Account anomaly identification method and device, electronic equipment and storage medium

Abstract

The invention provides an account anomaly identification method and device, electronic equipment and a storage medium, and the method comprises the steps: extracting account features from transaction data of a plurality of to-be-identified accounts, and constructing transaction flow data among the plurality of to-be-identified accounts according to the transaction data of the plurality of to-be-identified accounts; according to the transaction flow data, an initial transaction graph corresponding to the multiple accounts to be identified is constructed, the initial transaction graph comprises nodes and edges, the nodes correspond to the accounts to be identified, and the edges correspond to transaction behavior data between the nodes; carrying out edge classification on the initial transaction graph according to the account characteristics of each to-be-identified account to obtain an edge classification result; performing edge filtering on the initial transaction graph according to the edge classification result to obtain a target transaction graph; and according to a set edge weight distribution mechanism and a set atlas identification algorithm, performing anomaly identification on nodes in the target transaction atlas to obtain an anomaly identification result.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method, device, electronic device and storage medium for identifying abnormalities in an account. Background Art

[0002] Internet finance provides people with a convenient payment environment. At the same time, some participants in illegal activities also use the convenience of Internet finance to conduct illegal transactions. Therefore, how to effectively identify the relevant participants (or risky users) of illegal activities has become an urgent problem to be solved. Summary of the invention

[0003] Embodiments of the present application provide a method, device, electronic device, and storage medium for identifying anomalies in an account.

[0004] According to the first aspect of the present application, a method for identifying anomalies of an account is provided, the method comprising: extracting account features from transaction data of multiple accounts to be identified, and constructing transaction flow data between multiple accounts to be identified based on the transaction data of the multiple accounts to be identified; constructing an initial transaction graph corresponding to the multiple accounts to be identified based on the transaction flow data, the initial transaction graph comprising nodes and edges, the nodes corresponding to the accounts to be identified, and the edges corresponding to the transaction behavior data between the nodes; performing edge classification on the initial transaction graph according to the account features of each account to be identified to obtain an edge classification result; performing edge filtering on the initial transaction graph according to the edge classification result to obtain a target transaction graph; performing anomaly identification on the nodes in the target transaction graph according to a set edge weight distribution mechanism and a set graph recognition algorithm to obtain anomaly identification results.

[0005] According to one embodiment of the present application, account features are extracted from transaction data of multiple accounts to be identified, and transaction flow data between multiple accounts to be identified are constructed based on the transaction data of the multiple accounts to be identified, including: extracting account features of each account to be identified from the transaction data of each account to be identified; determining the transaction type, transaction counterparty and transaction behavior data of each transaction of each account to be identified based on the transaction data of each account to be identified, wherein the transaction type includes outgoing and incoming transactions; and associating the transaction data of multiple accounts to be identified based on the transaction type, transaction counterparty and transaction behavior data of each transaction of each account to be identified to obtain the transaction flow data between the multiple accounts to be identified.

[0006] According to one embodiment of the present application, the edge classification result includes the edge type of each edge in the initial transaction graph; accordingly, the initial transaction graph is edge classified according to the account characteristics of each account to be identified to obtain the edge classification result, including: obtaining the account characteristics of two accounts to be identified corresponding to two nodes of each edge of the initial transaction graph and the transaction behavior data between the two accounts to be identified; determining the edge type of each edge in the initial transaction graph according to the account characteristics of the two accounts to be identified corresponding to each edge in the initial transaction graph and the transaction behavior data between the two accounts to be identified.

[0007] According to one embodiment of the present application, the edge type of each edge in the initial transaction graph is determined based on the account characteristics of two accounts to be identified corresponding to each edge in the initial transaction graph and the transaction behavior data between the two accounts to be identified, including: obtaining an edge classification model, the edge classification model is trained using the following operations: obtaining training data, the training data including multiple training graphs with edge labels; training the edge classification model based on the training data; inputting the account characteristics of two accounts to be identified corresponding to each edge in the initial transaction graph and the transaction behavior data between the two accounts to be identified into the edge classification model to obtain the edge type of each edge, the edge types including high risk, medium risk, low risk and no risk.

[0008] According to one implementation of the present application, the initial transaction graph is edge filtered according to the edge classification result to obtain a target transaction graph, including: filtering the edges in the initial transaction graph that meet the set criteria, wherein the set criteria are that the edge type meets the risk-free criteria or the edge type meets the risk-free and low-risk criteria; filtering the nodes in which no edges exist in the filtered initial transaction graph to obtain the target transaction graph.

[0009] According to an embodiment of the present application, the edge weight allocation mechanism is to allocate a weight to each edge of the target transaction graph according to the edge classification result.

[0010] According to an implementation mode of the present application, the graph recognition algorithm is set to be a weighted label propagation algorithm, and the anomaly recognition result includes the account type of each account to be identified; accordingly, the nodes in the target transaction graph are identified for anomalies according to the set edge weight distribution mechanism and the set graph recognition algorithm to obtain anomaly recognition results, including: according to the set initialization label, the node label of each node in the target transaction graph is initialized, and a fixed label group and a gray label node group are obtained, the set initialization label includes a high-risk node black label and a risk-free node white label, and the fixed label group includes multiple nodes with fixed node labels; for nodes that do not belong to the fixed label group, the node label of each node is iterated according to the set edge weight distribution mechanism and the node labels of the neighboring nodes of each node to obtain an iterative result; according to the iterative result and the fixed label group, the account type of each account to be identified is determined; wherein, in the process of node label iteration, the nodes in the gray label node group are not used as neighbor nodes.

