Bank fraud account identification method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention discloses a bank fraud account identification method and device, electronic equipment and a storage medium. The method comprises the steps of obtaining personal information data and transaction flow data of a user target account, and performing preprocessing; inputting the preprocessed personal information data of the user into a multi-layer full-connection neural network to generate personal portrait features of the user; determining transaction characteristics between the users according to the preprocessed bank account information data, and obtaining user transaction network characteristics and user relationship characteristics according to the transaction characteristics; obtaining transaction flow data of the user in a preset time, and inputting the transaction flow data into the long-short-term memory network to obtain user transaction time sequence characteristics; and allocating corresponding attention weights to the features to obtain target bank account features, and performing fraud account identification on a target account of the user according to the target bank account features. By adopting the scheme, the account features are constructed in multiple dimensions, and the identification accuracy of the fraudulent account is improved.

Description

Technical Field

[0001] The embodiments of the present invention relate to the technical field of fraud detection, and in particular to a bank fraud account identification method, device, electronic device and storage medium. Background Art

[0002] The current banking industry is facing an increasingly serious fraud situation. The scale of fraud continues to expand. With the popularization of mobile payments, fraud methods are emerging in an endless stream, causing large-scale asset losses to banks. Bank financial fraud is networked, using the Internet to quickly transfer funds, which is difficult to track. Cross-border cooperative fraud is also common; fraud targets are diversified, not only targeting bank assets, but also customer assets, not only targeting individuals, but also targeting enterprises.

[0003] These financial frauds have also had an extremely bad impact on the banks themselves. For example, fraudulent accounts directly lead to bank asset losses through illegal means, which is the most direct economic impact; after the fraud incident is exposed, it will seriously damage the trust of ordinary customers in the bank, resulting in a decrease in the number of customers; the fraud incident will be disclosed by the media, which will seriously affect the bank's brand reputation and the stock price may also be negatively affected; business costs will rise, and more costs will be spent on fraud monitoring, account investigations and improving transaction security; regulatory issues, the existence of fraudulent accounts means that there are loopholes in bank management and control, and regulatory authorities may also hold them accountable; high-quality customers will be lost, and high-quality customers who value security may withdraw as a result, leaving more high-risk customers; legal proceedings, fraud may violate the law, and banks will face legal proceedings in various aspects. In the face of these development trends and hazards, financial institutions must strengthen the application of technology to effectively prevent and combat future financial fraud activities.

[0004] Therefore, how to identify bank fraud is a technical problem that needs to be solved urgently by those skilled in the art. Summary of the invention

[0005] The embodiments of the present invention provide a bank fraud account identification method, device, electronic device and storage medium to achieve the construction of account features in multiple dimensions and improve the recognition accuracy of fraud accounts.

[0006] In a first aspect, an embodiment of the present invention provides a method for identifying bank fraud accounts, comprising:

[0007] Obtaining bank account information data of a user's target account and preprocessing the bank account information data; the bank account information data includes personal information data and transaction flow data;

[0008] Input the preprocessed user personal information data into a multi-layer fully connected neural network to generate the user's personal portrait features;

[0009] Determine transaction characteristics between users based on the preprocessed bank account information data, and obtain user transaction network characteristics and user relationship characteristics based on the transaction characteristics;

[0010] Obtaining transaction flow data of the user within a preset time, and inputting the transaction flow data into a long short-term memory network to obtain the user's transaction time series features;

[0011] Corresponding attention weights are assigned to personal portrait features, user transaction network features, user relationship features, and user transaction timing features to obtain target bank account features, and fraudulent account identification is performed on the user's target account based on the target bank account features.

[0012] In a second aspect, an embodiment of the present invention further provides a bank fraud account identification device, comprising:

[0013] A bank account information data processing module, used to obtain the bank account information data of the user's target account and pre-process the bank account information data; the bank account information data includes personal information data and transaction flow data;

[0014] A personal portrait feature generation module is used to input the pre-processed user personal information data into a multi-layer fully connected neural network to generate the user's personal portrait features;

[0015] A user transaction relationship feature generation module, used to determine transaction features between users based on the pre-processed bank account information data, and obtain user transaction network features and user relationship features based on the transaction features;

[0016] A user transaction time series feature generation module is used to obtain the transaction flow data of the user within a preset time, and input the transaction flow data into the long short-term memory network to obtain the user transaction time series feature;

[0017] The fraud account identification module is used to assign corresponding attention weights to personal portrait features, user transaction network features, user relationship features and user transaction timing features, obtain target bank account features, and perform fraud account identification on the user's target account based on the target bank account features.

