Abnormal transaction identification method and related device

Abstract

The invention discloses an abnormal transaction identification method and a related device, and the method comprises the steps: obtaining current transaction data, determining the newly-added attribute graph elements of the current transaction data relative to an existing attribute graph, sending the newly-added attribute graph elements to an execution engine in a query actuator, controlling the execution engine to generate a matching task according to a sub-graph matching sequence, and scheduling and querying a corresponding execution operator in the executor based on the matching task, sending the newly-added attribute graph elements to the execution operator, controlling the execution operator to match instances of the newly-added attribute graph elements according to a sub-graph matching sequence, and when a complete instance is matched, determining that the current transaction data is an abnormal transaction. According to the invention, the attribute graph is constructed according to the transaction data, and the corresponding sub-graph matching sequence is generated for each abnormal transaction mode, so that the new attribute graph element of the current transaction data relative to the existing attribute graph is matched with the instance according to the sub-graph matching sequence, and automatic identification of the abnormal transaction can be realized. Therefore, the recognition efficiency of the abnormal transaction is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of transaction identification, and more specifically, to an abnormal transaction identification method and related devices. Background Art

[0002] Credit business, also known as credit assets or loan business, is the process by which financial institutions (such as banks, credit unions, etc.) provide funds to individuals, enterprises or governments. In this business, financial institutions, as lenders, provide funds to borrowers (individuals, enterprises or other organizations), and borrowers promise to repay the loans at a certain point in the future according to the agreed terms and interest rates. With the large-scale development of credit business, its impact on the economy, financial system and society has become increasingly significant.

[0003] However, financial institutions currently have limited means of monitoring the use of credit funds. After taking out loans, some customers evade bank fund detection by transferring funds multiple times or to multiple people, and conduct abnormal transactions, making it difficult for financial institutions to track the flow of funds. Currently, most scenarios for such abnormal transactions rely on expert experience and account manager constraints. Faced with rapidly expanding business data, it takes a long time to identify abnormal transactions. Summary of the invention

[0004] In view of this, the present invention discloses an abnormal transaction identification method and related devices to realize automatic identification of abnormal transactions and improve the identification efficiency of abnormal transactions.

[0005] An abnormal transaction identification method, comprising:

[0006] Acquire current transaction data, wherein the current transaction data includes: transaction subject and transaction type;

[0007] Determine a newly added attribute graph element of the current transaction data relative to the existing attribute graph, and send the newly added attribute graph element to an execution engine in a query executor, wherein the newly added attribute graph element includes: a vertex, an edge, a vertex attribute, and an edge attribute;

[0008] Control the execution engine to generate matching tasks according to the subgraph matching order, and schedule the corresponding execution operator in the query executor based on the matching tasks, and send the newly added attribute graph elements to the execution operator, wherein each subgraph matching order is generated based on an abnormal transaction pattern;

[0009] Controlling the execution operator to match the newly added attribute graph element to the instance according to the subgraph matching order;

[0010] When a complete instance is matched, the current transaction data is determined to be an abnormal transaction.

[0011] Optionally, after determining that the current transaction data is an abnormal transaction when a complete instance is matched, the method further includes:

[0012] Freeze the account related to the current transaction data and recover the funds, and output a notification that the current transaction data is an abnormal transaction.

[0013] Optionally, controlling the execution operator to match the newly added attribute graph element to the instance according to the subgraph matching order includes:

[0014] Controlling the execution operator to search the query optimizer for an abnormal transaction pattern index corresponding to the subgraph matching order;

[0015] If the abnormal transaction pattern index is found, a new partial match instance corresponding to the newly added attribute graph element is generated based on the abnormal transaction pattern index, and sent to the next first target execution operator in an idle state;

[0016] If the abnormal transaction pattern index is not found, the nodes to be expanded, node attributes, and connected edge attributes in the newly added attribute graph element are sent to the distributed graph storage module, and the edges connected to the nodes to be expanded in the attribute graph are requested;

[0017] Control the distributed graph storage module to search for a target edge that meets the conditions from the attribute graph using a node attribute index and an edge attribute index based on the node to be expanded, the node attribute, and the edge attribute of the connection, and send the target edge to the execution operator;

[0018] After the execution operator receives the target edge, it is controlled to generate a new partial matching instance and send it to the next second target execution operator that is in an idle state.

[0019] Optionally, before obtaining the current transaction data, the method further includes:

[0020] Acquire historical transaction data, wherein the historical transaction data includes: transaction subject and transaction type;

[0021] A property graph element is determined from the historical transaction data, and the property graph is created based on the property graph element.

