, and the Euclidean distance between the embedding representation of each financial account and each abnormal account is calculated to complete the model training.

[0086] In the embodiment of the present invention, a financial account monitoring model is constructed based on multi-model fusion technology. First, data preparation is performed. The input data of the model is the basis for building the detection model. The key is to ensure the accuracy, completeness and timeliness of the data, including transaction records, account information and other information. Then feature extraction is performed, that is, meaningful features are extracted from the original data for training and evaluating the model. The key is to select and construct features that can effectively capture illegal financial activities, such as transaction amount, frequency, correlation, etc. Continue to evaluate and optimize the model, and conduct a comprehensive evaluation and optimization of the model, including: selection of evaluation indicators, cross-validation, parameter adjustment, etc., to improve the performance and stability of the model.

[0087] In the embodiments of the present invention, the collected transaction data may involve a large amount of sensitive data, including account information and transaction records, etc. Therefore, it is necessary to ensure the security of the data during transmission, storage and processing to prevent the data from being maliciously tampered with or stolen. In addition, in order to enhance the credibility and acceptance of the model, it is necessary to ensure that the model can provide explainable early warning results and clearly explain why a financial account is determined to be an abnormal account.

[0088] In the embodiment of the present invention, the financial account monitoring model constructed based on the multi-model fusion technology has the following beneficial effects: (1) Improved accuracy: Multi-model fusion can combine the advantages of different models and comprehensively consider the prediction results of multiple models, thereby improving the accuracy and reliability of the prediction. In addition, the complementarity between different models can make up for the limitations of a single model and improve the ability to identify and warn of illegal financial activities; (2) Enhanced robustness: Through multi-model fusion, it can better adapt to different data distributions and scenario changes, thereby enhancing the robustness of the model. When a model performs poorly in a specific situation, other models can provide supplements and balance to ensure (3) Improved the performance and stability of the overall model; (4) Improved the generalization ability: Multi-model fusion can help the model better learn and capture the characteristics and patterns of illegal financial activities, thereby improving the generalization ability of the model. Different models can extract the behavioral characteristics of illegal financial activities more comprehensively from different perspectives and feature spaces, thereby improving the prediction ability of the model; (5) Increased interpretability: Multi-model fusion can provide more explanatory information to help understand and explain the monitoring results of financial transactions. By combining the prediction results and feature weights of multiple models, it can more clearly explain why a certain account is judged to be an abnormal account, thereby increasing the interpretability and credibility of the model.

[0089] In summary, the financial account monitoring model constructed based on multi-model fusion technology can improve accuracy, enhance robustness, improve generalization ability and increase interpretability, thereby effectively improving the effectiveness and credibility of the monitoring model and providing financial institutions with more effective risk prevention and control measures.

[0090] The following is a detailed description in conjunction with another embodiment.

[0091] Embodiment 2

[0092] A financial account monitoring device provided in this embodiment includes multiple implementation units, each implementation unit corresponding to each implementation step in the above-mentioned embodiment 1.

[0093] Figure 4 is a schematic diagram of an optional financial account monitoring device according to an embodiment of the present invention, such as Figure 4 As shown, the monitoring device may include: a construction unit 40, an output unit 41, a determination unit 42, and a screening unit 43, wherein:

[0094] A construction unit 40 is used to collect transaction data and construct a transaction network based on the transaction data, wherein the nodes in the transaction network are financial accounts;

[0095] An output unit 41 is used to input the transaction network into a preset semi-supervised model, output the predicted value and the first feature representation of each financial account, and input the transaction network into a preset unsupervised model, output the second feature representation of each financial account, and obtain a second feature representation set;

[0096] A determination unit 42, configured to determine, when the predicted value is greater than a preset abnormal threshold, that the financial account corresponding to the predicted value is an abnormal account, and obtain an abnormal account set;

[0097] The screening unit 43 is used to screen the second feature representations that match the first feature representations indicated by the abnormal accounts in the abnormal account set from the second feature representation set, and add the financial accounts indicated by the second feature representations to the abnormal account set.

