Bank transaction data graph database analysis method based on knowledge graph characteristics

Abstract

The invention discloses a bank transaction data graph database analysis method based on knowledge graph characteristics. The method comprises the following steps: S1, data preparation: collecting transaction flow data in a bank, preprocessing the data, removing invalid or repeated transaction records, and desensitizing sensitive information; s2, atlas establishment: establishing a transaction flow atlas by using an atlas database, taking an account as a node, taking a transaction as an edge, and storing transaction amount attribute information; s3, feature engineering: based on a graph structure, calculating various centrality measures of account nodes, performing community detection, and calculating similarity measures; s4, model training: training the model by using a LightGBM machine learning algorithm; and S5, performing prediction application: predicting unknown data by using the trained model, and performing post-processing on a prediction result. According to the invention, the accuracy of the machine learning model in processing financial transaction data is improved, and more accurate risk management and fraud detection means are provided for financial institutions.

Description

Technical Field

[0001] The present invention relates to the field of bank transaction data analysis, and in particular to a bank transaction data graph database analysis method based on knowledge graph features. Background Art

[0002] With the development of financial technology, financial institutions are facing massive data processing needs. Traditional data analysis methods mainly rely on the static characteristics of the account itself, such as transaction flow, account balance, AUM, etc. Although these characteristics can partially reflect the behavior patterns of the account, they have certain limitations when dealing with complex and dynamically changing financial transaction networks. When faced with problems such as fraud detection and risk assessment, it is difficult to fully capture the correlation and interaction patterns between accounts by relying solely on the static characteristics of the account. In addition, due to the lack of full use of information in the transaction network, a large amount of valuable data has not been effectively utilized, affecting the generalization ability and prediction accuracy of the model. When processing large-scale data sets, the traditional feature engineering process is complex and time-consuming, which increases the cost of model development and maintenance. Summary of the invention

[0003] The purpose of the present invention is to propose a bank transaction data graph database analysis method based on knowledge graph features in response to the above-mentioned technical problems.

[0004] A bank transaction data graph database analysis method based on knowledge graph features includes the following sub-steps:

[0005] S1: Data preparation: Collect transaction flow data within the bank, pre-process the data, remove invalid or duplicate transaction records, and desensitize sensitive information;

[0006] The pretreatment includes cleaning and standardization;

[0007] S2: Graph establishment: Use the graph database to establish a transaction flow graph, with accounts as nodes and transactions as edges, to store transaction amount attribute information;

[0008] S3: Feature Engineering: Based on the graph structure, calculate various centrality measures of account nodes, perform community detection, and calculate similarity measures;

[0009] S4: Model training: Combining traditional account static features with newly extracted graph features, the model is trained using the LightGBM machine learning algorithm;

[0010] S5: Prediction application: Use the trained model to predict unknown data and post-process the prediction results.

[0011] Furthermore, a method for analyzing a bank transaction data graph database based on knowledge graph features, step S2 includes the following sub-steps:

[0012] S21: Collect transaction flow data of active customers within the bank's time window and convert the transaction direction of the data so that only the transaction amount in the data transaction is positive flow:

[0013] The transaction flow data includes the transaction card number, transaction amount, transaction time, counterparty card number, and whether it is an account involved in the case;

[0014] If the transaction amount from trading account A to trading account B is positive, the direction will not be changed;

[0015] If the transaction amount from trading account A to trading account B is negative, the conversion direction is trading account B to trading account A, and the amount is set to positive;

[0016] S22: Establish a base map model, using a triple expression knowledge framework G = {E, R, P};

[0017] Where E is the entity set, R is the relationship set, P is the attribute set P = {P1, P2}, P1 is the entity attribute, P2 is the relationship attribute;

[0018] S221: Create normal and fraud of entity E;

[0019] Among them, normal is an ordinary bank account that may be involved in the case, and fraud is a bank account involved in the case.

