Feature fusion-based anti-money laundering identification method and device, equipment and medium

Abstract

The invention relates to the field of artificial intelligence, and discloses an anti-money laundering identification method and device based on feature fusion, equipment and a medium, and the method comprises the steps: obtaining original transaction data carried by a transaction request; inputting the original transaction data into a trained anti-money laundering recognition model, wherein the anti-money laundering recognition model comprises a long short-term memory network in which an attention mechanism is introduced; extracting transaction feature data in the original transaction data through an anti-money laundering recognition model, performing feature fusion on the transaction feature data and the original transaction data, and performing recognition to obtain a transaction risk category; and when the transaction risk category is a normal transaction, releasing the transaction request, and when the transaction risk category is an abnormal transaction, triggering preset transaction alarm information. The sensitivity of the model to the total data information is improved by introducing the long-short-term memory network of the attention mechanism, and end-to-end anti-money laundering recognition is carried out by fusing the transaction behavior characteristics while the meaning of the original transaction data is reserved, so that the recognition efficiency and accuracy are improved.

Description

Technical Field

[0001] The present invention relates to the fields of artificial intelligence technology and financial technology, and in particular to anti-money laundering identification methods, devices, equipment and media based on feature fusion. Background Art

[0002] The daily transaction volume of funds in the financial and insurance industries is very large, with tens of millions of funds flowing every day, among which there are many illegal money laundering transactions. For example, complex methods such as using multiple identities, a large number of accounts, low-frequency transactions, and changing transaction paths are mixed in with normal transactions to cover up money laundering transactions.

[0003] Most of the current mainstream anti-money laundering identification methods are based on some rules and restrictions on account transactions. Once these rules and restrictions are triggered, they will be identified as suspicious transactions and alarms will be issued. For example, large-value transactions, excessive number of transactions in a short period of time, multiple transactions of the same amount, etc. However, obtaining data requires real-time query and screening of the database, which consumes a lot of resources and the accuracy needs to be studied. Not only is the recognition efficiency low, but it is also difficult to accurately identify abnormal money laundering transactions. Summary of the invention

[0004] In view of the above-mentioned deficiencies in the prior art, the purpose of the present invention is to provide an anti-money laundering identification method, device, equipment and medium based on feature fusion that can be applied to financial technology or other related fields. Its main purpose is to improve the efficiency and accuracy of anti-money laundering identification and accurately and efficiently identify abnormal transaction behaviors.

[0005] The technical solution of the present invention is as follows:

[0006] The first aspect of the present invention provides an anti-money laundering identification method based on feature fusion, comprising:

[0007] Upon receiving a transaction request initiated by a user, obtaining original transaction data carried in the transaction request;

[0008] Inputting the raw transaction data into a pre-trained anti-money laundering recognition model, wherein the anti-money laundering recognition model includes a long short-term memory network with an attention mechanism;

[0009] Extracting transaction feature data from the original transaction data through the anti-money laundering identification model, and fusing the transaction feature data with the original transaction data to obtain corresponding transaction risk categories;

[0010] When the transaction risk category is a normal transaction, the transaction request is released; when the transaction risk category is an abnormal transaction, a preset transaction warning message is triggered.

[0011] A second aspect of the present invention provides an anti-money laundering identification device based on feature fusion, comprising:

[0012] A data acquisition module, configured to acquire original transaction data carried in a transaction request upon receiving a transaction request initiated by a user;

[0013] A data input module, used for inputting the raw transaction data into a pre-trained anti-money laundering identification model, wherein the anti-money laundering identification model includes a long short-term memory network with an attention mechanism;

[0014] A transaction identification module, used to extract transaction feature data from the original transaction data through the anti-money laundering identification model, and identify the corresponding transaction risk category after fusing the transaction feature data with the original transaction data;

[0015] The transaction processing module is used to release the transaction request when the transaction risk category is a normal transaction, and trigger preset transaction warning information when the transaction risk category is an abnormal transaction.

[0016] A third aspect of the present invention provides a computer device, comprising at least one processor; and

[0017] a memory communicatively connected to the at least one processor; wherein,

[0018] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the above-mentioned anti-money laundering identification method based on feature fusion.

[0019] A fourth aspect of the present invention provides a non-volatile computer-readable storage medium, which stores computer-executable instructions. When the computer-executable instructions are executed by one or more processors, the one or more processors can execute the above-mentioned anti-money laundering identification method based on feature fusion.

