Money laundering network identification method and device, equipment, storage medium and program product
By constructing a weighted graph and multiple clustering evaluation, identifying the money laundering network in label-free transaction data, solving the problem of low identification accuracy in the prior art and achieving higher identification accuracy.
Patent Information
- Application Number
- CN202411763610.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-03
- Publication Date
- 2025-03-11
AI Technical Summary
The existing money laundering network identification methods rely on a large number of labeled sample data, resulting in low identification accuracy among massive label-free transaction data.
By constructing a weighted graph based on account transaction information, the money laundering account and its feature vector are determined, multiple clustering is used and the contour coefficient and modularity are evaluated to determine the optimal number of clusters and identify the money laundering network.
Effectively identifying the money laundering network in label-free transaction data improves the identification accuracy of the money laundering network.
Smart Images
Figure CN119598230A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of financial technology, and in particular to a method, device, equipment, storage medium and program product for identifying a money laundering network. Background Art
[0002] A money laundering network refers to an organized structure in which multiple participants, through a series of complex financial transactions and operations, transform illegally obtained funds into seemingly legal funds, in order to conceal the illegal source of the funds. As financial institutions have become the main channels for money laundering activities, anti-money laundering has become one of the important tasks of financial institutions, and identifying money laundering networks is a key technical means in anti-money laundering work. By discovering and confirming money laundering networks, money laundering activities can be combated more effectively.
[0003] Existing methods for identifying money laundering networks usually use trained machine learning models to identify transaction data to discover potential money laundering networks.
[0004] However, this machine learning model used to identify money laundering networks requires a large amount of labeled sample data for training, while most of the massive transaction data is unlabeled, resulting in low accuracy in identifying money laundering networks. Summary of the invention
[0005] The present application provides a method, device, equipment, storage medium and program product for identifying a money laundering network, so as to solve the problem of low accuracy of existing methods for identifying money laundering networks.
[0006] In a first aspect, the present application provides a method for identifying a money laundering network, comprising:
[0007] Constructing a weighted graph based on transaction information of different accounts, wherein the nodes of the weighted graph are accounts, the edges of the weighted graph are transactions between accounts, and the weights of the edges are transaction amounts;
[0008] Determining a plurality of money laundering accounts and a feature vector of each money laundering account based on the weighted graph;
[0009] Clustering the feature vectors of the multiple money laundering accounts multiple times using multiple different numbers of clusters, and determining the silhouette coefficient and modularity corresponding to each clustering;
[0010] An optimal number of clusters among the multiple different numbers of clusters is determined according to the silhouette coefficient and the modularity, and a clustering result corresponding to the optimal number of clusters is determined as a money laundering network identification result.
[0011] In a second aspect, the present application provides a device for identifying a money laundering network, comprising:
[0012] A processing module, configured to construct a weighted graph based on transaction information of different accounts, wherein the nodes of the weighted graph are accounts, the edges of the weighted graph are transactions between accounts, and the weights of the edges are transaction amounts;
[0013] The processing module is further used to determine a plurality of money laundering accounts and a feature vector of each money laundering account based on the weighted graph;
[0014] A clustering module, used to cluster the feature vectors of the multiple money laundering accounts multiple times using multiple different numbers of clusters, and determine the silhouette coefficient and modularity corresponding to each clustering;
[0015] A determination module is used to determine the best number of clusters among the multiple different numbers of clusters according to the silhouette coefficient and the modularity, and determine the clustering result corresponding to the best number of clusters as the money laundering network identification result.
[0016] In a third aspect, the present application provides an electronic device, including: a memory, a processor;
[0017] The memory stores computer-executable instructions;
[0018] The processor executes the computer-executable instructions stored in the memory, so that the processor executes the method for identifying a money laundering network as described in the first aspect above.
[0019] In a fourth aspect, the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are executed by a processor, they are used to implement the method for identifying a money laundering network as described in the first aspect above.
[0020] In a fifth aspect, the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the method for identifying a money laundering network as described in the first aspect above.
