Financial data anomaly detection method and related device

Abstract

The invention discloses a financial data anomaly detection method and a related device, and relates to the technical field of big data, and the method comprises the steps: constructing a dynamic financial knowledge graph and knowledge association information based on financial data, obtaining target knowledge associated with a target event from the dynamic financial knowledge graph based on the knowledge association information, and obtaining the target event based on the target knowledge. The target knowledge comprises the first target financial entity, the second target financial entity and the corresponding relation. And based on the target event, updating the first target financial entity, the second target financial entity and the corresponding relationship in the state financial knowledge graph. And performing clustering analysis on the financial data by using a preset clustering algorithm to obtain a clustering result, and identifying abnormal data according to the clustering result and the dynamic financial knowledge graph. According to the method, the dynamic financial knowledge graph is dynamically updated through the event, the reliability of the financial knowledge graph representing financial data knowledge is improved, and the accuracy of an anomaly detection result is improved.

Description

Technical Field

[0001] The present application relates to the field of big data technology, and in particular to a method and related device for detecting anomalies in financial data. Background Art

[0002] Anomaly detection of financial data is one of the most important tasks of data processing systems in the financial field. Its purpose is to timely discover and identify abnormal or potential fraudulent behaviors. Anomaly detection of financial data plays an important role in financial fraud identification, medical insurance fraud detection, abnormal transaction identification and other fields. With the continuous development of Internet finance, financial data presents the characteristics of large data scale, high data dimension, fast growth rate, and diversified data types, and the information contained in it is becoming more and more abundant. Due to the large amount of financial data and the unstable data characteristics, traditional anomaly detection of financial data is difficult to cope with unstable financial data, resulting in low reliability of anomaly detection of financial data. Summary of the invention

[0003] In view of the above problems, the present application provides a method and related device for detecting anomalies in financial data to achieve the purpose of improving the reliability of anomaly detection results of financial data. The specific scheme is as follows:

[0004] The first aspect of the present application provides a method for detecting anomalies in financial data, comprising:

[0005] Based on financial data, a dynamic financial knowledge graph and knowledge association information are constructed, wherein the dynamic financial knowledge graph is constructed with financial entities as nodes and relationships between financial entities as edges, and the knowledge association information includes a set of associated events and timestamps of the knowledge represented by the dynamic financial knowledge graph, wherein one piece of the knowledge is used to indicate two financial entities and a corresponding relationship, and the set of associated events includes at least one associated event;

[0006] In response to the target event update, based on the knowledge association information, acquiring target knowledge associated with the target event from the dynamic financial knowledge graph, the target knowledge including a first target financial entity and a second target financial entity and corresponding relationships;

[0007] Based on the target event, updating the first target financial entity, the second target financial entity and the corresponding relationship in the dynamic financial knowledge graph;

[0008] A clustering analysis is performed on the financial data using a preset clustering algorithm to obtain a clustering result, and abnormal data is identified based on the clustering result and the dynamic financial knowledge graph.

[0009] In one possible implementation, building a dynamic financial knowledge graph based on financial data includes:

[0010] Construct basic financial knowledge graph based on semi-structured data and structured data in financial data;

[0011] Obtain extended knowledge based on unstructured data in financial data;

[0012] The basic financial knowledge graph is expanded according to the extended knowledge to obtain the initial dynamic financial knowledge graph.

[0013] In a possible implementation, based on the unstructured data in the financial data, extended knowledge is obtained, including:

[0014] Inputting unstructured data into a pre-trained entity recognition model to obtain an entity recognition result output by the entity recognition model, wherein the entity recognition result includes a plurality of candidate financial entities, wherein the entity recognition model is obtained by performing transfer learning training on a BETR language model combined with a bidirectional LSTM network using standard entity recognition data and financial entity recognition data;

[0015] Divide the unstructured data into sentence sequences, input each sentence sequence into a pre-trained relationship classifier to obtain a relationship recognition result, wherein the relationship recognition result includes a relationship type between two candidate financial entities, and the relationship type includes whether a relationship exists and the relationship type. The relationship classifier is supervised by the basic financial knowledge graph and is obtained through reinforcement learning training;

[0016] The extended knowledge is constructed based on the entity recognition result and the relationship recognition result. One piece of the extended knowledge is used to represent two candidate financial entities and the relationship type therebetween.

[0017] In a possible implementation, the basic financial knowledge graph is expanded according to the extended knowledge to obtain the initial dynamic financial knowledge graph, including:

[0018] Based on entity similarity, entity linking is performed on each candidate financial entity and a graph financial entity in the basic financial knowledge graph to obtain an entity linking result, wherein the entity linking result includes a plurality of pairs of financial entities having a link relationship, and the financial entity pair includes a candidate financial entity and a graph financial entity;

[0019] The basic financial knowledge graph is expanded based on the extended knowledge and the entity linking results to obtain the initial dynamic financial knowledge graph.

[0020] In a possible implementation, the basic financial knowledge graph is expanded based on the extended knowledge and the entity linking result to obtain the initial dynamic financial knowledge graph, including:

[0021] If the two financial entities in the extended knowledge are linked to the two graph financial entities in the basic financial knowledge graph respectively, then, according to the relationship type between the two financial entities in the extended knowledge, an edge between the two graph financial entities in the basic financial knowledge graph is constructed.

[0022] If a first financial entity in the extended knowledge has a link relationship with at least one financial entity in the basic financial knowledge graph, and a second financial entity in the extended knowledge has no link relationship with all graph financial entities in the basic financial knowledge graph, then the second financial entity is added to the basic financial knowledge graph, and an edge between the second financial entity and the linked graph financial entity is constructed according to the relationship type between the first financial entity and the second financial entity;

[0023] If the first financial entity and the second financial entity in the extended knowledge do not have a link relationship with all graph financial entities in the basic financial knowledge graph, the first financial entity and the second financial entity are added to the basic financial knowledge graph, and an edge between the first financial entity and the second financial entity is constructed according to a relationship type between the first financial entity and the second financial entity in the extended knowledge.