[0022] Optionally, it also includes:

[0023] A graph partitioning strategy is used to map nodes in the attribute graph to different devices for storage;

[0024] Node attribute indexes and edge attribute indexes are established for the node attributes and edge attributes of the attribute graph.

[0025] Optionally, before obtaining the current transaction data, the method further includes:

[0026] Obtain various abnormal transaction patterns;

[0027] Generate a corresponding subgraph matching order for each abnormal transaction pattern;

[0028] For nodes frequently visited in the attribute graph, each abnormal transaction pattern is calculated as a subgraph instance when querying the graph, and the abnormal transaction pattern index is updated accordingly.

[0029] An abnormal transaction identification device, comprising:

[0030] A current data acquisition unit, used to acquire current transaction data, wherein the current transaction data includes: a transaction subject and a transaction type;

[0031] A property graph element determination unit, used to determine a newly added property graph element of the current transaction data relative to the existing property graph, and send the newly added property graph element to the execution engine in the query executor, wherein the newly added property graph element includes: a vertex, an edge, a vertex attribute, and an edge attribute;

[0032] An execution operator scheduling unit, used to control the execution engine to generate matching tasks according to the subgraph matching order, and schedule the corresponding execution operator in the query executor based on the matching task, and send the newly added attribute graph element to the execution operator, wherein each subgraph matching order is generated based on an abnormal transaction pattern;

[0033] A matching unit, used to control the execution operator to match the newly added attribute graph element to the instance according to the subgraph matching order;

[0034] The abnormal transaction determination unit is used to determine that the current transaction data is an abnormal transaction when a complete instance is matched.

[0035] A computer program product includes computer-readable instructions. When the computer-readable instructions are executed on an electronic device, the electronic device implements the abnormal transaction identification method described above.

[0036] An electronic device, comprising: a memory and a processor;

[0037] The memory is used to store at least one instruction;

[0038] The processor is used to execute the at least one instruction to implement the above-mentioned abnormal transaction identification method.

[0039] A computer storage medium carries one or more computer programs. When the one or more computer programs are executed by an electronic device, the electronic device can implement the abnormal transaction identification method described above.

[0040] As can be seen from the above technical solutions, the present invention discloses an abnormal transaction identification method and related devices, which obtains current transaction data, determines the newly added attribute graph elements of the current transaction data relative to the existing attribute graph, and sends the newly added attribute graph elements to the execution engine in the query executor, controls the execution engine to generate matching tasks according to the subgraph matching order, and schedules the corresponding execution operator in the query executor based on the matching tasks, and sends the newly added attribute graph elements to the execution operator at the same time, controls the execution operator to match the newly added attribute graph elements to the instance according to the subgraph matching order, and when the complete instance is matched, determines that the current transaction data is an abnormal transaction. The present invention constructs an attribute graph according to the transaction data, and generates a corresponding subgraph matching order for each abnormal transaction mode, so that the automatic identification of abnormal transactions can be achieved by matching the newly added attribute graph elements of the current transaction data relative to the existing attribute graph in the subgraph matching order, thereby greatly improving the efficiency of identifying abnormal transactions. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the disclosed drawings without paying creative work.

[0042] Figure 1 A flow chart of an abnormal transaction identification method disclosed in an embodiment of the present invention;

[0043] Figure 2 A schematic diagram of an attribute graph disclosed in an embodiment of the present invention;

[0044] Figure 3-1 A schematic diagram of a query graph disclosed in an embodiment of the present invention;

[0045] Figure 3-2 A schematic diagram of a data graph disclosed in an embodiment of the present invention;

[0046] Figure 3-3 A schematic diagram of a matching example disclosed in an embodiment of the present invention;

[0047] Figure 4 A schematic diagram of an execution engine scheduling execution operator disclosed in an embodiment of the present invention;

[0048] Figure 5 A schematic diagram of an abnormal transaction identification system disclosed in an embodiment of the present invention;

[0049] Figure 6A schematic diagram of the structure of an abnormal transaction identification device disclosed in an embodiment of the present invention;

[0050] Figure 7 The present invention is a schematic diagram of the structure of an electronic device disclosed in an embodiment of the present invention. DETAILED DESCRIPTION