[0021] The money laundering network identification method, device, equipment, storage medium and program product provided by the present application construct a weighted graph based on transaction information of different accounts, determine multiple money laundering accounts and feature vectors of each money laundering account based on the weighted graph, cluster the feature vectors of multiple money laundering accounts multiple times using multiple different numbers of clusters, and determine the silhouette coefficient and modularity corresponding to each clustering, determine the best number of clusters among multiple different numbers of clusters according to the silhouette coefficient and modularity, and determine the clustering result corresponding to the best number of clusters as the money laundering network identification result; the method realizes the effective identification of money laundering networks in unlabeled transaction data and improves the identification accuracy of money laundering networks. BRIEF DESCRIPTION OF THE DRAWINGS
[0022] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.
[0023] Figure 1 Schematic diagram of the process of identifying the money laundering network provided in this application Figure 1 ;
[0024] Figure 2 Schematic diagram of the process of identifying the money laundering network provided in this application Figure 2 ;
[0025] Figure 3 A schematic diagram of the structure of the money laundering network identification device provided by this application;
[0026] Figure 4 A schematic diagram of the structure of the electronic device provided in this application.
[0027] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION
[0028] In order to make the purpose, technical solutions and advantages of this application clearer, the technical solutions in this application will be clearly and completely described below in conjunction with the drawings in this application. Obviously, the described embodiments are part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.
[0029] The terms "first", "second", "third", "fourth", etc. (if any) in the description and claims of the present invention and the above drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in sequences other than those illustrated or described herein.
[0030] In the embodiments of the present application, the words "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.
[0031] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use, processing, transmission, provision, disclosure and application of the relevant data comply with the relevant laws, regulations and standards of the relevant countries and regions, take necessary confidentiality measures, do not violate public order and good customs, and provide corresponding operation entrances for users to choose to authorize or refuse.
[0032] In addition, this application involves conducting big data analysis of user information (including but not limited to personal biometrics, identity data, consumption data, asset data, electronic terminal operation data, etc.), and using artificial intelligence technology to make automated decisions, and making technical solutions that have a significant impact on personal rights and interests based on the results of automated decisions. The application provides users with corresponding operation entrances for them to choose to agree or reject the results of automated decisions; if the user chooses to reject, the expert decision-making process will be entered.
[0033] It should be noted that the method, device, equipment, storage medium and program product for identifying the money laundering network of the present application can be used in the field of financial technology, and can also be used in any field other than the field of financial technology. The application field of the method, device, equipment, storage medium and program product for identifying the money laundering network of the present application is not limited.
[0034] Existing methods for identifying money laundering networks usually use trained machine learning models to identify transaction data to discover potential money laundering networks.
[0035] However, this machine learning model used to identify money laundering networks requires a large amount of labeled sample data for training, while most of the massive transaction data is unlabeled. It is very time-consuming and error-prone to manually label all the data. Due to the lack of sufficient labeled data, the existing money laundering network identification methods based on machine learning models have low accuracy in practical applications.
[0036] In view of this, the present application provides a method for identifying a money laundering network. First, a transaction network graph is constructed with transaction accounts as nodes and corresponding transaction records as edges, and an adjacency matrix of the graph and an initial feature matrix of each account are obtained based on the transaction network graph; then, the adjacency matrix and the initial feature matrix of the account are input into a graph convolutional neural network model to obtain the classification results of each node, thereby realizing the transformation of the money laundering account identification task into a graph node classification task to identify money laundering accounts and non-money laundering accounts in the transaction network; then, an unsupervised clustering algorithm is used to perform multiple clustering processes on the money laundering accounts, and the clustering effect is evaluated based on the silhouette coefficient and modularity of each clustering result to select the optimal number of clusters; finally, the clustering result corresponding to the optimal number of clusters is used as the identification result of the money laundering network; this method realizes the effective identification of money laundering networks in unlabeled transaction data and improves the identification accuracy of money laundering networks.
[0037] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.
[0038] Figure 1 Schematic diagram of the process of identifying the money laundering network provided in the embodiment of the present application Figure 1 The execution subject of this embodiment is, for example, an identification device of a money laundering network. Figure 1 As shown, the method for identifying a money laundering network provided in this embodiment includes:
[0039] S101. Construct a weighted graph based on transaction information of different accounts.