[0024] A second aspect of the present application provides a financial data anomaly detection device, comprising:

[0025] A dynamic graph construction unit, used to construct a dynamic financial knowledge graph and knowledge association information based on financial data, wherein the dynamic financial knowledge graph is constructed with financial entities as nodes and relationships between financial entities as edges, and the knowledge association information includes a set of association events and a timestamp of the knowledge represented by the dynamic financial knowledge graph, wherein one piece of the knowledge is used to indicate two financial entities and a corresponding relationship, and the set of association events includes at least one association event;

[0026] An event association unit, configured to, in response to a target event update, acquire target knowledge associated with the target event from the dynamic financial knowledge graph based on the knowledge association information, the target knowledge including a first target financial entity and a second target financial entity and corresponding relationships;

[0027] A dynamic graph updating unit, configured to update the first target financial entity, the second target financial entity and the corresponding relationship in the dynamic financial knowledge graph based on the target event;

[0028] The clustering analysis unit is used to perform clustering analysis on the financial data using a preset clustering algorithm to obtain clustering results, and identify abnormal data based on the clustering results and the dynamic financial knowledge graph.

[0029] In a possible implementation, when the dynamic graph construction unit is used to construct a dynamic financial knowledge graph based on financial data, it is specifically used to:

[0030] Construct basic financial knowledge graph based on semi-structured data and structured data in financial data;

[0031] Obtain extended knowledge based on unstructured data in financial data;

[0032] The basic financial knowledge graph is expanded according to the extended knowledge to obtain the initial dynamic financial knowledge graph.

[0033] A third aspect of the present application provides a computer program product, comprising computer-readable instructions, which, when executed on an electronic device, enables the electronic device to implement the method for detecting anomalies in financial data according to the first aspect or any implementation of the first aspect.

[0034] A fourth aspect of the present application provides an electronic device, comprising at least one processor and a memory connected to the processor, wherein:

[0035] The memory is used to store computer programs;

[0036] The processor is used to execute the computer program so that the electronic device can implement the method for detecting anomalies in financial data according to the first aspect or any implementation of the first aspect.

[0037] A fifth aspect of the present application provides a computer storage medium, which carries one or more computer programs. When the one or more computer programs are executed by an electronic device, the electronic device can implement the method for detecting anomalies in financial data according to the first aspect or any implementation of the first aspect.

[0038] By means of the above technical solution, the present application provides a method and related device for detecting anomalies of financial data. Based on financial data, a dynamic financial knowledge graph and knowledge association information are constructed. The dynamic financial knowledge graph includes financial entities as nodes and relationships between financial entities as edges. The knowledge association information includes a set of associated events and timestamps of knowledge represented by the dynamic financial knowledge graph. One piece of knowledge is used to indicate two financial entities and corresponding relationships. The associated event set includes at least one associated event. In response to the target event update, based on the knowledge association information, target knowledge associated with the target event is obtained from the dynamic financial knowledge graph. The target knowledge includes a first target financial entity and a second target financial entity and corresponding relationships. Based on the target event, the first target financial entity, the second target financial entity and the corresponding relationship in the dynamic financial knowledge graph are updated. A clustering analysis is performed on the financial data using a preset clustering algorithm to obtain a clustering result. According to the clustering result and the dynamic financial knowledge graph, abnormal data is identified. The present application dynamically updates the dynamic financial knowledge graph through events, improves the reliability of the financial knowledge graph in representing the financial data knowledge, and improves the reliability and accuracy of the anomaly detection results. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the accompanying drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and the originals and elements are not necessarily drawn to scale.

[0040] Figure 1 A schematic diagram of the architecture of an anomaly detection system for financial data provided in this application;

[0041] Figure 2 A schematic diagram of the hardware structure of a terminal provided in this application;

[0042] Figure 3 A schematic diagram of the hardware structure of a server provided for this application;

[0043] Figure 4 A flowchart of a method for detecting anomalies in financial data provided by an embodiment of the present application;

[0044] Figure 5 A specific implementation flow chart of a method for detecting anomalies in financial data is provided for an embodiment of the present application;

[0045] Figure 6 A schematic diagram of the structure of an entity recognition model provided in an embodiment of the present application;

[0046] Figure 7 A schematic diagram of a reinforcement learning process provided in an embodiment of the present application;

[0047] Figure 8 A schematic diagram of an anomaly detection process for financial data provided in an embodiment of the present application;

[0048] Fig. 9 A schematic diagram of the structure of a financial data anomaly detection device provided in an embodiment of the present application;

[0049] Fig.10 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0050] The following describes the embodiments of the present application in conjunction with the drawings in the embodiments of the present application. The terms used in the implementation method section of the present application are only used to explain the specific embodiments of the present application, and are not intended to limit the present application.

[0051] The embodiments of the present application are described below in conjunction with the accompanying drawings. Those skilled in the art will appreciate that, with the development of technology and the emergence of new scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0052] The terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and need not be used to describe a specific order or sequential order. It should be understood that the terms used in this way can be interchangeable under appropriate circumstances, which is only to describe the distinction mode adopted by the objects of the same attributes when describing in the embodiments of the present application. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, so that the process, method, system, product or equipment comprising a series of units need not be limited to those units, but may include other units that are not clearly listed or inherent to these processes, methods, products or equipment.

[0053] The present application can be applied in the field of big data technology, and specifically can be applied to scenarios where anomaly detection is performed on financial data to obtain anomaly data. Specifically, an anomaly detection method for financial data provided in an embodiment of the present application can be applied to an anomaly detection system for financial data, and the anomaly detection method for financial data can be implemented through a terminal or a server in the anomaly detection system for financial data, or the anomaly detection method for financial data can be implemented through the interaction between a terminal and a server in the anomaly detection system for financial data.

[0054] See also Figure 1 , Figure 1 FIG. 1 shows a schematic diagram of an abnormality detection system architecture for financial data. The system may include a terminal 100 and a server 200. The server 200 may include one or more servers ( Figure 1In the example, a server is included, and the server 200 can provide the method provided in the embodiment of the present application for one or more terminals.

[0055] Among them, a financial data anomaly detection application can be installed on the terminal 100. The above application and web page can provide an interface. The terminal 100 can receive relevant parameters entered by the user on the anomaly detection interface and send the above parameters to the server 200. The server 200 can obtain processing results based on the received parameters and return the processing results to the terminal 100.

[0056] It should be understood that in some optional implementations, the terminal 100 can also complete the action of obtaining the processing result based on the received parameters by itself without the cooperation of the server, and the embodiments of the present application are not limited to this.

[0057] Next describe Figure 1 The product form of the mid-terminal 100;

[0058] The terminal 100 in the embodiment of the present application can be a mobile phone, a tablet computer, a wearable device, a vehicle-mounted device, an augmented reality (AR) / virtual reality (VR) device, a laptop computer, an ultra-mobile personal computer (UMPC), a netbook, a personal digital assistant (PDA), etc., and the embodiment of the present application does not impose any limitation on this.

[0059] Figure 2 An optional hardware structure diagram of the terminal 100 is shown.

