Abnormal transaction object identification method and device, equipment, medium and program product

Abstract

The invention provides an abnormal transaction object identification method which can be applied to the technical field of big data and the field of financial science and technology. The abnormal transaction object identification method comprises the steps that a graph model representing a plurality of transaction objects is acquired, the graph model comprises nodes and edges, the nodes represent the transaction objects, and the edges represent transaction relations among the transaction objects; feature extraction is carried out on the transaction information of the transaction object according to the abnormal stage information, stage features of the transaction object are obtained, and the abnormal stage information represents evaluation indexes of all abnormal stages in the abnormal transaction process; determining the weights of the nodes and the weights of the edges according to the stage features; community structure updating is carried out on an initial community of the graph model according to the weights of the nodes and the weights of the edges, a target community is obtained, and the initial community comprises at least one node; and identifying the plurality of transaction objects according to the attribute information of each node in the target community to obtain an abnormal transaction object.

Description

Technical Field

[0001] The present disclosure relates to the fields of big data technology and financial technology, and more specifically to a method, device, equipment, medium and program product for identifying abnormal transaction objects. Background Art

[0002] With the continuous improvement of science and technology, abnormal trading methods are becoming more flexible and more concealed. Usually, abnormal trading methods will go through a series of complex trading processes to conceal the source of the transaction.

[0003] In the process of realizing the concept of the present disclosure, the inventors found that there are at least the following problems in the related art: it is difficult to accurately identify users who participate in abnormal transactions in massive transaction data. Summary of the invention

[0004] In view of the above problems, the present disclosure provides a method, apparatus, device, medium and program product for identifying abnormal transaction objects.

[0005] According to a first aspect of the present disclosure, a method for identifying abnormal transaction objects is provided, comprising: obtaining a graph model representing multiple transaction objects, the graph model comprising nodes and edges, the nodes representing transaction objects, and the edges representing transaction relationships between the multiple transaction objects; extracting features of transaction information of the transaction objects according to abnormal stage information to obtain stage features of the transaction objects, the abnormal stage information representing evaluation indicators of each abnormal stage in the abnormal transaction process; determining node weights and edge weights according to the stage features; updating a community structure of an initial community of the graph model according to the node weights and edge weights to obtain a target community, the initial community comprising at least one node; identifying multiple transaction objects according to attribute information of each node in the target community to obtain abnormal transaction objects.

[0006] According to an embodiment of the present disclosure, feature extraction is performed on transaction information of a transaction object according to abnormal stage information to obtain stage features of the transaction object, including: feature extraction is performed on transaction information of a transaction object according to abnormal stage information to obtain abnormal data of the transaction object at each abnormal stage in the abnormal transaction process; data processing is performed on the abnormal data at each stage to obtain stage features of the transaction object.

[0007] According to an embodiment of the present disclosure, determining the weight of a node and the weight of an edge according to stage characteristics includes: determining the number of abnormal stages corresponding to a transaction object according to the stage characteristics; and determining the weight of a node and the weight of an edge according to the number of abnormal stages and transaction information of the transaction object.

[0008] According to an embodiment of the present disclosure, determining the weight of a node and the weight of an edge according to the number of abnormal stages and the transaction information of a transaction object includes: determining the weight of a node according to the transaction volume of the transaction object within a preset time and the number of abnormal stages; determining an associated object having a transaction relationship with the transaction object according to the abnormal stage information; and determining the weight of an edge according to the transaction information between the transaction object and the associated object.

[0009] According to an embodiment of the present disclosure, the transaction information between the transaction object and the associated object includes at least one of the following: transaction times, transaction time, and common transaction objects between the transaction object and the associated object.

[0010] According to an embodiment of the present disclosure, the community structure of the initial community of the graph model is updated according to the weights of the nodes and the weights of the edges to obtain the target community of the graph model, including: calculating the modularity gain of the node moving from the current initial community to the target initial community according to the weights of the nodes and the weights of the edges; and updating the community structure of the initial community of the graph model according to the modularity gain to obtain the target community.

[0011] According to an embodiment of the present disclosure, multiple transaction objects are identified according to attribute information of each node in a target community to obtain abnormal transaction objects, including: clustering multiple nodes in the target community according to attribute information of multiple nodes in the target community to obtain clustering results of multiple transaction objects; identifying multiple transaction objects according to the clustering results to obtain a group with abnormal transaction objects.

[0012] According to an embodiment of the present disclosure, clustering is performed on multiple nodes in a target community according to attribute information of multiple nodes in a target community to obtain clustering results of multiple transaction objects, including: calculating similarities between multiple nodes in the target community according to attribute information of multiple nodes in the target community; determining multiple clustering nodes whose similarities reach a preset threshold from the multiple nodes; merging the multiple clustering nodes to obtain updated nodes; and repeatedly performing the above operations until a preset number of clustering nodes are included in the target community to obtain clustering results of multiple transaction objects.

