Illegal fund legalization risk team and user detection method and device

Abstract

The invention relates to the field of financial business risk control, in particular to an illegal fund legalization risk team and user detection method and device, and the illegal fund legalization risk team detection method comprises the steps: obtaining teams divided based on a knowledge graph; whether each member in the team hits the early warning rule or not is judged, different machine learning models are matched according to whether the early warning rule is hit or not, the illegal fund legalization risk probability of each member in the team is obtained, and therefore the illegal fund legalization risk detection result of the team is determined. According to the method, the problems that the quantitative analysis of the illegal fund legalization risk of the team is difficult, the individual illegal fund legalization risk detection effect is poor, and the cost is high are solved.

Description

Technical Field

[0001] The present invention relates to the field of financial business risk control, and in particular to a detection method and device for illegal funds legalization risk teams and users. Background Art

[0002] With the development of the Internet, financial technology is constantly being created, and payment products are becoming increasingly diversified. Various new types of fraud, illegal funds legalization and other financial crimes are emerging in an endless stream. In the illegal funds legalization crimes, illegal funds legalization behaviors are committed by both teams and individuals. As payment methods become more and more diverse, the illegal funds legalization methods are becoming more and more cunning. Therefore, it is necessary to detect users who have transactions and discover the perpetrators in a timely manner.

[0003] The existing technology detects illegal funds legalization teams by matching preset rules and then manually screening, which requires a lot of cost, or builds a suspicious illegal funds legalization team through knowledge graphs, but it is difficult to conduct quantitative analysis of the team and its members, so it is impossible to obtain a detailed evaluation result. The existing technology detects illegal funds legalization users by matching early warning rules and then manually screening, which can ensure the accuracy of illegal funds legalization risk detection, but it requires a lot of manpower costs, and simple early warning rules have limited matching for potential risk users. There is a risk of escape for illegal funds legalization users who are not matched, or the illegal funds legalization risk of individual users is predicted by machine learning models, but the model has a single source of training data and poor detection effect, and it is difficult to reasonably predict more potential illegal funds legalization users. Summary of the invention

[0004] The present invention provides a method and device for detecting illegal funds legalization risk teams and users, which are used to solve the difficulties in quantitative analysis of illegal funds legalization risk of teams, as well as the problems of poor detection effect and high cost of individual illegal funds legalization risk.

[0005] In order to solve the above technical problems, the first aspect of this document provides a method for detecting an illegal fund legalization risk team, the method comprising:

[0006] Get teams divided based on knowledge graph;

[0007] Determine whether each member of the team hits the warning rule;

[0008] If the judgment is yes, the feature data of the member is input into a pre-trained first machine learning model to obtain the risk probability of legalization of illegal funds for the member by the first machine learning model;

[0009] If the judgment is no, the feature data of the member is input into a pre-trained second machine learning model to obtain the risk probability of legalization of illegal funds for the member by the second machine learning model;

[0010] The illegal funds legalization risk detection result of the team is determined according to the illegal funds legalization risk probability of each member of the team.

[0011] As a further embodiment of this invention, the knowledge graph is pre-constructed in the following manner, including:

[0012] The knowledge graph is constructed based on member information and member relationships, wherein the member relationships include transactions, mobile phone numbers, MAC addresses, and IP addresses between members; the knowledge graph is an unweighted undirected heterogeneous graph.

[0013] As a further embodiment of this invention, the detection method of the illegal funds legalization risk team further includes:

[0014] Obtain daily transaction information of each member of the team within a specified historical period;

[0015] Determine whether the daily transaction information of each member in a specified historical period matches the warning rule;

[0016] If the judgment is yes, the transaction information of the member on that day is input into the first machine learning model to obtain the risk probability of legalization of illegal funds of the member on that day by the first machine learning model;

[0017] If the judgment is no, the transaction information of the member on that day is input into the second machine learning model to obtain the risk probability of legalization of illegal funds of the member on that day by the second machine learning model;

[0018] Obtaining a first maximum probability of the risk probability of legalization of illegal funds for each member of the team within a specified historical period according to the first machine learning model, and a second maximum probability of the risk probability of legalization of illegal funds for each member of the team within a specified historical period according to the second machine learning model;

[0019] The risk detection result of illegal funds legalization of the team is determined according to the first maximum probability and the second maximum probability.

[0020] As a further embodiment of the present invention, determining the risk detection result of illegal funds legalization of the team according to the first maximum probability and the second maximum probability includes:

[0021] Determining the illegal funds legalization risk score of each member of the team according to the first maximum probability and the second maximum probability;

[0022] Determine the aggregated statistical value of the team according to the illegal funds legalization risk score of each member of the team; the aggregated statistical value includes: maximum value, average value and standard deviation;

[0023] Order the teams in descending order according to the aggregated statistical values ​​to obtain team ranking information;

[0024] A team whose ranking in the team ranking information is less than a preset value is determined as an illegal funds legalization risk team.

[0025] As a further embodiment of the present invention, determining the illegal funds legalization risk score of each member of the team according to the first maximum probability and the second maximum probability includes:

[0026] Enter the first maximum probability and the second maximum probability into the formula

[0027] Obtaining the illegal funds legalization risk score of each member of the team;

[0028] Among them, Score i S1 is the risk score of illegal funds legalization of the i-th member in the team. i is the first maximum probability of the i-th member in the team, S2 i is the second maximum probability of the i-th member in the team, and a is a pre-set threshold.

[0029] As a further embodiment of the present invention, in the detection method of the illegal funds legalization risk team, the first machine learning model is pre-constructed in the following manner, including:

[0030] The cases in the history that are hit by the early warning rules and confirmed as the risk of legalization of illegal funds are taken as the first black samples;

[0031] The cases in the history that are hit by the warning rules and confirmed as non-illegal fund legalization risks are used as the first white sample;

[0032] constructing a first data set according to the first black sample and the first white sample;

[0033] The first data set is input into the first model training to obtain the first machine learning model.

[0034] As a further embodiment of this invention, the second machine learning model in the detection method of the illegal funds legalization risk team is pre-constructed in the following manner, including:

[0035] The cases in the history that are hit by the warning rules and confirmed as the risk of legalization of illegal funds are used as the second black samples;

[0036] The cases in the history that are not hit by the warning rule are used as the second white sample;

[0037] constructing a second data set according to the second black sample and the second white sample;

[0038] The second data set is input into the second model training to obtain the second machine learning model.

[0039] As a further embodiment of this invention, after obtaining the second machine learning model in the detection method of the illegal funds legalization risk team, it includes:

[0040] The cases in the history that are hit by the warning rules and confirmed as the risk of legalization of illegal funds are taken as the third black samples;

[0041] The cases in the history that are hit by the early warning rules and confirmed as non-illegal fund legalization risks are used as the third white sample;

[0042] Constructing a test data set according to the third black sample and the third white sample;

[0043] The second machine learning model is evaluated according to the test data set to obtain an evaluation result; the evaluation result is used to optimize the second machine learning model.

[0044] As a further embodiment of this invention, the detection method of the illegal funds legalization risk team further includes:

[0045] Obtaining graph indicator characteristics of each member of the illegal funds legalization risk team;

[0046] The first machine learning model and the second machine learning model are optimized in combination with the graph indicator features.

[0047] As a further embodiment of this invention, the detection method of the illegal funds legalization risk team further includes:

[0048] Obtaining graph indicator characteristics of each member of the illegal funds legalization risk team;

[0049] According to the graph indicator characteristics of each member, the function label and importance ranking of each member are determined.

[0050] A second aspect of the present invention provides a method for detecting users with risk of illegal fund legalization, the method comprising:

[0051] Get users who have made transactions on that day;

[0052] Determine whether the user hits the warning rule;

[0053] If the judgment is yes, the characteristic data of the user is input into a pre-trained first machine learning model to obtain the risk probability of legalization of illegal funds of the user by the first machine learning model;

[0054] If the judgment is no, input the characteristic data of the user into the pre-trained second machine learning model to obtain the risk probability of legalization of illegal funds of the user by the second machine learning model;

[0055] Determine a detection result of the illegal funds legalization risk of the user according to the first machine learning model for the illegal funds legalization risk probability of the user and the first preset condition;

[0056] Determine the illegal funds legalization risk detection result of the user based on the first machine learning model for the user's illegal funds legalization risk probability and the first preset condition.

[0057] As a further embodiment of this invention, in the method for detecting users with risk of illegal funds legalization, the first machine learning model is pre-constructed in the following manner, including:

[0058] The cases in the history that are hit by the early warning rules and confirmed as the risk of legalization of illegal funds are taken as the first black samples;

[0059] The cases in the history that are hit by the warning rules and confirmed as non-illegal fund legalization risks are used as the first white sample;

[0060] constructing a first data set according to the first black sample and the first white sample;

[0061] The first data set is input into the first model training to obtain the first machine learning model.