[0060] refer to Figure 2 As shown, the terminal 100 may include a radio frequency unit 110, a memory 120, an input unit 130, a display unit 140, a camera 150 (optional), an audio circuit 160 (optional), a speaker 161 (optional), a microphone 162 (optional), an earphone jack 163 (optional), a processor 170, an external interface 180, a power supply 190 and other components. Those skilled in the art will appreciate that Figure 2 These are merely examples of terminals or multi-function devices and do not constitute limitations on the terminals or multi-function devices, which may include more or fewer components than those shown in the figures, or combinations of certain components, or different components.

[0061] The input unit 130 can be used to receive input digital or character information, and generate key signal input related to the user settings and function control of the portable multifunctional device. Specifically, the input unit 130 may include a touch screen 131 (optional) and / or other input devices 132. The touch screen 131 can collect the user's touch operations on or near it (such as the user's operation on or near the touch screen using any suitable object such as fingers, joints, stylus, etc.), and drive the corresponding connection device according to a pre-set program. The touch screen can detect the user's touch action on the touch screen, convert the touch action into a touch signal and send it to the processor 170, and can receive and execute the command sent by the processor 170; the touch signal at least includes the touch point coordinate information. The touch screen 131 can provide an input interface and an output interface between the terminal 100 and the user. In addition, the touch screen can be implemented using multiple types such as resistive, capacitive, infrared and surface acoustic wave. In addition to the touch screen 131, the input unit 130 can also include other input devices. Specifically, other input devices 132 may include, but are not limited to, one or more of a physical keyboard, function keys (such as a volume control key, a switch key, etc.), a trackball, a mouse, a joystick, and the like.

[0062] Among them, the input device 132 can receive input data and the like.

[0063] The display unit 140 may be used to display information input by the user or provided to the user, various menus of the terminal 100, interactive interfaces, file displays, and / or playback of any multimedia files. In an embodiment of the present application, the display unit 140 may be used to display an interface for abnormal detection of financial data, processing results, etc.

[0064] The memory 120 can be used to store instructions and data. The memory 120 can mainly include an instruction storage area and a data storage area. The data storage area can store various data, such as multimedia files, texts, etc.; the instruction storage area can store software units such as operating systems, applications, instructions required for at least one function, or their subsets and extensions. It can also include a non-volatile random access memory; provide the processor 170 with hardware, software and data resources including management of computing and processing equipment, and support control software and applications. It is also used for the storage of multimedia files, and the storage of running programs and applications.

[0065] The processor 170 is the control center of the terminal 100. It uses various interfaces and lines to connect various parts of the entire terminal 100. By running or executing instructions stored in the memory 120 and calling data stored in the memory 120, it executes various functions of the terminal 100 and processes data, thereby controlling the terminal device as a whole. Optionally, the processor 170 may include one or more processing units; preferably, the processor 170 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface and application program, and the modem processor mainly processes wireless communication. It is understandable that the above-mentioned modem processor may not be integrated into the processor 170. In some embodiments, the processor and the memory may be implemented on a single chip, and in some embodiments, they may also be implemented separately on separate chips. The processor 170 may also be used to generate corresponding operation control signals, send them to corresponding components of the computing and processing device, read and process data in the software, especially read and process data and programs in the memory 120, so that each functional module therein performs corresponding functions, thereby controlling the corresponding components to act according to the requirements of the instructions.

[0066] Among them, the memory 120 can be used to store software codes related to the anomaly detection method of financial data, the processor 170 can execute the steps of the anomaly detection method of financial data, and can also schedule other units (such as the above-mentioned input unit 130 and display unit 140) to realize corresponding functions.

[0067] The radio frequency unit 110 (optional) can be used for receiving and sending information or receiving and sending signals during a call, for example, after receiving the downlink information of the base station, it is sent to the processor 170 for processing; in addition, the designed uplink data is sent to the base station. Generally, the RF circuit includes but is not limited to an antenna, at least one amplifier, a transceiver, a coupler, a low noise amplifier (Low Noise Amplifier, LNA), a duplexer, etc. In addition, the radio frequency unit 110 can also communicate with network devices and other devices through wireless communication. The wireless communication can use any communication standard or protocol, including but not limited to Global System of Mobile communication (Global System of Mobile communication, GSM), General Packet Radio Service (General Packet Radio Service, GPRS), Code Division Multiple Access (Code Division Multiple Access, CDMA), Wideband Code Division Multiple Access (Wideband Code Division Multiple Access, WCDMA), Long Term Evolution (Long Term Evolution, LTE), email, Short Messaging Service (SMS), etc.

[0068] In this embodiment of the present application, the RF unit 110 can send data to the server 200 and receive processing results sent by the server 200.

[0069] It should be understood that the radio frequency unit 110 is optional and can be replaced by other communication interfaces, such as a network port.

[0070] The terminal 100 also includes a power supply 190 (such as a battery) for supplying power to various components. Preferably, the power supply can be logically connected to the processor 170 through a power management system, so that the power management system can manage functions such as charging, discharging, and power consumption.

[0071] The terminal 100 further includes an external interface 180 , which may be a standard Micro USB interface or a multi-pin connector, and may be used to connect the terminal 100 to communicate with other devices, or to connect a charger to charge the terminal 100 .

[0072] Although not shown, the terminal 100 may also include a flashlight, a wireless fidelity (WiFi) module, a Bluetooth module, sensors with different functions, etc., which are not described in detail here. Some or all of the methods described below may be applied in the following embodiments. Figure 2 In the terminal 100 shown.

[0073] Next describe Figure 1 The product form of the server 200;

[0074] Figure 3 A schematic diagram of the structure of a server 200 is provided, such as Figure 3 As shown, the server 200 includes a bus 201, a processor 202, a communication interface 203, and a memory 204. The processor 202, the memory 204, and the communication interface 203 communicate with each other via the bus 201.

[0075] The bus 201 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 3 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0076] The processor 202 may be any one or more of a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0077] The memory 204 may include a volatile memory, such as a random access memory (RAM). The memory 204 may also include a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD), or a solid state drive (SSD).

[0078] The memory 204 may be used to store software codes related to the method for detecting anomalies in financial data, and the processor 202 may execute the steps of the method for detecting anomalies in financial data of the chip, and may also schedule other units to implement corresponding functions.