[0018] In a third aspect, an embodiment of the present invention further provides an electronic device, the electronic device comprising:

[0019] one or more processors;

[0020] A storage device for storing one or more programs;

[0021] When the one or more programs are executed by the one or more processors, the one or more processors implement the bank fraud account identification method described in any embodiment of the present invention.

[0022] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the bank fraud account identification method described in any embodiment of the present invention.

[0023] In a fifth aspect, an embodiment of the present invention further provides a computer program product, including a computer program, which, when executed by a processor, implements the bank fraud account identification method as described in any embodiment of the present invention.

[0024] The embodiment of the present invention provides a bank fraud account identification method, device, electronic device and storage medium, which obtains the personal information data and transaction flow data of the user's target account and performs preprocessing; inputs the preprocessed user personal information data into a multi-layer fully connected neural network to generate the user's personal portrait features; determines the transaction features between users based on the preprocessed bank account information data, and obtains the user transaction network features and user relationship features based on the transaction features; obtains the user's transaction flow data within a preset time, and inputs the transaction flow data into a long short-term memory network to obtain the user's transaction time series features; assigns corresponding attention weights to each feature, obtains the target bank account features, and performs fraud account identification on the user's target account based on the target bank account features. The technical solution of the embodiment of the present invention is adopted, and the account personal information data and transaction flow data are used as input to automatically detect fraud accounts; the account features are modeled in multiple dimensions, and the user modeling is more complete. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Other features, objects and advantages of the present invention will become more apparent by reading the detailed description of non-limiting embodiments made with reference to the following drawings. The drawings are only for the purpose of illustrating preferred embodiments and are not to be considered as limiting the present invention. Also, the same reference symbols are used throughout the drawings to represent the same parts. In the drawings:

[0026] Figure 1 is a flow chart of a bank fraud account identification method provided in an embodiment of the present invention;

[0027] Figure 2 is a flow chart of another bank fraud account identification method provided in an embodiment of the present invention;

[0028] Figure 3 It is a schematic diagram of the framework structure of a bank fraud account identification model provided in an embodiment of the present invention;

[0029] Figure 4 It is a structural schematic diagram of a bank fraud account identification device provided in an embodiment of the present invention;

[0030] Figure 5 It is a structural schematic diagram of an electronic device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0031] The present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the present invention, rather than to limit the present invention. It should also be noted that, for ease of description, only parts related to the present invention, rather than all structures, are shown in the accompanying drawings.

[0032] Before discussing the exemplary embodiments in more detail, it should be mentioned that some exemplary embodiments are described as processes or methods depicted as flow charts. Although the flow charts describe the operations (or steps) as sequential processes, many of the operations (or steps) therein can be implemented in parallel, concurrently or simultaneously. In addition, the order of the operations can be rearranged. The process can be terminated when its operation is completed, but can also have additional steps not included in the accompanying drawings. The process can correspond to a method, function, procedure, subroutine, subprogram, etc.

[0033] Among them, the acquisition, storage, use and processing of data in the technical solution of this application are in compliance with the relevant provisions of national laws and regulations. It should be noted that in the embodiments of this application, some existing solutions in the industry such as certain software, components or models may be mentioned, which should be considered as exemplary, and their purpose is only to illustrate the feasibility of the implementation of the technical solution of this application, but it does not mean that the applicant has or will necessarily use the solution.

[0034] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein.

[0035] Embodiment 1

[0036] Figure 1 1 is a flow chart of a bank fraud account identification method provided in an embodiment of the present invention. This embodiment is applicable to bank fraud account identification. The method of this embodiment can be executed by a bank fraud account identification device, which can be implemented in hardware and / or software. The device can be configured in a server for bank fraud account identification. The method specifically includes the following steps:

[0037] S110: Obtain bank account information data of a user's target account, and pre-process the bank account information data.

[0038] Among them, the bank account information data includes user personal information data and transaction flow data; the user personal information data includes user personal information such as user age, occupation, address, income, etc.; the transaction flow data includes but is not limited to the amount transferred in on the day, the amount transferred out on the day, the average transaction amount within a certain period of time, and the average transaction frequency within a certain period of time.

[0039] Since the acquired user personal information data and transaction flow data cannot be used directly, it is necessary to preprocess the user personal information data and transaction flow data. The preprocessing includes but is not limited to normalization and one-hot encoding. Among them, one-hot encoding is also called unique hot encoding and one-bit effective encoding. It represents the original classification features by creating a set of new binary features. Each feature represents a possible category. Only the feature value corresponding to the samples belonging to this category is 1, and the other feature values ​​are 0.

[0040] S120, splicing the pre-processed user personal information data, and inputting the spliced ​​data into a multi-layer fully connected neural network to generate the user's personal portrait features.