[0020] S222: Define entity attribute P1, and define the card number cardno of each entity E as an attribute:

[0021] For normal entity: define cardno: the set of all transaction card numbers and counterparty card numbers;

[0022] For the fraud entity: define cardno: all card numbers involved in the case;

[0023] S223: establish the trans of relation R;

[0024] Among them, trans refers to all transactions and transaction relationships between entities;

[0025] S224: define relationship attributes P2, each relationship contains amt and datetime attributes;

[0026] Among them, amt is the transaction amount, and atetime is the transaction time;

[0027] S23: Establish a data window sliding mechanism, use the time window in step 1 as the sliding window, add new relations R every day, and delete old relations R according to the datetime attribute in relation R, to ensure that there are only relations R within the time window in the graph model. After sliding the relation R, delete all isolated entities.

[0028] Furthermore, a method for analyzing a bank transaction data graph database based on knowledge graph features, step S3 includes the following sub-steps:

[0029] S31: Calculate centrality metrics including node degree and PageRank;

[0030] The centrality measure reflects the importance of a node in the network;

[0031] The node degree is an important indicator for measuring account activity;

[0032] The PageRank is an important feature in the machine learning model for predicting the accounts involved in the case;

[0033] S32: Perform community detection, using label propagation algorithm and Louvain algorithm to identify account groups with similar transaction behaviors and explore the community structure hidden behind the transaction data;

[0034] The community detection uses prior conditions to label each node and obtain unknown labels in a semi-supervised manner;

[0035] S33: The similarity between two accounts is measured by determining the Jaccard coefficient between the sets of trading counterparties of the two accounts. The formula is:

[0036]

[0037] Among them, J(A, B) represents the Jaccard coefficient, |A∩B| represents the value of the intersection of trading account A and trading account set B, and |A∪B| represents the value of the union of trading account A and trading account set B.

[0038] Furthermore, a bank transaction data graph database analysis method based on knowledge graph features, said S31 comprises the following sub-steps:

[0039] S311: When calculating degree centrality, it is divided into three categories: in-degree, out-degree, and total degree. The formula is:

[0040] C n =deg(n)

[0041] Among them, C n represents degree centrality, deg(n) represents the number of transactions connected to node n;

[0042] The in-degree is the transaction direction flowing to oneself, i.e. receiving payment, and the out-degree is the transaction direction flowing out from oneself, i.e. paying payment. The total degree is the sum of the first two.

[0043] S312: In the transaction network, PageRank considers both the in-degree and out-degree weights of the node to calculate the influence factor of the node in the entire network. The formula is:

[0044]

[0045] Among them, PR (p i ) represents node p i The PageRank value of the network, d represents the damping factor, which is usually 0.85, and N represents the total number of nodes in the network. Represents the basic score of all nodes, M(p i ) represents all points to node p i The node set, L(p j ) represents node p j The out-degree, that is, p j The number of nodes pointing to other nodes, PR(p j ) represents node p j PageRank value.

[0046] Furthermore, a bank transaction data graph database analysis method based on knowledge graph features, step S32 includes the following sub-steps:

[0047] S321: Detecting accounts with the same labels as criminals through label propagation algorithms:

[0048] S3211: Initialization phase: randomly assign an initial label to each node;

[0049] S3212: Propagation phase: Each node uses the neighbor label with the highest frequency as its new label;

[0050] S3213: Synchronous update: All nodes update labels simultaneously until the labels no longer change or the predetermined maximum number of iterations is reached;

[0051] S322: Louvain algorithm divides accounts into several communities to maximize modularity. The formula is:

[0052]

[0053] Among them, A ij Represents the adjacency matrix. If nodes i and j are connected, then A ij is 1, otherwise it is 0;

[0054] Among them, ki represents the degree of node i, m represents the sum of all weights carried by the edges, and c i represents the community assigned to node i by the algorithm, and Q represents modularity;

[0055] Among them, δ(c i , c j ) represents the Kronecker delta function. If i and j belong to the same community, then δ(c i , c j ), otherwise 0;

[0056] S3221: Initialization: Each node is initialized as an independent community;

[0057] S3222: Local optimization stage: For each node, calculate the change in modularity after moving it to the community where the adjacent node is located, move the node to the community that can maximize its modularity gain, and repeat this process until the movement of no node increases the modularity;

[0058] S3223: Graph reconstruction phase: The communities formed in the previous phase are regarded as new super nodes, and a new graph is constructed. The edges between super nodes represent the connections between communities in the original graph. The local optimization phase is repeated until the global optimum is reached or the convergence conditions are met.