[0098] The above-mentioned monitoring device can collect transaction data through the construction unit 40, and construct a transaction network based on the transaction data, input the transaction network into the preset semi-supervised model through the output unit 41, output the predicted value and the first feature representation of each financial account, and input the transaction network into the preset unsupervised model, output the second feature representation of each financial account, and obtain a second feature representation set, and determine that the financial account corresponding to the predicted value is an abnormal account when the predicted value is greater than the preset abnormal threshold through the determination unit 42, and obtain an abnormal account set, and filter the second feature representation that matches the first feature representation indicated by the abnormal account in the abnormal account set from the second feature representation set through the screening unit 43, and add the financial account indicated by the second feature representation to the abnormal account set. In an embodiment of the present invention, a transaction network can be constructed based on the collected transaction data, and then the transaction network can be input into a preset semi-supervised model to obtain a predicted value and a first feature representation of each financial account, and the transaction network can be input into a preset unsupervised model to obtain a second feature representation of each financial account. If there is a predicted value greater than a preset abnormal threshold, the financial account corresponding to the predicted value can be determined as an abnormal account, and then the second feature representation matching the first feature representation indicated by the abnormal account can be screened, and the financial account indicated by the second feature representation can be determined as an abnormal account to obtain an abnormal account set. By combining the semi-supervised model with the unsupervised model, abnormal accounts can be more comprehensively and accurately mined, thereby improving the timeliness of early warning for abnormal accounts, thereby solving the technical problem in the related art that financial accounts cannot be effectively monitored, resulting in poor timeliness of early warning for abnormal accounts.

[0099] Optionally, the construction unit includes: a first processing module, used to pre-process the transaction data to obtain target transaction data, wherein the target transaction data at least includes: account information, transaction information, the account information includes: account identification of the financial account, and the transaction information includes: transaction records, transaction amounts, and transaction times; a first characterization module, used to characterize financial accounts as nodes, wherein the nodes are associated with account identifications; a first determination module, used to determine the transaction relationship between financial accounts based on the transaction records, and characterize the transaction relationship as an edge; a second determination module, used to determine the weight of each edge based on the transaction amount and the transaction time; a first construction module, used to construct a transaction network based on nodes, edges, and edge weights.

[0100] Optionally, the output unit includes: a third determination module, used to determine the neighbor node set of each node in the transaction network, wherein the neighbor node set includes: multiple neighbor nodes, the neighbor node is another node connected to the node through a preset edge, and the preset edge is an edge with a weight greater than a preset weight threshold; a second construction module, used to select a preset number of neighbor nodes from the neighbor node set of the node, and construct a neighbor subgraph of the node based on all the selected neighbor nodes; a first aggregation module, used to aggregate the feature representations of all neighbor nodes in the neighbor subgraph to obtain an aggregated feature representation of the node; a first update module, used to update the feature representation of the node based on the aggregated feature representation to obtain a first feature representation; a second processing module, used to process the first feature representation using a preset semi-supervised model to obtain a predicted value.

[0101] Optionally, the first update module includes: a first splicing submodule, used to splice the initial feature representation of the node with the aggregated feature representation to obtain a new aggregated feature representation, wherein the initial feature representation is a feature representation generated by a preset semi-supervised model based on transaction data associated with the node; a first execution submodule, used to represent the new aggregated feature identifier as the initial feature representation, and repeatedly execute the update step until all hidden layers in the preset semi-supervised model are executed to obtain a first feature representation, wherein the hidden layer is used to update the feature representation of the node, and the update step includes: selecting a preset number of neighbor nodes from the neighbor node set of the node, and constructing a neighbor subgraph of the node based on all the selected neighbor nodes; aggregating the feature representations of all neighbor nodes in the neighbor subgraph to obtain the aggregated feature representation of the node; splicing the initial feature representation of the node with the aggregated feature representation to obtain a new aggregated feature representation.

[0102] Optionally, the monitoring device also includes: a first acquisition module, used to acquire historical transaction data, wherein the historical transaction data includes: multiple historical transaction records; a first selection module, used to select a preset number of historical transaction records for labeling, obtain a labeled transaction record set, and use the labeled transaction record set and all other historical transaction records in the historical transaction data as training data, wherein each labeled transaction record in the labeled transaction record set corresponds to an outlier, and other historical transaction records are historical transaction records in the historical transaction data other than the labeled transaction records; a third construction module, used to construct an initial semi-supervised model, wherein the model structure of the initial semi-supervised model includes at least: a preset number of hidden layers, and the initial semi-supervised model is used to output an initial prediction value; a first training module, used to adjust the preset number of layers using training data until the loss value calculated by the loss function belongs to a preset loss threshold range, and obtain a target number of layers, wherein the loss function is constructed based on the initial prediction value and the outlier; a first adjustment module, used to adjust the initial semi-supervised model based on the target number of layers to obtain a preset semi-supervised model.