[0041] Among them, the fully connected neural network (Fully Connected Neural Network) is the most common and basic neural network structure, also called a multi-layer feedforward neural network (Multi-Layer Perceptron, MLP). Each node has weights and directions. The nodes in adjacent layers are fully connected, but there is no connection between non-adjacent layers. Each node can use a nonlinear activation function, commonly used ones are ReLU and sigmoid.

[0042] In the embodiment of the present invention, the pre-processed user personal information data is spliced, and the spliced ​​data is input into a multi-layer fully connected neural network to generate the user's personal portrait features.

[0043] S130: Determine transaction characteristics between users based on the preprocessed bank account information data, and obtain user transaction network characteristics and user relationship characteristics based on the transaction characteristics.

[0044] Among them, in the embodiment of the present invention, a transaction directed network graph is constructed based on the bank account information data of the user's target account, and a graph neural network is constructed based on this, and the method of the graph neural network is used to mine the transaction relationship of the user, and the user transaction network characteristics and user relationship characteristics of the user are constructed. Among them, the graph neural network (Graph Neural Network) is a neural network model built on graph structure data for learning; its key idea is to represent nodes as vectors, use the connection relationship between nodes to learn better node vector representations, and through the message passing mechanism, nodes can aggregate the information of neighboring nodes and iteratively update their own representations.

[0045] In the embodiment of the present invention, accounts are used as nodes of the graph neural network, and transaction relationships between accounts are used as edges of the graph neural network; a transaction directed network graph of the target account is constructed based on the preprocessed bank account information data; transaction features between the target account and other transaction accounts are obtained, and user transaction network features and user relationship features are obtained based on the transaction features. The user transaction network features are used to characterize the transaction features between each user node and each account; and the user relationship features are used to characterize the transaction features between the target account and the transaction account.

[0046] S140, obtaining transaction flow data of the user within a preset time, and inputting the transaction flow data into a long short-term memory network to obtain the user transaction time series characteristics.

[0047] Among them, the Long Short-Term Memory (LSTM) network is a recurrent neural network structure commonly used to process time series data. The Long Short-Term Memory network can handle long-term dependency problems better than ordinary recurrent neural networks. The core of the LSTM network is the design of the cell state; the Cell State is like a conveyor belt that can retain historical information. LSTM controls the Cell State through a three-gate structure. LSTM overcomes the shortcomings of RNN with its unique structure, has obvious advantages in processing time series problems, and is one of the preferred models for time series modeling. In the embodiment of the present invention, the user's personal transaction flow data is used, and after processing, it is input into the LSTM model to extract the user's transaction time series features.

[0048] S150, assigning corresponding attention weights to personal portrait features, user transaction network features, user relationship features, and user transaction timing features to obtain target bank account features, and performing fraudulent account identification on the user's target account based on the target bank account features.

[0049] Among them, corresponding attention weights are assigned to personal portrait features, user transaction network features, user relationship features, and user transaction timing features, and the attention mechanism is used to multiply their respective weights and then concatenate and fused to generate a complete user representation, which is finally input into the prediction layer for prediction.

[0050] The embodiment of the present invention provides a bank fraud account identification method, which obtains the bank account information data of the user's target account and preprocesses the bank account information data; the bank account information data includes personal information data and transaction flow data; the preprocessed user personal information data is input into a multi-layer fully connected neural network to generate the user's personal portrait features; the transaction features between users are determined based on the preprocessed bank account information data, and the user transaction network features and user relationship features are obtained based on the transaction features; the transaction flow data of the user within a preset time is obtained, and the transaction flow data is input into a long short-term memory network to obtain the user transaction time series features; the personal portrait features, user transaction network features, user relationship features and user transaction time series features are assigned corresponding attention weights to obtain the target bank account features, and the target account of the user is identified as a fraud account based on the target bank account features. The technical solution of the embodiment of the present invention is adopted, and the account personal information data and transaction flow data are used as input to automatically detect fraud accounts; the account features are modeled in multiple dimensions, and the modeling of users is more perfect.

[0051] Embodiment 2

[0052] Figure 2 Flow chart of a bank fraud account identification method provided in an embodiment of the present invention. The embodiment of the present invention further optimizes the above embodiment on the basis of the above embodiment, and the embodiment of the present invention can be combined with various optional solutions in one or more of the above embodiments. Figure 2 As shown, the bank fraud account identification method provided in the embodiment of the present invention may include the following steps:

[0053] S210: Obtain bank account information data of the user's target account, and pre-process the bank account information data.

[0054] Among them, in the embodiment of the present invention, the bank account information data of the user's target account is encoded and used as the input of the model to perform fraud detection on the target account.