[0020] Beneficial effects: The present invention discloses an anti-money laundering identification method, device, equipment and medium based on feature fusion. Compared with the prior art, the embodiment of the present invention obtains the original transaction data carried by the transaction request when receiving the transaction request initiated by the user; inputs the original transaction data into a pre-trained anti-money laundering identification model, and the anti-money laundering identification model includes a long short-term memory network with an attention mechanism; extracts transaction feature data from the original transaction data through the anti-money laundering identification model, and identifies the corresponding transaction risk category after feature fusion of the transaction feature data with the original transaction data; when the transaction risk category is a normal transaction, the transaction request is released, and when the transaction risk category is an abnormal transaction, the preset transaction alarm information is triggered. By extracting features from the transaction data through the long short-term memory network with an attention mechanism, the sensitivity of the model to the full amount of data information is improved, and the extracted transaction feature data is fused with the original transaction data before identification, while retaining the meaning of the original transaction data, it also integrates the transaction behavior characteristics, realizes end-to-end anti-money laundering identification, and improves the efficiency and accuracy of anti-money laundering identification. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the scheme in the present invention, a brief introduction is given below to the drawings required for use in the description of the embodiments of the present invention. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0022] Figure 1 A schematic diagram of an application environment of an anti-money laundering identification method based on feature fusion provided in an embodiment of the present invention;

[0023] Figure 2 A flow chart of an anti-money laundering identification method based on feature fusion provided by an embodiment of the present invention;

[0024] Figure 3 A flow chart of step S203 of the anti-money laundering identification method based on feature fusion provided in an embodiment of the present invention;

[0025] Figure 4 A schematic diagram of the functional modules of an anti-money laundering identification device based on feature fusion provided by an embodiment of the present invention;

[0026] Figure 5 A schematic diagram of the hardware structure of a computer device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0027] In order to make the purpose, technical solution and effect of the present invention clearer and more specific, the present invention is further described in detail below. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention. The embodiments of the present invention are described below in conjunction with the accompanying drawings.

[0028] The anti-money laundering identification method based on feature fusion provided by the embodiment of the present invention can be applied in the following aspects: Figure 1 In the application environment of FIG. 1 , it includes a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104 and a server 105. The network 104 is used to provide a medium for a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103 and the server 105. The network 104 may include various connection types, such as wired and / or wireless communication links, etc.

[0029] The user can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 through the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as knowledge reading applications, web browser applications, search applications, instant messaging tools, email clients, and / or social platform software, etc. (only as examples).

[0030] The first terminal device 101, the second terminal device 102, and the third terminal device 103 may be various electronic devices having display screens and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.

[0031] The server 105 may be a server that provides various services, such as a background server that provides support for the content browsed by the user using the first terminal device 101, the second terminal device 102, and the third terminal device 103 (for example only). The background server may analyze and process the received data such as the user request, and feed back the processing results (such as web pages, information, or data obtained or generated according to the user request) to the terminal device. The server 105 may be a cloud server, also known as a cloud computing server or a cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services ("Virtual Private Server", or "VPS" for short). The server 105 may also be a server for a distributed system, or a server combined with a blockchain.

[0032] It should be noted that the anti-money laundering identification method based on feature fusion provided in the embodiment of the present application can generally be executed by the first terminal device 101, the second terminal device 102 or the third terminal device 103. Accordingly, the anti-money laundering identification device based on feature fusion provided in the embodiment of the present invention can also be set in the first terminal device 101, the second terminal device 102 or the third terminal device 103. Alternatively, the anti-money laundering identification method based on feature fusion provided in the embodiment of the present invention can also generally be executed by the server 105. Accordingly, the anti-money laundering identification device based on feature fusion provided in the embodiment of the present invention can generally be set in the server 105.

[0033] It should be understood that the numbers of the above terminal devices, networks and servers are only illustrative. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0034] like Figure 2 As shown, the anti-money laundering identification method based on feature fusion provided by the embodiment of the present invention specifically includes the following steps:

[0035] S201. When receiving a transaction request initiated by a user, obtain original transaction data carried in the transaction request.

[0036] In this embodiment, when a user initiates a transaction request through different channels such as mobile APP, ATM transfer, POS machine consumption, etc., the bank backend intercepts the transaction request and obtains the original transaction data carried in the transaction request. The original transaction data includes the transaction amount, transaction time, account information of the initiator and the payee, IP address, device information, etc. By obtaining the original transaction data, the bank can conduct a comprehensive monitoring and analysis of the transaction and provide basic data support for subsequent risk assessment.

[0037] For example, in a transfer transaction scenario, user Zhang San initiated a transfer request of RMB 100,000 to an unfamiliar overseas account through online banking on a certain weekday afternoon. The bank system can obtain and record detailed original transaction data based on the transfer request, including transaction amount: RMB 100,000; transaction time: 14:30 on zz / yy / xxxx; initiator account: Zhang San's account (with sufficient account balance); recipient account: an unfamiliar overseas account; initiator IP address: Zhang San's home network IP; initiator device information: Zhang San's personal computer. By recording every detail of the transaction in detail, the bank can conduct a comprehensive risk assessment of the transaction and improve the accuracy and reliability of anti-money laundering identification.

[0038] S202: Input the original transaction data into a pre-trained anti-money laundering recognition model, wherein the anti-money laundering recognition model includes a long short-term memory network that introduces an attention mechanism.

[0039] In this embodiment, the acquired original transaction data is input into a pre-trained anti-money laundering identification model, which includes a long short-term memory network that introduces an attention mechanism, that is, the model is a deep learning model that combines a long short-term memory network (LSTM) and an attention mechanism, and has been trained with historical transaction data, so that the model can learn from a large amount of historical data and identify complex patterns of money laundering behavior, and use deep learning technology to improve the accuracy and efficiency of anti-money laundering identification.