[0103] Optionally, the output unit also includes: a first generation module, used to sample the transaction network and generate a node sequence for each node; a second selection module, used to select a node subsequence matching a preset window size from the node sequence as the context information of the node; a first mapping module, used to map the context information to a preset vector space, and generate structural information and semantic information of the node; and a second generation module, used to generate a second feature representation of the node based on the structural information and semantic information of the node.

[0104] Optionally, the screening unit includes: a fourth determination module, used to determine the similarity value between the first feature representation indicated by the abnormal account and each second feature representation in the second feature representation set; and a fifth determination module, used to determine that the second feature indicated by the similarity value is the screened second feature representation when the similarity value is greater than a preset similarity threshold.

[0105] The above-mentioned monitoring device may also include a processor and a memory. The above-mentioned construction unit 40, output unit 41, determination unit 42, screening unit 43, etc. are all stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to realize corresponding functions.

[0106] The processor includes a kernel, which retrieves the corresponding program unit from the memory. One or more kernels can be set, and the kernel parameters are adjusted to select a second feature representation matching the first feature representation indicated by the abnormal account in the abnormal account set from the second feature representation set, and add the financial account indicated by the second feature representation to the abnormal account set.

[0107] The above-mentioned memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one storage chip.

[0108] The present application also provides a computer program product, which, when executed on a data processing device, is suitable for executing a program that is initialized with the following method steps: collecting transaction data, and based on the transaction data, constructing a transaction network, inputting the transaction network into a preset semi-supervised model, outputting a predicted value and a first feature representation of each financial account, and inputting the transaction network into a preset unsupervised model, outputting a second feature representation of each financial account, and obtaining a second feature representation set, and when the predicted value is greater than a preset abnormal threshold, determining that the financial account corresponding to the predicted value is an abnormal account, obtaining an abnormal account set, screening from the second feature representation set a second feature representation that matches the first feature representation indicated by the abnormal account in the abnormal account set, and adding the financial account indicated by the second feature representation to the abnormal account set.

[0109] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium including a stored computer program, wherein when the computer program is executed, the device where the computer-readable storage medium is located is controlled to execute the above-mentioned financial account monitoring method.

[0110] According to another aspect of an embodiment of the present invention, there is also provided an electronic device, comprising one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by one or more processors, the one or more processors implement the above-mentioned method for monitoring a financial account.

[0111] Figure 5 1 is a hardware structure block diagram of an electronic device (or mobile device) for a method for monitoring a financial account according to an embodiment of the present invention. Figure 5 As shown, the electronic device may include one or more ( Figure 5 502a, 502b, ..., 502n are used to illustrate) processor 502 (processor 502 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), memory 504 for storing data. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the I / O interface), a network interface, a keyboard, a power supply and / or a camera. It can be understood by those skilled in the art that Figure 5 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 5More or fewer components as shown, or with Figure 5 Different configurations are shown.

[0112] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0113] In the above embodiments of the present invention, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0114] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0115] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0116] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0117] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and other media that can store program codes.

[0118] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for monitoring a financial account, characterized in that: include: Collecting transaction data, and building a transaction network based on the transaction data, wherein the nodes in the transaction network are financial accounts; Inputting the transaction network into a preset semi-supervised model, outputting a predicted value and a first feature representation of each of the financial accounts, and inputting the transaction network into a preset unsupervised model, outputting a second feature representation of each of the financial accounts, to obtain a second feature representation set; When the predicted value is greater than a preset abnormal threshold, determining that the financial account corresponding to the predicted value is an abnormal account, and obtaining an abnormal account set; The second feature representation that matches the first feature representation indicated by the abnormal account in the abnormal account set is screened from the second feature representation set, and the financial account indicated by the second feature representation is added to the abnormal account set.

2. The monitoring method according to claim 1, characterized in that: The step of constructing a transaction network based on the transaction data includes: Preprocessing the transaction data to obtain target transaction data, wherein the target transaction data at least includes: account information and transaction information, the account information includes: account identification of a financial account, and the transaction information includes: transaction record, transaction amount, and transaction time; Characterizing the financial account as the node, wherein the node is associated with the account identifier; Based on the transaction records, determining a transaction relationship between the financial accounts, and characterizing the transaction relationship as an edge; Determine the weight of each edge based on the transaction amount and the transaction time; The transaction network is constructed based on the nodes, the edges, and the weights of the edges.