[0079] It should be understood that the above-mentioned terminal 100 and server 200 can be centralized or distributed devices, and the processors in the above-mentioned terminal 100 and server 200 (such as processor 170 and processor 202) can be hardware circuits (such as application specific integrated circuit (ASIC), field-programmable gate array (FPGA), general-purpose processor, digital signal processor (DSP), microprocessor or microcontroller, etc.), or a combination of these hardware circuits. For example, the processor can be a hardware system with an instruction execution function, such as a CPU, DSP, etc., or a hardware system without an instruction execution function, such as an ASIC, FPGA, etc., or a combination of the above-mentioned hardware systems without an instruction execution function and hardware systems with an instruction execution function.

[0080] When the financial system performs anomaly detection on financial data, the financial knowledge graph can be used to standardize large amounts of financial data and visualize it in a user-friendly way, greatly reducing the burden on financial practitioners.

[0081] However, due to the large amount of data, complex transaction patterns and rapidly changing market conditions involved, financial data in the financial system is unstable. The knowledge graph model can more comprehensively understand the complex relationships between financial data and improve the context-awareness of anomaly detection. Therefore, using knowledge graph technology to extract financial entities and financial relationships from large amounts of data helps to discover complex associations and patterns hidden in the data. However, traditional knowledge graphs are difficult to record changing data, ignoring the potential value of changing data, and there are omissions or false positives of abnormal data, resulting in low reliability of abnormal data detection results. In addition, in the financial field, knowledge is updated frequently and quickly. The existing financial knowledge graph is updated according to a fixed time period and cannot effectively reflect the real changes in financial data in a timely manner, thus affecting the accuracy of anomaly detection results.

[0082] In order to solve the above problems, the embodiment of the present application provides a method for detecting anomalies in financial data. The method for detecting anomalies in financial data in the embodiment of the present application is described in detail below with reference to the accompanying drawings.

[0083] Reference Figure 4 , Figure 4 A flowchart of a method for detecting anomalies in financial data provided by an embodiment of the present application is shown in FIG. Figure 4 As shown, a method for detecting anomalies in financial data provided by an embodiment of the present application may include the following steps:

[0084] S401. Build a dynamic financial knowledge graph and knowledge association information based on financial data.

[0085] In this embodiment, the dynamic financial knowledge graph includes financial entities as nodes and the relationships between financial entities as edges. The knowledge association information includes a set of associated events and timestamps of the knowledge represented by the dynamic financial knowledge graph. A piece of knowledge is used to indicate two financial entities and the corresponding relationship. The associated event set includes at least one associated event.

[0086] S402. In response to the target event update, based on the knowledge association information, target knowledge associated with the target event is acquired from the dynamic financial knowledge graph.

[0087] In this embodiment, the target knowledge includes a first target financial entity and a second target financial entity and corresponding relationships. Specifically, the associated event set of each knowledge in the knowledge association information is traversed, and the knowledge with the target event in the associated set is taken as the target knowledge.

[0088] S403: Based on the target event, the first target financial entity, the second target financial entity and the corresponding relationship in the updated financial knowledge graph.

[0089] S404: Use a preset clustering algorithm to perform cluster analysis on the financial data to obtain clustering results, and identify abnormal data based on the clustering results and the dynamic financial knowledge graph.

[0090] It can be seen from the above technical solutions that the embodiment of the present application provides a method for detecting anomalies in financial data. Based on financial data, a dynamic financial knowledge graph and knowledge association information are constructed. The dynamic financial knowledge graph includes financial entities as nodes and relationships between financial entities as edges. The knowledge association information includes a set of associated events and timestamps of knowledge represented by the dynamic financial knowledge graph. One piece of knowledge is used to indicate two financial entities and corresponding relationships. The associated event set includes at least one associated event. In response to the target event update, based on the knowledge association information, target knowledge associated with the target event is obtained from the dynamic financial knowledge graph. The target knowledge includes a first target financial entity and a second target financial entity and corresponding relationships. Based on the target event, the first target financial entity, the second target financial entity and the corresponding relationship in the dynamic financial knowledge graph are updated. A clustering analysis is performed on the financial data using a preset clustering algorithm to obtain a clustering result. According to the clustering result and the dynamic financial knowledge graph, abnormal data is identified. The present application dynamically updates the dynamic financial knowledge graph through events, improves the reliability of the financial knowledge graph in representing the financial data knowledge, and improves the accuracy of the anomaly detection results.

[0091] Furthermore, the present application provides a specific implementation method of a method for detecting anomalies in financial data. Figure 5A specific implementation flow chart of a method for detecting anomalies in financial data is provided for the present application embodiment. Figure 5 As shown, the method includes:

[0092] S501. Perform data preprocessing on original financial data to obtain target financial data.

[0093] In this embodiment, the target financial data includes semi-structured data, structured data, and unstructured data.

[0094] In this embodiment, data preprocessing includes data cleaning, filtering, deduplication and other preprocessing operations.

[0095] S502. Identify basic knowledge based on semi-structured data and structured data.

[0096] S503. Use basic knowledge to construct a basic financial knowledge graph.

[0097] In this embodiment, basic knowledge represents financial entities and their relationship types in semi-structured and structured data. The basic financial knowledge graph uses financial entities as nodes and the relationships between financial entities as edges. Specifically, preset first-category financial entities are extracted from semi-structured data, and second-category financial entities are constructed using transaction information (such as remittance information and identity authentication information) in the semi-structured data, and entity information associated with each financial entity is obtained, wherein the first-category financial entities include banks and financial institutions, and the second-category financial entities include personal entities and other corporate entities.

[0098] In this embodiment, a basic financial knowledge graph is constructed based on various financial entities and related entity information.

[0099] S504: Input the unstructured data into a pre-trained entity recognition model to obtain an entity recognition result output by the entity recognition model.

[0100] In this embodiment, the entity recognition result includes multiple financial entities, ie, candidate financial entities.

[0101] In this embodiment, the entity recognition model is a BETR language model combined with a bidirectional LSTM network. Figure 6 A schematic diagram of the structure of an entity recognition model provided in an embodiment of the present application is shown in FIG. Figure 6As shown in the figure, the entity recognition model is composed of the input layer, BETR (Bidirectional Encoder Representation from Transformers, unsupervised pre-training model) layer, bidirectional LSTM (Long Short Term Memory) layer (also known as BiLSTM layer), and CRF (Conditional Random Fields) layer from bottom to top, among which the CRF layer is the output layer.

[0102] In this embodiment, the training method of the entity recognition model includes:

[0103] The entity recognition model is initially trained using standard entity recognition data to obtain a standard entity recognition model, wherein the standard entity recognition data includes entity recognition sample data in all fields.