[0013] A second aspect of the present disclosure provides an apparatus for identifying abnormal transaction objects, including: an acquisition module, used to acquire a graph model representing multiple transaction objects, the graph model including nodes and edges, the nodes representing transaction objects, and the edges representing transaction relationships between multiple transaction objects; a feature extraction module, used to extract features of transaction information of transaction objects according to abnormal stage information to obtain stage features of transaction objects, the abnormal stage information representing evaluation indicators of each abnormal stage in an abnormal transaction process; a determination module, used to determine node weights and edge weights according to the stage features; an update module, used to update the community structure of an initial community of the graph model according to the node weights and edge weights to obtain a target community, the initial community including at least one node; and an identification module, used to identify multiple transaction objects according to attribute information of each node in the target community to obtain abnormal transaction objects.

[0014] A third aspect of the present disclosure provides an electronic device, comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the above method.

[0015] The fourth aspect of the present disclosure further provides a computer-readable storage medium on which a computer program or instruction is stored, and the steps of the above method are implemented when the above computer program or instruction is executed by a processor.

[0016] The fifth aspect of the present disclosure further provides a computer program product, including a computer program or instructions, which implement the steps of the above method when the above computer program or instructions are executed by a processor.

[0017] According to an embodiment of the present disclosure, by acquiring a graph model representing multiple transaction objects, feature extraction is performed on the transaction information of the transaction objects according to the abnormal stage information to obtain the stage features of the transaction objects, which can represent the information of the transaction objects at each abnormal stage in the abnormal transaction process. The weights of the nodes and the weights of the edges are determined according to the stage features; the community structure of the initial community of the graph model is updated according to the weights of the edges of the nodes to obtain the target community. The target community can be used to accurately target users involved in abnormal transactions. Therefore, multiple transaction objects are identified according to the attribute information of each node in the target community to obtain abnormal transaction objects, thereby improving the recognition accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The above contents and other purposes, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0019] Figure 1 A diagram schematically illustrates an application scenario of a method for identifying an abnormal transaction object according to an embodiment of the present disclosure;

[0020] Figure 2 A flowchart schematically shows a method for identifying an abnormal transaction object according to an embodiment of the present disclosure;

[0021] Figure 3 A flowchart schematically shows a method for identifying an abnormal transaction object according to another embodiment of the present disclosure;

[0022] Figure 4 A flowchart schematically shows a method of identifying multiple transaction objects according to attribute information of each node in a target community to obtain abnormal transaction objects according to an embodiment of the present disclosure;

[0023] Figure 5 A block diagram schematically shows a structure of a device for identifying abnormal transaction objects according to an embodiment of the present disclosure; and

[0024] Figure 6 A block diagram of an electronic device suitable for implementing a method for identifying an abnormal transaction object according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0025] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0026] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0027] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0028] When using expressions such as "at least one of A, B, and C, etc.", they should generally be interpreted according to the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0029] In the technical solution of the present disclosure, the user information (including but not limited to user personal information, user image information, user device information, such as location information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved are all information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with relevant laws, regulations and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0030] In the scenario of using personal information for automated decision-making, the methods, devices, and systems provided by the embodiments of the present disclosure provide users with corresponding operation portals for users to choose to agree or reject the automated decision-making results; if the user chooses to reject, the expert decision-making process will be entered. The expression "automated decision-making" here refers to the activity of automatically analyzing and evaluating a person's behavioral habits, interests and hobbies, or economic, health, credit status, etc. through computer programs, and making decisions. The expression "expert decision-making" here refers to the activity of making decisions by people who specialize in a certain field, have specialized experience, knowledge and skills, and have reached a certain level of professionalism.

[0031] With the continuous improvement of science and technology, abnormal trading methods are becoming more flexible and more concealed. Usually, abnormal trading methods will go through a series of complex transaction processes to conceal the source of funds. It is difficult to accurately identify users involved in abnormal transactions in massive transaction data.

[0032] An embodiment of the present disclosure provides a method for identifying abnormal transaction objects, including: obtaining a graph model representing multiple transaction objects, the graph model includes nodes and edges, the nodes represent transaction objects, and the edges represent transaction relationships between the multiple transaction objects; extracting features of transaction information of the transaction objects according to abnormal stage information to obtain stage features of the transaction objects, the abnormal stage information represents evaluation indicators of each abnormal stage in the abnormal transaction process; determining node weights and edge weights according to the stage features; updating the community structure of an initial community of the graph model according to the node weights and edge weights to obtain a target community, the initial community including at least one node; identifying multiple transaction objects according to attribute information of each node in the target community to obtain abnormal transaction objects.

