Fund flow data analysis method and device, computer equipment and storage medium

Abstract

The invention relates to a fund flow direction data analysis method and device, computer equipment and a storage medium. The method comprises the following steps: acquiring fund flow data of a risk account; generating a fund flow mind map according to the fund flow data; wherein the fund flow direction mind map is constructed by taking a transaction account as a node and taking a fund transaction flow direction as an edge; identifying a target node from the fund flow mind map, and determining at least one level of association node having an association relationship with the target node by taking the target node as an initiation point; wherein the target node is a node corresponding to a specified account in a plurality of transaction accounts having a transaction association relationship with the risk account; screening a target association node from the plurality of association nodes according to the importance degree of each association node of each level; and starting an automatic tracking and analysis process for the fund flow direction of the transaction account corresponding to the target association node. By adopting the method, the analysis efficiency of the fund flow data can be improved.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a method, apparatus, computer equipment and storage medium for analyzing capital flow data. Background Art

[0002] With the development of data processing technology, financial data analysis technology has emerged. In recent years, new types of illegal and criminal activities in telecommunications networks have frequently occurred, seriously threatening social and economic order. Analyzing the flow of funds can effectively prevent the occurrence of financial crimes.

[0003] Traditional methods for analyzing capital flows are based on manual analysis and rely on Excel list tools, usually through manual screening, batch query, replacement or cleaning of data. In terms of data processing capabilities, Excel worksheets limit the number of data rows (usually around 1 million rows). When processing large-scale data sets, Excel is prone to performance bottlenecks, such as slow operation, lag, and even crashes. Moreover, Excel data usually needs to be manually imported and refreshed, and real-time data updates, complex analysis, and visualization are difficult. Therefore, when faced with the analysis of fast-flowing capital data, it is inefficient and difficult to achieve timely and effective interception and tracing. Summary of the Invention

[0004] Based on this, it is necessary to provide a capital flow data analysis method, device, computer equipment and storage medium that can improve the efficiency of capital flow data analysis in response to the above technical problems.

[0005] In a first aspect, a method for analyzing capital flow data is provided, the method comprising:

[0006] Obtain fund flow data of risk accounts;

[0007] Generate a fund flow mind map based on fund flow data. The fund flow mind map is constructed with trading accounts as nodes and fund transaction flows as edges.

[0008] Identify a target node from the capital flow mind map, use the target node as a starting point, and determine at least one level of associated nodes associated with the target node; wherein the target node is a node corresponding to a designated account among multiple transaction accounts that have a transaction association relationship with the risk account;

[0009] Selecting a target associated node from a plurality of associated nodes according to the importance of each associated node at each level;

[0010] Start the automated tracking and analysis process of the funds flow of the trading account corresponding to the target associated node.

[0011] In some embodiments, obtaining fund flow data of a risk account includes:

[0012] Monitor risk accounts through software robots, collecting fund flow data and subject information data of risk accounts within a preset time period;

[0013] Conduct standardized data cleaning of fund flow data in accordance with fund flow record standards, and conduct standardized data cleaning of subject information data in accordance with subject information format standards;

[0014] Generate fund flow data corresponding to risk accounts based on fund flow data and subject information data after standardized data cleaning.

[0015] In some embodiments, selecting a target associated node from a plurality of associated nodes according to the importance of each associated node at each level includes:

[0016] The capital ratio of the transaction amount of the target node in each associated node is determined, and the associated node with a capital ratio greater than a preset threshold is determined as the target associated node.

[0017] In some embodiments, selecting a target associated node from a plurality of associated nodes according to the importance of each associated node at each level includes:

[0018] Collect transaction flow records of transaction accounts corresponding to each associated node;

[0019] Extract characteristic information of each associated node from each transaction flow record;

[0020] Perform feature rendering on the feature information of each associated node to generate feature labels corresponding to each associated node;

[0021] Determine the abnormality of each associated node based on each feature label;

[0022] The associated nodes whose capital ratio is greater than a preset threshold and whose abnormality is greater than a preset threshold are determined as target associated nodes.

[0023] In some embodiments, the method further comprises:

[0024] Prioritize each target-related node based on the size of the capital ratio and the degree of abnormality;

[0025] Target associated nodes with a priority greater than a preset threshold are marked with a key pending verification label, other target associated nodes are marked with a common pending verification label, and other associated nodes that do not belong to the target associated nodes are marked with a common pending verification label and a not recommended verification label.

[0026] In some embodiments, the method further comprises:

[0027] Monitor the status of each node in the capital flow mind map;

[0028] In response to monitoring the case information submitted by the terminal, marking the node corresponding to the victim account in the case information with a victim label according to the case information;

[0029] In response to monitoring that the target associated node has been investigated, marking the target associated node with a verified label;

[0030] In response to detecting that the target associated node is under investigation, the target associated node is marked with a verification-underway tag.