[0104] Further, the standard entity recognition model is retrained according to the financial entity recognition data, the sizes of the bidirectional LSTM layer and the CRF layer are optimized, and the weights of other network layers are fixed to obtain the entity recognition model, so as to fine-tune the parameters of the standard entity recognition model based on the financial entity recognition data. The financial entity recognition data includes entity recognition sample data in the financial field. The entity recognition sample data includes sample text and annotated entities.

[0105] It should be noted that in this step, the model parameters learned from the initial training are transferred to the retraining task through transfer learning to help improve the learning effect of the entity recognition model.

[0106] S505: Based on entity similarity, entity linking is performed on each financial entity in the entity recognition result and the financial entity in the basic financial knowledge graph to obtain an entity linking result.

[0107] In this embodiment, the entity similarity between any two financial entities is used to indicate the degree of similarity between the two financial entities. If the entity similarity is greater than a preset similarity threshold, a link relationship exists, and the entity linking result includes multiple pairs of financial entities with link relationships.

[0108] In this embodiment, the method for obtaining entity similarity between two financial entities includes:

[0109] The Word2Vec similarity and the Jaccard similarity between the two financial entities are obtained, and the text similarity of the two financial entities is obtained based on the Word2Vec similarity and the Jaccard similarity. Optionally, the Word2Vec similarity and the Jaccard similarity are weightedly added to obtain the text similarity.

[0110] The semantic similarity between two financial entities is calculated based on the similarity calculation model, and the similarity calculation model is the BERT network model.

[0111] The text similarity and semantic similarity are weightedly added to obtain entity similarity.

[0112] In this embodiment, entity similarity integrates text similarity and semantic similarity, improves the accuracy of similarity measurement between two financial entities, and improves the accuracy of entity linking results.

[0113] S506: Divide the unstructured data into sentence sequences, input each sentence sequence into a pre-trained relation classifier, and obtain a relation recognition result.

[0114] In this embodiment, the relationship recognition result includes the relationship type between each financial entity in the entity recognition result, the relationship type includes whether there is a relationship and the relationship type, and the relationship classifier is a BERT model.

[0115] In this embodiment, the relationship classifier is trained based on reinforcement learning under the supervision of the basic financial knowledge graph. Figure 7 A schematic diagram of a reinforcement learning process provided in an embodiment of the present application is shown in FIG. Figure 7 As shown in the figure, the relation classifier includes an input layer, a BERT layer, a CNN layer (or RNN layer), and a likelihood function layer. The instance selector trains a behavior policy distribution function through the policy gradient training method to make decisions on sentence sequences. First, the relation classifier is pre-trained to classify the sentence sequence. Further, the instance selector is pre-trained after the relation classifier is fixed. In each iteration, the instance selector updates the parameters based on the behavior policy distribution function trained by the policy gradient training method according to the feedback of the relation classifier. During joint training, the instance selector uses reinforcement learning to provide filtered training data for the relation classifier. The relation classifier obtains the relationship recognition result by performing the classification task on the filtered training data, and uses the relationship recognition result feedback to optimize the instance selector.

[0116] In this step, reinforcement learning is used to screen out key samples that can significantly improve the performance of the BERT model from a large number of candidate samples, that is, to select samples that are most helpful for BERT training, thereby improving the training efficiency of the BERT model and improving the classification accuracy of the relational classifier.

[0117] Financial relationship extraction is to determine whether two entities in a sentence are related and determine the category of the relationship, such as a cooperative relationship, a financial transaction relationship, etc. Relationship classification can be regarded as a subtask of relationship extraction. In the relationship classification task, no relationship is regarded as a special relationship category, and the relationship classification task can be equivalent to the relationship extraction task. The difficulty of the relationship classification task is that it requires a large amount of labeled data, and the mainstream method is remote supervision. Remote supervision generates training data based on existing databases. Traditional remote supervision assumes that there is a relationship between two entities in a sentence, which will inevitably introduce a lot of noise into the data.

[0118] Therefore, this step uses reinforcement learning to screen out key samples that can significantly improve the performance of the BERT model from a large number of candidate samples, that is, to select samples that are most helpful for BERT training, thereby improving the training efficiency of the BERT model and improving the classification effect of the relational classifier.

[0119] S507: Acquire an extended knowledge set based on the entity recognition result and the relationship recognition result.

[0120] In this embodiment, the extended knowledge set includes multiple extended knowledge, one of which is used to represent two financial entities and the relationship type between them. Specifically, one of the extended knowledge includes a triple determined based on the entity recognition result, the entity linking result and the relationship recognition result, and the triple includes the two financial entities and the relationship type between them.

[0121] S508. Expand the basic financial knowledge graph based on the extended knowledge and entity linking results to obtain a dynamic financial knowledge graph.

[0122] In this embodiment, for any extended knowledge, namely, target extended knowledge, the target extended knowledge includes a first financial entity and a second financial entity, and the method for expanding the basic financial knowledge graph based on the target extended knowledge and the entity linking result includes:

[0123] If the entity linking result indicates that the two financial entities in the target extended knowledge are linked to the two financial entities in the basic financial knowledge graph respectively, then, according to the relationship between the two financial entities in the target extended knowledge, the edge of the two financial entities in the basic financial knowledge graph is constructed, and the two financial entities in the target extended knowledge are used as the subsidiary information of the two financial entities in the basic financial knowledge graph respectively.

[0124] If the entity linking result indicates that the first financial entity has a link relationship with at least one financial entity in the basic financial knowledge graph, and the second financial entity has no link relationship with all financial entities in the basic financial knowledge graph, then the second financial entity is added to the basic financial knowledge graph, an edge between the second financial entity and the target first financial entity is constructed according to the relationship between the first financial entity and the second financial entity in the target extended knowledge, and the first financial entity is used as the attached information of the target first financial entity, and the target first financial entity is a financial entity in the basic financial knowledge graph that has a link relationship with the first financial entity.

[0125] If the entity linking result indicates that the first financial entity and the second financial entity do not have a link relationship with all financial entities in the basic financial knowledge graph, the first financial entity and the second financial entity are added to the basic financial knowledge graph, and an edge between the first financial entity and the second financial entity is constructed according to the relationship between the first financial entity and the second financial entity in the target extended knowledge.

[0126] S509: Obtain the timestamp and associated event set of each piece of knowledge represented by the dynamic financial knowledge graph.

[0127] In this embodiment, a piece of knowledge includes two financial entities and a relationship. The timestamp indicates the update time of the knowledge. It should be noted that the association granularity can be flexibly configured. For example, the associated event set of a relationship or a financial entity can be obtained separately. It can be understood that the associated event set of the knowledge is the collection of the associated event sets of the two financial entities and their relationship represented by the knowledge.

[0128] S510 . In response to a target event update of financial data, obtain target knowledge associated with the target event.