[0033] Figure 1 The application scenario diagram of the method for identifying abnormal transaction objects according to an embodiment of the present disclosure is schematically shown.

[0034] like Figure 1As shown, the application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 is used to provide a medium for a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired, wireless communication links, or optical fiber cables, etc.

[0035] The user can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 through the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only for example).

[0036] The first terminal device 101, the second terminal device 102, and the third terminal device 103 may be various electronic devices having display screens and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.

[0037] The server 105 may be a server that provides various services, such as a background management server (only as an example) that provides support for websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103. The background management server may analyze and process the received data such as user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal device.

[0038] It should be noted that the method for identifying an abnormal transaction object provided in the embodiment of the present disclosure can generally be executed by the server 105. Accordingly, the device for identifying an abnormal transaction object provided in the embodiment of the present disclosure can generally be set in the server 105. The method for identifying an abnormal transaction object provided in the embodiment of the present disclosure can also be executed by a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105. Accordingly, the device for identifying an abnormal transaction object provided in the embodiment of the present disclosure can also be set in a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105.

[0039] It should be understood that Figure 1The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0040] Figure 2 The flowchart of the method for identifying abnormal transaction objects according to an embodiment of the present disclosure is schematically shown.

[0041] like Figure 2 As shown, the method for identifying an abnormal transaction object in this embodiment includes operations S210 to S250, and the method for identifying an abnormal transaction object can be executed by a server.

[0042] In operation S210 , a graph model representing multiple transaction objects is obtained, where the graph model includes nodes and edges, where the nodes represent transaction objects and the edges represent transaction relationships between the multiple transaction objects.

[0043] According to an embodiment of the present disclosure, the graph model is an undirected graph, in which nodes represent transaction objects and edges represent transaction relationships between nodes.

[0044] In operation S220, feature extraction is performed on the transaction information of the transaction object according to the abnormal stage information to obtain the stage feature of the transaction object.

[0045] According to an embodiment of the present disclosure, the abnormal stage information represents the evaluation index of each abnormal stage in the abnormal transaction process.

[0046] According to an embodiment of the present disclosure, transaction information includes transaction type, transaction amount, transaction number, transaction method, etc.

[0047] For example, the abnormal transaction process may be an illegal transaction, and the abnormal stages of the illegal transaction may include a placement stage, a stratification stage, and an integration stage.

[0048] The evaluation indicators of the placement stage may include preset transaction methods, high-consumption transactions, cross-border transactions, etc. Preset transaction methods and cross-border transactions can be determined based on the transaction method identifier in the transaction information. High-consumption transactions can be determined from the transaction summary or transaction remarks in the transaction details data.

[0049] The evaluation indicators in the stratification stage are transaction indicators. They are as follows:

[0050] The transaction indicator Z1 is: on the trading day, the ratio of the accumulated debit amount to the accumulated credit amount of the account is between A and B, and the accumulated unilateral transaction volume is greater than the transaction threshold.

[0051] Transaction indicator Z2 is: on the day of the transaction, the transaction counterparty remitted money overseas multiple times, and the volume of a single remittance transaction was greater than the transaction threshold.

[0052] Transaction indicator Z3 is: on the transaction day, the cumulative number of transactions of the customer's borrowers and lenders is greater than or equal to the number threshold.

[0053] Trading indicator Z4 is: on the trading day, the number of metal transactions of the customer is greater than or equal to the threshold number of metal transactions, and the cumulative amount of metal transactions is greater than or equal to the cumulative threshold amount.

[0054] Transaction indicator Z5 is: on the transaction day, the number of transactions involving resources from preset channels in the customer's transaction sources and purposes is greater than or equal to the resource transaction number threshold, and the transaction volume of preset channel resources is greater than or equal to the resource transaction threshold.

[0055] Evaluation indicators in the integration phase may include investment, asset consumption, corporate transactions, etc. Investment, asset consumption, and corporate transactions may be determined from the transaction summary or transaction remarks in the transaction details data.

[0056] For example, an abnormal trading process may be a market manipulation transaction, which may include a preparation stage, an operation stage, and an exit stage.

[0057] The evaluation indicators in the preparation stage can be the number of asset transactions exceeding the threshold and the cumulative asset gain exceeding the threshold.

[0058] An evaluation indicator for the operational phase can be the number of transactions being well above a threshold.

[0059] The evaluation indicator of the exit stage can be the rapid recovery of all transaction assets within a preset time.