[0062] As a further embodiment of this invention, in the method for detecting users with risk of illegal funds legalization, the second machine learning model is pre-constructed in the following manner, including:

[0063] The cases in the history that are hit by the warning rules and confirmed as the risk of legalization of illegal funds are used as the second black samples;

[0064] The cases in the history that are not hit by the warning rule are used as the second white sample;

[0065] constructing a second data set according to the second black sample and the second white sample;

[0066] The second data set is input into the second model training to obtain the second machine learning model.

[0067] As a further embodiment of this invention, after obtaining the second machine learning model in the method for detecting users with risk of illegal funds legalization, the method includes:

[0068] The cases in the history that are hit by the warning rules and confirmed as the risk of legalization of illegal funds are taken as the third black samples;

[0069] The cases in the history that are hit by the early warning rules and confirmed as non-illegal fund legalization risks are used as the third white sample;

[0070] Constructing a test data set according to the third black sample and the third white sample;

[0071] The second machine learning model is evaluated according to the test data set to obtain an evaluation result; the evaluation result is used to optimize the second machine learning model.

[0072] The third aspect of the present invention provides a detection device for an illegal funds legalization risk team, the device comprising:

[0073] The first acquisition module is used to acquire teams divided based on the knowledge graph;

[0074] The first judgment module is used to judge whether each member of the team hits the warning rule;

[0075] A first strategy module is used to input the feature data of the member into a pre-trained first machine learning model to obtain the risk probability of illegal funds legalization for the member by the first machine learning model when the judgment is yes; and input the feature data of the member into a pre-trained second machine learning model to obtain the risk probability of illegal funds legalization for the member by the second machine learning model when the judgment is no;

[0076] The first identification module is used to determine the illegal funds legalization risk detection result of the team according to the illegal funds legalization risk probability of each member of the team.

[0077] A fourth aspect of the present invention provides a device for detecting users with risk of illegal fund legalization, the device comprising:

[0078] The second acquisition module acquires users who have made transactions on that day;

[0079] The second judgment module is used to judge whether the user hits the warning rule;

[0080] A second strategy module is used to input the characteristic data of the user into a pre-trained first machine learning model to obtain the risk probability of illegal funds legalization for the user by the first machine learning model when the judgment is yes; and input the characteristic data of the user into a pre-trained second machine learning model to obtain the risk probability of illegal funds legalization for the user by the second machine learning model when the judgment is no;

[0081] A second identification module, used to determine the illegal funds legalization risk detection result of the user according to the first machine learning model for the illegal funds legalization risk probability of the user and the first preset condition;

[0082] The third identification module is used to determine the illegal funds legalization risk detection result of the user according to the second machine learning model for the illegal funds legalization risk probability of the user and the second preset condition.

[0083] The fifth aspect of this document provides a computer device, including a memory, a processor, and a computer program stored on the memory. When the computer program is run by the processor, it executes instructions of the method for detecting the illegal funds legalization risk team and the illegal funds legalization risk user described in any of the aforementioned embodiments.

[0084] A sixth aspect of the present invention provides a computer storage medium having a computer program stored thereon, which, when executed by a processor of a computer device, executes instructions of the method for detecting an illegal funds legalization risk team or an illegal funds legalization risk user as described in any of the aforementioned embodiments.

[0085] The detection method and device of illegal funds legalization risk team and user provided in this paper can provide candidate targets for the screening of illegal funds legalization risk team based on the divided team obtained by knowledge graph, judge whether the members of the team hit the warning rules to match two different machine learning models, comprehensively judge the illegal funds legalization risk probability of the team, detect the illegal funds legalization risk team, and improve the judgment accuracy of the illegal funds legalization risk team; evaluate the illegal funds legalization risk of the team through the probability value obtained by the machine learning model, realize the quantitative analysis of the team, and obtain the evaluation results of the illegal funds legalization risk of the refined team. Different machine learning models are used to predict the illegal funds legalization risk of users according to whether the warning rules are hit, which reduces the cost of manual screening and improves the mining effect of illegal funds legalization risk users.

[0086] In order to make the above and other purposes, features and advantages of this article more obvious and easy to understand, the following specifically cites preferred embodiments and describes them in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0087] In order to more clearly illustrate the technical solutions in the embodiments of this article or the prior art, the drawings required for use in the embodiments or the prior art descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of this article. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0088] Figure 1 The first flow chart of the detection method of the illegal funds legalization risk team in the embodiment of this article is shown;

[0089] Figure 2 A second flow chart of the detection method of the illegal funds legalization risk team in the embodiment of this article is shown;

[0090] Figure 3 A flow chart of determining the risk detection result of illegal funds legalization of the team according to the first maximum probability and the second maximum probability in the embodiment of this article is shown;

[0091] Figure 4 A first machine learning model construction flow chart in the detection method of the illegal funds legalization risk team in the embodiment of this article is shown;

[0092] Figure 5 The first flow chart of constructing the second machine learning model in the detection method of the illegal funds legalization risk team in the embodiment of this article is shown;

[0093] Figure 6 A second flowchart for constructing a second machine learning model in the detection method of the illegal funds legalization risk team in the embodiment of this article is shown;

[0094] Figure 7 The third flow chart of the detection method of the illegal funds legalization risk team in the embodiment of this article is shown;

[0095] Figure 8 The fourth flow chart of the detection method of the illegal funds legalization risk team in the embodiment of this article is shown;

[0096] Fig. 9 A flow chart of a method for detecting users with risk of illegal funds legalization according to an embodiment of this document is shown;

[0097] Fig.10 A flowchart of constructing a first machine learning model in a method for detecting users with risk of legalizing illegal funds in an embodiment of this document is shown;

[0098] Fig.11 The first flow chart of constructing the second machine learning model in the method for detecting users with risk of legalizing illegal funds in the embodiment of this article is shown;

[0099] Fig.12A second flowchart for constructing a second machine learning model in the method for detecting users with risk of legalizing illegal funds in the embodiment of this document is shown;

[0100] Fig.13 A structural diagram of a detection device for an illegal funds legalization risk team in an embodiment of this invention is shown;

[0101] Fig.14 It shows a structural diagram of a detection device for users with risk of illegal funds legalization according to an embodiment of this document;

[0102] Fig.15 A structural diagram of a computer device according to an embodiment of this invention is shown.

[0103] Description of the accompanying symbols:

[0104] 1310, a first acquisition module;

[0105] 1320, first judgment module;

[0106] 1330, first strategy module;

[0107] 1340, a first identification module;

[0108] 1410, second acquisition module;

[0109] 1420, second judgment module;

[0110] 1430, second strategy module;

[0111] 1440, a second identification module;

[0112] 1450, a third identification module;

[0113] 1502. Computer equipment;

[0114] 1504. Processor;

[0115] 1506. Memory;

[0116] 1508, driving mechanism;

[0117] 1510, input / output module;

[0118] 1512. Input devices;

[0119] 1514. Output device;

[0120] 1516. Presentation equipment;

[0121] 1518. Graphical user interface;

[0122] 1520, network interface;

[0123] 1522. Communication link;

[0124] 1524. Communication bus. DETAILED DESCRIPTION

[0125] The following will be combined with the drawings in the embodiments of this article to clearly and completely describe the technical solutions in the embodiments of this article. Obviously, the described embodiments are only part of the embodiments of this article, not all of the embodiments. Based on the embodiments of this article, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this article.

[0126] It should be noted that the terms "first", "second", etc. in the specification and claims of this article and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of this article described here can be implemented in an order other than those illustrated or described here. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, device, product or equipment that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or equipment.

[0127] This specification provides method operation steps as described in the embodiments or flow charts, but more or fewer operation steps may be included based on routine or non-creative work. The order of steps listed in the embodiments is only one way of executing the order of many steps and does not represent the only execution order. When the system or device product is executed in practice, it can be executed in the order of the method shown in the embodiments or the drawings or in parallel.

[0128] It should be noted that the acquisition, storage, use, and processing of data in the technical solutions of the embodiments of this specification comply with the relevant provisions of national laws and regulations.

[0129] It should be noted that in the embodiments of the present application, certain software, components, models and other existing solutions in the industry may be mentioned, and they should be regarded as exemplary. Their purpose is only to illustrate the feasibility of implementing the technical solution of the present application, but it does not mean that the applicant has or will necessarily use the solution.

[0130] It should be noted that in the embodiments of the present application, legalization of illegal funds refers to the act of disguising, concealing, and converting illegal income obtained from illegal activities through various means to make it legal in form.

[0131] In one embodiment of the present invention, a detection method for a team with risk of illegal fund legalization is provided to solve the problem of difficulty in quantitative analysis of the risk of illegal fund legalization of the team.