[0040] The nodes of the weighted graph are accounts, the edges of the weighted graph are transactions between accounts, and the weight of the edges is the transaction amount.
[0041] First, we need to obtain account information and transaction information from the financial institution's data lake, data warehouse, and real-time streaming platform data to obtain personal account information, public account information, and account transaction information. At the same time, we need to establish a scheduled task to store and update data in the local database in a timely manner.
[0042] Secondly, the original data in the local database is processed, including data extraction, conversion and loading, removing duplicate parts, and supplementing missing data to prepare for the subsequent modeling process. Missing values in the data are deleted and abnormal values are replaced. The purpose of this is to convert the original account information and account transaction information into a format suitable for building a graph structure.
[0043] Then, define the structure of the graph. The structure of the weighted graph is: each account is a node, each transaction is an edge, connecting two account nodes, and the weight of the edge is the normalized value of the total amount of the merged transaction, so as to eliminate the scale difference between different units and speed up the convergence of the algorithm.
[0044] S102: Determine multiple money laundering accounts and a feature vector of each money laundering account based on the weighted graph.
[0045] Among them, multiple money laundering accounts and their feature vectors can be determined through the structure and properties of the weighted graph. For example, the node degree, edge weight, centrality and other features in the weighted graph are analyzed and processed to construct the feature vector of each node. The pre-trained isolation forest algorithm model is used to identify abnormal nodes based on the features related to money laundering activities, and a list of nodes identified as abnormal and the feature vector of each abnormal node is generated.
[0046] Specifically, node degree analysis includes: in-degree (number of transactions received), out-degree (number of transactions initiated), total degree (sum of in-degree and out-degree); edge weight analysis includes: total amount transferred in, total amount transferred out, total transaction amount (sum of total amount transferred in and total amount transferred out); centrality analysis includes: degree centrality (number of connections of a node), closeness centrality (average distance from a node to other nodes). Based on the above analysis results, construct the feature vector of each node. The feature vector of a node can contain the following attributes: in-degree, out-degree, total degree, total amount transferred in, total amount transferred out, total transaction amount, degree centrality, closeness centrality, etc.
[0047] Optionally, a standard score (Z-Score) algorithm can be used to extract the feature vector of each node in the weighted graph, and calculate the mean and standard deviation of each feature. Based on the mean and standard deviation of each feature, the standard score of the feature is calculated, and the data point whose absolute value of the standard score is greater than a preset value is regarded as an outlier, so that the account node corresponding to the outlier is regarded as a money laundering account.
[0048] S103, clustering the feature vectors of multiple money laundering accounts multiple times using multiple different numbers of clusters, and determining the silhouette coefficient and modularity corresponding to each clustering.
[0049] Among them, the KMeans clustering algorithm can be used to cluster multiple money laundering accounts to obtain clustering results containing multiple money laundering accounts. The silhouette coefficient is used to evaluate the quality of clustering. The silhouette coefficient is calculated by comparing the distance between a data point and other points in its cluster and the distance between the point and other clusters. It is used to evaluate the closeness and separation of data points in the cluster. Modularity is used to evaluate the quality of community structure in the network. The idea that the connections between internal nodes of the same type are more than the connections with the outside is used to measure the rationality of community division.
[0050] Exemplarily, a specific implementation method for clustering the feature vectors of the multiple money laundering accounts multiple times using multiple different numbers of clusters is provided herein: for each number of clusters, initializing the cluster centers of the number of clusters;
[0051] The feature vectors of the money laundering accounts are divided into the clusters with the nearest cluster centers, the cluster centers of each cluster are calculated again, and this step is repeated until the iteration stop condition is reached, and the clustering results corresponding to each cluster number are obtained.
[0052] First, K data points are randomly selected as the initial cluster centers, where the data points refer to the feature vectors of the money laundering accounts. The data points are then distributed to assign each data point to the cluster with the nearest cluster center. The cluster centers are then updated to recalculate the center of each cluster as the average of all data points in the cluster. The steps of allocating data points and updating cluster centers are repeated until the iteration stop condition is met.