[0059] Furthermore, a bank transaction data graph database analysis method based on knowledge graph features, step S4 includes the following sub-steps:

[0060] S41: Create training subgraphs suitable for centrality metrics and community detection:

[0061] S411: On the base map model, randomly extract normal accounts, all transaction relationships of normal accounts in the three months before the current month, all accounts involved in the current month, all customers involved in the one-time transaction of the account involved in the three months before the case, and all transaction relationships of the account involved in the three months before the current month.

[0062] S412: construct a training subgraph consisting of normal accounts, accounts involved in the case, and accounts within one transaction of the accounts involved in the case, with a time window of 3 months;

[0063] S42: Centrality measurement features, community detection, and similarity measurement of training graph features.

[0064] Furthermore, a method for analyzing a bank transaction data graph database based on knowledge graph features, step S42 includes the following sub-steps:

[0065] S421: Degree centrality and PageRank features for training centrality metric features:

[0066] Degree centrality: directly calculate the out-degree and in-degree of each account in the training subgraph, add the out-degree and in-degree of each account to get the total degree;

[0067] PageRank feature: Calculate the PageRank of each account;

[0068] S422: Calculate the community ID of the training sample in the community detection algorithm and save it in the attributes of the node. In the prediction process, the training sample and the prediction sample are used together to construct the subgraph. The existing community ID of the training sample is used as the seed community to initialize some nodes in the graph, and then the community ID of all nodes is:

[0069] S4221: Label propagation algorithm:

[0070] Directed graph features: directly calculate the community ID of each account in the training subgraph;

[0071] Undirected graph features: cancel the direction of transactions in the training subgraph and calculate the community ID of each account;

[0072] S4222: Louvain algorithm:

[0073] Directed graph features: directly calculate the community ID of each account in the training subgraph;

[0074] Undirected graph features: cancel the direction of transactions in the training subgraph and calculate the community ID of each account;

[0075] S423: In the similarity measurement, the Jaccard feature is calculated according to the set of account transaction counterparties, and the normal accounts in the training subgraph are taken as the set N, and the fraudulent accounts are taken as the set F, and the set U = {N, F}, where the set U is all the training samples;

[0076] S4231: Take all the counterparties in set F as set A;

[0077] S4232: Take the counterparty of each element i in the set U as B i ;

[0078] S4233: Calculate the Jaccard feature J(A, B) of node i i ), the formula is:

[0079]

[0080] Among them, J(A, B i ) represents the Jaccard feature of node i.

[0081] The beneficial effects of the present invention are as follows: a graph database analysis method for bank transaction data based on knowledge graph features is used to construct a graph of bank transaction flows using a graph database, and the performance of the machine learning model is enhanced by analyzing the relationship between accounts; the introduction of graph database technology and graph feature extraction methods solves the problem of ignoring the relationship between accounts, and improves the accuracy of the machine learning model when processing financial transaction data; and provides financial institutions with more accurate risk management and fraud detection methods. BRIEF DESCRIPTION OF THE DRAWINGS

[0082] Figure 1 It is a flow chart of a method for analyzing a graph database of bank transaction data based on knowledge graph features. DETAILED DESCRIPTION

[0083] In order to have a clearer understanding of the technical features, purposes and effects of the present invention, specific embodiments of the present invention are now described with reference to the accompanying drawings.

[0084] As attached Figure 1 As shown, (1) Data preparation:

[0085] Collect transaction flow data within the bank and pre-process the data, including cleaning and standardization operations, to ensure data quality, remove invalid or duplicate transaction records, desensitize sensitive information, and ensure data security and privacy.