[0051] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0052] The embodiment of the present invention discloses an abnormal transaction identification method and related devices, which obtains current transaction data, determines the newly added attribute graph elements of the current transaction data relative to the existing attribute graph, and sends the newly added attribute graph elements to the execution engine in the query executor, controls the execution engine to generate matching tasks according to the subgraph matching order, and schedules the corresponding execution operator in the query executor based on the matching tasks, and sends the newly added attribute graph elements to the execution operator at the same time, controls the execution operator to match the newly added attribute graph elements to the instance according to the subgraph matching order, and when the complete instance is matched, determines that the current transaction data is an abnormal transaction. The present invention constructs an attribute graph according to the transaction data, and generates a corresponding subgraph matching order for each abnormal transaction mode, so that the automatic identification of abnormal transactions can be achieved by matching the newly added attribute graph elements of the current transaction data relative to the existing attribute graph to the instance according to the subgraph matching order, thereby greatly improving the efficiency of identifying abnormal transactions.

[0053] See also Figure 1 , a flow chart of an abnormal transaction identification method disclosed in an embodiment of the present invention, the method comprising:

[0054] Step S101, obtaining current transaction data.

[0055] The current transaction data includes: transaction subject and transaction type.

[0056] Transaction entities include but are not limited to banking institutions, enterprises, individuals, business owners, corporate accounts, personal accounts, etc.

[0057] Transaction types include, but are not limited to, credit relationships (such as loan issuance), holding (account) relationships, transfer relationships, corporate customer affiliation, etc.

[0058] In actual applications, current transaction data can be obtained from various bank payment platforms, loan platforms, and enterprise ERP (Enterprise Resource Planning).

[0059] Step S102: Determine a newly added property graph element of the current transaction data relative to the existing property graph, and send the newly added property graph element to an execution engine in the query executor.

[0060] A property graph is a graph structure that contains three elements: nodes, edges, and properties.

[0061] Nodes are entities in a graph, and edges are directed connections between nodes, which are equivalent to the relationship between entities. Nodes and edges represent the topological relationship between entities. Attributes are associated with any point and edge in the form of key-value pairs. Different from relational databases, graph databases are databases that use graph models for storage and query.

[0062] In this application, an attribute graph is established based on transactions and loan relationships between financial entities, and the nodes include banking institutions, enterprises, individuals, business owners, corporate accounts, personal accounts, etc.

[0063] Edge: The connection between nodes. The type of edge can be used as an attribute of the edge: credit relationship (such as issuing a loan), holding (account), transfer, acting as a legal representative, personal shareholding, etc.

[0064] Other properties of the edge can also be used as edge attributes: such as transfer amount, shareholding ratio, etc.

[0065] The type of node can be used as a node attribute: banking institution, enterprise, individual, business owner, business account, personal account, etc. Other properties of the point: such as age, name, enterprise industry classification.

[0066] For an example of attribute graph, see Figure 2 , a schematic diagram of an attribute graph disclosed in an embodiment of the present invention, the nodes in this attribute graph include: enterprise A, enterprise B, Zhang San, Li Si, enterprise account, personal account and bank, Figure 2 The arrows in the graph represent the edges in the attribute graph. The attributes include: Zhang San is the legal representative of Enterprise A, Enterprise A holds a corporate account, the bank lends money to the corporate account, the corporate account conducts fund transactions with personal accounts, Li Si holds a personal account, and Li Si has personal holdings in Enterprise A and Enterprise B.

[0067] In this application, by comparing the current transaction data with the elements in the existing property graph, the newly added property graph elements of the current transaction data relative to the existing property graph can be determined. The newly added property graph elements include: points, edges, point attributes and edge attributes, and the newly added property graph elements are sent to the execution engine in the query executor.

[0068] In this embodiment, the query executor includes an execution operator and an execution engine. The execution operator is responsible for executing the matching algorithm, such as depth-first search. The executor thread pool contains multiple execution operators, and the execution engine is responsible for scheduling the execution operators, executing the operators with more matching points first in the depth-first execution order, and outputting abnormal transaction instances as soon as possible to avoid storing too many intermediate results and prevent memory overflow.

[0069] Depth-first search refers to: a graph search algorithm that starts from a node and visits its unvisited adjacent nodes in turn until there are no accessible nodes, then takes a step back and continues to search other paths until all accessible nodes have been visited.

[0070] Step S103: Control the execution engine to generate matching tasks according to the subgraph matching order, and schedule the corresponding execution operator in the query executor based on the matching tasks, and send the newly added attribute graph elements to the execution operator.

[0071] Wherein, each sub-graph matching order is generated based on an abnormal transaction pattern.