[0011] According to a second aspect of the present application, a device for identifying anomalies of an account is provided, and the device includes: a first construction module, which is used to extract account features from transaction data of multiple accounts to be identified, and construct transaction flow data between multiple accounts to be identified based on the transaction data of the multiple accounts to be identified; a second construction module, which is used to construct an initial transaction graph corresponding to the multiple accounts to be identified based on the transaction flow data, and the initial transaction graph includes nodes and edges, the nodes correspond to the accounts to be identified, and the edges correspond to the transaction behavior data between the nodes; a classification module, which is used to perform edge classification on the initial transaction graph according to the account features of each account to be identified, and obtain an edge classification result; a filtering module, which is used to perform edge filtering on the initial transaction graph according to the edge classification result, and obtain a target transaction graph; an identification module, which is used to perform anomaly identification on the nodes in the target transaction graph according to a set edge weight distribution mechanism and a set graph identification algorithm, and obtain an anomaly identification result.

[0012] According to a third aspect of the present application, an electronic device is provided, including: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method described in the present application.

[0013] According to a fourth aspect of the present application, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to enable the computer to execute the method described in the present application.

[0014] The method of the embodiment of the present application extracts account features from the transaction data of multiple accounts to be identified, and constructs transaction flow data between multiple accounts to be identified based on the transaction data of multiple accounts to be identified; constructs an initial transaction graph corresponding to the multiple accounts to be identified based on the transaction flow data, and the initial transaction graph includes nodes and edges, the nodes correspond to the accounts to be identified, and the edges correspond to the transaction behavior data between the nodes; performs edge classification on the initial transaction graph according to the account features of each account to be identified to obtain an edge classification result; performs edge filtering on the initial transaction graph according to the edge classification result to obtain a target transaction graph; performs abnormal identification on the nodes in the target transaction graph according to the set edge weight distribution mechanism and the set graph recognition algorithm to obtain an abnormal identification result. By constructing a transaction graph between accounts to be identified and performing abnormal identification based on the graph, effective abnormal identification of multiple accounts to be identified is achieved. At the same time, when performing abnormal identification of accounts to be identified based on the graph, it is also combined with the edge classification result of the transaction graph to further improve the accuracy of abnormal identification.

[0015] It should be understood that the teachings of the present application are not required to achieve all of the beneficial effects described above, but specific technical solutions can achieve specific technical effects, and other embodiments of the present application can also achieve beneficial effects not mentioned above. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] By reading the detailed description below with reference to the accompanying drawings, the above and other purposes, features and advantages of the exemplary embodiments of the present application will become readily understood. In the accompanying drawings, several embodiments of the present application are shown in an exemplary and non-limiting manner, wherein: In the drawings, the same or corresponding reference numerals represent the same or corresponding parts.

[0017] Figure 1 A schematic diagram of the implementation flow of the method for identifying abnormalities in an account provided in an embodiment of the present application is shown; Figure 2 A schematic diagram of the implementation flow of the edge classification operation of the account abnormality identification method provided in an embodiment of the present application is shown; Figure 3 A schematic diagram of the implementation flow of the edge type determination operation of the account abnormality identification method provided in an embodiment of the present application is shown; Figure 4 A schematic diagram of the implementation flow of an account type determination operation of the account abnormality identification method provided in an embodiment of the present application is shown; Figure 5 A schematic diagram of the structure of an abnormality identification device for an account provided in an embodiment of the present application is shown; Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0018] In order to make the purpose, features, and advantages of the present application more obvious and easy to understand, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present application.

[0019] Figure 1 A schematic diagram of the implementation flow of the method for identifying anomalies in an account provided in an embodiment of the present application is shown.

[0020] refer to Figure 1 , an embodiment of the present application provides a method for identifying abnormalities of an account, the method comprising: Operation 101 : extracting account features from transaction data of multiple accounts to be identified, and constructing transaction flow data between the multiple accounts to be identified based on the transaction data of the multiple accounts to be identified.

[0021] In one embodiment of the present application, account features are extracted from transaction data of multiple accounts to be identified, and transaction flow data between multiple accounts to be identified are constructed based on the transaction data of the multiple accounts to be identified, including: extracting account features of each account to be identified from the transaction data of each account to be identified; determining the transaction type, transaction counterparty and transaction behavior data of each transaction of each account to be identified based on the transaction data of each account to be identified, and the transaction type includes outgoing and incoming transactions; and associating the transaction data of multiple accounts to be identified based on the transaction type, transaction counterparty and transaction behavior data of each transaction of each account to be identified to obtain the transaction flow data between the multiple accounts to be identified.