[0031] In some embodiments, the method further comprises:

[0032] Determine the controlled node that is successfully controlled from the target associated nodes;

[0033] Determine the level of the controlled node relative to the target node;

[0034] Get the proportion of the transaction amount of the controlled nodes that includes the target node;

[0035] Obtain the occurrence time information of the target node's transaction amount and the capital freezing time information of the controlled node; calculate the target node's returnable amount based on the level, capital ratio, capital freezing time information and occurrence time information.

[0036] In a second aspect, a device for analyzing capital flow data is provided, the device comprising:

[0037] Data acquisition module, used to obtain capital flow data of risk accounts;

[0038] A graph construction module is used to generate a fund flow mind map based on fund flow data. The fund flow mind map is constructed using trading accounts as nodes and fund transaction flows as edges.

[0039] A node identification module is used to identify a target node from the capital flow mind map, and using the target node as a starting point, determine at least one level of associated nodes associated with the target node; wherein the target node is a node corresponding to a designated account among multiple transaction accounts that have a transaction association relationship with the risk account;

[0040] A node screening module is used to screen target associated nodes from multiple associated nodes according to the importance of each associated node at each level;

[0041] The node control module is used to initiate the automated tracking and analysis process of the capital flow of the trading account corresponding to the target associated node.

[0042] A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the fund flow data analysis of any one or more embodiments of the first aspect described above is implemented.

[0043] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the fund flow data analysis of any one or more embodiments of the first aspect described above.

[0044] The aforementioned fund flow data analysis method, apparatus, computer equipment, and storage medium generate a fund flow mind map based on the collected fund flow data of the risk account, and use the victim account that has a transaction association relationship with the risk account as the target node. The method identifies at least one level of associated nodes associated with the target node, and selects the target associated node from multiple associated nodes based on the importance of each associated node at each level. After determining the target associated node, the method promptly initiates the automated tracking and analysis process for the fund flow of the transaction account corresponding to the target associated node. This solution improves the efficiency and accuracy of fund flow data analysis and reduces errors and omissions in manual operations. Furthermore, based on the results of the automated analysis, the automated tracking and analysis process can be initiated promptly and accurately, thereby ensuring fund security and preventing the occurrence of financial risk activities. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 A diagram of an application environment of a capital flow data analysis method in some embodiments;

[0046] Figure 2 A flowchart of a method for analyzing capital flow data in some embodiments;

[0047] Figure 3 The following is a flowchart of the data analysis method of capital flow in some application examples;

[0048] Figure 4 is a structural block diagram of a fund flow data analysis device in some embodiments;

[0049] Figure 5 1 is a diagram of the internal structure of a computer device in some embodiments. DETAILED DESCRIPTION

[0050] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0051] The capital flow data analysis method provided in this application can be applied to Figure 1In the application environment shown, the terminal 102 communicates with the server 104 via the network.

[0052] Specifically, the user can submit case information based on the terminal 102, wherein the case information may include case number, name and other information, and the server 104 collects the capital flow data of the risk account from the police integrated system and the financial integrated system based on the RPA robot according to the case information; generates a capital flow mind map according to the capital flow data; wherein, the capital flow mind map is constructed with transaction accounts as nodes and capital transaction flows as edges; identifies the target node from the capital flow mind map, takes the target node as the starting point, and determines at least one level of associated nodes that have an associated relationship with the target node; wherein the target node is the node corresponding to the designated account in multiple transaction accounts that have a transaction associated relationship with the risk account; screens the target associated node from the multiple associated nodes according to the importance of each associated node at each level; and starts the automated tracking and analysis process of the capital flow of the transaction account corresponding to the target associated node.

[0053] The terminal 102 may be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, and portable wearable devices, and the server 104 may be implemented as an independent server or a server cluster consisting of multiple servers.

[0054] In some embodiments, as Figure 2 As shown, a method for analyzing capital flow data is provided, which is applied to Figure 1 The following steps are used as an example to illustrate the server in the example:

[0055] Step S202: Obtain the fund flow data of the risk account.

[0056] Among them, risk accounts refer to accounts involved in the case identified based on the case information provided by the user and the automatic extraction of police information from the corresponding integrated police system based on the case number.

[0057] Specifically, based on the risk account information, the corresponding fund flow data of the risk account can be obtained from a pre-built fund flow data database. The fund flow data is data representing the transaction relationship involved in the fund transaction activities between the risk account and the transaction object.

[0058] Step S204: generating a fund flow mind map based on the fund flow data; wherein the fund flow mind map is constructed with transaction accounts as nodes and fund transaction flows as edges.

[0059] Specifically, based on a mind map generation engine, mind map construction principles, and visualization effects, pre-processed, formatted fund flow data can be converted into a graphical fund flow mind map for fund tracking analysis and displayed. Each node in the fund flow mind map represents the transaction subject, i.e., the transaction account, of each transaction, and the edges between nodes can represent the flow of funds. For example, different node colors can be set to reflect the size of the transaction amount and the level of risk. Alternatively, the thickness of the relationship line (edge) can be set to represent the size of the transaction amount or the frequency of the transaction, etc., thereby allowing users to easily grasp the overall picture of fund flows.