[0129] In this embodiment, the target knowledge includes knowledge associated with the real-time event. Specifically, the associated event set of the knowledge is traversed, and the knowledge in the associated set that has the target event is taken as the target knowledge.

[0130] S511. Based on the target event, the first target financial entity, the second target financial entity and the corresponding relationship in the updated financial knowledge graph.

[0131] In this embodiment, the target knowledge includes a first target financial entity and a second target financial entity and corresponding relationships.

[0132] In summary, S501~S511 provide an optional specific method for constructing a dynamic financial knowledge graph. Figure 8 A schematic diagram of an anomaly detection process for financial data provided in an embodiment of the present application is shown in FIG. Figure 8 As shown, this application includes basic financial knowledge graph construction and graph expansion in the knowledge graph construction stage.

[0133] The construction of basic financial knowledge graph includes building basic financial knowledge graph based on semi-structured data and structured data.

[0134] Graph expansion includes data preprocessing, entity recognition, entity linking, relationship extraction, and graph expansion.

[0135] Entity recognition stage: The knowledge learned from the standard entity recognition dataset is transferred to the financial field through transfer learning, so as to fine-tune the entity recognition model on the financial entity recognition task and improve the performance of the entity recognition model.

[0136] Entity linking stage: The text similarity of entities is measured based on Word2Vec and Jaccard similarity, and the semantic similarity between entities in the text and knowledge graph entities is calculated based on the BERT network. Multiple similarity calculation methods are combined through similarity features, such as weighted summation, to obtain the final entity similarity, thereby obtaining entity linking results.

[0137] Relationship extraction stage: Reinforcement learning is introduced in the remote supervision training process based on the basic financial knowledge graph to build a BERT model for entity relationship extraction, effectively reducing the noise caused by remote supervision.

[0138] Graph expansion stage: Expand the basic financial knowledge graph based on entity recognition results, relationship recognition results, and entity linking results, and add associated event sets and timestamps to obtain a dynamic financial knowledge graph.

[0139] It should be noted that the method for locally updating the dynamic financial knowledge graph also includes: based on timestamps, monitoring the duration of objects in the dynamic financial knowledge graph, if the duration of the target object reaches a preset duration threshold, updating the target object, the target object includes the financial view indicated by any node or the relationship indicated by any edge.

[0140] S512. Use a preset clustering algorithm to perform cluster analysis on the financial data to be analyzed to obtain clustering results, and identify abnormal data based on the clustering results and the dynamic financial knowledge graph.

[0141] In this embodiment, the clustering algorithm includes K-means clustering and outlier detection algorithm DBSCAN, etc.

[0142] It should be noted that clustering algorithm is an unsupervised learning method that divides the data set into multiple clusters so that the data points within the same cluster are more similar, while the data points between different clusters are less similar. In abnormal data detection, clustering algorithm can identify abnormal data points that are significantly different from normal data points.

[0143] In this embodiment, the specific process of identifying abnormal data includes:

[0144] 1. Define normal financial entity behavior based on dynamic knowledge graph.

[0145] In this embodiment, normal financial entity behavior includes the link relationship, transaction model, financial indicators, etc. between financial entities.

[0146] 2. Extract financial entities and behavioral characteristics from financial data.

[0147] In this embodiment, the behavior characteristics include relationship strength, transaction frequency, entity attributes, etc., and data such as financial entities and behavior characteristics are extracted for standardization or normalization.

[0148] 3. Use the characteristic data of normal behavior to train the anomaly recognition model and define the boundaries of normal behavior data.

[0149] 4. Identify the data through the trained model and determine whether the data is abnormal based on the output of the model.

[0150] It can be seen from the above technical solution that an anomaly detection method for financial data provided in an embodiment of the present application utilizes a basic financial knowledge graph based on semi-structured data and structured data to extract extended knowledge from unstructured data under the supervision of the basic financial knowledge graph, based on the structure of the basic financial knowledge graph of extended knowledge, and adds associated events to the financial entities or relationships in the basic financial knowledge graph, thereby constructing a dynamic financial knowledge graph, and locally updating the dynamic financial knowledge graph based on changes in timestamps or events.

[0151] Furthermore, the present application also includes a real-time detection and updating method, specifically including:

[0152] In order to adapt to the rapidly changing market conditions, the financial knowledge graph is updated incrementally on a regular basis to adapt to the dynamic changes in the financial field. The incremental update method is used to avoid rebuilding the entire graph for each update, thereby improving the updating efficiency of the knowledge graph.

[0153] Through reinforcement learning, anomaly detection strategies are adjusted in real time to ensure timely responses to emerging risks and abnormal behaviors. Knowledge graphs and reinforcement learning models are integrated to fully utilize the synergy between the two.

[0154] It can be seen from the above technical solution that this solution can at least achieve the following technical effects:

[0155] This application makes full use of semi-structured, structured and unstructured data to construct a dynamic knowledge graph, so as to fully tap the value of unstructured data such as text, images, audio, etc. in financial data, so as to obtain more comprehensive knowledge and build a more complete dynamic knowledge graph, thereby helping to better capture data anomalies.

[0156] This application focuses on the dynamic changes of financial entities and relationships over time or events, and associates the updates of the dynamic financial knowledge graph with events to ensure that the dynamic financial knowledge graph can be locally updated in real time in response to changes in financial data.

[0157] The present application provides an incremental update method for a dynamic financial knowledge graph so as to avoid rebuilding the entire graph every time the data changes, thereby being able to efficiently update and maintain the dynamic financial knowledge graph.

[0158] This application combines remote supervision and reinforcement learning to implement the entity relationship extraction task, which not only solves the problem of relationship extraction requiring large amounts of data annotation, but also effectively reduces the noise of remote supervision and improves the performance of the model.

[0159] A method for detecting anomalies in financial data provided by an embodiment of the present application is introduced above. A device for executing the above method for detecting anomalies in financial data will be introduced below.