[0055] As an optional but non-limiting implementation, the step of obtaining the bank account information data of the user's target account and preprocessing the bank account information data includes but is not limited to steps A1-A2:

[0056] Step A1: Obtain the user's personal information data, and encode and normalize the personal information data; the personal information data includes age, occupation, address, income, average deposit, average transaction frequency and average transaction amount.

[0057] Step A2: Obtain the transaction flow data of the user, and process the transaction flow data according to preset rules; the preset rules include determining the average transaction flow or the total transaction flow within a certain period of time.

[0058] Among them, the personal information data in the embodiment of the present invention includes but is not limited to age, occupation, address, income, average deposit, average transaction frequency (calculated on a daily basis) and average transaction amount. These data are difficult to use directly in the current model, so it is necessary to encode this type of data. One-hot encoding is performed according to occupation classification, and one-hot encoding is performed after the age data is divided into intervals. The address is encoded based on whether the high-frequency transaction location and the account opening address are consistent. At the same time, the average deposit, average transaction frequency, average transaction amount, and income data are normalized, and the encoding of these fields after preprocessing is spliced ​​to obtain the original representation of the user's personal information.

[0059] Transaction flow data includes four major contents: first, the name of the transaction account, that is, the name of the account holder; second, the time and amount of the transaction; third, the transaction summary, such as transfer, withdrawal, remittance, etc.; fourth, the name and account number of the transaction counterparty, so as to facilitate the query of fund transactions. The characteristics of user personal transactions will be processed using data such as transaction time, amount, transaction category and balance as raw data. For user flow, there must be differences in the number of users within a year. At the same time, based on the relevant transaction characteristics of fraudulent accounts, transactions are aggregated by day, and variables are derived to obtain transaction characteristics. The derived variables, related variables and rules are shown in Table 1.

[0060] Table 1 Derived variables, related variables and rules

[0061]

[0062]

[0063] S220: splice the preprocessed user personal information data, and input the spliced ​​data into a multi-layer fully connected neural network to generate the user's personal portrait features.

[0064] Among them, in the embodiment of the present invention, the pre-processed user personal information data is used to generate the user's personal portrait features.

[0065] As an optional but non-limiting implementation, the pre-processed user personal information data is input into a multi-layer fully connected neural network to generate the user's personal portrait features, including but not limited to steps B1-B2:

[0066] Step B1: splice the preprocessed user personal information data and obtain a spliced ​​vector representation.

[0067] Step B2: Input the concatenated vector representation into a multi-layer fully connected neural network to generate the user's personal portrait features.

[0068] Among them, the embodiment of the present invention adopts a multi-layer fully connected network with an activation function as the main method for constructing user personal portrait features. The fully connected layer can process any form of information in the input vector, which makes it very flexible; at the same time, since each neuron is connected to all neurons in the previous layer, the fully connected layer has a strong expressive ability, and the use of a nonlinear RELU activation function enables the fully connected layer to capture complex nonlinear relationships, so that it can be better applied in feature extraction tasks. The feature extraction formula can be expressed as:

[0069]

[0070] in, Represents the user's personal portrait features, u i represents the concatenated vector representation, and h T Represents the parameter matrix of the fully connected layer.

[0071] S230: Determine transaction characteristics between users based on the preprocessed bank account information data, and obtain user transaction network characteristics based on the transaction characteristics.

[0072] Among them, currently, various illegal means such as fraud are emerging in an endless stream, and the account association is becoming more and more complicated. The sources of new bank risk accounts are diverse, and some accounts even come directly from ordinary bank accounts purchased from outside, so it is difficult to identify them from the account opening information alone. These account risk behaviors often follow certain patterns. Considering that the current financial illegal risk behaviors are clearly targeted, it is necessary to build a user transaction network based on the transaction relationship between users and mine the transaction characteristics between users. In response to the above problems, the embodiment of the present invention introduces a graph embedding algorithm into risk account detection to discover and integrate various information and improve risk detection capabilities.

[0073] At present, graph neural networks have become one of the hottest directions in the field of deep learning. As a representative graph convolutional network, the Graph Attention Network (GAT) introduces an attention mechanism to achieve better neighbor aggregation. By learning the weights of neighbors, GAT can achieve weighted aggregation of neighbors. Therefore, GAT is not only more robust to noisy neighbors, but the attention mechanism also gives the model a certain degree of interpretability. However, graph convolutional neural networks tend to believe that nodes that are relatively close in the graph are similar, which may not be completely consistent with the identification of some fraudulent accounts. For example, in fraud-related risk accounts, victims and other users should have different behavior patterns. Relying solely on this traditional graph convolutional neural network to generate new node representations by aggregating node representations around the node is insufficient in the field of bank fraud account identification. Therefore, an embodiment of the present invention proposes a dual convolution structure for financial scenarios.