[0060] Step S206: Identify a target node from the capital flow mind map, and use the target node as a starting point to determine at least one level of associated nodes that have an associated relationship with the target node; wherein the target node is a node corresponding to a designated account among multiple transaction accounts that have a transaction associated relationship with the risk account.

[0061] In this step, the account corresponding to the target node is a designated account among multiple transaction accounts that have a transactional relationship with the risk account. For example, this could be the victim's account identified based on the case information submitted by the terminal. Using the target node as the starting point, visual relationship lines can be used to trace the first-level associated nodes that have a transactional relationship with the target node. Based on the first-level associated nodes, the second-level associated nodes associated with the first-level associated nodes can be traced, and so on. This allows the identification of multiple levels of associated nodes associated with the target node.

[0062] Step S208: Filtering target associated nodes from the plurality of associated nodes according to the importance of each associated node at each level.

[0063] In this step, the associated nodes at each level can be ranked according to their importance, and the target associated nodes can be selected based on the ranking results. For example, the importance of the associated nodes relative to the target node can be determined by tracking the proportion of transfer amounts to accounts corresponding to the target node within the associated nodes, or by tracking the closeness of the association relationship or transaction frequency between the associated nodes and the target node, or by analyzing the feature tags of each associated node.

[0064] Step S210: Initiate an automated tracking and analysis process for the fund flow of the transaction account corresponding to the target associated node.

[0065] In this step, after identifying a target associated node that may have transaction risks, its corresponding transaction account is determined based on the target associated node, and an automated tracking and analysis process of the capital flow of the transaction account corresponding to the target associated node is initiated.

[0066] Exemplarily, after the automated tracking and analysis process is initiated, when a transaction is detected between a target node and a target-associated node, the transaction amount is limited or a payment stop operation is implemented.

[0067] Exemplarily, an automated tracking and analysis process of the fund flow of the transaction account corresponding to the target associated node is initiated, including: through docking with the RPA robot, automated stop payment operations, freezable fund account recommendation processing, account freezing processing, and refundable amount calculation, etc.

[0068] The aforementioned fund flow data analysis method generates a fund flow mind map based on the collected fund flow data of risk accounts. It uses the victim account with a transactional association relationship with the risk account as the target node, identifies at least one level of associated nodes associated with the target node, and selects the target associated node from multiple associated nodes based on the importance of each associated node at each level. Once the target associated node is identified, the automated tracking and analysis process for the transaction account corresponding to the target associated node is promptly initiated. This approach improves the efficiency and accuracy of fund flow data analysis and reduces errors and omissions in manual operations. Furthermore, based on the results of the automated analysis, the automated tracking and analysis process can be initiated promptly and accurately, thereby ensuring fund security and preventing the occurrence of financial risk activities.

[0069] In some implementations, obtaining fund flow data for risk accounts includes: monitoring risk accounts through software robots, collecting fund flow data and subject information data of risk accounts within a preset time period; performing standardized data cleaning processing on the fund flow data according to fund flow record standards, and performing standardized data cleaning processing on the subject information data according to subject information format standards; generating fund flow data corresponding to the risk account based on the fund flow data and subject information data after standardized data cleaning processing.

[0070] In this embodiment, based on the case information submitted by the user based on the terminal, the police information and risk accounts can be automatically extracted from the corresponding police integrated platform based on the case number, and the historical transaction flow records of the risk accounts can be obtained.

[0071] Furthermore, RPA (Robotic Process Automation) technology can be used to perform unattended automatic collection of risk accounts and their historical transaction flow records within a preset time (for example, 7*24 hours), thereby collecting the risk account's capital flow data, subject information data, etc.

[0072] Furthermore, the collected cash flow data, subject information data, etc. can be subjected to standardized data cleaning processing. For example, the standardized data cleaning processing can focus on field format requirements, content specifications, data noise reduction, data deduplication, etc.

[0073] Exemplarily, the fund flow record standard is to perform standardized data cleaning processing according to the following field format: transaction flow number, transaction flow institution type, transaction type, transaction payment type, transaction entry and exit identifier, transaction time, transaction currency, transaction amount, transaction balance, transaction result, transaction cash mark, transaction purpose, transaction voucher type, transaction voucher number, transaction order number, bank external channel transaction flow number, account type, account number, account name, account number corresponding to the bank card number, account number corresponding to the bank institution code, account number corresponding to the bank name, counterparty account type, counterparty account number, counterparty account name, counterparty account number corresponding to the bank card number, counterparty account number corresponding to the bank institution code, counterparty account corresponding to the bank name, counterparty ID number, counterparty merchant number, transaction location, transaction location longitude, transaction location latitude, transaction location branch code, transaction location branch name, transaction location IP (Intellectual property, International Interconnection Protocol) address, transaction terminal type, transaction terminal number, transaction terminal name, transaction terminal MAC (Media Access Control) Address, media access control address), transaction teller number, remarks, etc.