[0040] S203: extracting transaction feature data from the original transaction data through the anti-money laundering identification model, and fusing the transaction feature data with the original transaction data to obtain corresponding transaction risk categories.

[0041] In this embodiment, the input original transaction data is subjected to feature extraction through the anti-money laundering identification module to obtain key features in the original transaction data. For example, in the above example, the key features that can be extracted include the transaction amount being much higher than Zhang San's daily transaction level, the payee being an unfamiliar overseas account, the transaction time being consistent with Zhang San's usual transaction time, the IP address and device information being consistent with Zhang San's historical transaction records, etc. By fusing the extracted transaction feature data with the original transaction data and then identifying its transaction risk category, that is, whether the current transaction request is a normal transaction or an abnormal transaction, the meaning of the original data is retained while also fusing the behavioral features of the transaction itself, which can make the classification more reliable.

[0042] S204: When the transaction risk category is a normal transaction, the transaction request is released; when the transaction risk category is an abnormal transaction, a preset transaction warning message is triggered.

[0043] In this embodiment, the transaction request is processed accordingly based on the identification result of the anti-money laundering identification model. If the transaction risk category identified by the model is "normal transaction", the bank system will automatically release the transaction and allow the funds to be transferred; if it is identified as "abnormal transaction", the bank system will intercept and suspend the transaction request and trigger a preset transaction alarm information, such as notifying the anti-money laundering department for manual review, ensuring that only low-risk transactions can proceed smoothly and high-risk transactions can be reviewed and processed in a timely manner, effectively preventing the occurrence of money laundering and protecting the security and stability of the financial system.

[0044] In the above embodiment, the present invention discloses an anti-money laundering identification method based on feature fusion, by obtaining the original transaction data carried by the transaction request when receiving a transaction request initiated by a user; inputting the original transaction data into a pre-trained anti-money laundering identification model, the anti-money laundering identification model includes a long short-term memory network with an attention mechanism; extracting transaction feature data from the original transaction data through the anti-money laundering identification model, and identifying the corresponding transaction risk category after feature fusion of the transaction feature data with the original transaction data; when the transaction risk category is a normal transaction, the transaction request is released, and when the transaction risk category is an abnormal transaction, a preset transaction alarm information is triggered. By extracting features from the transaction data through the long short-term memory network with an attention mechanism, the sensitivity of the model to the full amount of data information is improved, and the extracted transaction feature data is fused with the original transaction data before identification, while retaining the meaning of the original transaction data, it also integrates the transaction behavior characteristics, realizes end-to-end anti-money laundering identification, and improves the efficiency and accuracy of anti-money laundering identification.

[0045] In one embodiment, step S201 specifically includes:

[0046] When a user initiates a transaction request, the transaction request is intercepted by a pre-created slice, and the transaction data carried in the transaction request is parsed and obtained.

[0047] In this embodiment, when a user initiates a transaction request, the bank system automatically intercepts the transaction request through the pre-deployed Aspect-Oriented Programming (AOP) aspect, and parses and obtains the transaction data carried in the transaction request. AOP (Aspect-Oriented Programming) is a programming paradigm that can separate cross-cutting concerns (such as logging, permission checking, transaction management, etc.) from business logic code, thereby improving the modularity and maintainability of the code. Among them, the AOP aspect (Aspect) represents a modular cross-cutting concern, which implements the encapsulation of cross-cutting concerns and can contain multiple advices. Advice is an operation performed at a specific point, which is used to describe the rule notification of when, where and how to apply the aspect logic, that is, Advice can represent the operation performed by the aspect at a connection point (a specific point in program execution, such as a method call or an exception throw), and can be executed before, after or around the connection point, thereby realizing the function of the cross-cutting concern.

[0048] Through the pre-created AOP aspect, when the user initiates a transaction request, the AOP can at least intercept all requests entering the Controller layer and obtain the transaction data in the request for subsequent anti-money laundering identification, that is, anti-money laundering identification is used as an aspect process of the banking system as a pre-verification of each transaction, that is, each transaction will be intercepted by the aspect and input into the anti-money laundering identification model for detection, so that the bank can monitor all transaction requests in real time to ensure that no transaction can bypass anti-money laundering monitoring, thereby achieving the effect of transaction risk control. At the same time, the aspect method can reduce the coupling of business logic and monitoring logic, greatly reduce the resource consumption of data, and improve the efficiency of anti-money laundering identification.

[0049] In one embodiment, before step S202, the method further includes:

[0050] Converting the original transaction data into a transaction matrix according to the data type and value in the original transaction data;

[0051] The transaction matrix is ​​subjected to one-hot encoding processing to obtain a corresponding original transaction encoding matrix as input data of the anti-money laundering identification model.

[0052] In this embodiment, before the original transaction data is input into the anti-money laundering identification model, data processing is first performed on it to improve the anti-money laundering identification effect. Specifically, the unstructured original transaction data is first converted into a structured matrix form, that is, according to the data type and value in the original transaction data, the original transaction data is converted into a transaction matrix. Each row in the transaction matrix represents a transaction record, and each column represents a specific data field. For example, the transaction matrix may contain the following columns (corresponding to the data type): transaction ID, transaction amount, initiator account, payee account, transaction time, IP address, etc. Each element of the transaction matrix is ​​a specific data value. The form of the transaction matrix allows the data to be directly processed by the algorithm, which facilitates feature extraction and model training.