[0074] As an optional but non-limiting implementation, determining transaction characteristics between users based on the pre-processed bank account information data, and obtaining user transaction network characteristics based on the transaction characteristics, includes but is not limited to steps C1-C2:

[0075] Step C1: Determine transaction characteristics between users based on the pre-processed bank account information data.

[0076] Step C2: Use the graph attention network to aggregate the transaction features between users according to the attention mechanism to generate the user transaction network features of the target account.

[0077] First, with accounts as nodes and transaction relationships as connecting edges, financial transactions can be organized into a giant graph containing thousands of nodes and edges. By studying the network, we can discover the different community roles and community relationships of normal accounts and fraudulent accounts.

[0078] Identifying financial accounts requires relying on their risky transaction behaviors. In the embodiments of the present invention, transaction relationships are used as edges in constructing graph structures. In this context, the traditional graph convolution mode of aggregating node information may no longer be applicable. Therefore, the present invention attempts to improve on the traditional GAT by aggregating the information on the edge of the node according to the attention mechanism to generate node representations. That is, the graph attention network is used to aggregate the transaction features between users according to the attention mechanism to generate the user transaction network features of the target account.

[0079] Among them, the graph attention network is used to aggregate the transaction features between users according to the attention mechanism, which can be expressed as:

[0080]

[0081] Among them, αij It represents the weight of the i-th node when aggregating its j-th edge. Nodes refer to accounts, and edges refer to transaction relationships between accounts. and W is the neural network weight matrix; Represents the node information of the i-th node after preprocessing; Represents the transaction information of the i-th node; represents the aggregated user transaction network characteristics; N i represents the set of connected edges of the ith node, including the ith node itself; σ is a nonlinear activation function.

[0082] S240: Determine transaction characteristics between users based on the preprocessed bank account information data, and obtain user relationship characteristics based on the transaction characteristics.

[0083] Among them, the embodiment of the present invention introduces the graph embedding algorithm into risk account detection to discover and integrate various information and improve risk detection capabilities. After determining the characteristics of the user transaction network, the graph convolution algorithm can be used to learn and integrate the community network structure and node attribute characteristics to form user relationship characteristics.

[0084] As an optional but non-limiting implementation, determining transaction features between users based on the pre-processed bank account information data, and obtaining user relationship features based on the transaction features, includes but is not limited to steps D1-D2:

[0085] Step D1: Determine the user transaction network characteristics of other accounts based on the user transaction network characteristics generated by the target account.

[0086] Step D2: assign corresponding weights to the user transaction network features of the target account and the user transaction network features of other accounts to construct the user relationship features of the target user.

[0087] Among them, in terms of risk account identification, user relationships are equally important. There may be related transactions between risk accounts, that is, there may be a certain community structure on the graph. Compared with general risk account detection algorithms, the advantage of graph-based algorithms to achieve telecommunications fraud detection is the exploration of community structure information. Community structure information reflects the approximate relationship between nodes, which can be strong, such as first-order approximation, or weak, such as high-order approximation. See Figure 3 , the embodiment of the present invention introduces an attention mechanism, which can focus on the most important neighbors of a node, so that it can learn the representation of the node more effectively; and GAT can learn non-local dependencies, and can establish connections between nodes of any distance through multi-layer attention. Therefore, the embodiment of the present invention extracts user relationship features through GAT.

[0088] This method first calculates the weight information of the surrounding nodes when the nodes are aggregated, which is the attention mechanism in the model. The formula of the attention mechanism is as follows:

[0089]

[0090] in, Represents the node information of the i-th node after preprocessing, N i Identify the first-order neighbor node set of the ith node (including the ith node itself), and W is the neural network weight matrix, α ij represents the weight of the i-th node when aggregating its j-th node, Represents user relationship characteristics.

[0091] S250, obtaining transaction flow data of the user within a preset time, and inputting the transaction flow data into a long short-term memory network to obtain the user transaction time series characteristics.

[0092] The time series data of transactions is one of the data that best reflects the transaction behavior patterns of users. In banking business, using the transaction time series characteristics of users to effectively classify and group users is a very common role of transaction time series data. The time interval of transactions, transaction frequency and other characteristics can be used to judge the activity of a user's account and distinguish between active and inactive users. The amount of transactions, number of transactions, income and expenditure structure and other characteristics can reflect the income level and financial status of a user and are used to judge the credit level of the user. The time series patterns of different types of transactions can judge a user's transaction preferences and habits. The above information that can be found in the transaction flow can be used as the basis for fraud detection. However, in recent years, the hiding means of risk accounts have become more and more sophisticated. It is difficult to efficiently and accurately identify risk accounts with simple qualitative analysis of risk account flow, and deep learning technology is good at discovering the user behavior patterns implied in bank transaction flow information. Therefore, in an embodiment of the present invention, LSTM is used as a user transaction time series feature mining tool. LSTM controls the flow of information through input gates, forget gates and output gates, which can better model the dependency between time steps in the time series and the internal mechanism can filter unimportant information and effectively resist interference.