[0022] The method of the embodiment of the present application can be applied to various systems or platforms with data processing capabilities. Preferably, in order to ensure high efficiency of identification during anomaly identification, the method of the embodiment of the present application is preferably applied to a Spark (Apache Spark, distributed computing) system, so as to rely on the distributed processing capabilities of the Spark system to improve the efficiency of data processing, thereby improving the efficiency of anomaly identification.

[0023] The transaction data of multiple accounts to be identified can be obtained by the system from the bank system. The transaction data includes the transaction records of each transaction of the account to be identified. In order to remove data irrelevant to abnormal identification in the transaction records, only the features useful for abnormal identification of the account to be identified can be extracted. Therefore, feature extraction can be performed on the transaction data of the account to be identified to obtain the account features of each account to be identified.

[0024] In one embodiment of the present application, the account characteristics include specific transaction characteristics of the account to be identified, such as account opening time (month), account opening time (day), number of trading days, activity rate within the statistical period, maximum daily trading hours, maximum trading hours, ratio of days to active days, number of fast-in and fast-out days, fast-in and fast-out ratio, cumulative number of transactions, cumulative number of deposits, cumulative number of withdrawals, number of deposits / number of withdrawals, average number of transactions per day, maximum number of transactions per day, maximum number of transactions per hour, maximum number of transfers per minute, number of transfers within a sensitive time period, number of small transactions, number of small transfers within a sensitive time period, average amount per transaction, maximum daily transaction amount, maximum daily transaction amount / average amount per transaction, average daily transaction amount, maximum daily cumulative transaction amount, maximum daily cumulative transaction amount / average daily transaction amount, transaction amount within a sensitive time period, cumulative transaction amount, cumulative deposit amount, cumulative withdrawal amount, deposit / outlet, number of counterparties, number of deposit counterparties, number of withdrawal counterparties, and maximum number of associated counterparties per day.

[0025] In one embodiment of the present application, account characteristics may also include relevant characteristics of the account itself, such as account, counterparty account, deposit and withdrawal mark, transaction amount, transaction time, time interval with the last transaction, number of transactions within one day, number of transactions within three days, number of transactions within one hour, account balance after transaction, whether the transaction is in sensitive time (11:00-07:00), number of transfers per minute for this transaction, cumulative transaction amount of this transaction, cumulative deposit amount of this transaction, cumulative withdrawal amount of this transaction, number of deposit counterparties count, number of withdrawal counterparties count, number of transaction counterparties, etc.

[0026] The transaction data of the account to be identified includes the record of each transaction of the account to be identified. According to the record of each transaction, the transaction type, transaction counterparty and transaction behavior data of each transaction of the account to be identified can be extracted. The transaction type shows whether each transaction is an outgoing or incoming transaction and the characteristics of each transaction, such as the number of transactions in the last 24 hours for each transaction, the transaction amount in the last 24 hours for each transaction, the time interval between each transaction and the last transaction, the outgoing and incoming ratio of each transaction in the last 24 hours, whether each transaction is a small amount transaction, etc. Therefore, according to the transaction type of each transaction, the account to be identified and the transaction counterparty corresponding to each transaction can be determined as an outgoing account and an incoming account respectively. After that, by associating the outgoing account with the incoming account and recording the transaction behavior data between the outgoing and incoming accounts, the transaction flow data between multiple accounts to be identified is obtained.

[0027] In this embodiment of the present application, it is assumed that resource transactions have occurred in advance between multiple accounts to be identified. Resource transactions include direct resource transactions and indirect resource transactions. Direct resource transactions are transactions between two accounts directly without going through other accounts, and indirect resource transactions are transactions between two accounts indirectly through other accounts.

[0028] Operation 102, constructing an initial transaction graph corresponding to a plurality of accounts to be identified based on the transaction flow data, wherein the initial transaction graph includes nodes and edges, wherein the nodes correspond to the accounts to be identified, and the edges correspond to the transaction behavior data between the nodes.

[0029] The accounts to be identified are taken as nodes. When there is a transaction between two accounts to be identified, the corresponding transaction behavior data is taken as an edge to complete the construction of the initial transaction graph of multiple accounts to be identified. Among them, since the transactions between the accounts to be identified are bidirectional, the initial transaction graph of the embodiment of the present application is preferably an undirected graph.

[0030] In one embodiment of the present application, the transaction behavior data may include transaction behavior related data such as the transaction amount, timing, and balance changes.

[0031] Operation 103 , edge classification is performed on the initial transaction graph according to the account characteristics of each account to be identified, to obtain an edge classification result.

[0032] The edge classification result includes the edge type of each edge of the initial transaction graph. Each edge in the initial transaction graph corresponds to two nodes, and the two nodes represent two accounts to be identified. Each edge can be classified according to the account characteristics of the two accounts to be identified corresponding to each edge to obtain the edge type of each edge. Among them, the edge type is used to show the degree of abnormality of the edge. The degree of abnormality can be divided based on the numerical value, or it can be divided into normal and abnormal according to the type of abnormality. It can also be divided into high risk, medium risk, low risk and no risk according to the risk type. The specific division method of the degree of abnormality is not specifically limited in this application.

[0033] When classifying edges, conventional classification algorithms may be used, such as logistic regression, vector machines, neural networks, etc., which will not be described in detail here.