[0086] (2) Graph establishment:

[0087] Use a graph database, such as Neo4j, to build a transaction flow graph, with accounts as nodes, transactions as edges, and store transaction amount attribute information. During the graph construction process, consider the characteristics of the graph database, select a suitable indexing strategy to speed up query efficiency, and design a reasonable data model to support subsequent complex query requirements.

[0088] 1. First, collect transaction flow data of active customers within the bank's time window, such as the past two years. The data content includes transaction card number, transaction amount, transaction time, counterparty card number, and whether it is an account involved in the case;

[0089] During data preprocessing, the transaction direction is converted. For example, if the transaction amount from A to B is positive, the direction is not converted. If the transaction amount from A to B is negative, the direction is converted to B to A, and the amount is set to positive. After processing, the transaction amount in all data has only positive flow.

[0090] 2. Establish a base graph model and use triples to express the knowledge framework as G = {E, R, P}, where E is the entity set, R is the relationship set, and P is the attribute set (P = {P1, P2}, where P1 is the entity attribute and P2 is the relationship attribute).

[0091] The specific model structure is as follows:

[0092] Entity

[0093] normal: an ordinary bank account, which may be an account involved in the case;

[0094] fraud: the bank account involved;

[0095] Entity attributes (P1)

[0096] For each entity, we define the card number as its attribute:

[0097] For normal entities:

[0098] cardno: the set of all transaction card numbers and counterparty card numbers with no duplication;

[0099] For fraud entities:

[0100] cardno: all card numbers involved in the case;

[0101] Relationship (R)

[0102] trans: all transactions, transaction relationships between entities;

[0103] Relationship attributes (P2)

[0104] For each relationship, the following properties are included:

[0105] AMT: transaction amount

[0106] atetime: transaction time.

[0107] 3. Establish a data window sliding mechanism. Banks generate a large amount of transaction data every moment. To avoid excessive data volume and the resulting model calculation burden, the time window in step 1 is used as the sliding window. New relations R are added every day, and old relations R are deleted according to the attribute datetime in relation R to ensure that there are only relations R within the time window in the graph model. For entity E, it is only necessary to delete all isolated entities, that is, entities without any relations, after sliding the relation R.

[0108] (3) Feature Engineering:

[0109] The calculation of graph features is mainly divided into three parts: centrality measurement, community detection, and similarity measurement:

[0110] Centrality measures:

[0111] In a fraudulent transaction network, some nodes are in an "important" position in the entire network. Once these nodes are destroyed, the entire transaction network can be disintegrated.

[0112] The formula for degree centrality is defined as follows:

[0113] C n =deg(n)

[0114] Among them, deg(n) represents the number of transactions connected to node n. In a network, the more people there are in a transaction relationship, the more important it is. This is an important indicator for measuring account activity. When calculating degree centrality, it needs to be divided into three categories: in-degree, out-degree, and total degree. In-degree represents receipt, out-degree represents payment, and total degree represents the sum of the first two.

[0115] The formula for PageRank is defined as follows:

[0116]

[0117] Where: PR(p j ) is the node p j The PageRank value of the network, d is the damping factor, which is usually 0.85, and N is the total number of nodes in the network. is the basic score of all nodes, M(p i ) are all points to node p i The node set, L(p j ) is the node p j The out-degree, that is, p j The number of points to other nodes;

[0118] The principle is that in a transaction network, to measure the centrality of a node and judge its importance, it is not enough to simply calculate its outgoing and incoming degrees. Not all incoming and outgoing degrees have the same weight. For example, in a fraud network, an account A collected all the stolen money and transferred it to another account B. The weight of the transaction relationship A→B is quite high, while the transaction from an ordinary account to B is not so important. PageRank considers both the incoming degree of the node and the weight of the incoming degree, thereby calculating the influence factor of the node in the entire network. It is an important feature in the machine learning model for predicting involved accounts.

[0119] (4) Community testing:

[0120] In fraud-related networks, criminals may not act alone, but often form communities in the transaction network. Community detection uses prior conditions to label each node and obtain unknown labels in a semi-supervised way.