[0053] The following is an example of the iteration stop condition:
[0054] (1) Cluster centers no longer change: In one iteration, if the centers of all clusters do not change after the update, it means that the distribution of data points and the positions of cluster centers have stabilized, and the clustering algorithm stops;
[0055] (2) The distribution of data points no longer changes: If in one iteration, the cluster distribution of all data points is the same as in the previous iteration, indicating that the data points have been assigned to the most appropriate cluster, the clustering algorithm will also stop;
[0056] (3) Reaching the maximum number of iterations: Set a maximum number of iterations. If the number of clustering iterations reaches this maximum number of iterations, the clustering algorithm will be forced to stop. This is to ensure that the algorithm is completed within a reasonable time, even if it has not fully converged.
[0057] (4) The change of cluster center is less than the set threshold: Set a threshold. When the change of cluster center is less than this threshold, the clustering algorithm will stop.
[0058] The above iteration stopping conditions can be used individually or in combination to ensure that the algorithm converges within a reasonable time and finds the appropriate cluster partitioning.
[0059] After each clustering result is obtained, the cluster label of each data point (feature vector of money laundering account) is obtained. For each data point i, based on the cluster labels of all data points, the average distance a(i) between the data point and other data points in the same cluster is calculated, as well as the average distance b(i) between the data point and all data points in different clusters closest to it is calculated. Then, based on a(i) and b(i), the silhouette coefficient of data point i is calculated. Finally, the silhouette coefficient of all data points is averaged to obtain the silhouette coefficient of this clustering result. Modularity is based on the graph structure in the weighted graph. The clustering result is mapped to each node on the weighted graph. Then, the node degree, edge weights between nodes and other information are added to the graph to calculate the modularity of this clustering result. In this way, by calculating the silhouette coefficient and modularity after each clustering, the quality of the clustering result and the effectiveness of the community structure can be evaluated.
[0060] In the embodiment of the present application, multiple iterations can increase the chance of finding the global optimal solution, thereby improving the overall quality of clustering, and can verify the consistency of clustering results. If the clustering results produced by multiple iterations are similar, it means that these results are stable and have high credibility.
[0061] S104. Determine the best number of clusters among a plurality of different numbers of clusters according to the silhouette coefficient and the modularity, and determine the clustering result corresponding to the best number of clusters as the money laundering network identification result.
[0062] Among them, the value range of the silhouette coefficient is usually between [-1, 1]. The closer the silhouette coefficient value is to 1, the better the clustering effect is, the closer the value is to -1, the worse the clustering effect is, and the value of 0 indicates a general clustering effect. The value range of modularity is usually between [-0.5, 1]. The closer the modularity value is to 1, the more obvious and high-quality the community division is, the closer the modularity value is to -1, the poorer the community division is or the community structure does not exist, and the value of modularity close to 0 indicates that the community division is not obvious.
[0063] For example, based on the silhouette coefficient and modularity corresponding to multiple clustering results, we can draw curves showing the changes in silhouette coefficient and modularity with quantity, respectively. By looking at the two curves, we can find the number of clusters with high silhouette coefficient and modularity, and use this number of clusters as the optimal number of clusters. We can further determine the clustering result corresponding to the optimal number of clusters as the money laundering network identification result.
[0064] The method for identifying a money laundering network provided in an embodiment of the present application constructs a weighted graph based on transaction information of different accounts, determines multiple money laundering accounts and feature vectors of each money laundering account based on the weighted graph, clusters the feature vectors of the multiple money laundering accounts multiple times using multiple different numbers of clusters, and determines the silhouette coefficient and modularity corresponding to each clustering, determines the best number of clusters among the multiple different numbers of clusters according to the silhouette coefficient and the modularity, and determines the clustering result corresponding to the best number of clusters as the money laundering network identification result; the method realizes the effective identification of money laundering networks in unlabeled transaction data and improves the identification accuracy of money laundering networks.
[0065] Figure 2 Schematic diagram of the process of identifying the money laundering network provided in this application Figure 2 ,like Figure 2 As shown, in this embodiment Figure 1 Based on the embodiment, a method for identifying a money laundering network is described in detail. The method for identifying a money laundering network provided in this embodiment includes:
[0066] S201. Construct a weighted graph based on transaction information of different accounts.
[0067] Step S201 is similar to the above step S101 and will not be described again.