[0132] Specifically, Figure 1 As shown, the detection methods of the illegal funds legalization risk team include:

[0133] Step 110, obtaining teams divided based on the knowledge graph;

[0134] Step 120, respectively determining whether each member of the team hits the warning rule, if the determination is yes, executing step 130, if the determination is no, executing step 140;

[0135] Step 130, inputting the feature data of the member into a pre-trained first machine learning model to obtain the risk probability of legalization of illegal funds for the member by the first machine learning model;

[0136] Step 140, inputting the feature data of the member into a pre-trained second machine learning model to obtain the risk probability of legalization of illegal funds for the member by the second machine learning model;

[0137] Step 150, determining the illegal funds legalization risk detection result of the team according to the illegal funds legalization risk probability of each member of the team.

[0138] The teams divided based on the knowledge graph in this embodiment can provide candidate targets for the screening of illegal funds legalization risk teams, determine whether team members hit the warning rules and match two different machine learning models, comprehensively judge the team's illegal funds legalization risk probability, detect the illegal funds legalization risk team, and improve the judgment accuracy of the illegal funds legalization risk team; evaluate the illegal funds legalization risk of the team through the probability value obtained by the machine learning model, realize the quantitative analysis of the team, and thus obtain a refined evaluation result of the illegal funds legalization risk of the team.

[0139] In some embodiments of the present invention, user information of commercial banks is obtained for illegal fund legalization risk detection, and the association relationship between users is constructed through the knowledge graph, and then the constructed graph is divided into teams using a connectivity algorithm to obtain the teams to be detected; considering that the existing knowledge graph is mostly constructed through transaction relationships, a weighted directed isomorphic graph is constructed and then divided using a community discovery algorithm, however, in the field of anti-illegal fund legalization, the association relationship is too single and does not conform to the typical illegal fund legalization scenario identification. In addition to fund transaction relationships, relationships such as IP, MAC, and mobile phone numbers more directly reveal the association between individuals, and this relationship is usually undirected and unauthorized, so an unauthorized and undirected knowledge graph is constructed based on member information and member relationships.

[0140] In some embodiments of this article, the knowledge graph is constructed and the teams are divided through the following steps:

[0141] (1) Graph design: Define the knowledge graph point-edge schema table structure. You can design multiple entities and relationships, and design the corresponding attributes of entity relationships (such as member name, transaction amount, etc.). Then, perform knowledge processing and extraction based on the designed graph schema. Here, members are taken as entities, and transactions, same IP, same MAC, same mobile phone number, etc. are taken as relationships to construct an unweighted, undirected, heterogeneous graph.

[0142] (2) Data acquisition: After defining the graph structure, basic data is acquired according to the preset graph structure. If you need to build a transaction relationship between members, you need to obtain the transaction flow of members within a period of time (such as 1 month, 3 months, 6 months); if you need to obtain the identity information of members, you need to obtain all the information of members within a certain period of time, such as the mobile phone number, MAC address, IP address, etc. used by the members within 3 months.

[0143] (3) Data filtering: For the acquired data, we first need to filter out missing values ​​and outliers, such as mobile phone number length not meeting requirements and MAC address format abnormalities, to ensure the accuracy of the basic data when constructing the graph. Secondly, in order to improve recognition accuracy, some non-active account transactions within the bank should also be eliminated, such as financial management interest settlement, judicial freezing and other data. Finally, we need to do some targeted processing based on the business logic, such as keeping track of whitelist members within the bank.

[0144] (4) Data processing: Based on the filtered data, taking each member as the starting point, two members with transactions, same mobile phone number, same MAC, same IP, etc. are connected to construct an unweighted undirected graph; then, the number of relationships corresponding to each member entity and the degree of the node are counted, and nodes greater than a certain threshold (such as 1000) are removed to prevent the emergence of explosive nodes.

[0145] (5) Team division: After data processing, the point-edge data is obtained to construct a knowledge graph, and then the connectivity algorithm is used to divide the graph into communities and divide it into several subgraphs. Considering the data volume of commercial banks, the connected branch algorithm is used to generate a maximum subgraph, and then the connectivity algorithm Louvain is used to divide the maximum subgraph into multiple teams. The connectivity algorithm can also be other algorithms, which are not limited in this article.

[0146] In some embodiments of this article, hitting the warning rule means hitting a certain warning rule, hitting several warning rules, or hitting all warning rules, which is not limited in this article. The warning rules are written in SQL language and generate warning rule programs. The rules and thresholds are refined by business experience. When the rules are met, the cases are generated by violent triggering. According to the transaction characteristics of members, the commonly used rules are "concentrated transfer in, decentralized transfer out", "frequent transactions at night", "transfer amounts are multiples of hundreds", etc. Warning rules can also be written in other programming languages, which are not limited in this article. According to whether the warning rules are hit, different machine learning models are matched to predict the risk probability, and the team's illegal funds legalization risk detection results are obtained.

[0147] In some embodiments of this invention, the risk team for legalization of illegal funds can also be obtained through business indicator evaluation. Considering that many risk members may not have transaction behaviors in current financial institutions, but have qualitative risks after investigation by competent authorities, such as judicial investigation and freezing, involvement in cases or disciplinary actions, the transaction performance of such members is relatively low, and they may be considered not suspicious by machine learning, that is, the score is low. Therefore, in order to enrich the dimensions of the entire team evaluation, business rule evaluation design is introduced, such as "the number of members in the team who have been frozen by judicial investigation", "the number of members in the team who have been punished by competent authorities", "the number of members in the team who have been reported in the past", etc.

[0148] In one embodiment of this invention, Figure 2 As shown, the detection method of the illegal funds legalization risk team also includes:

[0149] Step 210, obtaining daily transaction information of each member of the team within a specified historical period;

[0150] Step 220, respectively determining whether the daily transaction information of each member in the specified historical period matches the warning rule, if the determination is yes, executing step 230, if the determination is no, executing step 240;

[0151] Step 230, inputting the member's transaction information for that day into the first machine learning model to obtain the first machine learning model's risk probability of legalizing illegal funds for the member for that day;

[0152] Step 240, inputting the member's transaction information on that day into the second machine learning model to obtain the illegal funds legalization risk probability of the member on that day by the second machine learning model;

[0153] Step 250, obtaining a first maximum probability of the risk probability of legalization of illegal funds for each member of the team within a specified historical period according to the first machine learning model, and a second maximum probability of the risk probability of legalization of illegal funds for each member of the team within a specified historical period according to the second machine learning model;

[0154] Step 260: Determine the risk detection result of illegal funds legalization of the team based on the first maximum probability and the second maximum probability.

[0155] This embodiment judges the daily transaction information of each member in the team within the specified historical period, obtains the daily illegal funds legalization probability predicted by the two machine learning models within the specified historical period, and respectively counts the maximum illegal funds legalization probability predicted by the two machine learning models for each member, so as to obtain the maximum suspicious probability of each member based on different models, thereby determining the illegal funds legalization risk detection result of the team.

[0156] In some embodiments of this document, the daily transaction information of members includes, but is not limited to (1) basic information: such as gender, age, nationality, and occupation; (2) account information: the earliest account opening date, the number of accounts of a category, and the number of accounts under one’s name; (3) simple transaction characteristics: the number of counterparties, the total transaction amount, the total number of transactions, the number of transaction MAC addresses, the proportion of transactions in the early morning, and the proportion of cash transactions; (4) complex transaction characteristics: the total amount of fast-in and fast-out transactions, the total number of transactions with consecutive repeated amounts, and the total amount during frequent transactions; (5) external information: the number of inquiries by the competent authority, the number of freezes by the competent authority, and the number of cases involved. The specified historical period can be a week, a month, a quarter, etc., which is not limited in this document.

[0157] In some embodiments of this document, hitting a warning rule means hitting a certain warning rule, hitting several warning rules, or hitting all warning rules, which is not limited in this document.

[0158] In one embodiment of this invention, Figure 3 As shown, according to the first maximum probability and the second maximum probability, determining the risk detection result of the illegal funds legalization of the team includes:

[0159] Step 310, determining the illegal funds legalization risk score of each member of the team according to the first maximum probability and the second maximum probability;

[0160] Step 320, determining the aggregated statistical value of the team according to the illegal funds legalization risk score of each member of the team; the aggregated statistical value includes: maximum value, average value and standard deviation;

[0161] Step 320, sorting the teams in descending order according to the aggregated statistical value to obtain team ranking information;

[0162] Step 330: Determine the team whose ranking in the team ranking information is less than a preset value as an illegal funds legalization risk team.

[0163] This embodiment aggregates and counts the illegal funds legalization risk scores of each member of the team. The statistical values ​​of different dimensions can be obtained through the maximum value, average value and standard deviation, so as to select the statistical method according to the actual situation and obtain a reasonable team score ranking. By sorting the teams in descending order according to the statistical values, the team ranking information is obtained, and the top-ranked teams are selected as screening targets, which greatly increases the screening efficiency. The screened-out illegal funds legalization risk teams are then handed over to the staff for final confirmation to find out the illegal funds legalization teams.