[0053] Furthermore, since some columns in the transaction matrix may contain categorical data, such as account type (individual or enterprise), transaction channel (online banking, mobile banking, etc.), in order to improve the data processing efficiency, the data in the transaction matrix is ​​coded in a standardized manner, that is, the transaction matrix is ​​coded in a one-hot manner to obtain the corresponding original transaction coding matrix. For example, if there are two categories of transaction channels: "online banking" and "mobile banking", after the transaction channel data in the transaction matrix is ​​coded in a one-hot manner, the categorical data of "online banking" is coded as [1,0], and the categorical data of "mobile banking" is coded as [0,1], so that all elements in the matrix are displayed in a unified form and converted into a form that can be better processed by the model. The converted coded data is used as the input data of the anti-money laundering identification model, which improves the performance and prediction accuracy of the machine learning model.

[0054] In one embodiment, the anti-money laundering identification model includes a long short-term memory network with an attention mechanism, a feature fusion module and a classifier connected in sequence, wherein the long short-term memory network with an attention mechanism includes several hidden layers, and adjacent hidden layers are connected with attention mechanism modules.

[0055] In one embodiment, Figure 3 As shown, step S203 includes:

[0056] S301, performing feature extraction processing on the original transaction data through the long short-term memory network introduced with the attention mechanism to obtain corresponding transaction feature data;

[0057] S302, performing feature connection and fusion on the transaction feature data and the original transaction data through the feature fusion module to obtain fused transaction features;

[0058] S303: predicting the transaction risk category of the fused transaction feature through the classifier, and identifying whether the fused transaction feature is a normal transaction or an abnormal transaction.

[0059] In this embodiment, the long short-term memory network that introduces the attention mechanism into the anti-money laundering identification model is used as a feature extraction module. Since the information that the LSTM network itself pays attention to is closely related to the transaction time, while ignoring other transaction information, the anti-money laundering identification model provided in this embodiment improves the original long short-term memory network (LSTM), and adds the Attention module, that is, the attention mechanism module, to the basic LSTM network as a feature extraction module for input data. The attention mechanism module is connected between adjacent hidden layers, so that the attention mechanism is processed before the input of each layer, so as to increase the weight of key information and help the model better focus on key information in the transaction data, such as transaction amount, frequency, and account behavior, thereby improving the model's ability to identify money laundering behavior, and can also improve the model's sensitivity to the full amount of data information, thereby improving the reliability of the prediction results.

[0060] After the LSTM network with the attention mechanism extracts the transaction feature data, the feature fusion module integrates these features with the original transaction data. That is, the feature fusion module in the model structure can integrate features from different sources and dimensions, so that the model can understand the transaction data from more perspectives and improve the accuracy of identifying money laundering behaviors. For example, the high-dimensional features output by LSTM are fused with low-dimensional features such as account information and transaction history in the original transaction data. The fusion process can be achieved through weighted summation, feature connection, etc. to form a comprehensive feature vector, so that the model can show better generalization ability when facing different types of money laundering behaviors.

[0061] Finally, the fused feature vector is input into a classifier. Specifically, the classifier in the model can be, for example, a support vector machine (SVM) or a random forest (RF). The fused features are predicted and identified by the classifier to determine the transaction risk category, that is, whether the current transaction request is a normal transaction or an abnormal transaction suspected of money laundering. This enables the anti-money laundering identification model to extract key features from the original transaction data, and accurately identify abnormal transaction behaviors such as money laundering after feature fusion, thereby ensuring the security and stability of the financial system.

[0062] In one embodiment, step S301 includes:

[0063] The attention mechanism module performs attention mechanism processing on the output and unit state of the previous hidden layer respectively to obtain the attention output and attention unit state of the previous hidden layer;

[0064] The attention output of the previous hidden layer and the original transaction data of the current hidden layer are used as the input data of the current hidden layer, and the input data and the attention unit state of the current hidden layer are processed by the gating mechanism and the state update process to obtain the output and unit state of the current hidden layer;

[0065] The output of the last hidden layer is obtained as the transaction feature data of the original transaction encoding matrix.

[0066] In this embodiment, when the original transaction data is processed by the LSTM network with the attention mechanism introduced, the LSTM network includes several hidden layers. The hidden layer here refers to the repeated unit structure in the LSTM network. Each unit is responsible for processing a time step of the sequence data and contains its own state, which can also be called an LSTM layer or an LSTM unit. Each layer is the output of the previous layer (h t-1 ) and the original transaction data input of the current layer (x t ) as input data, C t As the feature accumulation of each layer, i.e., the unit state, useless information will be filtered out and useful information will be retained. Based on the model structure in which the attention mechanism module is connected between adjacent hidden layers in this embodiment, the output (h t-1 ) and the unit state C of the previous layer t-1 Attention mechanism processing will be performed before participating in the gating calculation and state update of the current layer, thereby increasing the weight of key information. The specific formulas for gating mechanism processing and state update processing at each layer are as follows:

[0067] f t =σ(W f *[att*h t-1 ,x t ]+b f )

[0068] i t =σ(W i *[att*h t-1 ,x t ]+b i )

[0069] b t =tanh(W C *[att*h t-1 ,x t ]+b c )

[0070] C t =att*[f t *C t-1 ]+i t *b t

[0071] o t =σ(W o *[att*h t-1 ,x t]+b o )

[0072] h t =o t *tanh(C t )

[0073] Among them, f t represents the output of the forget gate, σ represents the sigmoid function, W f is the weight matrix of the forget gate, h t-1 is the output of the previous layer, x t is the original transaction data input of the current layer, b f is the bias vector of the forget gate, i t represents the output of the input gate, b t represents the candidate unit state, W i and W C are the weight matrices of the input gate and candidate unit states, respectively, and b i and b c are the bias vectors of the input gate and candidate unit states, tanh is the tanh activation function, and C t Indicates the unit state of the current layer, C t-1 Indicates the unit state of the previous layer, o t represents the output of the output gate, W o is the weight matrix of the output gate, b o is the bias vector of the output gate, g t is the output of the current layer.

[0074] By introducing the attention mechanism into the LSTM network, the model can identify and focus on the information in the transaction data that is more relevant to money laundering during feature extraction, improve the relevance and accuracy of feature extraction, and ignore less important information, thereby reducing data redundancy. At the same time, based on the gating mechanism and state update of the LSTM network, the time dependency in the transaction data can be better captured, thereby identifying the complex patterns and dependencies in the transaction data, allowing the model to more accurately predict whether the transaction involves money laundering.

[0075] In one embodiment, before step S201, the method further includes:

[0076] Collect historical transaction records, quantify the historical transaction records into transaction behavior graph feature data and mark corresponding transaction risk categories to obtain corresponding training data sets;

[0077] An anti-money laundering recognition model is constructed, and the anti-money laundering recognition model is trained using the training data set until a preset convergence condition is met to obtain a trained anti-money laundering recognition model.

[0078] In this embodiment, during the training phase of the anti-money laundering identification model, historical transaction records are collected, for example, all customer transaction records in the past year are collected, and these records include the amount, time, frequency, account type, geographic location and other information of each transaction. These transaction records are quantified as transaction behavior graph feature data. For example, each transaction can be represented as a node in the graph, and the relationship between transactions (such as the flow of amount, time interval) can be represented as an edge. At the same time, each transaction or transaction pattern is labeled as a corresponding risk category, such as "normal transaction", "suspicious transaction" or "confirmed money laundering", so as to obtain the corresponding training data set and input it into the anti-money laundering identification model for model parameter adjustment training.

[0079] Preferably, in order to improve the efficiency of data processing, each historical transaction record can also be converted into a sparse matrix for representation, where each row represents a transaction record and each column represents a specific feature or attribute. The following is an example of transaction data represented by a sparse matrix:

[0080] Data = [[transaction ID, transaction type, transaction amount, transaction time, transaction role, transaction address, transaction status],

[0081] [1001,purchase,$1000,2024-05-11 10:11,Buyer,USA,1],

[0082] [1001,transfer,$100,2024-05-12 10:11,receiver,China,0],

[0083] [1001,sale,$1600,2024-05-13 10:11,seller,China,2]]

[0084] In addition, the sparse matrix is ​​represented by one-hot encoding and then used as input feature data for subsequent training models to obtain a training data set that is more suitable for model processing and improve the training effect.

[0085] After that, an anti-money laundering identification model is constructed. The structure of the anti-money laundering identification model is the same as that in the above embodiment, which will not be described in detail here. The initialized anti-money laundering identification model is trained through a training data set, that is, the above-mentioned quantified transaction behavior graph feature data is used as input, and the transaction behavior graph feature data is extracted through a long short-term memory network that introduces an attention mechanism to obtain high-dimensional feature data, and the high-dimensional feature data is subjected to dimensionality reduction processing to obtain historical transaction feature data. The specific feature extraction process is the same as the feature extraction process of the original transaction data in the above-mentioned recognition stage embodiment, which will not be described in detail here. The feature fusion module in the model is used to connect and fuse the historical transaction feature data and the transaction behavior graph feature data, and the classifier is used to predict the transaction risk category of the fused feature. The corresponding loss value is calculated according to the category prediction result and category label of each transaction behavior graph feature data, and the model parameters are adjusted by back propagation, that is, training is performed by supervised learning. During the training process, the model continuously adjusts parameters to minimize the difference between the predicted results and the actual risk category. When the difference is minimized or the preset number of iterations is reached, the model is considered to have met the convergence condition until the preset convergence condition is met to obtain a trained anti-money laundering identification model, thereby obtaining an effective anti-money laundering identification model that can be deployed in an actual production environment to improve the ability of financial institutions to identify and prevent money laundering activities.

[0086] It should be noted that there is not necessarily a certain order between the above-mentioned steps. A person skilled in the art can understand, based on the description of the embodiments of the present invention, that in different embodiments, the above-mentioned steps may have different execution orders, that is, they may be executed in parallel, may be executed interchangeably, and so on.