[0160] See also Fig. 9 , Fig. 9 A schematic diagram of the structure of a financial data anomaly detection device provided in an embodiment of the present application. Fig. 9 As shown, the financial data anomaly detection device 900 includes:

[0161] A dynamic graph construction unit 901 is used to construct a dynamic financial knowledge graph and knowledge association information based on financial data, wherein the dynamic financial knowledge graph is constructed with financial entities as nodes and relationships between financial entities as edges, and the knowledge association information includes a set of association events and a timestamp of the knowledge represented by the dynamic financial knowledge graph, wherein one piece of the knowledge is used to indicate two financial entities and a corresponding relationship, and the set of association events includes at least one association event;

[0162] An event association unit 902 is used to obtain target knowledge associated with the target event from the dynamic financial knowledge graph in response to the target event update based on the knowledge association information, wherein the target knowledge includes a first target financial entity and a second target financial entity and corresponding relationships;

[0163] A dynamic graph updating unit 903, configured to update the first target financial entity, the second target financial entity and the corresponding relationship in the dynamic financial knowledge graph based on the target event;

[0164] The clustering analysis unit 904 is used to perform cluster analysis on the financial data using a preset clustering algorithm to obtain clustering results, and identify abnormal data based on the clustering results and the dynamic financial knowledge graph.

[0165] In a possible implementation, when the dynamic graph construction unit is used to construct a dynamic financial knowledge graph based on financial data, it is specifically used to:

[0166] Construct basic financial knowledge graph based on semi-structured data and structured data in financial data;

[0167] Obtain extended knowledge based on unstructured data in financial data;

[0168] The basic financial knowledge graph is expanded according to the extended knowledge to obtain the initial dynamic financial knowledge graph.

[0169] In a possible implementation, the dynamic graph construction unit is used to obtain extended knowledge based on unstructured data in financial data, specifically for:

[0170] Inputting unstructured data into a pre-trained entity recognition model to obtain an entity recognition result output by the entity recognition model, wherein the entity recognition result includes a plurality of candidate financial entities, wherein the entity recognition model is obtained by performing transfer learning training on a BETR language model combined with a bidirectional LSTM network using standard entity recognition data and financial entity recognition data;

[0171] Divide the unstructured data into sentence sequences, input each sentence sequence into a pre-trained relationship classifier to obtain a relationship recognition result, wherein the relationship recognition result includes a relationship type between two candidate financial entities, and the relationship type includes whether a relationship exists and the relationship type. The relationship classifier is supervised by the basic financial knowledge graph and is obtained through reinforcement learning training;

[0172] The extended knowledge is constructed based on the entity recognition result and the relationship recognition result. One piece of the extended knowledge is used to represent two candidate financial entities and the relationship type therebetween.

[0173] In a possible implementation, the dynamic graph construction unit is used to expand the basic financial knowledge graph according to the extended knowledge to obtain the initial dynamic financial knowledge graph, specifically for:

[0174] Based on entity similarity, entity linking is performed on each candidate financial entity and a graph financial entity in the basic financial knowledge graph to obtain an entity linking result, wherein the entity linking result includes a plurality of pairs of financial entities having a link relationship, and the financial entity pair includes a candidate financial entity and a graph financial entity;

[0175] The basic financial knowledge graph is expanded based on the extended knowledge and the entity linking results to obtain the initial dynamic financial knowledge graph.

[0176] In a possible implementation, the dynamic graph construction unit is used to expand the basic financial knowledge graph based on the extended knowledge and the entity linking result to obtain the initial dynamic financial knowledge graph, specifically for:

[0177] If the two financial entities in the extended knowledge are linked to the two graph financial entities in the basic financial knowledge graph respectively, then, according to the relationship type between the two financial entities in the extended knowledge, an edge between the two graph financial entities in the basic financial knowledge graph is constructed.

[0178] If a first financial entity in the extended knowledge has a link relationship with at least one financial entity in the basic financial knowledge graph, and a second financial entity in the extended knowledge has no link relationship with all graph financial entities in the basic financial knowledge graph, then the second financial entity is added to the basic financial knowledge graph, and an edge between the second financial entity and the linked graph financial entity is constructed according to the relationship type between the first financial entity and the second financial entity;

[0179] If the first financial entity and the second financial entity in the extended knowledge do not have a link relationship with all graph financial entities in the basic financial knowledge graph, the first financial entity and the second financial entity are added to the basic financial knowledge graph, and an edge between the first financial entity and the second financial entity is constructed according to a relationship type between the first financial entity and the second financial entity in the extended knowledge.

[0180] The present application also provides an electronic device in an embodiment. Fig.10 As shown, it shows a schematic diagram of the structure of an electronic device suitable for implementing the embodiment of the present application. The electronic device in the embodiment of the present application may include but is not limited to fixed terminals such as mobile phones, laptops, PDAs (personal digital assistants), PADs (tablet computers), desktop computers, etc. Fig.10 The electronic device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0181] like Fig.10As shown, the electronic device may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 1001, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1002 or a program loaded from a storage device 1008 to a random access memory (RAM) 1003. When the electronic device is powered on, various programs and data required for the operation of the electronic device are also stored in the RAM 1003. The processing device 1001, the ROM 1002, and the RAM 1003 are connected to each other via a bus 1004. An input / output (I / O) interface 1005 is also connected to the bus 1004.

[0182] Typically, the following devices may be connected to the I / O interface 1005: an input device 1006 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 1007 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 1008 including, for example, a memory card, a hard disk, etc.; and a communication device 1009. The communication device 1009 may allow the electronic device to communicate with other devices wirelessly or by wire to exchange data. Although Fig.10 An electronic device having various devices is shown, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0183] An embodiment of the present application also provides a computer program product including computer-readable instructions. When the computer-readable instructions are executed on an electronic device, the electronic device implements any one of the financial data anomaly detection methods provided in the embodiments of the present application.

[0184] A computer-readable storage medium is also provided in an embodiment of the present application. The storage medium carries one or more computer programs. When the one or more computer programs are executed by an electronic device, the electronic device can implement any one of the financial data anomaly detection methods provided in the embodiment of the present application.

[0185] It should also be noted that the device embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed over multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. In addition, in the drawings of the device embodiments provided by the present application, the connection relationship between the modules indicates that there is a communication connection between them, which may be specifically implemented as one or more communication buses or signal lines.

[0186] Through the description of the above implementation mode, the technicians in the field can clearly understand that the present application can be implemented by means of software plus necessary general hardware, and of course, it can also be implemented by special hardware including special integrated circuits, special CPUs, special memories, special components, etc. In general, all functions completed by computer programs can be easily implemented by corresponding hardware, and the specific hardware structure used to implement the same function can also be various, such as analog circuits, digital circuits or special circuits. However, for the present application, software program implementation is a better implementation mode in more cases. Based on such an understanding, the technical solution of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a readable storage medium, such as a computer floppy disk, a U disk, a mobile hard disk, a ROM, a RAM, a disk or an optical disk, etc., including a number of instructions to enable a computer device (which can be a personal computer, a training device, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0187] In the above embodiments, all or part of the embodiments may be implemented by software, hardware, firmware or any combination thereof. When implemented by software, all or part of the embodiments may be implemented in the form of a computer program product.