[0164] In some embodiments of this invention, the aggregated statistical value of a team is obtained by the maximum value. For example, if there are a few members with extremely high scores in a team, while most of the members have very low scores, then in this case, the maximum score of the team is very high and the average score is very low. There may be independent suspicious members in the team (i.e., the individual scores are high), and independent unsuspicious members who are associated with him and are classified as a team (i.e., the individual scores are low) may also be suspicious, but they are temporarily undiscovered due to their own low transaction performance. In this case, the maximum value is given priority for aggregate statistics.

[0165] In some embodiments of this invention, the aggregated statistical value of the team is obtained by the average value. For example, if the team average score is very high, it means that the members of the team are suspicious independently and there may be suspicion of cross-branch crime. In this case, in order to better characterize the illegal funds legalization team, the average value is given priority for aggregate statistics.

[0166] In some embodiments of this article, in addition to the maximum value, average value and standard deviation for aggregate statistics, other indicators can also be used to sort the aggregate statistics according to the actual screening habits to indicate the team's suspicious degree, which is not limited in this article. The preset value can be 50%, 30%, 15%, etc., which is selected according to the actual situation, and is not limited in this article.

[0167] In some embodiments herein, the first maximum probability and the second maximum probability are input into the formula Get the illegal funds legalization risk score of each member of the team;

[0168] Among them, Score i S1 is the risk score of illegal funds legalization of the i-th member in the team. i is the first maximum probability of the i-th member in the team, S2 i is the second maximum probability of the i-th member in the team, and a is a preset threshold, which is set according to the actual situation and is not limited in this article.

[0169] In one embodiment of this invention, Figure 4As shown, the first machine learning model in the detection method of the illegal funds legalization risk team is pre-built in the following ways, including:

[0170] Step 410, taking the cases in the historical cases that are hit by the early warning rule and confirmed as the risk of legalization of illegal funds as the first black sample;

[0171] Step 420, taking the cases in the historical cases that are hit by the early warning rule and confirmed as not having the risk of legalization of illegal funds as the first white sample;

[0172] Step 430, constructing a first data set according to the first black sample and the first white sample;

[0173] Step 440: input the first data set into a first model training to obtain the first machine learning model.

[0174] This embodiment uses the cases that hit the warning rules as a data set, and is able to train a first machine learning model for the cases that hit the warning rules, so that the first machine learning model can detect the members who hit the warning rules and obtain the risk probability of illegal funds legalization of the member, thereby obtaining the probability of each member in the team hitting the warning rules, which serves as a probability dimension of the risk probability of illegal funds legalization of each member of the team, and provides an analysis basis for the overall risk probability of illegal funds legalization of the team.

[0175] In some embodiments of the present invention, a first machine learning model is constructed by the following steps:

[0176] (1) Sample acquisition: Collect cases that have been hit by historical warning rules as a data set, take manually reported samples as black samples, and manually excluded samples as white samples, label them separately, and use them as training samples for the first machine learning model.

[0177] (2) Feature processing: The obtained case personnel information is subjected to feature engineering to form a high-dimensional complex feature set, which may include, but is not limited to, the following: basic information: such as gender, age, nationality, and occupation; account information: the earliest account opening date, the number of accounts of one type, and the number of accounts under one’s name; simple transaction features: the number of counterparties, the total transaction amount, the total number of transactions, the number of transaction MAC addresses, the proportion of transactions in the early morning, and the proportion of cash transactions; complex transaction features: the total amount of fast-in and fast-out transactions, the total number of transactions with consecutive repeated amounts, and the total amount during frequent transactions; external information: the number of inquiries by the competent authority, the number of freezes by the competent authority, and the number of cases involved.

[0178] (3) Model training: Based on the constructed sample labels and feature data, a classification machine learning algorithm is used for learning and training. The algorithms that can be used are but not limited to: LR, GBDT, XGboost, LightGBM, etc., which are not limited in this article.

[0179] (4) Model evaluation: Use machine learning evaluation indicators to verify the effect of model learning, and continuously adjust the model parameters until the effect meets the requirements, and obtain the first machine learning model that has been trained. Machine learning evaluation indicators can be used but are not limited to: Precision, Recall, F1-score and other indicators, which are not limited in this article.

[0180] In one embodiment of this invention, Figure 5 As shown, the second machine learning model in the detection method of the illegal funds legalization risk team is pre-built in the following ways, including:

[0181] Step 510, taking the cases in the historical cases that are hit by the early warning rule and confirmed as the risk of legalization of illegal funds as the second black sample;

[0182] Step 520, taking the cases in the historical cases that are not hit by the warning rule as the second blank samples;

[0183] Step 530, constructing a second data set according to the second black sample and the second white sample;

[0184] Step 540: input the second data set into a second model training to obtain the second machine learning model.

[0185] This embodiment uses cases determined to be at risk of illegal funds legalization as black samples, and cases that are not hit by the warning rules as white samples, and can train a second machine learning model for cases that do not hit the warning rules, so that the second machine learning model can detect members who do not hit the warning rules, and obtain the member's illegal funds legalization risk probability, thereby obtaining the probability of each member in the team hitting the warning rules, which serves as another probability dimension of the illegal funds legalization risk probability of each member of the team, and provides an analysis basis for the overall illegal funds legalization risk probability of the team.

[0186] In some embodiments of the present invention, the second machine learning model is constructed by the following steps:

[0187] (1) Sample acquisition: Samples with historical warnings and manual reporting are taken as black samples, and samples without historical warning behaviors are extracted as white samples. They are labeled and used as training samples for the second machine learning model.

[0188] (2) Feature processing: The obtained case personnel information is subjected to feature engineering. Considering that the number of people to be predicted by the second machine learning model is much larger than that of the first machine learning model, the complexity of feature processing calculation is reduced on this basis to form a high-dimensional complex feature set, which may include, but is not limited to, the following: basic information: such as gender, age, nationality, occupation; account information: earliest account opening date, number of accounts of one type, number of accounts under one’s name; transaction characteristics: number of counterparties, total transaction amount, total number of transactions, number of transaction MAC addresses, proportion of transactions in the early morning, and proportion of cash transactions; external information: number of inquiries by the competent authority, number of freezes by the competent authority, and number of cases involved.

[0189] (3) Model training: Based on the constructed sample labels and feature data, a classification machine learning algorithm is used for learning and training. The algorithms that can be used are but not limited to: LR, GBDT, XGboost, LightGBM, etc., which are not limited in this article.

[0190] (4) Model evaluation: Use machine learning evaluation indicators to verify the effect of model learning, and continuously adjust the model parameters until the effect meets the requirements, and obtain the second machine learning model that has been trained. Machine learning evaluation indicators can be used but are not limited to: Precision, Recall, F1-score and other indicators, which are not limited in this article.

[0191] In one embodiment of this invention, Figure 6 As shown, the detection method of the illegal funds legalization risk team obtained the second machine learning model, including:

[0192] Step 610, taking the cases in the historical cases that are hit by the early warning rule and confirmed as the risk of legalization of illegal funds as the third black sample;

[0193] Step 620, taking the cases in the historical cases that are hit by the early warning rule and confirmed as not having the risk of legalization of illegal funds as the third white sample;

[0194] Step 630, constructing a test data set according to the third black sample and the third white sample;

[0195] Step 640: evaluate the second machine learning model according to the test data set to obtain an evaluation result; the evaluation result is used to optimize the second machine learning model.

[0196] This embodiment takes into account that there are also risk cases in the white samples for training the second machine learning model. At this time, the actual effect of the model cannot be objectively evaluated based on the second data set. Therefore, the cases hit by the warning rules are used as test data sets to evaluate the model performance, so as to continuously adjust the model to obtain an optimized second machine learning model; wherein, the samples of the test data set can be selected from the second data set.

[0197] In one embodiment of this invention, Figure 7 As shown, the detection method of the illegal funds legalization risk team also includes:

[0198] Step 710, obtaining graph indicator characteristics of each member of the illegal funds legalization risk team;

[0199] Step 720: Optimize the first machine learning model and the second machine learning model in combination with the graph indicator features.

[0200] This embodiment extracts the graph indicator features of each member of the illegal funds legalization risk team, and uses them to optimize the first machine learning model and the second machine learning model in combination with the feature data of the training machine learning model, thereby further improving the model effect. The optimized machine learning model then scores the team to discover more valuable teams, and then extracts more efficient graph indicator features, thereby realizing the two-way empowerment of machine learning and knowledge graphs and forming a closed value loop.

[0201] In some embodiments of this invention, the extracted graph index features are recorded as The original machine learning feature is recorded as f 1 , f 2 , ..., f m , then stitch the graph index characteristics Get the feature set f 1 , f 2 , ..., f m , The machine learning model is input again to obtain the optimized first machine learning model and second machine learning model.

[0202] In one embodiment of this invention, Figure 8 As shown, the detection method of the illegal funds legalization risk team also includes:

[0203] Step 810, obtaining graph indicator characteristics of each member of the illegal funds legalization risk team;

[0204] Step 820: Determine the function label and importance ranking of each member according to the graph indicator characteristics of each member.