[0087] Further references Figure 4 , as a response to the above Figure 2 The present invention provides an embodiment of an anti-money laundering identification device based on feature fusion, and the device embodiment is similar to Figure 2 Corresponding to the method embodiment shown, the device can be specifically applied to various electronic devices.

[0088] like Figure 4 As shown, the anti-money laundering identification device 40 based on feature fusion described in this embodiment includes:

[0089] The data acquisition module 401 is used to acquire the original transaction data carried in the transaction request when receiving the transaction request initiated by the user;

[0090] A data input module 402, used to input the original transaction data into a pre-trained anti-money laundering recognition model, wherein the anti-money laundering recognition model includes a long short-term memory network that introduces an attention mechanism;

[0091] The transaction identification module 403 is used to extract transaction feature data from the original transaction data through the anti-money laundering identification model, and identify the corresponding transaction risk category after fusing the transaction feature data with the original transaction data;

[0092] The transaction processing module 404 is used to release the transaction request when the transaction risk category is a normal transaction, and trigger preset transaction warning information when the transaction risk category is an abnormal transaction.

[0093] The module referred to in the present invention refers to a series of computer program instruction segments that can complete specific functions, which is more suitable for describing the anti-money laundering identification execution process based on feature fusion than a program. For the specific implementation of each module, please refer to the corresponding method embodiment above, which will not be repeated here.

[0094] In one embodiment, the data acquisition module 401 is specifically used to:

[0095] When a user initiates a transaction request, the transaction request is intercepted by a pre-created slice, and the transaction data carried in the transaction request is parsed and obtained.

[0096] In one embodiment, the device 40 further includes:

[0097] A data conversion module, used for converting the original transaction data into a transaction matrix according to the data type and value in the original transaction data;

[0098] The encoding module is used to perform one-hot encoding processing on the transaction matrix to obtain the corresponding original transaction encoding matrix as input data of the anti-money laundering identification model.

[0099] In one embodiment, the anti-money laundering identification model includes a long short-term memory network with an attention mechanism, a feature fusion module and a classifier connected in sequence, wherein the long short-term memory network with an attention mechanism includes several hidden layers, and adjacent hidden layers are connected with attention mechanism modules.

[0100] In one embodiment, the transaction identification module 403 includes:

[0101] A feature extraction unit, configured to perform feature extraction processing on the original transaction data through the long short-term memory network introduced with the attention mechanism, so as to obtain corresponding transaction feature data;

[0102] A fusion unit, configured to perform feature connection and fusion on the transaction feature data and the original transaction data through the feature fusion module to obtain a fused transaction feature;

[0103] The prediction unit is used to predict the transaction risk category of the fused transaction feature through the classifier, and identify whether the fused transaction feature is a normal transaction or an abnormal transaction.

[0104] In one embodiment, the feature extraction unit comprises:

[0105] An attention mechanism unit, used to perform attention mechanism processing on the output and unit state of the previous hidden layer through the attention mechanism module to obtain the attention output and attention unit state of the previous hidden layer;

[0106] A processing unit, used to take the attention output of the previous hidden layer and the original transaction data of the current hidden layer as the input data of the current hidden layer, perform gating mechanism processing and state update processing on the input data of the current hidden layer and the attention unit state, and obtain the output and unit state of the current hidden layer;

[0107] The output unit is used to obtain the output of the last hidden layer as the transaction feature data of the original transaction encoding matrix.

[0108] In one embodiment, the device 40 further includes:

[0109] A data collection module is used to collect historical transaction records, quantify the historical transaction records into transaction behavior graph feature data and mark corresponding transaction risk categories to obtain corresponding training data sets;

[0110] The model training module is used to construct an anti-money laundering recognition model, and train the anti-money laundering recognition model through the training data set until a preset convergence condition is met to obtain a trained anti-money laundering recognition model.

[0111] In the above embodiment, the present invention discloses an anti-money laundering identification device based on feature fusion, which obtains the original transaction data carried by the transaction request when receiving the transaction request initiated by the user; inputs the original transaction data into a pre-trained anti-money laundering identification model, and the anti-money laundering identification model includes a long short-term memory network with an attention mechanism; extracts transaction feature data from the original transaction data through the anti-money laundering identification model, and identifies the corresponding transaction risk category after feature fusion of the transaction feature data with the original transaction data; when the transaction risk category is a normal transaction, the transaction request is released, and when the transaction risk category is an abnormal transaction, a preset transaction alarm information is triggered. By extracting features from the transaction data through the long short-term memory network with an attention mechanism, the sensitivity of the model to the full amount of data information is improved, and the extracted transaction feature data is fused with the original transaction data before identification, while retaining the meaning of the original transaction data, it also integrates the transaction behavior characteristics, realizes end-to-end anti-money laundering identification, and improves the efficiency and accuracy of anti-money laundering identification.

[0112] Another embodiment of the present invention provides a computer device, such as Figure 5 As shown, the computer device 50 includes:

[0113] One or more processors 501 and memory 502, Figure 5 A processor 501 is used as an example for the description. The processor 501 and the memory 502 may be connected via a bus or other means. Figure 5 The example of connecting through bus is taken in the following.