[0121] Label Propagation Algorithm:

[0122] The label propagation algorithm is divided into three stages, and the basic principles are as follows:

[0123] 1. Initialization phase: randomly assign an initial label to each node;

[0124] 2. Propagation phase: Each node updates its own label based on the labels of its neighbor nodes. Specifically, the node selects the neighbor label with the highest frequency as its new label.

[0125] 3. Synchronous update: All nodes update labels simultaneously until the labels no longer change or the predetermined maximum number of iterations is reached;

[0126] In the process of label propagation, accounts belonging to the same community will eventually be labeled with the same label, which means that accounts with the same labels as criminals are very likely to become new fraud-related accounts.

[0127] Louvain algorithm:

[0128] The main goal of the Louvain algorithm is to maximize modularity, which is a measure of the density of links within a community. The higher the modularity, the better the community division effect.

[0129] The modularity Q is defined as follows:

[0130]

[0131] Among them, A ij is the adjacency matrix. If nodes i and j are connected, then A ij is 1, otherwise it is 0, k i is the degree of node i, m is the sum of all weights carried by the edges, c i is the community assigned to node i by the algorithm, δ(c i , c j ) is the Kronecker delta function. If i and j belong to the same community, then δ(c i , c j ), otherwise 0.

[0132] It is mainly divided into three stages:

[0133] 1. Initialization: Each node is initialized as an independent community;

[0134] 2. Local optimization stage: For each node v in the graph, calculate the change in modularity after moving it to the community where the adjacent node is located, move the node to the community where its modularity gain is the largest, and repeat this process until no node movement can further increase the modularity

[0135] 3. Graph reconstruction phase: The communities formed in the previous phase are regarded as new supernodes, and a new graph is constructed, in which the edges between supernodes represent the connections between communities in the original graph. The local optimization phase is repeated until the global optimum is reached or the convergence conditions are met.

[0136] Whether it is the Louvain algorithm or the label propagation algorithm, its essence is similar to the clustering algorithm, which aims to divide accounts into several communities. Accounts in the same community are more closely related and may also engage in the same behavior, such as fraudulent transactions.

[0137] Similarity measure:

[0138] The Jaccard coefficient is defined as the size of the intersection of two sets divided by the size of their union:

[0139]

[0140] In the model, the similarity between two accounts is measured by determining the Jaccard coefficient between the sets of the two account counterparties. For example, for accounts A and B, the counterparties associated with them in the recent period (such as 1 month) are taken respectively to calculate J(A, B). Assuming that A is a fraudulent account, if the J(A, B) value is high, A and B may have the same transaction group and behavior, and the possibility of B being fraudulent is also high.

[0141] (4) Model training:

[0142] Combining traditional account static features with newly extracted graph features, the model is trained using machine learning algorithms such as LightGBM. During the model training process, methods such as cross-validation are used to optimize hyperparameters to ensure that the model can perform well on different data sets.

[0143] Focus on prediction and training

[0144] Because the underlying graph model contains a time window, such as the nodes and relationships in the past two years are too large, usually with hundreds of millions of nodes and tens of billions of edges, all of which are used to calculate graph features. The amount of calculation is very large and basically cannot be completed. Therefore, on the basis of the underlying graph model, random screening, narrowing the time window, etc. are used to extract sub-graphs, and then calculate the graph features, which can greatly reduce the amount of calculation and facilitate model training.

[0145] Creation of training subgraphs, suitable for centrality measurement and community detection:

[0146] On the underlying graph model, we randomly extract normal accounts (100,000 accounts) and all transaction relationships of the accounts in the three months before the current month (including the current month), all accounts involved in the case in the current month (usually 200-300 accounts) and all transaction relationships of the accounts in the three months before the current month (including the current month), all customers of the accounts involved in the case within one transaction in the three months before the case (usually 6,000-7,000 accounts) and all transaction relationships of the accounts in the three months before the current month (including the current month). This forms a training subgraph consisting of normal accounts, accounts involved in the case, accounts within one transaction of the accounts involved in the case, and a time window of three months.