[0205] This embodiment extracts the graph indicator features of each member of the illegal funds legalization risk team, determines the function label and importance ranking of each member in the team based on the graph indicator features, and uses this as a basis for implementing different processing strategies for different members of the illegal funds legalization risk team.

[0206] In some embodiments of this invention, some graph indicator features, such as "degree", "closeness centrality", "betweenness centrality", etc., are extracted from the team to determine the functional labels and importance of different nodes (members) in the subgraph (team). Table 1 explains the relevant concepts as follows:

[0207] Table 1

[0208]

[0209]

[0210] Use v i represents the i-th node in the subgraph, then the degree of the i-th node

[0211] Degree centrality of the i-th node n is the number of nodes in the subgraph.

[0212] The closeness centrality of the i-th node n is the number of nodes in the subgraph, I ij is node v i and v j The shortest distance between them is the shortest path. is the node v i The average shortest path between a node and all other nodes. The smaller the average shortest path, the higher the closeness centrality of the node.

[0213] Betweenness centrality of the ith node N jk Indicates v i and v j The number of shortest paths between jk (i) indicates v i and v j The shortest path between i If a member is located on multiple shortest paths of other members, it has a large betweenness centrality, and then the member is a core member.

[0214] When the intermediary centrality of a node is high, it is possible that the node mainly plays a bridging role in the illegal funds legalization team, that is, the functional label of a "transition account"; for example, in a transaction relationship network of a risk group, the intermediary centrality of a node is high. Combined with its transactions, the node may be a high-risk account (high importance) belonging to the "owner", and a large amount of funds are collected or split by these accounts.

[0215] In one embodiment of the present invention, a method for detecting users with risk of illegal funds legalization is also provided to solve the problem of poor detection effect and high cost of risk of personal illegal funds legalization.

[0216] Specifically, Fig. 9 As shown, the detection methods of the illegal funds legalization risk team include:

[0217] Step 910, obtaining users who have performed transactions on that day;

[0218] Step 920, determining whether the user hits the warning rule, if it is determined to be yes, executing step 930, if it is determined to be no, executing step 940;

[0219] Step 930, input the characteristic data of the user into a pre-trained first machine learning model to obtain the risk probability of legalization of illegal funds of the user by the first machine learning model, and execute step 950;

[0220] Step 940, input the characteristic data of the user into the pre-trained second machine learning model to obtain the risk probability of legalization of illegal funds of the user by the second machine learning model, and execute step 960;

[0221] Step 950, determining the illegal funds legalization risk detection result of the user according to the first machine learning model for the illegal funds legalization risk probability of the user and the first preset condition;

[0222] Step 960: Determine the illegal funds legalization risk detection result of the user according to the second machine learning model for the illegal funds legalization risk probability of the user and the second preset condition.

[0223] This embodiment detects users who have made transactions on the same day, determines whether the users match the early warning rules with two different machine learning models, determines the users' illegal funds legalization risk probability from different angles, detects users with illegal funds legalization risk, and improves the mining effect of users with illegal funds legalization risk; screens users who hit the early warning rules through the first machine learning model, reduces the workload of manual further screening and confirmation after the early warning rules hit the users, and reduces the manual screening cost; checks users who do not hit the early warning rules through the second machine learning model, thereby mining potential illegal funds legalization risk users who do not hit the early warning rules.

[0224] In some embodiments of this invention, the user information of commercial banks with daily transaction behaviors is obtained for the risk detection of legalization of illegal funds. The user information includes, but is not limited to (1) basic information: such as gender, age, nationality, and occupation; (2) account information: the earliest account opening date, the number of accounts of a category, and the number of accounts under one's name; (3) simple transaction characteristics: the number of counterparties, the total transaction amount, the total number of transactions, the number of transaction MAC addresses, the proportion of transactions in the early morning, and the proportion of cash transactions; (4) complex transaction characteristics: the total amount of fast-in and fast-out transactions, the total number of transactions with consecutive repeated amounts, and the total amount during frequent transactions; (5) external information: the number of inquiries by the competent authority, the number of freezes by the competent authority, and the number of cases involved. The specified historical period can be a week, a month, a quarter, etc., which is not limited in this invention.

[0225] In some embodiments of this article, hitting the warning rule means hitting a certain warning rule, hitting several warning rules, or hitting all warning rules, which is not limited in this article. The warning rules are written in SQL language and generate warning rule programs. The rules and thresholds are refined by business experience. When the rules are met, the cases are generated by violent triggering. According to the characteristics of user transactions, the commonly used rules are "concentrated transfer in, dispersed transfer out", "frequent transactions at night", "transfer amounts are multiples of hundreds", etc. Warning rules can also be written in other programming languages, which are not limited in this article. According to whether the warning rules are hit, different machine learning models are matched to predict the risk probability, and the user's illegal funds legalization risk detection results are obtained.

[0226] In one embodiment of this invention, Fig.10 As shown, in the method for detecting users with risk of illegal funds legalization, the first machine learning model is pre-built in the following ways, including:

[0227] Step 1010, taking the cases in the historical cases that are hit by the early warning rule and confirmed as the risk of legalization of illegal funds as the first black sample;

[0228] Step 1020, taking the cases in the historical cases that are hit by the early warning rule and confirmed as not having the risk of legalization of illegal funds as the first white sample;

[0229] Step 1030, constructing a first data set according to the first black sample and the first white sample;

[0230] Step 1040: input the first data set into a first model training to obtain the first machine learning model.

[0231] This embodiment uses cases that hit the warning rules as data sets, and is able to train a first machine learning model for cases that hit the warning rules, so that the first machine learning model can detect users who hit the warning rules and obtain the risk probability of illegal funds legalization of the user. Users with a higher probability are screened out based on the risk probability of illegal funds legalization of the user, and output them to the staff for further confirmation to reduce the screening costs of the staff.

[0232] In some embodiments of this invention, users with a higher probability of legalizing illegal funds of the users are screened out according to the risk probability of legalizing illegal funds of the users, which is achieved through preset values, and the preset values ​​may be 50%, 30%, 15%, etc., which are selected according to the actual situation and are not limited in this invention.

[0233] In some embodiments of the present invention, a first machine learning model is constructed by the following steps:

[0234] (1) Sample acquisition: Collect cases that have been hit by historical warning rules as a data set, take manually reported samples as black samples, and manually excluded samples as white samples, label them separately, and use them as training samples for the first machine learning model.

[0235] (2) Feature processing: The obtained case personnel information is subjected to feature engineering to form a high-dimensional complex feature set, which may include, but is not limited to, the following: basic information: such as gender, age, nationality, and occupation; account information: the earliest account opening date, the number of accounts of one type, and the number of accounts under one’s name; simple transaction features: the number of counterparties, the total transaction amount, the total number of transactions, the number of transaction MAC addresses, the proportion of transactions in the early morning, and the proportion of cash transactions; complex transaction features: the total amount of fast-in and fast-out transactions, the total number of transactions with consecutive repeated amounts, and the total amount during frequent transactions; external information: the number of inquiries by the competent authority, the number of freezes by the competent authority, and the number of cases involved.

[0236] (3) Model training: Based on the constructed sample labels and feature data, a classification machine learning algorithm is used for learning and training. The algorithms that can be used are but not limited to: LR, GBDT, XGboost, LightGBM, etc., which are not limited in this article.

[0237] (4) Model evaluation: Use machine learning evaluation indicators to verify the effect of model learning, and continuously adjust the model parameters until the effect meets the requirements, and obtain the first machine learning model that has been trained. Machine learning evaluation indicators can be used but are not limited to: Precision, Recall, F1-score and other indicators, which are not limited in this article.

[0238] In one embodiment of this invention, Fig.11 As shown, in the method for detecting users with risk of illegal funds legalization, the second machine learning model is pre-built in the following ways, including:

[0239] Step 1110, taking the cases in the historical cases that are hit by the early warning rule and confirmed as the risk of legalization of illegal funds as the second black sample;

[0240] Step 1120, taking the cases in the historical cases that are not hit by the warning rule as the second blank samples;

[0241] Step 1130, constructing a second data set according to the second black sample and the second white sample;

[0242] Step 1140: input the second data set into a second model training to obtain the second machine learning model.

[0243] This embodiment uses cases determined to be at risk of illegal funds legalization as black samples, and cases that are not hit by the warning rules as white samples, and can train a second machine learning model for cases that do not hit the warning rules, so that the second machine learning model can detect users who do not hit the warning rules, and obtain the user's illegal funds legalization risk probability. Users with a higher probability are screened out based on the user's illegal funds legalization risk probability, and output them to staff for further confirmation, thereby mining potential risk users from users who do not hit the warning rules.

[0244] In some embodiments of this invention, users with a higher probability of legalizing illegal funds of the users are screened out according to the risk probability of legalizing illegal funds of the users, which is achieved through preset values, and the preset values ​​may be 50%, 30%, 15%, etc., which are selected according to the actual situation and are not limited in this invention.