[0068] S202: Determine the adjacency matrix and initial feature matrix of the weighted graph.
[0069] Among them, the elements in the adjacency matrix are used to represent the weight of the edge between two nodes, and the elements in the initial feature matrix are used to represent the account information corresponding to each node.
[0070] For example, there are 5 nodes: Account A, Account B, Account C, Account D and Account E. The transaction amounts between these accounts are: AB: (10), AC: (20), BC: (15), BD: (25), CD (30), CE (10), DE (20).
[0071] The adjacency matrix corresponding to the weighted graph can be obtained as:
[0072]
[0073] For the constructed weighted graph, calculate the in-degree, out-degree, total amount of transfers, total amount of transfers, total transaction amount, transaction timestamp, account type (individual, company), personal account opening information (account opening location, identity information, mobile phone number, etc.) and public account information (registration location, registered capital, legal person information, etc.) of each node. And normalize each dimension of features, and the final result is used as the original feature vector of the node, that is, the initial feature matrix of the account.
[0074] It can be understood that the purpose of normalization is to ensure that the features of the initial feature vector in different dimensions are comparable, so as to ensure that when classification is performed based on the initial feature vector, the impact of the node vector on account division in each dimension is not much different.
[0075] S203: Input the adjacency matrix and the initial feature matrix into the graph convolutional neural network to obtain the feature vector of each node, and determine the classification result of each node based on the feature vector of each node.
[0076] Among them, the classification results are money laundering accounts or non-money laundering accounts.
[0077] Exemplarily, the adjacency matrix and the initial feature matrix can be input into the first-level graph convolutional neural network in a cascaded multi-level graph convolutional neural network to obtain the feature vector of each node output by the last-level graph convolutional neural network.
[0078] Features Layer graph convolutional network, each layer output is recorded as The calculation formula of the graph convolutional neural network is as follows:
[0079]
[0080] in, For the Layer network parameters, is a nonlinear activation function, is the adjacency matrix, , is the initial feature matrix.
[0081] The graph convolutional neural network takes the initial feature matrix and adjacency matrix as input and passes the parameter vector To process the input data, the dynamic feature information between accounts is extracted according to the transaction path in the graph modeling process, and finally the final account feature vector is obtained through the nonlinear activation unit, so as to identify the money laundering accounts and non-money laundering accounts in the transaction network.
[0082] In the embodiment of the present application, structural features are captured locally and globally through multi-layer convolution operations, thereby extracting feature vectors of higher-level nodes and improving recognition accuracy.
[0083] S204, clustering the feature vectors of multiple money laundering accounts multiple times using multiple different numbers of clusters, and determining the silhouette coefficient and modularity corresponding to each clustering.
[0084] The method of clustering the feature vectors of multiple money laundering accounts multiple times using multiple different numbers of clusters is similar to that in step S103 of the above embodiment, and will not be described in detail here.
[0085] Exemplarily, a specific implementation method for determining the silhouette coefficient and modularity corresponding to each clustering is given here: for the clustering result of each clustering, the silhouette coefficient corresponding to each clustering is determined according to the distance between the feature vector of each money laundering account and the feature vectors of other money laundering accounts in the same cluster, and the distance between the feature vector of each money laundering account and the feature vectors of money laundering accounts in other clusters.
[0086] For example, for each cluster and the cluster Each sample in , the sample can be calculated using the following formula The silhouette coefficient is:
[0087]
[0088] in, For sample With cluster The average of the sum of distances of other samples in , For sample With other clusters The minimum value among the average distances of each sample in .
[0089] After obtaining the silhouette coefficients of all samples, the overall silhouette coefficient is calculated using the following formula:
[0090]
[0091] in, is the sum of the silhouette coefficients of all samples, is the total number of samples.
[0092] The modularity corresponding to each clustering is determined based on the adjacency matrix, whether the two nodes corresponding to each element in the adjacency matrix belong to the same cluster, the degrees of the two nodes, and the number of edges in the weighted graph.
[0093] For example, the modularity of the clustering results can be calculated using the following formula:
[0094]
[0095] in, is the number of edges in the weighted graph, is the adjacency matrix The elements in and Node and nodes The degree.