[0114] Processor 501 is used to complete various control logics of computer device 50, and it can be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA), a single-chip microcomputer, an ARM (Acorn RISC Machine) or other programmable logic device, a discrete gate or transistor logic, a discrete hardware component or any combination of these components. In addition, processor 501 can also be any traditional processor, microprocessor or state machine. Processor 501 can also be implemented as a combination of computing devices, for example, a combination of a DSP and a microprocessor, a plurality of microprocessors, one or more microprocessors combined with a DSP and / or any other such configuration.

[0115] The memory 502 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules, such as program instructions corresponding to the anti-money laundering identification method based on feature fusion in the embodiment of the present invention. The processor 501 executes various functional applications and data processing of the computer device 50 by running the non-volatile software programs, instructions and units stored in the memory 502, that is, realizing the anti-money laundering identification method based on feature fusion in the above method embodiment.

[0116] The memory 502 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required by at least one function; the data storage area may store data created according to the use of the computer device 50, etc. In addition, the memory 502 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some embodiments, the memory 502 may optionally include a memory remotely arranged relative to the processor 501, and these remote memories may be connected to the computer device 50 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof. One or more units are stored in the memory 502, and when executed by one or more processors 501, the steps of the anti-money laundering identification method based on feature fusion in any of the above-mentioned method embodiments are executed.

[0117] In the above embodiment, the present invention discloses a computer device, which obtains the original transaction data carried by the transaction request when receiving the transaction request initiated by the user; inputs the original transaction data into a pre-trained anti-money laundering recognition model, and the anti-money laundering recognition model includes a long short-term memory network with an attention mechanism; extracts the transaction feature data in the original transaction data through the anti-money laundering recognition model, and identifies the corresponding transaction risk category after the transaction feature data is fused with the original transaction data; when the transaction risk category is a normal transaction, the transaction request is released, and when the transaction risk category is an abnormal transaction, a preset transaction alarm information is triggered. By extracting the features of the transaction data through the long short-term memory network with an attention mechanism, the sensitivity of the model to the full amount of data information is improved, and the extracted transaction feature data is fused with the original transaction data before identification, while retaining the meaning of the original transaction data, it also integrates the transaction behavior characteristics, realizes end-to-end anti-money laundering identification, and improves the efficiency and accuracy of anti-money laundering identification.

[0118] An embodiment of the present invention provides a non-volatile computer-readable storage medium, which stores computer-executable instructions. When the computer-executable instructions are executed by one or more processors, the steps of the anti-money laundering identification method based on feature fusion in any of the above method embodiments are executed.

[0119] In the above embodiment, the present invention discloses a non-volatile computer-readable storage medium, which obtains the original transaction data carried by the transaction request when receiving a transaction request initiated by a user; inputs the original transaction data into a pre-trained anti-money laundering recognition model, and the anti-money laundering recognition model includes a long short-term memory network with an attention mechanism; extracts transaction feature data from the original transaction data through the anti-money laundering recognition model, and identifies the corresponding transaction risk category after feature fusion of the transaction feature data and the original transaction data; when the transaction risk category is a normal transaction, the transaction request is released, and when the transaction risk category is an abnormal transaction, a preset transaction alarm information is triggered. By extracting features from the transaction data through a long short-term memory network with an attention mechanism, the sensitivity of the model to the full amount of data information is improved, and the extracted transaction feature data is fused with the original transaction data before identification, while retaining the meaning of the original transaction data, it also integrates the transaction behavior characteristics, realizes end-to-end anti-money laundering identification, and improves the efficiency and accuracy of anti-money laundering identification.

[0120] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for enabling a terminal device (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0121] The present invention can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronic devices, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc. The present invention can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present invention can also be practiced in distributed computing environments, in which tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media including storage devices.

[0122] In summary, the method, device, equipment and medium for anti-money laundering identification based on feature fusion disclosed in the present invention include: when receiving a transaction request initiated by a user, obtaining the original transaction data carried by the transaction request; inputting the original transaction data into a pre-trained anti-money laundering identification model, the anti-money laundering identification model includes a long short-term memory network with an attention mechanism; extracting transaction feature data from the original transaction data through the anti-money laundering identification model, and identifying the corresponding transaction risk category after feature fusion of the transaction feature data with the original transaction data; when the transaction risk category is a normal transaction, the transaction request is released, and when the transaction risk category is an abnormal transaction, the preset transaction alarm information is triggered. By extracting features from the transaction data through the long short-term memory network with an attention mechanism, the sensitivity of the model to the full amount of data information is improved, and the extracted transaction feature data is fused with the original transaction data before identification, while retaining the meaning of the original transaction data, it also integrates the transaction behavior characteristics, realizes end-to-end anti-money laundering identification, and improves the efficiency and accuracy of anti-money laundering identification.

[0123] Of course, those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing related hardware (such as a processor, a controller, etc.) through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium, and the computer program can include the processes of the above-mentioned method embodiments when executed. The storage medium can be a memory, a disk, a floppy disk, a flash memory, an optical storage device, etc.