[0245] In some embodiments of the present invention, the second machine learning model is constructed by the following steps:

[0246] (1) Sample acquisition: Samples with historical warnings and manual reporting are taken as black samples, and samples without historical warning behaviors are extracted as white samples. They are labeled and used as training samples for the second machine learning model.

[0247] (2) Feature processing: The obtained case personnel information is subjected to feature engineering. Considering that the number of people to be predicted by the second machine learning model is much larger than that of the first machine learning model, the complexity of feature processing calculation is reduced on this basis to form a high-dimensional complex feature set, which may include, but is not limited to, the following: basic information: such as gender, age, nationality, occupation; account information: earliest account opening date, number of accounts of one type, number of accounts under one’s name; transaction characteristics: number of counterparties, total transaction amount, total number of transactions, number of transaction MAC addresses, proportion of transactions in the early morning, and proportion of cash transactions; external information: number of inquiries by the competent authority, number of freezes by the competent authority, and number of cases involved.

[0248] (3) Model training: Based on the constructed sample labels and feature data, a classification machine learning algorithm is used for learning and training. The algorithms that can be used are but not limited to: LR, GBDT, XGboost, LightGBM, etc., which are not limited in this article.

[0249] (4) Model evaluation: Use machine learning evaluation indicators to verify the effect of model learning, and continuously adjust the model parameters until the effect meets the requirements, and obtain the second machine learning model that has been trained. Machine learning evaluation indicators can be used but are not limited to: Precision, Recall, F1-score and other indicators, which are not limited in this article.

[0250] In one embodiment of this invention, Fig.12 As shown, after obtaining the second machine learning model in the detection method of illegal funds legalization risk users, it includes:

[0251] Step 1210, taking the cases in the historical cases that are hit by the early warning rule and confirmed as the risk of legalization of illegal funds as the third black sample;

[0252] Step 1220, taking the cases in the historical cases that are hit by the early warning rule and confirmed as not having the risk of legalization of illegal funds as the third white sample;

[0253] Step 1230, constructing a test data set according to the third black sample and the third white sample;

[0254] Step 1240: evaluate the second machine learning model based on the test data set to obtain an evaluation result; the evaluation result is used to optimize the second machine learning model.

[0255] This embodiment takes into account that there are also risk cases in the white samples for training the second machine learning model. At this time, the actual effect of the model cannot be objectively evaluated based on the second data set. Therefore, the cases hit by the warning rules are used as test data sets to evaluate the model performance, so as to continuously adjust the model to obtain an optimized second machine learning model; wherein, the samples of the test data set can be selected from the second data set.

[0256] Based on the same inventive concept, this article also provides a detection device for an illegal fund legalization risk team, as described in the following embodiments. Since the principle of solving the problem by the detection device for illegal fund legalization risk team is similar to the detection method for illegal fund legalization risk team, the implementation of the detection device for illegal fund legalization risk team can refer to the detection method for illegal fund legalization risk team, and the repeated parts will not be repeated.

[0257] Specifically, Fig.13 As shown, the detection devices of the illegal funds legalization risk team include:

[0258] The first acquisition module 1310 is used to acquire teams divided based on the knowledge graph;

[0259] The first judgment module 1320 is used to judge whether each member of the team hits the warning rule;

[0260] The first strategy module 1330 is used to input the feature data of the member into a pre-trained first machine learning model to obtain the risk probability of illegal funds legalization for the member by the first machine learning model when the judgment is yes; and input the feature data of the member into a pre-trained second machine learning model to obtain the risk probability of illegal funds legalization for the member by the second machine learning model when the judgment is no;

[0261] The first identification module 1340 is used to determine the illegal funds legalization risk detection result of the team according to the illegal funds legalization risk probability of each member of the team.

[0262] The teams divided based on the knowledge graph in this embodiment can provide candidate targets for the screening of illegal funds legalization risk teams, determine whether team members hit the warning rules and match two different machine learning models, comprehensively judge the team's illegal funds legalization risk probability, detect the illegal funds legalization risk team, and improve the judgment accuracy of the illegal funds legalization risk team; evaluate the illegal funds legalization risk of the team through the probability value obtained by the machine learning model, realize the quantitative analysis of the team, and thus obtain a refined evaluation result of the illegal funds legalization risk of the team.

[0263] Based on the same inventive concept, this article also provides a detection device for illegal funds legalization risk users, as described in the following embodiments. Since the principle of the detection device for illegal funds legalization risk users to solve the problem is similar to the detection method for illegal funds legalization risk users, the implementation of the detection device for illegal funds legalization risk users can refer to the detection method for illegal funds legalization risk users, and the repeated parts will not be repeated.

[0264] Specifically, Fig.14 As shown, the detection device for users with risk of illegal funds legalization includes:

[0265] The second acquisition module 1410 acquires users who have performed transactions on that day;

[0266] The second judgment module 1420 is used to judge whether the user hits the warning rule;

[0267] The second policy module 1430 is used to input the characteristic data of the user into a pre-trained first machine learning model to obtain the risk probability of illegal funds legalization for the user according to the first machine learning model when the judgment is yes; and input the characteristic data of the user into a pre-trained second machine learning model to obtain the risk probability of illegal funds legalization for the user according to the second machine learning model when the judgment is no;

[0268] A second identification module 1440 is used to determine the illegal funds legalization risk detection result of the user according to the first machine learning model for the illegal funds legalization risk probability of the user and the first preset condition;

[0269] The third identification module 1450 is used to determine the illegal funds legalization risk detection result of the user according to the second machine learning model for the illegal funds legalization risk probability of the user and the second preset condition.

[0270] This embodiment detects users who have made transactions on the same day, determines whether the users match the early warning rules with two different machine learning models, determines the users' illegal funds legalization risk probability from different angles, detects users with illegal funds legalization risk, and improves the mining effect of users with illegal funds legalization risk; screens users who hit the early warning rules through the first machine learning model, reduces the workload of manual further screening and confirmation after the early warning rules hit the users, and reduces the manual screening cost; checks users who do not hit the early warning rules through the second machine learning model, thereby mining potential illegal funds legalization risk users who do not hit the early warning rules.

[0271] The detection method and device of illegal funds legalization risk team and user provided in this paper can provide candidate targets for the screening of illegal funds legalization risk team based on the divided team obtained by knowledge graph, judge whether the members of the team hit the warning rules to match two different machine learning models, comprehensively judge the illegal funds legalization risk probability of the team, detect the illegal funds legalization risk team, and improve the judgment accuracy of the illegal funds legalization risk team; evaluate the illegal funds legalization risk of the team through the probability value obtained by the machine learning model, realize the quantitative analysis of the team, and obtain the evaluation results of the illegal funds legalization risk of the refined team. Different machine learning models are used to predict the illegal funds legalization risk of users according to whether the warning rules are hit, which reduces the cost of manual screening and improves the mining effect of illegal funds legalization risk users.

[0272] In order to more clearly illustrate the technical solution of this article, a specific detection example of an illegal funds legalization risk team is used for detailed explanation below.

[0273] Take some cases that triggered the early warning rules in the first half of 2023, and report the high-quality cases according to the business prompts. Modeling is carried out with 100,000 samples, of which 20,000 are black samples (reported) and 80,000 are white samples (excluded). Data analysis is carried out on the samples to analyze their transaction distribution, identity characteristics, judicial and other information, and comprehensively characterize the case portrait. Based on this, more than 3,000 dimensions of processing features are constructed, and then feature dimensionality reduction technology is used. Here, the calculation of feature IV values ​​and PSI is selected to select 50 dimensions of important features. After training with the XGBoost model and tuning of model parameters, the first machine learning model is obtained.

[0274] Take some cases that triggered the early warning rules in the first half of 2023. Those with higher reporting quality according to business prompts are recorded as black samples, totaling 20,000. In the month when the black samples are reported, select cases with no historical warning records and transactions in the current month according to the sample ratio, totaling 980,000. A total of 1 million samples are modeled, including 20,000 black samples and 980,000 white samples. Data analysis is performed on the samples to analyze their transaction distribution, identity characteristics, judicial and other information, and comprehensively characterize the case portraits. Based on this, simple features with more than 1,000 dimensions are constructed and processed, and then feature dimensionality reduction technology is used. Here, the features with the top 50 feature importance are selected after training with the random forest algorithm, and then trained with the XGBoost model, and the model parameters are tuned to obtain the second machine learning model.

[0275] We construct a knowledge graph based on the transaction data of commercial banks for one month, use the connected branch algorithm to divide the maximal connected subgraph, and then use the Louvain algorithm to further divide the teams. The final result statistics are shown in Table 2:

[0276] Table 2

[0277] Basic data Initial Entity Initial Relationship Excavation Team Subgraph Entity Subgraph Relationship 900 million+ 200 million+ 200 million+ 5 million+ 15 million+ 20 million+

[0278] As can be seen from Table 2, more than 5 million teams were identified from the massive relational data (900 million+), and the number of sub-graph entities and relationships was more than 15 million, covering the potential risks as much as possible.