[0034] Operation 104 , edge filtering is performed on the initial transaction graph according to the edge classification result to obtain a target transaction graph.

[0035] In order to reduce the complexity of data processing and facilitate subsequent anomaly identification, the edges of the initial transaction graph can be filtered according to the edge classification results. For example, when the edge types include normal and abnormal, the edges without abnormalities can be filtered.

[0036] Operation 105 , performing abnormality identification on the nodes in the target transaction graph according to the set edge weight distribution mechanism and the set graph identification algorithm to obtain an abnormality identification result.

[0037] Among them, the graph recognition algorithm mainly refers to the algorithm used to classify the nodes of the graph, such as graph neural network, community discovery algorithm or label propagation algorithm.

[0038] There are differences in transaction risks between different transaction behaviors between the accounts to be identified. In order to fully consider the risk differences between different transactions, this application is also configured in advance with a setting edge weight allocation mechanism to assign different weights to different edges by setting the edge weight allocation mechanism, thereby considering the risk differences between different transaction behavior data corresponding to different edges.

[0039] Finally, by setting the edge weight distribution mechanism and the graph recognition algorithm to identify the abnormal nodes of the target transaction graph, the account type of the account to be identified corresponding to each node can be obtained. Among them, the division of account types can refer to the division of edge types, such as normal and abnormal, which will not be repeated here. In one embodiment of the present application, the abnormality identification result may include the account type of each account to be identified, or may only include the accounts to be identified whose account types indicate abnormalities.

[0040] Therefore, the embodiment of the present application realizes effective anomaly identification of multiple accounts to be identified by constructing a transaction graph between accounts to be identified and performing anomaly identification based on the graph. At the same time, when performing anomaly identification of accounts to be identified based on the graph, the edge weight distribution mechanism is also set to take into account the risk differences between different transactions, further improving the accuracy of anomaly identification.

[0041] Figure 2 A schematic diagram of the implementation flow of the edge classification operation of the account anomaly identification method provided in an embodiment of the present application is shown.

[0042] refer to Figure 2 In one embodiment of the present application, the edge classification result includes the edge type of each edge in the initial transaction graph. The above operation 103 performs edge classification on the initial transaction graph according to the account characteristics of each account to be identified, and obtains the edge classification result, including: Operation 201, obtaining account features of two accounts to be identified corresponding to two nodes of each edge of the initial transaction graph and transaction behavior data between the two accounts to be identified; Operation 202 : determining the edge type of each edge in the initial transaction graph according to the account features of the two accounts to be identified corresponding to each edge in the initial transaction graph and the transaction behavior data between the two accounts to be identified.

[0043] The main purpose of edge classification of the initial transaction graph is to classify each edge in the initial transaction graph and obtain the edge type of each edge in the initial transaction graph.

[0044] In order to more accurately identify the edge type, the edge type can be identified by the edge transaction behavior data and the account features of the account to be identified corresponding to the edge. Specifically, for each edge in the initial transaction graph, the corresponding account features and transaction behavior data can be extracted respectively, and each edge can be identified based on the account features and transaction behavior data to obtain the edge type of each edge.

[0045] Figure 3 A schematic diagram of the implementation flow of the edge type determination operation of the account anomaly identification method provided in an embodiment of the present application is shown.

[0046] refer to Figure 3 In one embodiment of the present application, the operation 202, according to the account characteristics of the two accounts to be identified corresponding to each edge in the initial transaction graph and the transaction behavior data between the two accounts to be identified, determines the edge type of each edge in the initial transaction graph, including: Operation 301, obtaining an edge classification model, the edge classification model is trained by the following operations: obtaining training data, the training data including a plurality of training graphs with edge labels; training the edge classification model according to the training data; Operation 302 , inputting the account features of the two accounts to be identified corresponding to each edge in the initial transaction graph and the transaction behavior data between the two accounts to be identified into the edge classification model to obtain the edge type of each edge, where the edge types include high risk, medium risk, low risk and no risk.

[0047] For edge classification in the initial transaction graph, a pre-trained edge classification model can be used.

[0048] In one embodiment of the present application, the edge classification model can be trained and saved in advance by the application platform or system itself, and called when edge classification is needed. It can also be trained in advance on other stand-alone devices to reduce the hardware requirements for model training, and obtained from other stand-alone devices when edge classification is needed.

[0049] The training process of the edge classification model includes: obtaining training data, where the training data includes multiple training graphs with edge labels; and training the edge classification model according to the training data.

[0050] Multiple groups of labeled accounts that have undergone transactions can be obtained from historical detection data, and each group of labeled accounts includes multiple labeled accounts. Then, the account transaction graph of each group of labeled accounts is constructed in the manner of nodes representing accounts and edges representing transaction behavior data between accounts.

[0051] Account labels are divided into black labels for high-risk nodes, white labels for risk-free nodes, and gray labels for undetermined labels according to the degree of abnormality. Transactions between two high-risk accounts are usually high-risk, transactions between risk-free accounts are risk-free, transactions between risk-free and low-risk accounts are usually low-risk, and transactions between high-risk accounts and other undetermined labeled accounts or between two undetermined labeled accounts are usually medium-risk. Therefore, the edges between nodes can be labeled based on the nodes with existing labels to obtain the edge labels of each edge.