[0074] Exemplarily, the subject information standard is to perform standardized data cleaning processing according to the following field format: account opening name, ID number, telephone number, account opening time, account opening branch, account status, account type, account opening bank, account balance, last transaction time, etc.

[0075] Furthermore, after the collected data is pre-processed by standardized data cleaning and other data pre-processing, the funds flow data corresponding to the risk account is obtained. A funds flow thematic database can be constructed based on the processed funds flow data of multiple risk accounts. When funds flow data is needed, the server can directly extract the funds flow data of the corresponding risk account from the funds flow thematic database.

[0076] In this embodiment, the risk account is automatically identified through the case information submitted by the terminal, and the risk account is monitored by a software robot to collect the capital flow data and subject information data of the risk account within a preset time period, and the capital flow data of the risk account that meets the formatting standards is obtained through data preprocessing. By adopting this embodiment, data that fully reflects the transaction status of the risk account can be accurately and efficiently obtained and can adapt to the format requirements of the mind mapping engine.

[0077] In some embodiments, transaction flow records of transaction accounts corresponding to each associated node are collected; feature information of each associated node is extracted from each transaction flow record; feature rendering is performed on the feature information of each associated node to generate feature tags corresponding to each associated node; the abnormality of each associated node is determined based on each feature tag; and associated nodes whose capital ratio is greater than a preset threshold and whose abnormality is greater than the preset threshold are determined as target associated nodes.

[0078] In this embodiment, feature rendering can also be used to generate feature tags for each associated node at each level. The feature tags can reflect characteristic information related to the transaction behavior of the transaction account corresponding to each associated node. The characteristic information may include whether it is a core account, whether there is ATM transaction, whether there is large-amount transfer, whether it is offline daily consumption, whether it is a fast-in-fast-out transaction, whether it is a test account, etc. The feature tags corresponding to each associated node can be used to comprehensively analyze the abnormality of each associated node based on the characteristic information in the feature tags. In combination with the proportion of funds contained in the transaction amount of the account corresponding to the target node, the importance of each associated node can be more accurately determined.

[0079] In some embodiments, the method further includes: prioritizing each target-associated node according to the size of the capital ratio and the degree of abnormality; marking target-associated nodes with a priority greater than a preset threshold with a key to-be-verified label, marking other target-associated nodes with a general to-be-verified label, and marking other associated nodes that do not belong to the target-associated node with a general to-be-verified label and a not recommended verification label.

[0080] In this embodiment, the importance of each associated node can be used to classify associated nodes of different importance, and corresponding labels representing the degree of charge of associated nodes of different categories can be marked. Furthermore, associated nodes of different importance can be displayed in different colors or shapes, so that users can understand the risk status of each node more clearly.

[0081] In some embodiments, the method also includes: monitoring the status of each node in the capital flow mind map; in response to monitoring that the terminal submits case information, marking the node corresponding to the victim account in the case information with a victim label according to the case information; in response to monitoring that the target associated node has been investigated, marking the target associated node with a verified label; in response to monitoring that the target associated node is under investigation, marking the target associated node with a verifying label.

[0082] In this embodiment, the status of each node in the fund flow mind map can also be monitored in real time and dynamically, and the victim account can be dynamically identified based on the case information submitted by the terminal user and used as the target node for subsequent processing. In addition, the verification status label of each associated node can be dynamically changed based on the monitoring of the investigation status of each associated node, thereby being able to more accurately and intuitively reflect the fund flow status between each node.

[0083] For example, nodes in different verification states may also be displayed in different colors or shapes and in reverse order for a clearer and more intuitive presentation.

[0084] In some embodiments, the method further includes: determining a controlled node that is successfully controlled from the target associated nodes; determining the level of the controlled node relative to the target node; obtaining the proportion of funds in the controlled node that includes the transaction amount of the target node; obtaining the occurrence time information of the transaction amount of the target node; and calculating the returnable amount of the target node based on the level, funds proportion and occurrence time information.

[0085] In this embodiment, after enabling the transaction behavior control process for target-associated nodes that may be at risk, the refundable amount can be further automatically calculated based on the successfully controlled nodes. By analyzing the level of the controlled nodes relative to the target nodes, and the amount of transactions involving the target nodes, and combining the time information of the transaction, etc., the refundable amount can be calculated quickly and accurately. In particular, when there are multiple target nodes, the risky target-associated nodes corresponding to the multiple target nodes may overlap. Through this embodiment, the corresponding refundable amounts can be efficiently calculated for different target nodes.

[0086] In some embodiments, the method further includes: integrating the analysis results based on the determined target associated nodes, automatically generating a report containing detailed exception descriptions, transaction account information corresponding to the target associated nodes, and a recommended action plan, and pushing the report to the terminal devices of relevant departments through various channels such as email and text messages, thereby accelerating the subsequent processing process.

[0087] In some embodiments, the method also includes: the system automatically identifies the nodes corresponding to abnormal capital flows based on the generated capital flow mind map according to preset rules and algorithms, thereby determining the abnormal accounts corresponding to the nodes, abnormal capital flows including large-scale capital transfers, frequent transactions, etc., and generates an abnormal capital flow report.