[0072] This application supports the registration of multiple abnormal transaction modules, such as multiple loans to one household, multiple loans to one household, capital repatriation, etc., which can be defined as query graph patterns and specify relevant attribute values ​​of the query graph.

[0073] Multiple loans for one household means that a borrower has multiple loans for different purposes, or is a joint borrower and has to repay multiple loan accounts. If the repayment ability is insufficient, credit risks caused by multiple borrowings are usually likely to occur.

[0074] Multiple loans for one purpose means that multiple loan funds are transferred to the account of the same person or enterprise through multiple transfers. This behavior is usually to cover up the fact of misappropriation of funds. For example, some self-employed businesses with financing difficulties obtain large bank loans through the decentralized credit of multiple farmers; some individuals involved in usury and illegal fund-raising raise illegal funds through loans from multiple farmers; some village cadres take advantage of their positions to obtain loan funds through loans from multiple farmers, etc.

[0075] Step S104: Control the execution operator to match the newly added attribute graph elements to instances according to the subgraph matching order.

[0076] In this application, the execution operator is responsible for executing the matching algorithm, such as depth-first search. The executor thread pool contains multiple execution operators, and the execution engine is responsible for scheduling the execution operators, in a depth-first execution order, executing the execution operators with more matching points first, and outputting abnormal transaction instances as soon as possible.

[0077] Step S105: When a complete instance is matched, the current transaction data is determined to be an abnormal transaction.

[0078] In summary, the present invention discloses a method for identifying abnormal transactions, which obtains current transaction data, determines newly added attribute graph elements of the current transaction data relative to an existing attribute graph, and sends the newly added attribute graph elements to the execution engine in the query executor, controls the execution engine to generate matching tasks according to the subgraph matching order, and schedules the corresponding execution operator in the query executor based on the matching tasks, and sends the newly added attribute graph elements to the execution operator at the same time, controls the execution operator to match the newly added attribute graph elements to the instance according to the subgraph matching order, and when the complete instance is matched, determines that the current transaction data is an abnormal transaction. The present invention constructs an attribute graph according to the transaction data, and generates a corresponding subgraph matching order for each abnormal transaction mode, so that the automatic identification of abnormal transactions can be achieved by matching the newly added attribute graph elements of the current transaction data relative to the existing attribute graph to the instance according to the subgraph matching order, thereby greatly improving the efficiency of identifying abnormal transactions.

[0079] In one embodiment, after step S105, the following steps may also be included:

[0080] Freeze the account related to the current transaction data and recover the funds, and output a notification that the current transaction data is an abnormal transaction.

[0081] When this application determines that the current transaction data is an abnormal transaction, in order to reduce the losses caused by the transaction, it will freeze the relevant accounts corresponding to the current transaction data, recover funds, etc., and notify the client account to take effective measures in time by outputting a notification that the current transaction data is an abnormal transaction.

[0082] In one embodiment, step S104 may specifically include:

[0083] (1) The control execution operator searches the query optimizer to see whether there is an abnormal transaction pattern index corresponding to the subgraph matching order.

[0084] This application sets a corresponding abnormal transaction mode index for each abnormal transaction mode.

[0085] (2) If the abnormal transaction pattern index is found, a new partial match instance corresponding to the newly added attribute graph element is generated based on the abnormal transaction pattern index and sent to the next first target execution operator in an idle state.

[0086] (3) If the abnormal transaction pattern index is not found, the nodes to be expanded, node attributes, and connected edge attributes in the newly added attribute graph element are sent to the distributed graph storage module, the edges connected to the nodes to be expanded in the attribute graph are requested, and (4) is continued.

[0087] (4) Controlling the distributed graph storage module to search for a target edge that meets the conditions from the attribute graph using a node attribute index and an edge attribute index based on the node to be expanded, the node attributes, and the edge attributes of the connection, and sending the target edge to the execution operator;

[0088] (5) After the execution operator receives the target edge, it generates a new partial matching instance and sends it to the next second target execution operator that is in an idle state.

[0089] The query optimizer of the present application generates a corresponding subgraph matching order for each query instruction (carrying an abnormal transaction pattern). According to the subgraph matching order, the execution operator generates a new partial matching instance until a complete instance is matched. The execution engine determines the execution order and time of the execution operator.

[0090] It should be noted that the process of executing the operator in this application to match the instance of the newly added attribute graph element in the subgraph matching order is actually the subgraph matching process, that is, the subgraph query process. The specific process is: given a query graph Q and a data graph G, subgraph matching refers to finding the subgraph instance of G that is isomorphic to Q on both sides.