[0052] For example, the edge between two high-risk black-label nodes can be labeled as high risk, the edge between two risk-free white-label nodes can be labeled as risk-free, the edge between a risk-free white-label node and a high-risk black-label node and between a risk-free white-label node and a gray-label node can be labeled as low risk, and the edge between a high-risk black-label node and a gray-label node and between two gray-label nodes can be labeled as medium risk.

[0053] The edge of the account transaction graph of each group of labeled accounts is labeled by using the above edge labeling method, that is, the account transaction graph with edge labels corresponding to each group of labeled accounts is obtained, that is, the training graph. The account transaction graph with edge labels corresponding to each group of labeled accounts is used as training data to train the edge classification model, so that the edge classification model learns the edge classification ability, that is, the final edge classification model is obtained.

[0054] After obtaining the edge classification model, for each edge, the account characteristics and transaction behavior data of the account to be identified corresponding to each edge are input into the edge classification model to obtain the edge type of each edge. The edge type may include high risk, medium risk, low risk, and no risk.

[0055] In one embodiment of the present application, the edge classification model is a model based on LSTM (Long Short-Term Memory). The construction process of the edge classification model may include: 1) Construct loss function:

[0056] Among them, M is the number of nodes, N is the number of neighbor nodes, For Node and nodes The edge between for Transaction behavior data and account characteristics between Edge types include high risk, medium risk, low risk, and no risk; 2) Use the loss function and training data to adjust the model parameters of the edge classification model to obtain the final edge classification model.

[0057] In one embodiment of the present application, the initial transaction graph is edge filtered according to the edge classification result to obtain a target transaction graph, including: filtering the edges in the initial transaction graph that meet the set criteria, wherein the set criteria are that the edge type meets the risk-free criteria or the edge type meets the risk-free and low-risk criteria; filtering the nodes in which no edges exist in the filtered initial transaction graph to obtain the target transaction graph.

[0058] The amount of data that needs to be processed determines the requirements for hardware and the efficiency of data processing. In order to reduce the requirements for hardware, improve data processing efficiency, and meet real-time requirements, after building the initial transaction graph, the initial transaction graph is compressed by edge filtering, thereby reducing the amount of data that needs to be processed later.

[0059] When the edge type is low risk or no risk, it means that the transaction between the two accounts to be identified corresponding to the edge is normal or low risk. At this time, in order to reduce the data size, the risk-free edge or both the risk-free and low-risk edges can be filtered out. Whether to filter only the risk-free edge or remove both the risk-free and low-risk edges can be determined according to actual needs.

[0060] After filtering the edges that meet the set standards in the initial transaction graph, there are a large number of isolated nodes, that is, nodes without edges. Most of these nodes are not abnormal. Therefore, after filtering the edges, the nodes without edges are also filtered out.

[0061] In one embodiment of the present application, an edge weight allocation mechanism is set to allocate a weight to each edge of the target transaction graph according to the edge classification result.

[0062] The edge weight allocation mechanism can be configured to allocate weights to each edge in the target transaction graph according to the edge classification results. Specifically, the edge classification results show the edge type of each edge, and the abnormality of the edge type fully shows the risk of the transaction corresponding to the edge. Therefore, by allocating weights to each edge according to the edge type, the risk differences between transactions can be taken into consideration.

[0063] When weights are assigned to edges according to edge types, higher weights are assigned to edges with higher abnormality levels shown by edge types, and lower weights are assigned to edges with lower abnormality levels.

[0064] For example, when edge types include high risk, medium risk, low risk, and no risk, the highest weight, such as 100, can be assigned to high-risk edges, and a lower weight, such as 0.2, can be assigned to medium-risk edges. And even lower weights, such as 0, can be assigned to no-risk and low-risk edges.

[0065] In one embodiment of the present application, the abnormal identification result includes the account type of each account to be identified. Combined with the weight of each edge in the target transaction graph, a weighted label propagation algorithm is used to identify the node to obtain the node label of each node. The node label shows the abnormality degree of the node, and the abnormality degree shown in the node label is assigned to the account to be identified corresponding to each node, that is, the account type of each account to be identified is obtained. Among them, the division of abnormality degree can refer to Figure 1 The process of dividing the edge types described above will not be repeated here.

[0066] Figure 4 A schematic diagram of the implementation flow of the account type determination operation of the account abnormality identification method provided in an embodiment of the present application is shown.

[0067] refer to Figure 4 In one embodiment of the present application, the graph recognition algorithm is set as a weighted label propagation algorithm, and the abnormal recognition result includes the account type of each account to be recognized; accordingly, the above operation 105 performs abnormal recognition on the nodes in the target transaction graph according to the set edge weight allocation mechanism and the set graph recognition algorithm, and obtains the abnormal recognition result, including: Operation 401, according to the set initialization label, initialize the node label of each node in the target transaction graph, and obtain a fixed label group and a gray label node group, the set initialization label includes a high-risk node black label and a risk-free node white label, and the fixed label group includes multiple nodes with fixed node labels; Operation 402, for nodes that do not belong to the fixed label group, iterate the node label of each node according to the set edge weight distribution mechanism and the labels of the neighboring nodes of each node to obtain an iteration result; Operation 403 : determining the account type of each account to be identified according to the iteration result and the fixed label group; wherein, in the process of performing node label iteration, the nodes in the gray label node group are not used as neighbor nodes.