[0279] However, there are still too many teams, and it is still difficult to locate the risk teams of illegal funds legalization. At this time, it is necessary to use the set group indicators to assist in screening. The designed indicators are as follows:

[0280] (1) Number of team entities, (2) Types of team entities, (3) Reasons for team agglomeration, (4) Number of team members, (5) Number of team members within the bank, (6) Total transaction amount of the team, (7) Total number of team transactions, (8) Number of members reported in the team, (9) Percentage of members reported in the team, (10) Number of members warned in the team, (11) Percentage of members warned in the team, (12) Number of low- and medium-risk members in the team, (13) Percentage of low- and medium-risk members in the team, (14) Average machine learning score of the team, (15) Minimum machine learning score of the team, (16) Maximum machine learning score of the team, (17) Coefficient of variation of machine learning score of the team, (18) Number of members with machine learning scores above 0.9, (19) Percentage of members with machine learning scores above 0.9, (20) Number of members who have been detained or punished for involvement in the case, (21) Number of entities with the same equipment, and (22) Number of entities with the same place of origin.

[0281] The designed group indicators cover many risk points that screeners are concerned about. Among them, (2) and (3) are heterogeneous graphs, so it is necessary to explain how many entities there are and what relationships lead to clustering; the medium and low risks involved in (12) and (13) are the rating range of members against illegal funds legalization. If there are many medium and low risk members in the team and there are high scores, more abnormal members can be located through association relationships.

[0282] According to the business screening habits, here we use the two indicators of "the maximum machine learning score within the team>=0.9" or "the number of members in the team who have been frozen or punished by judicial investigation in history>=1", and screen out 680 teams from more than 5 million teams. The accuracy rate of the business investigation team is more than 95%, and more than 3,000 risk members that have not been discovered by rules and machine learning are added. Suspicious teams with illegal funds legalization risks are accurately screened out, and accurate identification is carried out to the greatest extent, reducing the burden of business investigation. Part of the investigation puts the risk exposure link in advance, that is, it digs out some of its own transactions that are not suspicious for the time being, but by observing its subsequent performance, it also participates in the illegal funds legalization behavior, which can achieve early attention and timely control.

[0283] Below, we will give some examples of typical teams that have been specifically analyzed and excavated, and analyze the risk characteristics of the cases in a targeted manner, as shown in Table 3:

[0284] Table 3

[0285]

[0286]

[0287] As can be seen from Table 3, in both Case 1 and Case 3, there are members who are investigated and frozen by the competent authorities or involved in the case. Following this clue, other undiscovered members who are closely related to them and form a legalization team for illegal funds can be found. However, there are no such members in Case 2, nor are there any members who have been reported in history. Therefore, the value of combining machine learning is reflected, which makes up for the shortcomings of business rules that cannot cover suspicious items and covers potential risks as much as possible. Furthermore, from the perspective of equipment and location, all three cases have cases of public equipment being used to commit crimes, and Case 3 is a crime committed in the same location. These indicators can effectively help case screeners locate risk teams and sort out the characteristics of the teams' crimes.

[0288] For the mined teams, we further analyzed their graph indicator characteristics, as shown in Table 4:

[0289] Table 4

[0290] Various indicators … Node 2 … Node 9 Spend … 17 … 22 Closeness Centrality … 0.133 … 0.265 … … … … … Betweenness Centrality … 0.338 … 0.221

[0291] From this, we can analyze that the intermediary centrality of node 2 is relatively high. Combined with the degree index, this node mainly plays a bridging role in the risk group, that is, a "transition account"; the various centralities of node 9 are relatively high, so this node may be of high importance in this risk group. These graph indicators processed through the subgraph mining function can effectively help business screening personnel better locate key nodes and improve identification efficiency.

[0292] Taking the second machine learning model as an example, the graph index features are combined with the training data to retrain the second machine learning model. Here, 18 graph index features are selected, including: (1) degree, (2) degree centrality, (3) hub centrality, (4) closeness centrality, (5) betweenness centrality, (6) eigenvector centrality, (7) PageRank centrality, (8) information centrality, (9) Katz centrality, (10) local clustering coefficient, (11) number of team entities, (12) number of team edges, (13) average degree of the team, (14) standard deviation of the team degree, (15) coefficient of variation of the team degree, (16) average path length of the team, (17) eigenvalues ​​of the Laplace matrix of the team, and (18) modularity of the team.

[0293] During the cross-validation process of the second machine learning model, the precision rate at the same threshold increased from the original 89.16% to 93.24%, and the recall rate increased from 81.37% to 90.22%, with significant improvement.

[0294] In order to more clearly illustrate the technical solution of this article, a specific example of detecting users with risk of legalizing illegal funds is described in detail below.

[0295] Take some cases that triggered the early warning rules in the first half of 2023, and report the high-quality cases according to the business prompts. Modeling is carried out with 100,000 samples, of which 20,000 are black samples (reported) and 80,000 are white samples (excluded). Data analysis is carried out on the samples to analyze their transaction distribution, identity characteristics, judicial and other information, and comprehensively characterize the case portrait. Based on this, more than 3,000 dimensions of processing features are constructed, and then feature dimensionality reduction technology is used. Here, the calculation of feature IV values ​​and PSI is selected to select 50 dimensions of important features. After training with the XGBoost model and tuning of model parameters, the first machine learning model is obtained.

[0296] The first machine learning model is used to evaluate cases hit by the warning rules every day. Taking one month's cases as an example, when the model scoring threshold is set to 0.5, the cumulative business accuracy is 70%, which can cover more than 90% of the cases in that month and save more than 50% of the case screening time of screening personnel.

[0297] Take some cases that triggered the early warning rules in the first half of 2023. Those with higher reporting quality according to business prompts are recorded as black samples, totaling 20,000. In the month when the black samples are reported, select cases with no historical warning records and transactions in the current month according to the sample ratio, totaling 980,000. A total of 1 million samples are modeled, including 20,000 black samples and 980,000 white samples. Data analysis is performed on the samples to analyze their transaction distribution, identity characteristics, judicial and other information, and comprehensively characterize the case portraits. Based on this, simple features with more than 1,000 dimensions are constructed and processed, and then feature dimensionality reduction technology is used. Here, the features with the top 50 feature importance are selected after training with the random forest algorithm, and then trained with the XGBoost model, and the model parameters are tuned to obtain the second machine learning model.

[0298] The second machine learning model is used to detect cases that are not hit by the warning rules every day, and 500 users (daily) that have not triggered the warning rules in the past year are added. The average monthly case cumulative accuracy is above 80%, and more than 30% of the warning cases are added.

[0299] In one embodiment of the present invention, a computer device is also provided for implementing the method described in any of the above embodiments, such as Fig.15As shown in the structural diagram of the device on the computer of the embodiment of this article, the computer device 1502 may include one or more processors 1504, such as one or more central processing units (CPUs), and each processing unit may implement one or more hardware threads. The computer device 1502 may also include any memory 1506, which is used to store any kind of information such as code, settings, data, etc. Non-limiting, for example, the memory 1506 may include any one or more combinations of the following: any type of RAM, any type of ROM, flash memory device, hard disk, optical disk, etc. More generally, any memory can use any technology to store information. Further, any memory can provide volatile or non-volatile retention of information. Further, any memory can represent a fixed or removable component of the computer device 1502. In one case, when the processor 1504 executes an associated instruction stored in any memory or a combination of memories, the computer device 1502 can perform any operation of the associated instruction. The computer device 1502 also includes one or more drive mechanisms 1508 for interacting with any memory, such as a hard disk drive mechanism, an optical disk drive mechanism, etc.

[0300] The computer device 1502 may also include an input / output module 1510 (I / O) for receiving various inputs (via input devices 1512) and for providing various outputs (via output devices 1514). A specific output mechanism may include a presentation device 1516 and an associated graphical user interface (GUI) 1518. In other embodiments, the input / output module 1510 (I / O), input device 1512, and output device 1514 may not be included, and the computer device 1502 may be used as a computer device in a network. The computer device 1502 may also include one or more network interfaces 1520 for exchanging data with other devices via one or more communication links 1522. One or more communication buses 1524 couple the components described above together.

[0301] The communication link 1522 may be implemented in any manner, for example, through a local area network, a wide area network (e.g., the Internet), a point-to-point connection, etc., or any combination thereof. The communication link 1522 may include any combination of hardwired links, wireless links, routers, gateway functions, name servers, etc. governed by any protocol or combination of protocols.

[0302] Corresponds to Figure 1-Figure 12 The method in this article also provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the above method are executed.

[0303] The embodiment of the present invention also provides a computer readable instruction, wherein when the processor executes the instruction, the program therein causes the processor to execute the following Figures 1 to 12 The method shown.

[0304] It should be understood that in the various embodiments of this document, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this document.