[0091] For an example, see Figure 3-1 For the query graph (C->B->A->D), Figure 3-2 is a data graph, where A, B, C, and D represent the attributes of the points, 0, 1, 2, 3, 4, and 5 represent the numbers of the points in the data graph, and v0, v1, v2, and v3 represent the numbers of the points in the query graph.

[0092] The process of matching the query graph and the data graph is as follows:

[0093] The distributed graph storage module generates new edges (C->B) based on the current transaction data and stores the new edges (C->B).

[0094] The execution operator obtains the new edge (C->B) from the distributed graph storage module, and through the extension operation, expands a new matching point each time in the matching order to generate a new partial matching instance, or uses the index (cached partial match) to expand multiple points.

[0095] See Figure 3-3 The matching examples shown in the figure, assuming that S1, S2 and S3 are query graphs, the corresponding matching examples are as follows:

[0096] Table 1

[0097]

[0098] Table 2

[0099]

[0100] Table 3

[0101]

[0102] Repeat the above matching process until the query graph is fully matched.

[0103] See also Figure 4 The schematic diagram of the execution engine scheduling execution operators is shown in FIG. Figure 4 The execution operators in include: the execution operator of S1->S2 and the execution operator of S2->S3. In this application, the execution engine can execute the operator with more matching points according to the depth-first strategy. Based on Tables 1 to 3 above, the execution engine prioritizes the scheduling of the execution operator extending S2->S3.

[0104] In one embodiment, before step S101, the following steps may also be included:

[0105] (1) Obtaining historical transaction data, wherein the historical transaction data includes: transaction subject and transaction type;

[0106] (2) Determining attribute graph elements from the historical transaction data, and creating an attribute graph based on the attribute graph elements.

[0107] Transaction entities include but are not limited to banking institutions, enterprises, individuals, business owners, corporate accounts, personal accounts, etc.

[0108] Transaction types include, but are not limited to, credit relationships (such as loan issuance), holding (account) relationships, transfer relationships, corporate customer affiliation, etc.

[0109] In one embodiment, after creating the property graph, the following steps may also be performed:

[0110] A graph partitioning strategy is used to map nodes in the attribute graph to different devices for storage;

[0111] Node attribute indexes and edge attribute indexes are established for the node attributes and edge attributes of the attribute graph.

[0112] The graph partitioning strategy refers to evenly dividing a large database into a group of subgraphs and distributing them across multiple devices to support parallel execution of subgraph matching. The graph partitioning algorithm requires reducing the inter-machine communication overhead generated by subsequent calculations.

[0113] The graph partitioning strategies in this application include but are not limited to random hashing, clustering algorithms, and partitioning according to enterprise attributes.

[0114] Index refers to: the data structure generated by preprocessing the data graph for query, in order to speed up the search of nodes and subgraphs and reduce the amount of matching calculations. Usually, indexes are created for frequently visited nodes, and subgraph instances of the query graph containing this node are pre-generated and dynamically updated. In addition, indexes are created for attributes to support fast filtering of attribute values.

[0115] In one embodiment, before step S101, the following steps may also be included:

[0116] Obtain various abnormal transaction patterns;

[0117] Generate a corresponding subgraph matching order for each abnormal transaction pattern;

[0118] For nodes frequently visited in the attribute graph, each abnormal transaction pattern is calculated as a subgraph instance when querying the graph, and the abnormal transaction pattern index is updated accordingly.

[0119] Among them, abnormal transaction models include but are not limited to multiple loans to one household, multiple loans to one household, capital repatriation, and other patterns that can be defined as query graphs.

[0120] To facilitate understanding of the abnormal transaction identification process disclosed in the present invention, see Figure 5 , a schematic diagram of an abnormal transaction identification system disclosed in an embodiment of the present invention, the abnormal transaction identification system includes: a distributed graph storage module, a query optimizer, a query executor, an exception processing module and a message notification component.

[0121] Among them, the distributed graph storage module can generate the corresponding attribute graph based on the transaction data. Through the built-in graph partitioning strategy, the nodes in the attribute graph are mapped to different device storages, the topological structure of the attribute graph (i.e., points and edges) is stored in the graph, and the attributes of the attribute graph (i.e., the attributes of points and edges) are stored in the attribute to support fast and convenient reading of the attribute graph.

[0122] When the distributed graph storage module receives transaction data, it can map the edge storage to the corresponding device according to the endpoints.

[0123] When subgraph matching requires information of other subgraphs, the distributed graph storage module can request it through the communication component.