[0147] The graph features for training are divided into three parts, and each part extracts features differently:

[0148] 1. Centrality measurement characteristics

[0149] 1) Degree Centrality

[0150] Out-degree feature: directly calculate the out-degree of each account in the training subgraph;

[0151] In-degree feature: directly calculate the in-degree of each account in the training subgraph;

[0152] Total degree feature: add the out-degree and in-degree of each account to get the total degree;

[0153] 2) PageRank Features

[0154] PageRank feature: Directly calculate the PageRank of each account.

[0155] 2. Community Detection

[0156] In the community detection algorithm, the community ID of the training sample is first calculated and saved in the attributes of the node. Then, in the prediction process, the training sample and the prediction sample are used together to participate in the subgraph construction, and the existing community ID of the training sample is used as the seed community (prior knowledge) to initialize some nodes in the graph, and then the community ID of all nodes. This ensures the consistency of the community ID during the training and prediction process, that is, those prediction samples with the same community ID as the fraudulent account in the training sample are more likely to be predicted as a fraudulent account;

[0157] In the community detection algorithm, the algorithm itself does not actually care about the transaction direction between nodes. It only cares whether the nodes are connected, so it can be divided into directed graphs and undirected graphs to calculate features separately.

[0158] 1) Label Propagation Algorithm

[0159] Directed graph features: directly calculate the community ID of each account in the training subgraph;

[0160] Undirected graph features: cancel the direction of transactions in the training subgraph, and then calculate the community ID of each account;

[0161] 2) Louvain algorithm

[0162] Directed graph features: directly calculate the community ID of each account in the training subgraph;

[0163] Undirected graph features: cancel the direction of transactions in the training subgraph, and then calculate the community ID of each account.

[0164] 3. Similarity measurement

[0165] In the similarity measurement, the Jaccard feature is calculated based on the set of account counterparties. The normal accounts in the training subgraph are taken as set N, and the fraudulent accounts are taken as set F. Set U = {N, F}, where set U is all training samples.

[0166] First, take all the counterparties in set F as set A, and take the counterparties of each element i in set U as B. i , calculate the Jaccard feature J(A, B i ):

[0167]

[0168] After calculating all graph features, they are integrated into traditional static features, and then algorithms such as XGB and LightGBM are used for model training.

[0169] (5) Prediction application: Use the trained model to predict unknown data, improve the accuracy and robustness of the model, and post-process the prediction results, such as setting thresholds to filter out low-probability events and reduce false alarm rates.

[0170] The establishment of the prediction subgraph is very simple. It only needs to add the prediction sample to the training subgraph to form the prediction subgraph. In the prediction subgraph, the community ID (label propagation, Louvain) of the training sample is included as prior information;

[0171] In centrality metrics and community detection algorithms, calculating prediction features only requires replacing the training subgraph in the training process with the prediction subgraph;

[0172] In the similarity measurement calculation, the predicted subgraph set U = {N, F, P}, where N is a normal account, F is a fraudulent account, and P is a predicted account. The calculation steps are still the same as the training process, using the counterparty set B of each node in U iand all counterparty sets A in F to calculate the Jaccard feature J(A, B i ).

[0173] This solution uses a graph database analysis method for bank transaction data based on knowledge graph features, uses a graph database to build a graph of bank transaction flows, and enhances the performance of machine learning models by analyzing the relationships between accounts. It introduces graph database technology and graph feature extraction methods to solve the problem of ignoring the relationships between accounts and improves the accuracy of machine learning models when processing financial transaction data. It provides financial institutions with more accurate risk management and fraud detection methods.

[0174] The above shows and describes the basic principles and main features of the present invention and the advantages of the present invention. It should be understood by those skilled in the art that the present invention is not limited to the above embodiments. The above embodiments and descriptions are only for explaining the principles of the present invention. Without departing from the spirit and scope of the present invention, the present invention may have various changes and improvements, which fall within the scope of the present invention to be protected. The scope of protection of the present invention is defined by the attached claims and their equivalents.