[0068] In this embodiment of the present application, the graph recognition algorithm is set as a weighted label propagation algorithm.

[0069] Different from the existing label propagation algorithm, the embodiment of the present application adds a setting edge weight allocation mechanism based on the traditional label propagation algorithm. The setting edge weight allocation mechanism is to allocate weights to the edge according to the node labels of the two nodes corresponding to the edge.

[0070] Specifically, the node labels of the nodes usually include high-risk node black labels, risk-free node white labels, and gray labels with undetermined labels. Transactions between two high-risk node black label nodes are usually high-risk transactions. Transactions between two risk-free node white label nodes, between risk-free node white label and high-risk node black label nodes, and between risk-free node white label and gray label nodes are usually low-risk transactions, while transactions between high-risk node black label and gray label nodes and transactions between two gray label nodes are usually medium-risk transactions. Considering that risk transactions are distributed in a power law in the overall transactions, a weight much higher than that of low-risk transactions and medium-risk transactions can be set for high-risk transactions. Therefore, setting an edge weight allocation mechanism may include: allocating a weight much higher than that of an edge involving a risk-free node white label, an edge between two gray label nodes, and an edge between a high-risk node black label and a gray label node to an edge between two high-risk nodes black label and gray label nodes, and the weight of an edge involving a risk-free node white label is different from that of an edge between two gray label nodes and an edge between a high-risk node black label and a gray label node. Among them, the weight of an edge involving a risk-free node white label can be configured to be 0.

[0071] For example, the edge weight distribution mechanism can be set to configure a weight of 100 for high-risk node black label node-high-risk node black label node, a weight of 0 for risk-free node white label node-risk-free node white label node, risk-free node white label node-high-risk node black label node, and risk-free node white label node-gray label node, and a weight of 0.2 for high-risk node black label node-gray label node and gray label node-gray label node.

[0072] In addition to setting the configuration of the edge weight distribution mechanism, different from the traditional label propagation algorithm, the embodiment of the present application also provides a fixed label group and a gray label node group. The fixed label group includes nodes with fixed node labels, such as nodes with existing training labels, high-risk nodes with black labels, and risk-free nodes with white labels.

[0073] According to the configured edge weight distribution mechanism and fixed label group, the node is identified through the weighted label propagation algorithm. The process of identifying nodes through the weighted label propagation algorithm includes: initializing the label group according to the setting, initializing a node label for each node, and obtaining the fixed label group, and iterating the node labels of the nodes that do not belong to the fixed label group according to the set weight distribution mechanism to obtain the iterative result.

[0074] For each node, each iteration assigns a weight to each edge according to the set edge weight mechanism, and then iterates the node label according to the node label of the corresponding neighbor node and the weight between the neighbor node. Among them, gray label nodes are usually assigned empty labels. In order to avoid the influence of empty label nodes on node label iteration, when determining neighbor nodes, nodes with empty labels are not used as neighbor nodes, that is, nodes in the gray label node group are not used as neighbor nodes.

[0075] Specifically, node label iteration can be performed on nodes using the following weighted label propagation algorithm:

[0076] in, Is a node In the The node labels for the iterations, For Node The weight to its first neighbor node, Is a node The node label of the first neighbor node, For Node To its The weight of neighbor nodes, Is a node No. The node labels of the neighbor nodes.

[0077] For each node, the weighted label propagation algorithm is continuously iterated until the convergence condition is reached, and the iteration is terminated to obtain the final node label of each node. The convergence condition is that the node labels of all nodes in the current iteration are the same as the node labels of the previous iteration.

[0078] The iteration result shows the node label of each node outside the fixed label group, and the abnormality degree shown by the node label in the iteration result and the node label in the fixed label group is assigned to the corresponding account to be identified, and the account type of each account to be identified is obtained. Among them, the abnormality degree is the risk degree. For example, if the node label is a high-risk node black label, the risk degree is high risk, and the high risk is assigned to the corresponding account to be identified.

[0079] Figure 5 A schematic diagram of the composition structure of the account abnormality identification device provided in an embodiment of the present application is shown.

[0080] refer to Figure 5Based on the above-mentioned account abnormality identification method, the embodiment of the present application also provides an account abnormality identification device, which includes: a first construction module 501, which is used to extract account features from transaction data of multiple accounts to be identified, and construct transaction flow data between multiple accounts to be identified based on the transaction data of multiple accounts to be identified; a second construction module 502, which is used to construct an initial transaction graph corresponding to multiple accounts to be identified based on the transaction flow data, and the initial transaction graph includes nodes and edges, the nodes correspond to the accounts to be identified, and the edges correspond to the transaction behavior data between the nodes; a classification module 503, which is used to perform edge classification on the initial transaction graph according to the account features of each account to be identified, and obtain an edge classification result; a filtering module 504, which is used to perform edge filtering on the initial transaction graph according to the edge classification result, and obtain a target transaction graph; an identification module 505, which is used to perform abnormal identification on the nodes in the target transaction graph according to a set edge weight distribution mechanism and a set graph identification algorithm, and obtain an abnormal identification result.