[0305] It should also be understood that in the embodiments of this article, the term "and / or" is only a description of the association relationship of the associated objects, indicating that three relationships may exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0306] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this article.

[0307] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0308] In the several embodiments provided herein, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of the units is only a logical function division, and there may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, or can be electrical, mechanical or other forms of connection.

[0309] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the embodiments of this article.

[0310] In addition, each functional unit in each embodiment of this invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above integrated unit may be implemented in the form of hardware or in the form of software functional unit.

[0311] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this article is essentially or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of this article. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0312] Specific embodiments are used in this article to illustrate the principles and implementation methods of this article. The description of the above embodiments is only used to help understand the methods and core ideas of this article. At the same time, for general technicians in this field, according to the ideas of this article, there will be changes in the specific implementation methods and application scopes. In summary, the content of this specification should not be understood as a limitation on this article.

Claims

1. A detection method for an illegal funds legalization risk team, characterized in that: The method comprises: Get teams divided based on knowledge graph; Determine whether each member of the team hits the warning rule; If the judgment is yes, the feature data of the member is input into a pre-trained first machine learning model to obtain the risk probability of legalization of illegal funds for the member by the first machine learning model; If the judgment is no, the feature data of the member is input into a pre-trained second machine learning model to obtain the risk probability of legalization of illegal funds for the member by the second machine learning model; The illegal funds legalization risk detection result of the team is determined according to the illegal funds legalization risk probability of each member of the team.

2. The method according to claim 1, characterized in that The knowledge graph is pre-constructed in the following ways, including: The knowledge graph is constructed based on member information and member relationships, wherein the member relationships include transactions, mobile phone numbers, MAC addresses, and IP addresses between members; the knowledge graph is an unweighted undirected heterogeneous graph.

3. The method according to claim 1, characterized in that Also includes: Obtain daily transaction information of each member of the team within a specified historical period; Determine whether the daily transaction information of each member in a specified historical period matches the warning rule; If the judgment is yes, the transaction information of the member on that day is input into the first machine learning model to obtain the risk probability of legalization of illegal funds of the member on that day by the first machine learning model; If the judgment is no, the transaction information of the member on that day is input into the second machine learning model to obtain the risk probability of legalization of illegal funds of the member on that day by the second machine learning model; Obtaining a first maximum probability of the risk probability of legalization of illegal funds for each member of the team within a specified historical period according to the first machine learning model, and a second maximum probability of the risk probability of legalization of illegal funds for each member of the team within a specified historical period according to the second machine learning model; The risk detection result of illegal funds legalization of the team is determined according to the first maximum probability and the second maximum probability.

4. The method according to claim 3, characterized in that The step of determining the risk detection result of illegal funds legalization of the team according to the first maximum probability and the second maximum probability includes: Determining the illegal funds legalization risk score of each member of the team according to the first maximum probability and the second maximum probability; Determine the aggregated statistical value of the team according to the illegal funds legalization risk score of each member of the team; the aggregated statistical value includes: maximum value, average value and standard deviation; Order the teams in descending order according to the aggregated statistical values ​​to obtain team ranking information; A team whose ranking in the team ranking information is less than a preset value is determined as an illegal funds legalization risk team.

5. The method according to claim 4, characterized in that Determining the illegal funds legalization risk score of each member of the team according to the first maximum probability and the second maximum probability includes: Enter the first maximum probability and the second maximum probability into the formula Obtaining the illegal funds legalization risk score of each member of the team; Among them, Score i S1 is the risk score of illegal funds legalization of the i-th member in the team. i is the first maximum probability of the i-th member in the team, S2 i is the second maximum probability of the i-th member in the team, and a is a pre-set threshold.

6. The method according to claim 1, characterized in that The first machine learning model is pre-built in the following manner, including: The cases in the history that are hit by the early warning rules and confirmed as the risk of legalization of illegal funds are taken as the first black samples; The cases in the history that are hit by the warning rules and confirmed as non-illegal fund legalization risks are used as the first white sample; constructing a first data set according to the first black sample and the first white sample; The first data set is input into the first model training to obtain the first machine learning model.

7. The method according to claim 1, characterized in that The second machine learning model is pre-built in the following manner, including: The cases in the history that are hit by the warning rules and confirmed as the risk of legalization of illegal funds are used as the second black samples; The cases in the history that are not hit by the warning rule are used as the second white sample; constructing a second data set according to the second black sample and the second white sample; The second data set is input into the second model training to obtain the second machine learning model.

8. The method according to claim 7, characterized in that After obtaining the second machine learning model, the method includes: The cases in the history that are hit by the warning rules and confirmed as the risk of legalization of illegal funds are taken as the third black samples; The cases in the history that are hit by the early warning rules and confirmed as non-illegal fund legalization risks are used as the third white sample; Constructing a test data set according to the third black sample and the third white sample; The second machine learning model is evaluated according to the test data set to obtain an evaluation result; the evaluation result is used to optimize the second machine learning model.

9. The method according to claim 1, characterized in that The method further comprises: Obtaining graph indicator characteristics of each member of the illegal funds legalization risk team; The first machine learning model and the second machine learning model are optimized in combination with the graph indicator features.

10. The method according to claim 1, characterized in that The method further comprises: Obtaining graph indicator characteristics of each member of the illegal funds legalization risk team; According to the graph indicator characteristics of each member, the function label and importance ranking of each member are determined.

11. A method for detecting users with risk of illegal fund legalization, characterized in that: The method comprises: Get users who have made transactions on that day; Determine whether the user hits the warning rule; If the judgment is yes, the characteristic data of the user is input into a pre-trained first machine learning model to obtain the risk probability of legalization of illegal funds of the user by the first machine learning model; If the judgment is no, input the characteristic data of the user into the pre-trained second machine learning model to obtain the risk probability of legalization of illegal funds of the user by the second machine learning model; Determine a detection result of the illegal funds legalization risk of the user according to the first machine learning model for the illegal funds legalization risk probability of the user and the first preset condition; Determine the illegal funds legalization risk detection result of the user based on the second machine learning model for the illegal funds legalization risk probability of the user and the second preset condition.

12. The method according to claim 11, characterized in that The first machine learning model is pre-built in the following manner, including: The cases in the history that are hit by the early warning rules and confirmed as the risk of legalization of illegal funds are taken as the first black samples; The cases in the history that are hit by the warning rules and confirmed as non-illegal fund legalization risks are used as the first white sample; constructing a first data set according to the first black sample and the first white sample; The first data set is input into the first model training to obtain the first machine learning model.

13. The method according to claim 11, characterized in that The second machine learning model is pre-built in the following manner, including: The cases in the history that are hit by the warning rules and confirmed as the risk of legalization of illegal funds are used as the second black samples; The cases in the history that are not hit by the warning rule are used as the second white sample; constructing a second data set according to the second black sample and the second white sample; The second data set is input into the second model training to obtain the second machine learning model.

14. The method according to claim 13, characterized in that After obtaining the second machine learning model, the method includes: The cases in the history that are hit by the warning rules and confirmed as the risk of legalization of illegal funds are taken as the third black samples; The cases in the history that are hit by the early warning rules and confirmed as non-illegal fund legalization risks are used as the third white sample; Constructing a test data set according to the third black sample and the third white sample; The second machine learning model is evaluated according to the test data set to obtain an evaluation result; the evaluation result is used to optimize the second machine learning model.

15. A detection device for illegal funds legalization risk team, characterized in that: The device comprises: The first acquisition module is used to acquire teams divided based on the knowledge graph; The first judgment module is used to judge whether each member of the team hits the warning rule; A first strategy module is used to input the feature data of the member into a pre-trained first machine learning model to obtain the risk probability of illegal funds legalization for the member by the first machine learning model when the judgment is yes; and input the feature data of the member into a pre-trained second machine learning model to obtain the risk probability of illegal funds legalization for the member by the second machine learning model when the judgment is no; The first identification module is used to determine the illegal funds legalization risk detection result of the team according to the illegal funds legalization risk probability of each member of the team.

16. A device for detecting users with risk of illegal fund legalization, characterized in that: The device comprises: The second acquisition module acquires users who have made transactions on that day; The second judgment module is used to judge whether the user hits the warning rule; A second strategy module is used to input the characteristic data of the user into a pre-trained first machine learning model to obtain the risk probability of illegal funds legalization for the user by the first machine learning model when the judgment is yes; and input the characteristic data of the user into a pre-trained second machine learning model to obtain the risk probability of illegal funds legalization for the user by the second machine learning model when the judgment is no; A second identification module, used to determine the illegal funds legalization risk detection result of the user according to the first machine learning model for the illegal funds legalization risk probability of the user and the first preset condition; The third identification module is used to determine the illegal funds legalization risk detection result of the user according to the second machine learning model for the illegal funds legalization risk probability of the user and the second preset condition.

17. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 14 is implemented.

18. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor of a computer device, the method according to any one of claims 1 to 14 is implemented.

Images