[0096]
[0097] S205 . For the silhouette coefficient and modularity corresponding to each clustering, weighted average is performed on the silhouette coefficient and modularity to obtain an evaluation index value for each clustering.
[0098] The weights of the silhouette coefficient and the modularity may be determined based on experience or through experiments on a data set, and this application does not impose any particular limitation on this.
[0099] For example, when the number of clusters in multiple clustering is [2,3,4,5,6], the corresponding silhouette coefficient is: [0.6,0.7,0.5,0.8,0.65], and the modularity is: [0.3,0.4,0.5,0.6,0.45]. If the silhouette coefficient and modularity are assigned the same weight, that is, 50% each, for each number of clusters, the weighted average values of the silhouette coefficient and modularity are calculated as: [0.45,0.55,0.50,0.70,0.55], that is, the evaluation index values of each clustering are: 0.45, 0.55, 0.50, 0.70, 0.55, respectively.
[0100] S206. Determine the number of clusters corresponding to the cluster with the highest evaluation index value as the optimal number of clusters, and determine the clustering result corresponding to the optimal number of clusters as the money laundering network identification result.
[0101] For example, according to the evaluation index value of each clustering mentioned above, it can be obtained that the highest evaluation index value is 0.70, and the number of clusters corresponding to this index value is 5. Then the clustering result corresponding to the number of clusters 5 is used as the money laundering network identification result. Each cluster contains multiple money laundering accounts and transaction paths, transaction amounts, transaction frequencies and other information. Through the money laundering network identification results, potential risk accounts and behavior patterns in the money laundering network can be more effectively identified and analyzed.
[0102] The method for identifying a money laundering network provided in an embodiment of the present application constructs a weighted graph based on transaction information of different accounts, determines an adjacency matrix and an initial feature matrix of the weighted graph, inputs the adjacency matrix and the initial feature matrix into a graph convolutional neural network, obtains a feature vector of each node, and determines a money laundering account and a non-money laundering account based on the feature vector of each node, clusters the feature vectors of multiple money laundering accounts multiple times using multiple different numbers of clusters, determines a silhouette coefficient and a modularity corresponding to each clustering, performs weighted averaging on the silhouette coefficient and the modularity corresponding to each clustering, obtains an evaluation index value for each clustering, determines the number of clusters corresponding to the cluster with the highest evaluation index value as the optimal number of clusters, and determines the clustering result corresponding to the optimal number of clusters as the money laundering network identification result; the method realizes effective identification of money laundering networks in unlabeled transaction data and improves the identification accuracy of money laundering networks.
[0103] Figure 3 A schematic diagram of the structure of the money laundering network identification device provided in this application, such as Figure 3 As shown, the money laundering network identification device 300 provided in this embodiment includes:
[0104] Processing module 301, used to construct a weighted graph based on transaction information of different accounts, wherein the nodes of the weighted graph are accounts, the edges of the weighted graph are transactions between accounts, and the weights of the edges are transaction amounts;
[0105] The processing module 301 is further used to determine a plurality of money laundering accounts and a feature vector of each money laundering account based on the weighted graph;
[0106] A clustering module 302 is used to cluster the feature vectors of the multiple money laundering accounts multiple times using multiple different numbers of clusters, and determine the silhouette coefficient and modularity corresponding to each clustering;
[0107] The determination module 303 is used to determine the best number of clusters among the multiple different numbers of clusters according to the silhouette coefficient and the modularity, and determine the clustering result corresponding to the best number of clusters as the money laundering network identification result.
[0108] In some embodiments, the processing module 301 is further used to determine an adjacency matrix and an initial feature matrix of the weighted graph, wherein the elements in the adjacency matrix are used to represent the weights of the edges between two nodes, and the elements in the initial feature matrix are used to represent the account information corresponding to each node;
[0109] The processing module 301 is further used to input the adjacency matrix and the initial feature matrix into a graph convolutional neural network to obtain a feature vector of each node, and determine a classification result of each node based on the feature vector of each node, wherein the classification result is a money laundering account or a non-money laundering account.