[0093] In the embodiment of the present invention, the transaction flow data of the user within a preset time is obtained, and the transaction flow data is input into the long short-term memory network to obtain the user transaction time series feature. The user transaction time series feature can be expressed as:

[0094]

[0095] Among them, T seqiRepresents the account transaction time series data for the past year after data preprocessing. Represents the time series feature representation of user transactions of the i-th account.

[0096] S260, assigning corresponding attention weights to personal portrait features, user transaction network features, user relationship features, and user transaction timing features to obtain target bank account features, and performing fraudulent account identification on the user's target account based on the target bank account features.

[0097] The embodiment of the present invention generates a total of four aspects of representation, namely, user personal portrait features, user transaction network features, user relationship features, and user transaction time series features. For the identification of different accounts, there are certain differences in the importance of different information; for example, for accounts with almost no bank transactions, it is impossible to mine effective new messages from the transaction network and transaction time series data. In this case, the personal information representation of the account obviously has better performance capabilities; correspondingly, other representations may be more important in other cases. Therefore, for different accounts, the importance of the representation required for identification varies with the amount of information contained in the representation. For this reason, the embodiment of the present invention designs an attention mechanism to assign different weights to the four features to obtain new representations.

[0098] As an optional but non-limiting implementation, the personal portrait features, user transaction network features, user relationship features, and user transaction time series features are assigned corresponding attention weights to obtain target bank account features, and fraudulent account identification is performed on the user's target account based on the target bank account features, including but not limited to steps E1-E2:

[0099] Step E1: Assign corresponding attention weights to personal portrait features, user transaction network features, user relationship features, and user transaction timing features and concatenate them to obtain target bank account features.

[0100] Step E2: Input the target bank account features into a fully connected neural network, output the probability that the target account is a risky account, and identify the user's target account as a fraudulent account based on the probability.

[0101] Among them, corresponding attention weights are assigned to personal portrait features, user transaction network features, user relationship features, and user transaction time series features. The weight calculation can be expressed as:

[0102]

[0103] where h i1 to h i4 Respectively represent the four representations obtained above, β ij represents the weight of the corresponding representation.

[0104] The original representation is multiplied by the corresponding weight and concatenated to obtain the complete target bank account feature, which can be expressed as:

[0105] e i =merge(h i1 β i,1 ,h i2 β i,2 ,h i3 β i,3 ,h i4 β i,4 )

[0106] Finally, a fully connected neural network is used as the output layer for identifying risky accounts, and softmax is used to output the probability that the account is a risky account, thereby producing the final identification result. The specific calculation method can be expressed as:

[0107] r i =softmax(We i )

[0108] An embodiment of the present invention provides a method for identifying bank fraud accounts, which uses personal information data and transaction flow data to construct a multi-dimensional table feature of an account, including personal portrait features, user transaction network features, user relationship features, and user transaction timing features, which more fully describes the characteristics of the account. A dual graph convolution structure is designed for financial fraud scenarios, and traditional graph convolution structures cannot adapt well to fraud scenarios. The present invention uses two different graph convolution methods to construct a user transaction graph structure. In addition to traditional graph convolution, a graph neural network is used to aggregate information on the transaction edge according to attention weights when generating user transaction network features. The network structure is optimized for special scenarios of financial fraud, thereby improving the accuracy of identifying fraudulent accounts.

[0109] Embodiment 3

[0110] Figure 4 : is a schematic diagram of the structure of a bank fraud account identification device provided in an embodiment of the present invention. The technical solution of this embodiment can be applied to the situation of bank fraud account identification. The device can be implemented by software and / or hardware and is generally integrated on any electronic device with network communication function, including but not limited to: servers, computers, personal digital assistants and other devices. Figure 4 As shown, the bank fraud account identification device provided in this embodiment may include: a bank account information data processing module 410, a personal portrait feature generation module 420, a user transaction relationship feature generation module 430, a user transaction time series feature generation module 440 and a fraud account identification module 450; wherein,

[0111] The bank account information data processing module 410 is used to obtain the bank account information data of the user's target account and pre-process the bank account information data: the bank account information data includes personal information data and transaction flow data;

[0112] A personal portrait feature generation module 420 is used to input the pre-processed user personal information data into a multi-layer fully connected neural network to generate a personal portrait feature of the user;

[0113] A user transaction relationship feature generation module 430 is used to determine transaction features between users based on the pre-processed bank account information data, and obtain user transaction network features and user relationship features based on the transaction features;

[0114] The user transaction time series feature generation module 440 is used to obtain the transaction flow data of the user within a preset time, and input the transaction flow data into the long short-term memory network to obtain the user transaction time series feature;

[0115] The fraud account identification module 450 is used to assign corresponding attention weights to personal portrait features, user transaction network features, user relationship features and user transaction timing features, obtain target bank account features, and perform fraud account identification on the user's target account based on the target bank account features.