[0088] Below, combined with an application example, the capital flow data analysis method involved in this application is described in detail. Figure 3 As shown, this application integrates RPA robot technology with visual mind mapping technology, specifically including the following:

[0089] 1. Data collection and preprocessing to build a special database on capital flow.

[0090] (1) Receive case information submitted by the user terminal, where the case information includes case number, name and other information. The server automatically extracts police information, risk account information and obtains transaction flow records of risk accounts based on the case number and the corresponding police integrated platform.

[0091] (2) Through RPA robots, risk account cash flow data, subject information data, etc. are automatically collected 24 / 7 based on risk accounts and transaction flow records of risk accounts.

[0092] (3) In accordance with the cash flow record standards and the main information format standards, focus on field format requirements, content specifications, data noise reduction, data deduplication and other standardized data cleaning processes.

[0093] (4) Construct a special database on fund flow based on the processed fund flow data.

[0094] 2. Construct a mind-mapping-based fund tracking analysis generation engine: Based on the principles of mind mapping and visual structure effects, the processed fund flow data is converted into a graphical structure and displayed. Each node represents the subject of a transaction, that is, the trading account. The "edges" (relationship lines) between nodes are used to represent the flow of funds between trading accounts. The node color can reflect the transaction amount and risk level, allowing users to grasp the overall picture of fund flows at a glance.

[0095] (1) The node corresponding to the victim's account is used as the target node, and the target node is used as the starting point to identify the node of the suspected first-level account associated with the target node through the visual relationship line. The node is used as the first-level associated node, and the secondary associated node is tracked based on the first-level associated node. The tracking level data can be preset, and by analogy, the associated nodes of each level that meet the preset level can be obtained. The size of the transfer amount is presented by the thickness of the relationship line, and the details of the transaction flow record are displayed by the description label corresponding to the relationship line.

[0096] (2) By tracking the importance of the associated nodes at each level, different colors are used to classify them according to their importance, including key nodes to be verified, ordinary nodes to be verified, and nodes not recommended for verification. Furthermore, they can be classified according to their current status, including victims, nodes under verification, and nodes verified.

[0097] (3) Construct display modes such as bird's-eye view, adaptive scaling, drag interaction, capital flow map, details / overview, etc.

[0098] (4) Generate and render the feature labels of the associated nodes at each level, and extract the feature information of the associated nodes by comprehensively analyzing the transaction flow of the associated nodes. The feature information may include: core accounts, ATM transactions, large-amount transfers, offline life consumption, fast in and out, test accounts, etc.

[0099] 3. Based on the analysis and tracking results based on the mind map, the RPA robot is called to implement automated control processes such as fund flow control, fund suspension, frozen account recommendation, and refundable amount calculation.

[0100] (1) Combined with the proportion of the victim's amount in the associated node and the relationship level of the associated node, the RPA robot can realize the automated payment stop work.

[0101] (2) Combined with the amount transferred into the associated node, including the victim's amount, the relationship level of the associated node, etc., the RPA robot is connected to recommend the transaction account that can be frozen.

[0102] (3) Using the complex network analysis method based on mind mapping, a model for calculating the refundable amount is constructed. By identifying the characteristic parameters corresponding to the abnormal associated nodes (the target associated nodes that have been successfully controlled) as the input of the model, the model comprehensively considers multiple dimensions such as the level of the abnormal associated nodes relative to the target nodes, the proportion of funds in the transaction amount including the target nodes, the time information of fund freezing, and the time information of the occurrence of related transactions with the target nodes, so as to calculate the amount that can be traced and frozen by the abnormal associated nodes as the refundable amount, optimize the return strategy, and reduce unnecessary financial losses.

[0103] 4. Based on the identified target association nodes, the analysis results are integrated to automatically generate a report containing detailed exception descriptions, transaction account information corresponding to the target association nodes, and recommended action plans. This report is then pushed to the terminal devices of relevant departments via multiple channels such as email and SMS, thereby accelerating the subsequent processing process.

[0104] 5. Based on the preset rules and algorithms and the generated fund flow mind map, the server automatically monitors and identifies the nodes corresponding to abnormal fund flows, thereby determining the abnormal accounts corresponding to the nodes. Abnormal fund flows include large-scale fund transfers, frequent transactions, etc., and generates an abnormal fund flow report.

[0105] It should be understood that although Figures 2 to 3 The steps in the flowchart are shown in sequence as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified in this document, there is no strict order restriction for the execution of these steps, and these steps can be executed in other orders. In addition, Figures 2 to 3 At least part of the steps may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily executed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least part of the sub-steps or stages of other steps.