[0124] The query optimizer is used to generate an optimized execution plan based on the abnormal transaction patterns registered by the system administrator. The specific process is: for each abnormal transaction pattern, a corresponding subgraph matching order is generated. For example, the subgraph matching order first matches points and edges with fewer related attribute values, and then matches points and edges with more related attribute values, so as to reduce the search space and calculation amount and prevent memory explosion. For frequently visited nodes (edges with larger degrees), each abnormal transaction pattern is pre-calculated as a subgraph instance when querying the graph, and the abnormal transaction pattern index is updated accordingly.

[0125] The query executor is used to execute queries online and output abnormal transaction query results.

[0126] The query executor includes: an execution operator and an execution engine. The execution operator is responsible for executing matching algorithms, such as depth-first search. The executor thread pool contains multiple execution operators, and the execution engine is responsible for scheduling the execution operators, executing the operators with more matching points first in a depth-first execution order, and outputting abnormal transaction instances as soon as possible to avoid storing too many intermediate results and prevent memory overflow.

[0127] Exception handling module, used to freeze related accounts, recover funds, etc.

[0128] The message notification component is used to notify the client account manager so that effective procedures can be taken in time for abnormal transactions.

[0129] Corresponding to the above method embodiment, the present invention also discloses an abnormal transaction identification device.

[0130] See also Figure 6 , a schematic diagram of the structure of an abnormal transaction identification device disclosed in an embodiment of the present invention, the device may include:

[0131] The current data acquisition unit 201 is used to acquire current transaction data, wherein the current transaction data includes: transaction subject and transaction type;

[0132] Transaction entities include but are not limited to banking institutions, enterprises, individuals, business owners, corporate accounts, personal accounts, etc.

[0133] Transaction types include, but are not limited to, credit relationships (such as loan issuance), holding (account) relationships, transfer relationships, corporate customer affiliation, etc.

[0134] In actual applications, current transaction data can be obtained from various bank payment platforms, loan platforms, and enterprise ERP (Enterprise Resource Planning).

[0135] The property graph element determination unit 202 is used to determine the newly added property graph elements of the current transaction data relative to the existing property graph, and send the newly added property graph elements to the execution engine in the query executor, wherein the newly added property graph elements include: points, edges, point attributes and edge attributes;

[0136] In this application, an attribute graph is established based on transactions and loan relationships between financial entities, and the nodes include banking institutions, enterprises, individuals, business owners, corporate accounts, personal accounts, etc.

[0137] Edge: The connection between nodes. The type of edge can be used as an attribute of the edge: credit relationship (such as issuing a loan), holding (account), transfer, acting as a legal representative, personal shareholding, etc.

[0138] Other properties of the edge can also be used as edge attributes: such as transfer amount, shareholding ratio, etc.

[0139] The type of node can be used as a node attribute: banking institution, enterprise, individual, business owner, business account, personal account, etc. Other properties of the point: such as age, name, enterprise industry classification.

[0140] An execution operator scheduling unit 203 is used to control the execution engine to generate matching tasks according to the subgraph matching order, and schedule the corresponding execution operator in the query executor based on the matching task, and send the newly added attribute graph element to the execution operator, wherein each subgraph matching order is generated based on an abnormal transaction pattern;

[0141] This application supports the registration of multiple abnormal transaction modules, such as multiple loans to one household, multiple loans to one household, capital repatriation, etc., which can be defined as query graph patterns and specify relevant attribute values ​​of the query graph.

[0142] A matching unit 204, used to control the execution operator to match the newly added attribute graph element to the instance according to the subgraph matching order;

[0143] In this application, the execution operator is responsible for executing the matching algorithm, such as depth-first search. The executor thread pool contains multiple execution operators, and the execution engine is responsible for scheduling the execution operators, in a depth-first execution order, executing the execution operators with more matching points first, and outputting abnormal transaction instances as soon as possible.

[0144] The abnormal transaction determination unit 205 is used to determine that the current transaction data is an abnormal transaction when a complete instance is matched.

[0145] In summary, the present invention discloses an abnormal transaction identification device, which obtains current transaction data, determines the newly added attribute graph elements of the current transaction data relative to the existing attribute graph, and sends the newly added attribute graph elements to the execution engine in the query executor, controls the execution engine to generate matching tasks according to the subgraph matching order, and schedules the corresponding execution operator in the query executor based on the matching tasks, and sends the newly added attribute graph elements to the execution operator at the same time, controls the execution operator to match the newly added attribute graph elements to the instance according to the subgraph matching order, and when the complete instance is matched, determines that the current transaction data is an abnormal transaction. The present invention constructs an attribute graph according to the transaction data, and generates a corresponding subgraph matching order for each abnormal transaction mode, so that the automatic identification of abnormal transactions can be achieved by matching the newly added attribute graph elements of the current transaction data relative to the existing attribute graph to the instance according to the subgraph matching order, thereby greatly improving the efficiency of identifying abnormal transactions.