Claims

1. A bank transaction data graph database analysis method based on knowledge graph features, characterized in that: It includes the following sub-steps: S1: Data preparation: Collect transaction flow data within the bank, pre-process the data, remove invalid or duplicate transaction records, and desensitize sensitive information; The pretreatment includes cleaning and standardization; S2: Graph establishment: Use the graph database to establish a transaction flow graph, with accounts as nodes and transactions as edges, to store transaction amount attribute information; S3: Feature Engineering: Based on the graph structure, calculate various centrality measures of account nodes, perform community detection, and calculate similarity measures; S4: Model training: Combining traditional account static features with newly extracted graph features, the model is trained using the LightGBM machine learning algorithm; S5: Prediction application: Use the trained model to predict unknown data and post-process the prediction results.

2. A bank transaction data graph database analysis method based on knowledge graph features according to claim 1, characterized in that: The step S2 comprises the following sub-steps: S21: Collect transaction flow data of active customers within the bank's time window and convert the transaction direction of the data so that only the transaction amount in the data transaction is positive flow: The transaction flow data includes the transaction card number, transaction amount, transaction time, counterparty card number, and whether it is an account involved in the case; If the transaction amount from trading account A to trading account B is positive, the direction will not be changed; If the transaction amount from trading account A to trading account B is negative, the conversion direction is trading account B to trading account A, and the amount is set to positive; S22: Establish a base map model, using a triple expression knowledge framework G = {E, R, P}; Where E is the entity set, R is the relationship set, P is the attribute set P = {P1, P2}, P1 is the entity attribute, P2 is the relationship attribute; S221: Create normal and fraud of entity E; Among them, normal is an ordinary bank account that may be involved in the case, and fraud is a bank account involved in the case. S222: Define entity attribute P1, and define the card number cardno of each entity E as an attribute: For normal entity: define cardno: the set of all transaction card numbers and counterparty card numbers; For the fraud entity: define cardno: all card numbers involved in the case; S223: establish the trans of relation R; Among them, trans refers to all transactions and transaction relationships between entities; S224: define relationship attributes P2, each relationship contains amt and datetime attributes; Among them, amt is the transaction amount, and atetime is the transaction time; S23: Establish a data window sliding mechanism, use the time window in step 1 as the sliding window, add new relations R every day, and delete old relations R according to the datetime attribute in relation R, to ensure that there are only relations R within the time window in the graph model. After sliding the relation R, delete all isolated entities.

3. According to claim 1, a bank transaction data graph database analysis method based on knowledge graph features is characterized in that: The step S3 comprises the following sub-steps: S31: Calculate centrality metrics including node degree and PageRank; The centrality measure reflects the importance of a node in the network; The node degree is an important indicator for measuring account activity; The PageRank is an important feature in the machine learning model for predicting the accounts involved in the case; S32: Perform community detection, using label propagation algorithm and Louvain algorithm to identify account groups with similar transaction behaviors and explore the community structure hidden behind the transaction data; The community detection uses prior conditions to label each node and obtain unknown labels in a semi-supervised manner; S33: The similarity between two accounts is measured by determining the Jaccard coefficient between the sets of trading counterparties of the two accounts. The formula is: Among them, J(A, B) represents the Jaccard coefficient, |A∪B| represents the value of the intersection of trading account A and trading account set B, and |A∪B| represents the value of the union of trading account A and trading account set B.

4. A bank transaction data graph database analysis method based on knowledge graph features according to claim 3, characterized in that: The S31 includes the following sub-steps: S311: When calculating degree centrality, it is divided into three categories: in-degree, out-degree, and total degree. The formula is: C n =you(n) Among them, C n represents degree centrality, deg(n) represents the number of transactions connected to node n; The in-degree is the transaction direction flowing to oneself, i.e. receiving payment, and the out-degree is the transaction direction flowing out from oneself, i.e. paying payment. The total degree is the sum of the first two. S312: In the transaction network, PageRank considers both the in-degree and out-degree weights of the node to calculate the influence factor of the node in the entire network. The formula is: Among them, PR (p i ) represents node p i The PageRank value of the network, d represents the damping factor, which is usually 0.85, and N represents the total number of nodes in the network. Represents the basic score of all nodes, M(p i ) represents all points to node p i The node set, L(p j ) represents node p j The out-degree, that is, p j The number of nodes pointing to other nodes, PR(p j ) represents node p j PageRank value.