[0106] In some embodiments, as Figure 4 As shown, a device for analyzing capital flow data is provided, comprising: a data acquisition module 410, a graph construction module 420, a node identification module 430, a node screening module 440, and a node checking and controlling module 450, wherein:

[0107] Data acquisition module 410, used to obtain fund flow data of risk accounts;

[0108] A graph construction module 420 is configured to generate a fund flow mind map based on the fund flow data; wherein the fund flow mind map is constructed using transaction accounts as nodes and fund transaction flows as edges;

[0109] The node identification module 430 is configured to identify a target node from the capital flow mind map, and using the target node as a starting point, determine at least one level of associated nodes associated with the target node; wherein the target node is a node corresponding to a designated account among multiple transaction accounts that have a transaction association relationship with the risk account;

[0110] The node screening module 440 is used to screen a target associated node from a plurality of associated nodes according to the importance of each associated node at each level;

[0111] The node checking and controlling module 450 is used to start the automatic tracking and analysis process of the fund flow of the transaction account corresponding to the target associated node.

[0112] In some embodiments, the data acquisition module 410 monitors risk accounts through a software robot, collects the cash flow data and subject information data of the risk accounts within a preset time period; performs standardized data cleaning processing on the cash flow data according to the cash flow record standard, and performs standardized data cleaning processing on the subject information data according to the subject information format standard; generates capital flow data corresponding to the risk account based on the cash flow data and subject information data after standardized data cleaning processing.

[0113] In some embodiments, the node screening module 440 determines the capital ratio of the transaction amount of each associated node including the target node, and determines the associated node with a capital ratio greater than a preset threshold as the target associated node.

[0114] In some embodiments, the node screening module 440 collects transaction flow records of transaction accounts corresponding to each associated node; extracts feature information of each associated node from each transaction flow record; performs feature rendering on the feature information of each associated node to generate feature tags corresponding to each associated node; determines the abnormality of each associated node based on each feature tag; and determines the associated node whose capital ratio is greater than a preset threshold and whose abnormality is greater than the preset threshold as a target associated node.

[0115] In some embodiments, the node screening module 440 is also used to prioritize each target-related node according to the size of the capital ratio and the degree of abnormality; target-related nodes with a priority greater than a preset threshold are marked with a key to be verified label, other target-related nodes are marked with a general to be verified label, and other related nodes that do not belong to the target-related nodes are marked with a general to be verified label not recommended for verification label.

[0116] In some embodiments, the node screening module 440 is also used to monitor the status of each node in the capital flow mind map; in response to monitoring the terminal submitting case information, the node corresponding to the victim account in the case information is marked with a victim label according to the case information; in response to monitoring that the target associated node has been investigated, the target associated node is marked with a verified label; in response to monitoring that the target associated node is under investigation, the target associated node is marked with a verifying label.

[0117] In some embodiments, the node check and control module 450 is used to determine the controlled node that is successfully controlled from the target associated nodes; determine the level of the controlled node relative to the target node; obtain the proportion of funds in the controlled node that includes the transaction amount of the target node; obtain the occurrence time information of the transaction amount of the target node and the fund freezing time information of the controlled node; calculate the returnable amount of the target node based on the level, fund proportion, fund freezing time information and occurrence time information.

[0118] The specific definition of the fund flow data analysis device can be found in the definition of the fund flow data analysis method above and will not be repeated here. Each module in the aforementioned fund flow data analysis device can be implemented in whole or in part through software, hardware, or a combination thereof. Each of the aforementioned modules can be embedded in or independent of a processor in a computer device in hardware form, or can be stored in a computer device memory in software form, so that the processor can call and execute the corresponding operations of each module.

[0119] In some embodiments, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 4 As shown. The computer device includes a processor, memory, a network interface, and a database connected via a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operation of the operating system and computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external terminal via a network connection. When executed by the processor, the computer program implements a method for analyzing capital flow data.

[0120] In some embodiments, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as follows: Figure 5 As shown. The computer device includes a processor, memory, network interface, display screen and input device connected via a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, a method for analyzing capital flow data is implemented. The display screen of the computer device can be a liquid crystal display or an electronic ink display screen. The input device of the computer device can be a touch layer covering the display screen, or a key, trackball or touchpad provided on the computer device housing, or an external keyboard, touchpad or mouse.

[0121] Those skilled in the art will understand that Figure 5 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0122] In some embodiments, a computer device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the following steps when executing the computer program: obtaining capital flow data of a risk account; generating a capital flow mind map based on the capital flow data; wherein the capital flow mind map is constructed with trading accounts as nodes and capital transaction flows as edges; identifying a target node from the capital flow mind map, and determining at least one level of associated nodes having an associated relationship with the target node with the target node as a starting point; wherein the target node is a node corresponding to a designated account among a plurality of trading accounts having a transaction associated relationship with the risk account; screening a target associated node from a plurality of associated nodes based on the importance of each associated node at each level; and initiating an automated tracking and analysis process for the capital flow of the trading account corresponding to the target associated node.

[0123] In some embodiments, when the processor executes the computer program, it also implements the following steps: monitoring the risk account through a software robot, collecting the cash flow data and subject information data of the risk account within a preset time period; performing standardized data cleaning processing on the cash flow data according to the cash flow record standard, and performing standardized data cleaning processing on the subject information data according to the subject information format standard; generating the cash flow direction data corresponding to the risk account based on the cash flow data and subject information data after the standardized data cleaning processing.