[0081] In one embodiment of the present application, the first construction module 501 includes: an extraction submodule, which is used to extract the account characteristics of each account to be identified from the transaction data of each account to be identified; a first determination submodule, which is used to determine the transaction type, transaction counterparty and transaction behavior data of each transaction of each account to be identified based on the transaction data of each account to be identified, and the transaction type includes outgoing and incoming transactions; an association submodule, which is used to associate the transaction data of multiple accounts to be identified based on the transaction type, transaction counterparty and transaction behavior data of each transaction of each account to be identified, so as to obtain the transaction flow data between the multiple accounts to be identified.

[0082] In one embodiment of the present application, the edge classification result includes the edge type of each edge in the initial transaction graph; accordingly, the classification module 503 includes: a first acquisition submodule, used to obtain the account characteristics of two accounts to be identified corresponding to two nodes of each edge of the initial transaction graph and the transaction behavior data between the two accounts to be identified; a second determination submodule, used to determine the edge type of each edge in the initial transaction graph according to the account characteristics of the two accounts to be identified corresponding to each edge in the initial transaction graph and the transaction behavior data between the two accounts to be identified.

[0083] In one embodiment of the present application, the second determination submodule includes: an acquisition unit, used to obtain an edge classification model; an input unit, used to input the account characteristics of two accounts to be identified corresponding to each edge in the initial transaction graph and the transaction behavior data between the two accounts to be identified into the edge classification model to obtain the edge type of each edge, and the edge types include high risk, medium risk, low risk and no risk.

[0084] In one embodiment of the present application, the graph recognition algorithm is set as a weighted label propagation algorithm, and the abnormal recognition result includes the account type of each account to be identified; accordingly, the recognition module 505 includes: an initialization submodule, which is used to initialize the node label of each node in the target transaction graph according to the set initialization label, and obtain a fixed label group and a gray label node group, and the set initialization label includes a high-risk node black label and a risk-free node white label, and the fixed label group includes multiple nodes with fixed node labels; an iteration submodule, which is used to iterate the node label of each node that does not belong to the fixed label group according to the set edge weight distribution mechanism and the node labels of the neighboring nodes of each node to obtain an iteration result; a third determination submodule, which is used to determine the account type of each account to be identified according to the iteration result and the fixed label group; wherein, in the process of node label iteration, the nodes in the gray label node group are not used as neighbor nodes.

[0085] It should be noted that the description of the device in the embodiment of the present application is similar to the description of the method embodiment above, and has similar beneficial effects as the method embodiment, so it will not be repeated. Figures 1 to 4 The present invention can be understood by referring to the description of any one of the accompanying drawings.

[0086] According to an embodiment of the present application, the present application also provides an electronic device and a non-transitory computer-readable storage medium.

[0087] Figure 6 A schematic block diagram of an example electronic device 60 that can be used to implement an embodiment of the present application is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workbenches, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present application described and / or required herein.

[0088] like Figure 6As shown, the electronic device 60 includes a computing unit 601, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 602 or a computer program loaded from a storage unit 608 into a random access memory (RAM) 603. In the RAM 603, various programs and data required for the operation of the electronic device 60 can also be stored. The computing unit 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0089] A number of components in the electronic device 60 are connected to the I / O interface 605, including: an input unit 606, such as a keyboard, a mouse, etc.; an output unit 607, such as various types of displays, speakers, etc.; a storage unit 608, such as a disk, an optical disk, etc.; and a communication unit 609, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 609 allows the electronic device 60 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0090] The computing unit 601 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 601 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 601 performs the various methods and processes described above, such as the abnormal identification method of the account. For example, in some embodiments, the abnormal identification method of the account may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit 608. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 60 via the ROM 602 and / or the communication unit 609. When the computer program is loaded into the RAM 603 and executed by the computing unit 601, one or more steps of the abnormal identification method of the account described above may be performed. Alternatively, in other embodiments, the computing unit 601 may be configured to execute the abnormal identification method of the account in any other appropriate manner (e.g., by means of firmware).

[0091] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0092] The program code for implementing the method of the present application can be written in any combination of one or more programming languages. These program codes can be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, implements the functions / operations specified in the flow chart and / or block diagram. The program code can be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0093] In the context of the present application, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0094] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0095] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0096] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship of client and server is generated by computer programs running on respective computers and having a client-server relationship with each other. The server may be a cloud server, a server of a distributed system, or a server combined with a blockchain.

[0097] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this application can be executed in parallel, sequentially or in different orders, as long as the expected results of the technical solution disclosed in this application can be achieved, and this document is not limited here.