5. A bank transaction data graph database analysis method based on knowledge graph features according to claim 3, characterized in that: The step S32 includes the following sub-steps: S321: Detecting accounts with the same labels as criminals through label propagation algorithms: S3211: Initialization phase: randomly assign an initial label to each node; S3212: Propagation phase: Each node uses the neighbor label with the highest frequency as its new label; S3213: Synchronous update: All nodes update labels simultaneously until the labels no longer change or the predetermined maximum number of iterations is reached; S322: Louvain algorithm divides accounts into several communities to maximize modularity. The formula is: Among them, A ij Represents the adjacency matrix. If nodes i and j are connected, then A ij is 1, otherwise it is 0; Among them, k i represents the degree of node i, m represents the sum of all weights carried by the edges, and c i represents the community assigned to node i by the algorithm, and Q represents modularity; Among them, δ(c i , c j ) represents the Kronecker delta function. If i and j belong to the same community, then δ(c i , c j ), otherwise 0; S3221: Initialization: Each node is initialized as an independent community; S3222: Local optimization stage: For each node, calculate the change in modularity after moving it to the community where the adjacent node is located, move the node to the community that can maximize its modularity gain, and repeat this process until the movement of no node increases the modularity; S3223: Graph reconstruction phase: The communities formed in the previous phase are regarded as new super nodes, and a new graph is constructed. The edges between super nodes represent the connections between communities in the original graph. The local optimization phase is repeated until the global optimum is reached or the convergence conditions are met.

6. A bank transaction data graph database analysis method based on knowledge graph features according to claim 1, characterized in that: The step S4 comprises the following sub-steps: S41: Create training subgraphs suitable for centrality metrics and community detection: S411: On the base map model, randomly extract normal accounts, all transaction relationships of normal accounts in the three months before the current month, all accounts involved in the current month, all customers involved in the one-time transaction of the account involved in the three months before the case, and all transaction relationships of the account involved in the three months before the current month. S412: construct a training subgraph consisting of normal accounts, accounts involved in the case, and accounts within one transaction of the accounts involved in the case, with a time window of 3 months; S42: Centrality measurement features, community detection, and similarity measurement of training graph features.

7. A bank transaction data graph database analysis method based on knowledge graph features according to claim 6, characterized in that: The step S42 includes the following sub-steps: S421: Degree centrality and PageRank features for training centrality metric features: Degree centrality: directly calculate the out-degree and in-degree of each account in the training subgraph, add the out-degree and in-degree of each account to get the total degree; PageRank Features: Calculate the PageRank of each account; S422: Calculate the community ID of the training sample in the community detection algorithm and save it in the attributes of the node. In the prediction process, the training sample and the prediction sample are used together to construct the subgraph. The existing community ID of the training sample is used as the seed community to initialize some nodes in the graph, and then the community ID of all nodes is: S4221: Label propagation algorithm: Directed graph features: directly calculate the community ID of each account in the training subgraph; Undirected graph features: cancel the direction of transactions in the training subgraph and calculate the community ID of each account; S4222: Louvain algorithm: Directed graph features: directly calculate the community ID of each account in the training subgraph; Undirected graph features: cancel the direction of transactions in the training subgraph and calculate the community ID of each account; S423: In the similarity measurement, the Jaccard feature is calculated according to the set of account transaction counterparties, and the normal accounts in the training subgraph are taken as the set N, and the fraudulent accounts are taken as the set F, and the set U = {N, F}, where the set U is all the training samples; S4231: Take all the counterparties in set F as set A; S4232: Take the counterparty of each element i in the set U as B i ; S4233: Calculate the Jaccard feature J(A, B) of node i i ), the formula is: Among them, J(A, B i ) represents the Jaccard feature of node i.

Images