[0124] In some embodiments, when the processor executes the computer program, it further implements the following steps: determining the capital proportion of the transaction amount of each associated node that includes the target node, and determining the associated node with a capital proportion greater than a preset threshold as the target associated node.

[0125] In some embodiments, when the processor executes the computer program, it also implements the following steps: collecting transaction flow records of the transaction accounts corresponding to each associated node; extracting feature information of each associated node from each transaction flow record; performing feature rendering on the feature information of each associated node to generate feature tags corresponding to each associated node; determining the abnormality of each associated node based on each feature tag; and determining the associated node whose capital ratio is greater than a preset threshold and whose abnormality is greater than the preset threshold as a target associated node.

[0126] In some embodiments, when the processor executes the computer program, it also implements the following steps: prioritizing each target-associated node according to the size of the capital ratio and the degree of abnormality; marking the target-associated nodes with a priority greater than a preset threshold with a key to be verified label, marking other target-associated nodes with a general to be verified label, and marking other associated nodes that do not belong to the target-associated node with a general to be verified label and a not recommended verification label.

[0127] In some embodiments, when the processor executes the computer program, it also implements the following steps: monitoring the status of each node in the capital flow mind map; in response to monitoring the terminal submitting case information, marking the node corresponding to the victim account in the case information with a victim label according to the case information; in response to monitoring that the target associated node has been investigated, marking the target associated node with a verified label; in response to monitoring that the target associated node is under investigation, marking the target associated node with a verifying label.

[0128] In some embodiments, when the processor executes the computer program, it also implements the following steps: determining the controlled node that is successfully controlled from the target associated nodes; determining the level of the controlled node relative to the target node; obtaining the proportion of funds in the controlled node that includes the transaction amount of the target node; obtaining the occurrence time information of the transaction amount of the target node and the fund freezing time information of the controlled node; and calculating the returnable amount of the target node based on the level, fund proportion, fund freezing time information and occurrence time information.

[0129] In some embodiments, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented: obtaining capital flow data of a risk account; generating a capital flow mind map based on the capital flow data; wherein the capital flow mind map is constructed with trading accounts as nodes and capital transaction flows as edges; identifying a target node from the capital flow mind map, and determining at least one level of associated nodes that have an associated relationship with the target node with the target node as a starting point; wherein the target node is a node corresponding to a designated account in multiple trading accounts that have a transaction associated relationship with the risk account; screening a target associated node from multiple associated nodes based on the importance of each associated node at each level; and initiating an automated tracking and analysis process for the capital flow of the trading account corresponding to the target associated node.

[0130] In some embodiments, when the computer program is executed by the processor, the following steps are also implemented: monitoring the risk account through a software robot, collecting the cash flow data and subject information data of the risk account within a preset time period; performing standardized data cleaning processing on the cash flow data according to the cash flow record standard, and performing standardized data cleaning processing on the subject information data according to the subject information format standard; generating the cash flow data corresponding to the risk account based on the cash flow data and subject information data after standardized data cleaning processing.

[0131] In some embodiments, when the computer program is executed by the processor, the following steps are further implemented: determining the capital proportion of the transaction amount of each associated node that includes the target node, and determining the associated node with a capital proportion greater than a preset threshold as the target associated node.

[0132] In some embodiments, when the computer program is executed by the processor, the following steps are also implemented: collecting transaction flow records of the transaction accounts corresponding to each associated node; extracting feature information of each associated node from each transaction flow record; performing feature rendering on the feature information of each associated node to generate feature tags corresponding to each associated node; determining the abnormality of each associated node based on each feature tag; and determining the associated node whose capital ratio is greater than a preset threshold and whose abnormality is greater than the preset threshold as a target associated node.

[0133] In some embodiments, when the computer program is executed by the processor, the following steps are also implemented: priority is sorted among the target associated nodes according to the size of the capital ratio and the degree of abnormality; target associated nodes with a priority greater than a preset threshold are marked with a key to be verified label, other target associated nodes are marked with a general to be verified label, and other associated nodes that do not belong to the target associated nodes are marked with a general to be verified label and a not recommended verification label.

[0134] In some embodiments, when the computer program is executed by the processor, the following steps are also implemented: monitoring the status of each node in the capital flow mind map; in response to monitoring the terminal submitting case information, marking the node corresponding to the victim account in the case information with a victim label according to the case information; in response to monitoring that the target associated node has been investigated, marking the target associated node with a verified label; in response to monitoring that the target associated node is under investigation, marking the target associated node with a verifying label.

[0135] In some embodiments, when the computer program is executed by the processor, the following steps are also implemented: determining the controlled node that is successfully controlled from the target associated nodes; determining the level of the controlled node relative to the target node; obtaining the proportion of funds in the controlled node that includes the transaction amount of the target node; obtaining the occurrence time information of the transaction amount of the target node and the fund freezing time information of the controlled node; and calculating the returnable amount of the target node based on the level, fund proportion, fund freezing time information and occurrence time information.