[0124] It should be noted that if any software tools or components other than those of the Company appear in the embodiments of the present application, they are merely used for illustration and do not represent actual use. It should be understood that the application of the present invention is not limited to the above examples, and that those skilled in the art can make improvements or changes based on the above description, and all such improvements and changes shall fall within the scope of protection of the claims attached to the present invention.

Claims

1. An anti-money laundering identification method based on feature fusion, characterized in that: include: Upon receiving a transaction request initiated by a user, obtaining original transaction data carried in the transaction request; Inputting the raw transaction data into a pre-trained anti-money laundering recognition model, wherein the anti-money laundering recognition model includes a long short-term memory network with an attention mechanism; Extracting transaction feature data from the original transaction data through the anti-money laundering identification model, and fusing the transaction feature data with the original transaction data to obtain corresponding transaction risk categories; When the transaction risk category is a normal transaction, the transaction request is released; when the transaction risk category is an abnormal transaction, a preset transaction warning message is triggered.

2. The anti-money laundering identification method based on feature fusion according to claim 1 is characterized in that: When receiving a transaction request initiated by a user, obtaining the transaction data carried in the transaction request specifically includes: When a user initiates a transaction request, the transaction request is intercepted by a pre-created slice, and the transaction data carried in the transaction request is parsed and obtained.

3. The anti-money laundering identification method based on feature fusion according to claim 1 is characterized in that: Before inputting the raw transaction data into a pre-trained anti-money laundering identification model, wherein the anti-money laundering identification model includes a long short-term memory network with an attention mechanism introduced, the method further includes: Converting the original transaction data into a transaction matrix according to the data type and value in the original transaction data; The transaction matrix is ​​subjected to one-hot encoding processing to obtain a corresponding original transaction encoding matrix as input data of the anti-money laundering identification model.

4. The anti-money laundering identification method based on feature fusion according to any one of claims 1 to 3, characterized in that: The anti-money laundering identification model includes a long short-term memory network with an attention mechanism, a feature fusion module and a classifier connected in sequence, wherein the long short-term memory network with an attention mechanism includes several hidden layers, and adjacent hidden layers are connected with attention mechanism modules.

5. The anti-money laundering identification method based on feature fusion according to claim 4 is characterized in that: The extracting transaction feature data from the original transaction data by the anti-money laundering identification model, and fusing the transaction feature data with the original transaction data to identify the corresponding transaction risk category, includes: Performing feature extraction processing on the original transaction data through the long short-term memory network that introduces the attention mechanism to obtain corresponding transaction feature data; The transaction feature data is connected and fused with the original transaction data by the feature fusion module to obtain a fused transaction feature; The transaction risk category of the fused transaction feature is predicted by the classifier to identify whether the fused transaction feature is a normal transaction or an abnormal transaction.

6. The anti-money laundering identification method based on feature fusion according to claim 5 is characterized in that: The feature extraction process is performed on the original transaction data by using the long short-term memory network that introduces the attention mechanism to obtain corresponding transaction feature data, including: The attention mechanism module performs attention mechanism processing on the output and unit state of the previous hidden layer respectively to obtain the attention output and attention unit state of the previous hidden layer; The attention output of the previous hidden layer and the original transaction data of the current hidden layer are used as the input data of the current hidden layer, and the input data and the attention unit state of the current hidden layer are processed by the gating mechanism and the state update process to obtain the output and unit state of the current hidden layer; The output of the last hidden layer is obtained as the transaction feature data of the original transaction encoding matrix.

7. The anti-money laundering identification method based on feature fusion according to claim 1 is characterized in that: When receiving a transaction request initiated by a user, before obtaining the original transaction data carried in the transaction request, the method further includes: Collect historical transaction records, quantify the historical transaction records into transaction behavior graph feature data and mark corresponding transaction risk categories to obtain corresponding training data sets; An anti-money laundering recognition model is constructed, and the anti-money laundering recognition model is trained using the training data set until a preset convergence condition is met to obtain a trained anti-money laundering recognition model. 8.An anti-money laundering identification device based on feature fusion, characterized in that: include: A data acquisition module, configured to acquire original transaction data carried in a transaction request upon receiving a transaction request initiated by a user; A data input module, used for inputting the raw transaction data into a pre-trained anti-money laundering identification model, wherein the anti-money laundering identification model includes a long short-term memory network with an attention mechanism; A transaction identification module, used to extract transaction feature data from the original transaction data through the anti-money laundering identification model, and identify the corresponding transaction risk category after fusing the transaction feature data with the original transaction data; The transaction processing module is used to release the transaction request when the transaction risk category is a normal transaction, and trigger preset transaction warning information when the transaction risk category is an abnormal transaction.

9. A computer device, characterized in that: comprising at least one processor; and, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the anti-money laundering identification method based on feature fusion as described in any one of claims 1-7.

10. A non-volatile computer-readable storage medium, characterized in that: The non-volatile computer-readable storage medium stores computer-executable instructions, which, when executed by one or more processors, enable the one or more processors to execute the anti-money laundering identification method based on feature fusion as described in any one of claims 1-7.

Images