3. The monitoring method according to claim 1, characterized in that: The step of inputting the transaction network into a preset semi-supervised model and outputting a predicted value of each of the financial accounts and a first feature representation comprises: Determine a neighbor node set of each of the nodes in the transaction network, wherein the neighbor node set includes: a plurality of neighbor nodes, wherein the neighbor node is another node connected to the node via a preset edge, wherein the preset edge is an edge having a weight greater than a preset weight threshold; Selecting a preset number of neighbor nodes from the neighbor node set of the node, and constructing a neighbor subgraph of the node based on all the selected neighbor nodes; Aggregating feature representations of all the neighbor nodes in the neighbor subgraph to obtain an aggregated feature representation of the node; Based on the aggregated feature representation, updating the feature representation of the node to obtain the first feature representation; The preset semi-supervised model is used to process the first feature representation to obtain the predicted value.

4. The monitoring method according to claim 3, characterized in that: The step of updating the feature representation of the node based on the aggregated feature to obtain the first feature representation includes: concatenating the initial feature representation of the node with the aggregate feature representation to obtain a new aggregate feature representation, wherein the initial feature representation is a feature representation generated by the preset semi-supervised model based on the transaction data associated with the node; The new aggregate feature identifier is represented as the initial feature representation, and the updating step is repeatedly performed until all hidden layers in the preset semi-supervised model are executed to obtain the first feature representation, wherein the hidden layer is used to update the feature representation of the node, and the updating step includes: selecting the preset number of neighbor nodes from the neighbor node set of the node, and constructing the neighbor subgraph of the node based on all the selected neighbor nodes; aggregating the feature representations of all the neighbor nodes in the neighbor subgraph to obtain the aggregate feature representation of the node; and concatenating the initial feature representation of the node with the aggregate feature representation to obtain a new aggregate feature representation.

5. The monitoring method according to claim 4, characterized in that: The monitoring method further comprises: Acquiring historical transaction data, wherein the historical transaction data includes: a plurality of historical transaction records; A preset number of historical transaction records are selected for annotation to obtain an annotated transaction record set, and the annotated transaction record set and all other historical transaction records in the historical transaction data are used as training data, wherein each annotated transaction record in the annotated transaction record set corresponds to an abnormal value, and the other historical transaction records are the historical transaction records in the historical transaction data except the annotated transaction record; Constructing an initial semi-supervised model, wherein the model structure of the initial semi-supervised model at least includes: a preset number of hidden layers, and the initial semi-supervised model is used to output an initial prediction value; Using the training data to adjust the preset number of layers until the loss value calculated by the loss function falls within a preset loss threshold range, thereby obtaining a target number of layers, wherein the loss function is constructed based on the initial prediction value and the abnormal value; The initial semi-supervised model is adjusted based on the target number of layers to obtain the preset semi-supervised model.

6. The monitoring method according to claim 4, characterized in that: The step of inputting the transaction network into a preset unsupervised model and outputting a second feature representation of each of the financial accounts comprises: Sampling the transaction network to generate a node sequence for each of the nodes; Selecting a node subsequence matching a preset window size from the node sequence as context information of the node; Mapping the context information to a preset vector space to generate structural information and semantic information of the node; The second feature representation of the node is generated based on the structural information and the semantic information of the node.

7. The monitoring method according to claim 1, characterized in that: The step of selecting the second feature representation that matches the first feature representation indicated by the abnormal account in the abnormal account set from the second feature representation set includes: determining a similarity value between the first feature representation of the abnormal account indication and each of the second feature representations in the set of second feature representations; When the similarity value is greater than a preset similarity threshold, it is determined that the second feature indicated by the similarity value is the screened second feature representation.

8. A financial account monitoring device, characterized in that: include: A construction unit, configured to collect transaction data and construct a transaction network based on the transaction data, wherein the nodes in the transaction network are financial accounts; an output unit, configured to input the transaction network into a preset semi-supervised model, output a predicted value and a first feature representation of each of the financial accounts, and input the transaction network into a preset unsupervised model, output a second feature representation of each of the financial accounts, and obtain a second feature representation set; A determination unit, configured to determine, when the predicted value is greater than a preset abnormal threshold, that the financial account corresponding to the predicted value is an abnormal account, and obtain an abnormal account set; A screening unit is used to screen the second feature representations that match the first feature representations indicated by the abnormal accounts in the abnormal account set from the second feature representation set, and add the financial accounts indicated by the second feature representations to the abnormal account set.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored computer program, wherein when the computer program is executed, the device where the computer-readable storage medium is located is controlled to execute the financial account monitoring method according to any one of claims 1 to 7.

10. An electronic device, characterized in that: It includes one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the financial account monitoring method described in any one of claims 1 to 7.

Images