[0110] In some embodiments, the processing module 301 is also used to input the adjacency matrix and the initial feature matrix into the first-level graph convolutional neural network in a cascaded multi-level graph convolutional neural network to obtain the feature vector of each node output by the last-level graph convolutional neural network.
[0111] In some embodiments, the determination module 303 is further used to perform weighted average on the silhouette coefficient and the modularity corresponding to each clustering to obtain an evaluation index value for each clustering;
[0112] The determination module 303 is further configured to determine the number of clusters corresponding to the cluster with the highest evaluation index value as the optimal number of clusters.
[0113] In some embodiments, the clustering module 302 is further used to initialize the cluster centers of each cluster number for each cluster number;
[0114] The clustering module 302 is also used to divide the feature vectors of the money laundering accounts into clusters with the nearest cluster centers, calculate the cluster centers of each cluster again, and repeat this step until the iteration stop condition is reached to obtain the clustering results corresponding to each cluster number.
[0115] In some embodiments, the clustering module 302 is further used to determine the silhouette coefficient corresponding to each clustering according to the distance between the feature vector of each money laundering account and the feature vectors of other money laundering accounts in the same cluster, and the distance between the feature vector of each money laundering account and the feature vectors of money laundering accounts in other clusters for the clustering result of each clustering;
[0116] The clustering module 302 is further used to determine the modularity corresponding to each clustering according to the adjacency matrix, whether the two nodes corresponding to each element in the adjacency matrix belong to the same cluster, the degrees of the two nodes, and the number of edges in the weighted graph.
[0117] Figure 4 This is a schematic diagram of the structure of the electronic device provided in this application. Figure 4 As shown, the present application provides an electronic device, the electronic device 400 includes: a receiver 401, a transmitter 402, a processor 403 and a memory 404.
[0118] Receiver 401, used for receiving instructions and data;
[0119] A transmitter 402, used for sending instructions and data;
[0120] Memory 404, for storing computer-executable instructions;
[0121] The processor 403 is used to execute the computer-executable instructions stored in the memory 404 to implement the various steps executed by the method for identifying a money laundering network in the above embodiment. For details, please refer to the relevant description in the above embodiment of the method for identifying a money laundering network.
[0122] Optionally, the memory 404 may be independent or integrated with the processor 303 .
[0123] When the memory 404 is independently provided, the electronic device further includes a bus for connecting the memory 404 and the processor 403 .
[0124] In the above embodiments, it should be understood that the processor can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in the invention can be directly implemented as a hardware processor, or can be implemented by a combination of hardware and software modules in the processor.
[0125] The memory may include a high-speed memory (Random Access Memory, RAM), and may also include a non-volatile memory (NVM), such as at least one disk storage.
[0126] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of this application is not limited to only one bus or one type of bus.
[0127] The present application also provides a computer program product, including a computer program, which implements the above-mentioned method for identifying a money laundering network when executed by a processor.
[0128] The present application also provides a computer-readable storage medium, in which computer-executable instructions are stored. When a processor executes the computer-executable instructions, the above-mentioned method for identifying a money laundering network is implemented.
[0129] The above-mentioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general or special-purpose computer.
[0130] An exemplary readable storage medium is coupled to a processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (Application Specific Integrated Circuits, referred to as: ASIC). Of course, the processor and the readable storage medium can also exist in the device as discrete components.
[0131] The division of units is only a logical function division, and there may be other divisions in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interface, device or unit, which can be electrical, mechanical or other forms.
[0132] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.
[0133] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
[0134] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.
[0135] Those skilled in the art can understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, disk or optical disk and other media that can store program codes.
[0136] Finally, it should be noted that those skilled in the art will readily conceive of other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. The present invention is intended to cover any variations, uses or adaptations of the present invention, which follow the general principles of the present invention and include common knowledge or customary technical means in the art not disclosed by the present invention, are not limited to the precise structure described above and shown in the drawings, and may be modified and changed in various ways without departing from the scope thereof. The scope of the present invention is limited only by the appended claims.