[0116] Based on the above embodiment, optionally, the bank account information data processing module is specifically used to:

[0117] Obtaining the user's personal information data, and encoding and normalizing the personal information data; the personal information data includes age, occupation, address, income, average deposit, average transaction frequency, and average transaction amount;

[0118] The transaction flow data of the user is obtained, and the transaction flow data is processed according to preset rules; the preset rules include determining the average transaction flow or the total transaction flow within a certain period of time.

[0119] Based on the above embodiment, optionally, the personal portrait feature generation module is specifically used to:

[0120] The pre-processed user personal information data is concatenated to obtain a concatenated vector representation;

[0121] The concatenated vector representation is input into a multi-layer fully connected neural network to generate the user's personal portrait features;

[0122] The generated user's personal portrait feature is expressed as:

[0123]

[0124] in, Represents the user's personal portrait features, u i represents the concatenated vector representation, and h T Represents the parameter matrix of the fully connected layer.

[0125] Based on the above embodiment, optionally, the user transaction relationship feature generation module is specifically used to:

[0126] Determine transaction characteristics between users based on pre-processed bank account information data;

[0127] The graph attention network is used to aggregate the transaction features between users according to the attention mechanism to generate the user transaction network features of the target account; wherein, the graph attention network is used for aggregation, which can be expressed as:

[0128]

[0129] Among them, α ij It represents the weight of the i-th node when aggregating its j-th edge. Nodes refer to accounts, and edges refer to transaction relationships between accounts. and W is the neural network weight matrix; Represents the node information of the i-th node after preprocessing; Represents the transaction information of the i-th node; represents the aggregated user transaction network characteristics; N i represents the set of connected edges of the ith node, including the ith node itself; σ is a nonlinear activation function.

[0130] Based on the above embodiment, optionally, the user transaction relationship feature generation module is further specifically used for:

[0131] Determine the user transaction network characteristics of other accounts based on the user transaction network characteristics generated by the target account;

[0132] Corresponding weights are assigned to the user transaction network features of the target account and the user transaction network features of other accounts to construct the user relationship features of the target user; the user relationship features can be expressed as:

[0133]

[0134] in, Represents the node information of the i-th node after preprocessing, N i Identify the first-order neighbor node set of the ith node (including the ith node itself), and W is the neural network weight matrix, αij represents the weight of the i-th node when aggregating its j-th node, Represents user relationship characteristics.

[0135] Based on the above embodiment, optionally, the fraud account identification module is specifically used to:

[0136] Assign corresponding attention weights to personal portrait features, user transaction network features, user relationship features, and user transaction time series features, and concatenate them to obtain the target bank account features;

[0137] The target bank account features are input into a fully connected neural network, the probability that the target account is a risky account is output, and fraudulent account identification is performed on the user's target account based on the probability.

[0138] The bank fraud account identification device provided in the embodiment of the present invention can execute the bank fraud account identification method provided in any embodiment of the present invention, and has the corresponding functions and beneficial effects of executing the bank fraud account identification method. For detailed processes, please refer to the relevant operations of the bank fraud account identification method in the aforementioned embodiment.

[0139] Embodiment 4

[0140] Figure 5 1 is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. The electronic device 10 is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0141] like Figure 5As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0142] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0143] The processor 11 may be a variety of general and / or dedicated processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as a bank fraud account identification method.

[0144] In some embodiments, the bank fraud account identification method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the bank fraud account identification method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to execute the bank fraud account identification method in any other appropriate manner (e.g., by means of firmware).

[0145] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0146] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0147] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, device, or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0148] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0149] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0150] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0151] Embodiment 5

[0152] An embodiment of the present invention further provides a computer program product, including a computer program, which, when executed by a processor, implements the bank fraud account identification method provided in any embodiment of the present application.

[0153] In the process of implementation, the computer program product can be written in one or more programming languages ​​or a combination thereof to perform the computer program code of the present invention, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (for example, using an Internet service provider to connect through the Internet).