[0136] Those skilled in the art will appreciate that all or part of the processes in the methods for implementing the above embodiments can be accomplished by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0137] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0138] In addition, the term "and / or" in this article simply describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can mean: A exists alone, A and B exist simultaneously, and B exists alone. In addition, the characters in this article generally indicate that the related objects are in an "or" relationship.

[0139] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that a person skilled in the art could make various modifications and improvements without departing from the spirit of the present application, all of which fall within the scope of protection of the present application. Therefore, the scope of protection of the present patent application shall be determined by the appended claims.

[0140] It should be noted that in the embodiments of the present application, the data collection and other related operations involved and the collected related data need to be authorized and agreed by the user or the relevant platform system before they can be obtained and processed. When the embodiments of the present application are applied to specific products or technologies, it is necessary to obtain the permission or consent of the user or the relevant platform system, and the collection, use and processing of relevant data need to comply with the relevant laws, regulations and standards of the relevant countries and regions.

Claims

1. A method for analyzing capital flow data, the method comprising: Obtain fund flow data of risk accounts; Generate a fund flow mind map based on the fund flow data; wherein the fund flow mind map is constructed with transaction accounts as nodes and fund transaction flows as edges; Identify a target node from the capital flow mind map, and determine at least one level of associated nodes that have an associated relationship with the target node, taking the target node as a starting point; wherein the target node is a node corresponding to a designated account among a plurality of transaction accounts that have a transaction associated relationship with the risk account; Selecting a target associated node from the plurality of associated nodes according to the importance of each associated node at each level; Initiate an automated tracking and analysis process of the fund flow of the transaction account corresponding to the target associated node.

2. The method according to claim 1, characterized in that The obtaining of fund flow data of risk accounts includes: The risk account is monitored by a software robot, and the fund flow data and subject information data of the risk account within a preset time period are collected; Performing standardized data cleaning processing on the fund flow data in accordance with the fund flow record standard, and performing standardized data cleaning processing on the subject information data in accordance with the subject information format standard; The fund flow data corresponding to the risk account is generated based on the fund flow data and the subject information data after the standardized data cleaning process.

3. The method according to claim 1, characterized in that The step of selecting a target associated node from the plurality of associated nodes according to the importance of each associated node at each level includes: The capital ratio of the transaction amount of the target node in each of the associated nodes is determined, and the associated node whose capital ratio is greater than a preset threshold is determined as the target associated node.

4. The method according to claim 3, characterized in that The step of selecting a target associated node from the plurality of associated nodes according to the importance of each associated node at each level includes: Collecting transaction flow records of transaction accounts corresponding to each of the associated nodes; Extracting characteristic information of each of the associated nodes from each of the transaction flow records; Performing feature rendering on the feature information of each of the associated nodes to generate a feature label corresponding to each of the associated nodes; Determine the abnormality of each associated node according to each of the feature tags; The associated node whose fund ratio is greater than a preset threshold and whose abnormality is greater than a preset threshold is determined as the target associated node.

5. The method according to claim 4, characterized in that The method further comprises: Prioritize each of the target associated nodes according to the size of the fund ratio and the level of the abnormality; The target associated nodes with a priority greater than a preset threshold are marked with a key pending verification label, the other target associated nodes are marked with a common pending verification label, and the other associated nodes that are not target associated nodes are marked with a common pending verification label and a not recommended verification label.

6. The method according to claim 5, characterized in that The method further comprises: Monitor the status of each node in the capital flow mind map; In response to monitoring that the terminal submits case information, marking a victim label for a node corresponding to a victim account in the case information according to the case information; In response to monitoring that the target associated node has been investigated, marking the target associated node with a verified label; In response to monitoring that the target-related node is under investigation, the target-related node is marked with a "under investigation" tag.

7. The method according to claim 1, characterized in that The method further comprises: Determining a controlled node that is successfully controlled from the target associated nodes; Determining the level of the controlled node relative to the target node; Obtaining the proportion of funds in the controlled nodes that include the transaction amount of the target node; The occurrence time information of the transaction amount of the target node and the fund freezing time information of the controlled node are obtained; and the returnable amount of the target node is calculated according to the level, the fund ratio, the fund freezing time information and the occurrence time information.

8. A fund flow data analysis device, characterized in that: The device comprises: Data acquisition module, used to obtain fund flow data of risk accounts; A graph construction module, used to generate a fund flow mind map according to the fund flow data; wherein the fund flow mind map is constructed with transaction accounts as nodes and fund transaction flows as edges; A node identification module, used to identify a target node from the capital flow mind map, and determine at least one level of associated nodes that have an associated relationship with the target node, taking the target node as a starting point; wherein the target node is a node corresponding to a designated account among a plurality of transaction accounts that have a transaction associated relationship with the risk account; A node screening module, used for screening a target associated node from a plurality of associated nodes according to the importance of each associated node at each level; The node checking and controlling module is used to start the automatic tracking and analysis process of the fund flow of the transaction account corresponding to the target associated node.

9. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images