[0188] The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from a website site, a computer, a training device, or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, training device, or data center. The computer-readable storage medium may be any available medium that a computer can store or a data storage device such as a training device, a data center, etc. that includes one or more available media integrations. The available medium may be a magnetic medium, (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive (SSD)), etc.

Claims

1. A method for detecting anomalies in financial data, characterized in that: include: Based on financial data, a dynamic financial knowledge graph and knowledge association information are constructed, wherein the dynamic financial knowledge graph is constructed with financial entities as nodes and relationships between financial entities as edges, and the knowledge association information includes a set of associated events and timestamps of the knowledge represented by the dynamic financial knowledge graph, wherein one piece of the knowledge is used to indicate two financial entities and a corresponding relationship, and the set of associated events includes at least one associated event; In response to the target event update, based on the knowledge association information, acquiring target knowledge associated with the target event from the dynamic financial knowledge graph, the target knowledge including a first target financial entity and a second target financial entity and corresponding relationships; Based on the target event, updating the first target financial entity, the second target financial entity and the corresponding relationship in the dynamic financial knowledge graph; A clustering analysis is performed on the financial data using a preset clustering algorithm to obtain a clustering result, and abnormal data is identified based on the clustering result and the dynamic financial knowledge graph.

2. The method for detecting anomalies in financial data according to claim 1, characterized in that: The construction of a dynamic financial knowledge graph based on financial data includes: Construct basic financial knowledge graph based on semi-structured data and structured data in financial data; Obtain extended knowledge based on unstructured data in financial data; The basic financial knowledge graph is expanded according to the extended knowledge to obtain the initial dynamic financial knowledge graph.

3. The method for detecting anomalies in financial data according to claim 2, characterized in that: The method of acquiring extended knowledge based on unstructured data in financial data includes: Inputting unstructured data into a pre-trained entity recognition model to obtain an entity recognition result output by the entity recognition model, wherein the entity recognition result includes a plurality of candidate financial entities, wherein the entity recognition model is obtained by performing transfer learning training on a BETR language model combined with a bidirectional LSTM network using standard entity recognition data and financial entity recognition data; Divide the unstructured data into sentence sequences, input each sentence sequence into a pre-trained relationship classifier to obtain a relationship recognition result, wherein the relationship recognition result includes a relationship type between two candidate financial entities, and the relationship type includes whether a relationship exists and the relationship type. The relationship classifier is supervised by the basic financial knowledge graph and is obtained through reinforcement learning training; The extended knowledge is constructed based on the entity recognition result and the relationship recognition result. One piece of the extended knowledge is used to represent two candidate financial entities and the relationship type therebetween.

4. The method for detecting anomalies in financial data according to claim 2, characterized in that: The step of expanding the basic financial knowledge graph according to the extended knowledge to obtain the initial dynamic financial knowledge graph includes: Based on entity similarity, entity linking is performed on each candidate financial entity and a graph financial entity in the basic financial knowledge graph to obtain an entity linking result, wherein the entity linking result includes a plurality of pairs of financial entities having a link relationship, and the financial entity pair includes a candidate financial entity and a graph financial entity; The basic financial knowledge graph is expanded based on the extended knowledge and the entity linking results to obtain the initial dynamic financial knowledge graph.

5. The method for detecting anomalies in financial data according to claim 4, characterized in that: The step of expanding the basic financial knowledge graph based on the extended knowledge and the entity linking result to obtain the initial dynamic financial knowledge graph includes: If the two financial entities in the extended knowledge are linked to the two graph financial entities in the basic financial knowledge graph, then, according to the relationship type between the two financial entities in the extended knowledge, an edge between the two graph financial entities in the basic financial knowledge graph is constructed; If a first financial entity in the extended knowledge has a link relationship with at least one financial entity in the basic financial knowledge graph, and a second financial entity in the extended knowledge has no link relationship with all graph financial entities in the basic financial knowledge graph, then the second financial entity is added to the basic financial knowledge graph, and an edge between the second financial entity and the linked graph financial entity is constructed according to the relationship type between the first financial entity and the second financial entity; If the first financial entity and the second financial entity in the extended knowledge do not have a link relationship with all graph financial entities in the basic financial knowledge graph, the first financial entity and the second financial entity are added to the basic financial knowledge graph, and an edge between the first financial entity and the second financial entity is constructed according to a relationship type between the first financial entity and the second financial entity in the extended knowledge.

6. A device for detecting anomalies in financial data, characterized in that: include: A dynamic graph construction unit, used to construct a dynamic financial knowledge graph and knowledge association information based on financial data, wherein the dynamic financial knowledge graph is constructed with financial entities as nodes and relationships between financial entities as edges, and the knowledge association information includes a set of association events and a timestamp of the knowledge represented by the dynamic financial knowledge graph, wherein one piece of the knowledge is used to indicate two financial entities and a corresponding relationship, and the set of association events includes at least one association event; An event association unit, configured to, in response to a target event update, acquire target knowledge associated with the target event from the dynamic financial knowledge graph based on the knowledge association information, the target knowledge including a first target financial entity and a second target financial entity and corresponding relationships; A dynamic graph updating unit, configured to update the first target financial entity, the second target financial entity and the corresponding relationship in the dynamic financial knowledge graph based on the target event; The clustering analysis unit is used to perform clustering analysis on the financial data using a preset clustering algorithm to obtain clustering results, and identify abnormal data based on the clustering results and the dynamic financial knowledge graph.

7. The financial data anomaly detection device according to claim 6, characterized in that: The dynamic graph construction unit is used to construct a dynamic financial knowledge graph based on financial data, specifically for: Construct basic financial knowledge graph based on semi-structured data and structured data in financial data; Obtain extended knowledge based on unstructured data in financial data; The basic financial knowledge graph is expanded according to the extended knowledge to obtain the initial dynamic financial knowledge graph.

8. A computer program product, characterized in that It includes computer-readable instructions, and when the computer-readable instructions are executed on an electronic device, the electronic device implements the method for detecting anomalies in financial data as described in any one of claims 1 to 5.

9. An electronic device, characterized in that: The method comprises at least one processor and a memory connected to the processor, wherein: The memory is used to store computer programs; The processor is used to execute the computer program so that the electronic device can implement the method for detecting anomalies in financial data as described in any one of claims 1 to 5.

10. A computer storage medium, characterized in that: The storage medium carries one or more computer programs, and when the one or more computer programs are executed by an electronic device, the electronic device can implement the method for detecting anomalies in financial data as described in any one of claims 1 to 5.

Images