[0098] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A method for identifying abnormality of an account, characterized in that: The method comprises: Extracting account features from the transaction data of multiple accounts to be identified, and constructing transaction flow data between the multiple accounts to be identified based on the transaction data of the multiple accounts to be identified; According to the transaction flow data, construct an initial transaction graph corresponding to the multiple accounts to be identified, wherein the initial transaction graph includes nodes and edges, the nodes correspond to the accounts to be identified, and the edges correspond to the transaction behavior data between the nodes; Performing edge classification on the initial transaction graph according to the account characteristics of each account to be identified to obtain an edge classification result; Performing edge filtering on the initial transaction graph according to the edge classification result to obtain a target transaction graph; According to the set edge weight distribution mechanism and the set graph recognition algorithm, anomaly recognition is performed on the nodes in the target transaction graph to obtain anomaly recognition results.

2. The method according to claim 1, characterized in that: Account features are extracted from the transaction data of multiple accounts to be identified, and transaction flow data between multiple accounts to be identified are constructed based on the transaction data of multiple accounts to be identified, including: Extracting account features of each account to be identified from the transaction data of each account to be identified; Determine the transaction type, transaction counterparty and transaction behavior data of each transaction of each account to be identified according to the transaction data of each account to be identified, wherein the transaction type includes outgoing and incoming transactions; According to the transaction type, transaction counterparty and transaction behavior data of each transaction of each account to be identified, the transaction data of multiple accounts to be identified are associated to obtain the transaction flow data between the multiple accounts to be identified.

3. The method according to claim 1, characterized in that The edge classification result includes the edge type of each edge in the initial transaction graph; accordingly, The initial transaction graph is edge-classified according to the account characteristics of each account to be identified, and an edge classification result is obtained, including: Obtaining account features of two accounts to be identified corresponding to two nodes of each edge of the initial transaction graph and transaction behavior data between the two accounts to be identified; The edge type of each edge in the initial transaction graph is determined according to the account characteristics of the two accounts to be identified corresponding to each edge in the initial transaction graph and the transaction behavior data between the two accounts to be identified.

4. The method according to claim 3, characterized in that: Determining the edge type of each edge in the initial transaction graph according to the account features of the two accounts to be identified corresponding to each edge in the initial transaction graph and the transaction behavior data between the two accounts to be identified includes: Acquire an edge classification model, wherein the edge classification model is trained by the following operations: acquire training data, wherein the training data includes a plurality of training graphs with edge labels; train the edge classification model according to the training data; The account characteristics of the two accounts to be identified corresponding to each edge in the initial transaction graph and the transaction behavior data between the two accounts to be identified are input into the edge classification model to obtain the edge type of each edge, and the edge types include high risk, medium risk, low risk and no risk.

5. The method according to claim 4, characterized in that The initial transaction graph is edge filtered according to the edge classification result to obtain a target transaction graph, including: Filtering the edges that meet the set criteria in the initial transaction graph, wherein the set criteria are that the edge type meets the criteria of no risk or the edge type meets the criteria of no risk and low risk; Nodes without edges in the filtered initial transaction graph are filtered to obtain the target transaction graph.

6. The method according to claim 1, characterized in that The edge weight allocation mechanism is to allocate a weight to each edge of the target transaction graph according to the edge classification result.

7. The method according to claim 1, characterized in that The set graph recognition algorithm is a weighted label propagation algorithm, and the abnormal recognition result includes the account type of each account to be recognized; accordingly, According to the set edge weight distribution mechanism and the set graph recognition algorithm, anomaly recognition is performed on the nodes in the target transaction graph to obtain anomaly recognition results, including: Initialize the node label of each node in the target transaction graph according to the set initialization label, and obtain a fixed label group and a gray label node group, wherein the set initialization label includes a high-risk node black label and a risk-free node white label, and the fixed label group includes multiple nodes with fixed node labels; For nodes that do not belong to the fixed label group, the node label of each node is iterated according to the set edge weight distribution mechanism and the node labels of each node's neighbor nodes to obtain the iterative result; Determining the account type of each account to be identified according to the iteration result and the fixed tag group; In the process of iterating node labels, the nodes in the gray label node group are not used as neighbor nodes.

8. A device for identifying abnormalities in an account, characterized in that: The device comprises: A first construction module is used to extract account features from the transaction data of the multiple accounts to be identified, and to construct transaction flow data between the multiple accounts to be identified based on the transaction data of the multiple accounts to be identified; A second construction module is used to construct an initial transaction graph corresponding to the multiple accounts to be identified based on the transaction flow data, wherein the initial transaction graph includes nodes and edges, the nodes correspond to the accounts to be identified, and the edges correspond to the transaction behavior data between the nodes; A classification module, used for edge classification of the initial transaction graph according to the account characteristics of each account to be identified, to obtain an edge classification result; A filtering module, configured to perform edge filtering on the initial transaction graph according to the edge classification result to obtain a target transaction graph; The identification module is used to identify abnormalities of nodes in the target transaction graph according to a set edge weight distribution mechanism and a set graph identification algorithm to obtain abnormality identification results.

9. An electronic device, characterized in that: include: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 7.

10. A non-transitory computer-readable storage medium storing computer instructions, characterized in that: The computer instructions are used to make a computer execute the method according to any one of claims 1 to 7.

Images