[0146] In one embodiment, the abnormal transaction identification device may further include:

[0147] The transaction exception processing unit is used to freeze and recover funds from accounts related to the current transaction data, and output a notification that the current transaction data is an abnormal transaction.

[0148] In one embodiment, the matching unit 204 may be specifically configured to:

[0149] Controlling the execution operator to search the query optimizer for an abnormal transaction pattern index corresponding to the subgraph matching order;

[0150] If the abnormal transaction pattern index is found, a new partial match instance corresponding to the newly added attribute graph element is generated based on the abnormal transaction pattern index, and sent to the next first target execution operator in an idle state;

[0151] If the abnormal transaction pattern index is not found, the nodes to be expanded, node attributes, and connected edge attributes in the newly added attribute graph element are sent to the distributed graph storage module, and the edges connected to the nodes to be expanded in the attribute graph are requested;

[0152] Control the distributed graph storage module to search for a target edge that meets the conditions from the attribute graph using a node attribute index and an edge attribute index based on the node to be expanded, the node attribute, and the edge attribute of the connection, and send the target edge to the execution operator;

[0153] After the execution operator receives the target edge, it is controlled to generate a new partial matching instance and send it to the next second target execution operator that is in an idle state.

[0154] In one embodiment, the abnormal transaction identification device may further include:

[0155] A historical data acquisition unit, used to acquire historical transaction data, wherein the historical transaction data includes: a transaction subject and a transaction type;

[0156] The property graph creation unit is used to determine the property graph elements from the historical transaction data, and create the property graph based on the property graph elements.

[0157] In one embodiment, the abnormal transaction identification device may further include:

[0158] A mapping unit, used to map the nodes in the attribute graph to different devices for storage by adopting a graph partitioning strategy;

[0159] The index building unit is used to build node attribute indexes and edge attribute indexes for the node attributes and edge attributes of the attribute graph.

[0160] In one embodiment, the abnormal transaction identification device may further include:

[0161] A transaction mode acquisition unit, used to acquire multiple abnormal transaction modes;

[0162] A subgraph matching order acquisition unit, used for generating a corresponding subgraph matching order for each abnormal transaction mode;

[0163] A calculation unit is used to calculate each abnormal transaction pattern as a subgraph instance when querying the graph for the frequently visited nodes in the attribute graph, and update the abnormal transaction pattern index accordingly.

[0164] It should be noted that, for the specific working principles of each component in the device embodiment, please refer to the corresponding part of the method embodiment, which will not be repeated here.

[0165] Corresponding to the above embodiment, the present invention further discloses a computer program product, including computer-readable instructions. When the computer-readable instructions are executed on an electronic device, the electronic device implements the steps shown in the abnormal transaction identification method embodiment.

[0166] Corresponding to the above embodiments, the present invention also discloses a computer storage medium, which carries one or more computer programs. When the one or more computer programs are executed by an electronic device, the electronic device can implement the steps shown in the embodiment of the abnormal transaction identification method.

[0167] Computer storage media may be tangible media that may contain or store programs for use by or in conjunction with an instruction execution system, device, or apparatus. Computer storage media may be machine-readable signal media or machine-readable storage media. Computer storage media may include, but are not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media may include electrical connections based on one or more lines, portable computer disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), optical fibers, portable compact disk read-only memories (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0168] Corresponding to the above embodiment, Figure 7 As shown, the present invention also provides an electronic device, which may include: a processor 1 and a memory 2;

[0169] The processor 1 and the memory 2 communicate with each other via a communication bus 3;

[0170] Processor 1, configured to execute at least one instruction;

[0171] Memory 2, used to store at least one instruction;

[0172] The processor 1 may be a central processing unit (CPU), or an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present invention.

[0173] The memory 2 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.

[0174] Among them, the processor executes at least one instruction to implement the steps shown in the embodiment of the abnormal transaction identification method.