[0154] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0155] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for identifying bank fraud accounts, characterized in that: The method comprises: Obtaining bank account information data of a user's target account and preprocessing the bank account information data; the bank account information data includes personal information data and transaction flow data; Input the preprocessed user personal information data into a multi-layer fully connected neural network to generate the user's personal portrait features; Determine transaction characteristics between users based on the preprocessed bank account information data, and obtain user transaction network characteristics and user relationship characteristics based on the transaction characteristics; Obtaining transaction flow data of the user within a preset time, and inputting the transaction flow data into a long short-term memory network to obtain the user's transaction time series features; Corresponding attention weights are assigned to personal portrait features, user transaction network features, user relationship features, and user transaction timing features to obtain target bank account features, and fraudulent account identification is performed on the user's target account based on the target bank account features.

2. The method according to claim 1, characterized in that The step of obtaining bank account information data of a user's target account and preprocessing the bank account information data includes: Obtaining the user's personal information data, and encoding and normalizing the personal information data; the personal information data includes age, occupation, address, income, average deposit, average transaction frequency, and average transaction amount; The transaction flow data of the user is obtained, and the transaction flow data is processed according to preset rules; the preset rules include determining the average transaction flow or the total transaction flow within a certain period of time.

3. The method according to claim 1, characterized in that The pre-processed user personal information data is input into a multi-layer fully connected neural network to generate the user's personal portrait features, including: The pre-processed user personal information data is concatenated to obtain a concatenated vector representation; The concatenated vector representation is input into a multi-layer fully connected neural network to generate the user's personal portrait features; The generated user's personal portrait feature is expressed as: in, Represents the user's personal portrait features, u i represents the concatenated vector representation, and h T Represents the parameter matrix of the fully connected layer.

4. The method according to claim 1, characterized in that: Determining transaction characteristics between users based on the preprocessed bank account information data, and obtaining user transaction network characteristics based on the transaction characteristics, includes: Determine transaction characteristics between users based on pre-processed bank account information data; The graph attention network is used to aggregate the transaction features between users according to the attention mechanism to generate the user transaction network features of the target account; wherein, the graph attention network is used for aggregation, which can be expressed as: Among them, α ij It represents the weight of the i-th node when aggregating its j-th edge. Nodes refer to accounts, and edges refer to transaction relationships between accounts. and W is the neural network weight matrix; Represents the node information of the i-th node after preprocessing; Represents the transaction information of the i-th node; represents the aggregated user transaction network characteristics; N i represents the set of connected edges of the ith node, including the ith node itself; σ is a nonlinear activation function.

5. The method according to claim 4, characterized in that Determining transaction features between users based on the pre-processed bank account information data, and obtaining user relationship features based on the transaction features, includes: Determine the user transaction network characteristics of other accounts based on the user transaction network characteristics generated by the target account; Corresponding weights are assigned to the user transaction network features of the target account and the user transaction network features of other accounts to construct the user relationship features of the target user; the user relationship features can be expressed as: in, Represents the node information of the i-th node after preprocessing, N i Identify the first-order neighbor node set of the ith node (including the ith node itself), and W is the neural network weight matrix, α ij represents the weight of the i-th node when aggregating its j-th node, Represents user relationship characteristics.

6. The method according to claim 1, characterized in that The method allocates corresponding attention weights to the personal portrait features, the user transaction network features, the user relationship features, and the user transaction time series features to obtain the target bank account features, and performs fraudulent account identification on the user's bank account based on the target bank account features, including: Assign corresponding attention weights to personal portrait features, user transaction network features, user relationship features, and user transaction time series features, and concatenate them to obtain the target bank account features; The target bank account features are input into a fully connected neural network, the probability that the target account is a risky account is output, and fraudulent account identification is performed on the user's target account based on the probability.

7. A bank fraud account identification device, characterized in that: The device comprises: A bank account information data processing module, used to obtain the bank account information data of the user's target account and pre-process the bank account information data; the bank account information data includes personal information data and transaction flow data; A personal portrait feature generation module is used to input the pre-processed user personal information data into a multi-layer fully connected neural network to generate the user's personal portrait features; A user transaction relationship feature generation module, used to determine transaction features between users based on the pre-processed bank account information data, and obtain user transaction network features and user relationship features based on the transaction features; A user transaction time series feature generation module is used to obtain the transaction flow data of the user within a preset time, and input the transaction flow data into the long short-term memory network to obtain the user transaction time series feature; The fraud account identification module is used to assign corresponding attention weights to personal portrait features, user transaction network features, user relationship features and user transaction timing features, obtain target bank account features, and perform fraud account identification on the user's target account based on the target bank account features.

8. An electronic device, characterized in that: include: one or more processors; A storage device for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the bank fraud account identification method described in any one of claims 1-6.

9. A storage medium containing computer executable instructions, characterized in that: The computer executable instructions are used to perform the bank fraud account identification method as described in any one of claims 1-6 when executed by a computer processor.

10. A computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the computer program implements the bank fraud account identification method according to any one of claims 1 to 6.

Images