Claims
1. A method for identifying a money laundering network, characterized in that: include: Constructing a weighted graph based on transaction information of different accounts, wherein the nodes of the weighted graph are accounts, the edges of the weighted graph are transactions between accounts, and the weights of the edges are transaction amounts; Determining a plurality of money laundering accounts and a feature vector of each money laundering account based on the weighted graph; Clustering the feature vectors of the multiple money laundering accounts multiple times using multiple different numbers of clusters, and determining the silhouette coefficient and modularity corresponding to each clustering; An optimal number of clusters among the multiple different numbers of clusters is determined according to the silhouette coefficient and the modularity, and a clustering result corresponding to the optimal number of clusters is determined as a money laundering network identification result.
2. The method according to claim 1, characterized in that The determining of a plurality of money laundering accounts and a feature vector of each money laundering account based on the weighted graph includes: Determine an adjacency matrix and an initial feature matrix of the weighted graph, wherein the elements in the adjacency matrix are used to represent the weight of an edge between two nodes, and the elements in the initial feature matrix are used to represent the account information corresponding to each node; The adjacency matrix and the initial feature matrix are input into a graph convolutional neural network to obtain a feature vector of each node, and a classification result of each node is determined based on the feature vector of each node, wherein the classification result is a money laundering account or a non-money laundering account.
3. The method according to claim 2, characterized in that The step of inputting the adjacency matrix and the initial feature matrix into a graph convolutional neural network to obtain a feature vector of each node includes: The adjacency matrix and the initial feature matrix are input into a first-level graph convolutional neural network in a cascaded multi-level graph convolutional neural network to obtain a feature vector of each node output by the last-level graph convolutional neural network.
4. The method according to any one of claims 1 to 3, characterized in that: The step of determining the optimal number of clusters among the multiple different numbers of clusters according to the silhouette coefficient and the modularity comprises: For the silhouette coefficient and modularity corresponding to each clustering, weighted average is performed on the silhouette coefficient and the modularity to obtain an evaluation index value for each clustering; The number of clusters corresponding to the cluster with the highest evaluation index value is determined as the optimal number of clusters.
5. The method according to any one of claims 1 to 3, characterized in that: The method of clustering the feature vectors of the multiple money laundering accounts multiple times using multiple different numbers of clusters includes: For each number of clusters, initialize the cluster centers of the number of clusters; The feature vectors of the money laundering accounts are divided into the clusters with the nearest cluster centers, the cluster centers of each cluster are calculated again, and this step is repeated until the iteration stop condition is reached, and the clustering results corresponding to each cluster number are obtained.
6. The method according to claim 2 or 3, characterized in that: Determine the silhouette coefficient and modularity corresponding to each clustering, including: For the clustering results of each clustering, the silhouette coefficient corresponding to each clustering is determined according to the distance between the feature vector of each money laundering account and the feature vectors of other money laundering accounts in the same cluster, and the distance between the feature vector of each money laundering account and the feature vectors of money laundering accounts in other clusters; The modularity corresponding to each clustering is determined according to the adjacency matrix, whether two nodes corresponding to each element in the adjacency matrix belong to the same cluster, the degrees of the two nodes, and the number of edges in the weighted graph.
7. A money laundering network identification device, characterized in that: include: A processing module, configured to construct a weighted graph based on transaction information of different accounts, wherein the nodes of the weighted graph are accounts, the edges of the weighted graph are transactions between accounts, and the weights of the edges are transaction amounts; The processing module is further used to determine a plurality of money laundering accounts and a feature vector of each money laundering account based on the weighted graph; A clustering module, used to cluster the feature vectors of the multiple money laundering accounts multiple times using multiple different numbers of clusters, and determine the silhouette coefficient and modularity corresponding to each clustering; A determination module is used to determine the best number of clusters among the multiple different numbers of clusters according to the silhouette coefficient and the modularity, and determine the clustering result corresponding to the best number of clusters as the money laundering network identification result.
8. An electronic device, characterized in that: include: Memory; processor; Wherein, the memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the method for identifying a money laundering network according to any one of claims 1 to 6.
9. A computer storage medium, characterized in that The computer storage medium stores computer execution instructions, which, when executed by a processor, are used to implement the method for identifying a money laundering network as described in any one of claims 1 to 6.
10. A computer program product, characterized in that The invention comprises a computer program, which, when executed by a processor, implements the method for identifying a money laundering network as claimed in any one of claims 1 to 6.