[0175] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0176] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0177] The above description of the disclosed embodiments enables one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for identifying abnormal transactions, characterized in that: include: Acquire current transaction data, wherein the current transaction data includes: transaction subject and transaction type; Determine a newly added attribute graph element of the current transaction data relative to the existing attribute graph, and send the newly added attribute graph element to an execution engine in a query executor, wherein the newly added attribute graph element includes: a vertex, an edge, a vertex attribute, and an edge attribute; Control the execution engine to generate matching tasks according to the subgraph matching order, and schedule the corresponding execution operator in the query executor based on the matching tasks, and send the newly added attribute graph elements to the execution operator, wherein each subgraph matching order is generated based on an abnormal transaction pattern; Controlling the execution operator to match the newly added attribute graph element to the instance according to the subgraph matching order; When a complete instance is matched, the current transaction data is determined to be an abnormal transaction.

2. The abnormal transaction identification method according to claim 1, characterized in that: After the current transaction data is determined to be an abnormal transaction when a complete instance is matched, the method further includes: Freeze the account related to the current transaction data and recover the funds, and output a notification that the current transaction data is an abnormal transaction.

3. The abnormal transaction identification method according to claim 1, characterized in that: The controlling the execution operator to match the newly added attribute graph element to the instance according to the subgraph matching order includes: Controlling the execution operator to search the query optimizer for an abnormal transaction pattern index corresponding to the subgraph matching order; If the abnormal transaction pattern index is found, a new partial match instance corresponding to the newly added attribute graph element is generated based on the abnormal transaction pattern index, and sent to the next first target execution operator in an idle state; If the abnormal transaction pattern index is not found, the nodes to be expanded, node attributes, and connected edge attributes in the newly added attribute graph element are sent to the distributed graph storage module, and the edges connected to the nodes to be expanded in the attribute graph are requested; Control the distributed graph storage module to search for a target edge that meets the conditions from the attribute graph using a node attribute index and an edge attribute index based on the node to be expanded, the node attribute, and the edge attribute of the connection, and send the target edge to the execution operator; After the execution operator receives the target edge, it is controlled to generate a new partial matching instance and send it to the next second target execution operator that is in an idle state.

4. The abnormal transaction identification method according to any one of claims 1 to 3, characterized in that: Before obtaining the current transaction data, the method further includes: Acquire historical transaction data, wherein the historical transaction data includes: transaction subject and transaction type; A property graph element is determined from the historical transaction data, and the property graph is created based on the property graph element.

5. The abnormal transaction identification method according to claim 4, characterized in that: Also includes: A graph partitioning strategy is used to map nodes in the attribute graph to different devices for storage; Node attribute indexes and edge attribute indexes are established for the node attributes and edge attributes of the attribute graph.

6. The abnormal transaction identification method according to claim 1, characterized in that: Before obtaining the current transaction data, the method further includes: Obtain various abnormal transaction patterns; Generate a corresponding subgraph matching order for each abnormal transaction pattern; For nodes frequently visited in the attribute graph, each abnormal transaction pattern is calculated as a subgraph instance when querying the graph, and the abnormal transaction pattern index is updated accordingly.

7. An abnormal transaction identification device, characterized in that: include: A current data acquisition unit, used to acquire current transaction data, wherein the current transaction data includes: a transaction subject and a transaction type; A property graph element determination unit, used to determine a newly added property graph element of the current transaction data relative to the existing property graph, and send the newly added property graph element to the execution engine in the query executor, wherein the newly added property graph element includes: a vertex, an edge, a vertex attribute, and an edge attribute; An execution operator scheduling unit, used to control the execution engine to generate matching tasks according to the subgraph matching order, and schedule the corresponding execution operator in the query executor based on the matching task, and send the newly added attribute graph element to the execution operator, wherein each subgraph matching order is generated based on an abnormal transaction pattern; A matching unit, used to control the execution operator to match the newly added attribute graph element to the instance according to the subgraph matching order; The abnormal transaction determination unit is used to determine that the current transaction data is an abnormal transaction when a complete instance is matched.

8. A computer program product, characterized in that It comprises computer-readable instructions, and when the computer-readable instructions are executed on an electronic device, the electronic device implements the abnormal transaction identification method as claimed in any one of claims 1 to 6.

9. An electronic device, characterized in that: The electronic device comprises: a memory and a processor; The memory is used to store at least one instruction; The processor is used to execute the at least one instruction to implement the abnormal transaction identification method as described in any one of claims 1 to 6.

10. A computer storage medium, characterized in that: The storage medium carries one or more computer programs, and when the one or more computer programs are executed by an electronic device, the electronic device can implement the abnormal transaction identification method as described in any one of claims 1 to 6.

Images