[0060] In an embodiment of the present disclosure, before obtaining the transaction information of the transaction object, the user's consent or authorization may be obtained. For example, before operation S220, a request for obtaining the transaction information may be issued to the transaction object. When the transaction object agrees or authorizes that the transaction information may be obtained, the operation S220 is performed.

[0061] According to an embodiment of the present disclosure, the stage feature may represent information of each abnormal stage of a transaction object during an abnormal transaction process.

[0062] In operation S230 , the weights of the nodes and the weights of the edges are determined according to the phase characteristics.

[0063] According to an embodiment of the present disclosure, since nodes represent transaction objects and edges represent transaction relationships between multiple transaction objects, the stage characteristics can reflect the degree of participation of transaction objects in the abnormal transaction process, as well as the transaction relationship with other transaction objects in each abnormal stage.

[0064] For example, the stage feature contains valid feature values ​​for each stage, so the transaction object participates in each abnormal stage and the node has a greater weight.

[0065] For example, the stage feature also contains the transaction information of the transaction object, which can obtain the transaction frequency and transaction correlation between the transaction object and other transaction objects in each abnormal stage. Therefore, the greater the transaction frequency between the transaction object and other transaction objects in the abnormal stage, the stronger the transaction correlation, and the greater the weight of the edge.

[0066] In operation S240 , the community structure of the initial community of the graph model is updated according to the weights of the nodes and the weights of the edges to obtain a target community.

[0067] According to an embodiment of the present disclosure, the initial community includes at least one node.

[0068] For example, the initial community can be a single node. The change in modularity after moving from the initial community to the adjacent community is calculated based on the weight of the edge. If it is a positive contribution to the modularity, the node and the adjacent node can be classified into the same community, and the community weight is obtained by adding the node weight and the adjacent node weight. Repeat the above operation until the nodes in each community no longer change, and the updated community is obtained. The updated community is used as the target community.

[0069] For example, the initial community can be a single node. The change in modularity after moving from the initial community to the adjacent community can be calculated based on the node weight and edge weight. If it is a positive contribution to the modularity, the node and the adjacent nodes can be classified into the same community. Repeat the above operation until the nodes in each community no longer change, and obtain multiple target communities of the graph model.

[0070] For example, the initial community can be composed of multiple historical nodes. Multiple historical nodes are graph models constructed by historical transaction objects. The weights of the nodes and the weights of the edges corresponding to the historical transaction objects are also determined according to the stage characteristics. The historical nodes associated with the nodes are determined from the graph model. The local community structure of the initial community of the graph model is updated according to the weights of the nodes and the weights of the edges to obtain the target community.

[0071] In operation S250, multiple transaction objects are identified according to the attribute information of each node in the target community to obtain abnormal transaction objects.

[0072] According to an embodiment of the present disclosure, the attribute information may include a unique identifier, address, account identifier, transaction type, educational background, etc. of the transaction object.

[0073] According to the embodiments of the present disclosure, multiple transaction objects are identified based on attribute information to obtain abnormal transaction objects, which can balance the role of abnormal stage information in identification and facilitate identification of abnormal transaction objects between transaction objects belonging to the same target community.

[0074] For example, an abnormal transaction object may be one that has a weak correlation with other transaction objects in attribute information in the target community.

[0075] For example, an abnormal transaction object may be one that is strongly associated with some transaction objects in the target community in terms of attribute information, but is weakly associated with other transaction objects in terms of attribute information.

[0076] According to an embodiment of the present disclosure, by acquiring a graph model representing multiple transaction objects, feature extraction is performed on the transaction information of the transaction objects according to the abnormal stage information to obtain the stage features of the transaction objects, which can represent the information of the transaction objects at each abnormal stage in the abnormal transaction process. The weights of the nodes and the weights of the edges are determined according to the stage features; the community structure of the initial community of the graph model is updated according to the weights of the edges of the nodes to obtain the target community. The target community can be used to accurately target users involved in abnormal transactions. Therefore, multiple transaction objects are identified according to the attribute information of each node in the target community to obtain abnormal transaction objects, thereby improving the recognition accuracy.

[0077] According to an embodiment of the present disclosure, feature extraction is performed on transaction information of a transaction object according to abnormal stage information to obtain stage features of the transaction object, including: feature extraction is performed on transaction information of a transaction object according to abnormal stage information to obtain abnormal data of the transaction object at each abnormal stage in the abnormal transaction process; data processing is performed on the abnormal data at each stage to obtain stage features of the transaction object.

[0078] For example, an abnormal transaction process may be an illegal transaction, and the abnormal stage of an illegal transaction may include a placement stage. The evaluation indicators of the placement stage may include preset transaction methods, high-consumption transactions, cross-border transactions, etc. The transaction method identifier may be determined from the transaction information of the transaction object, and according to the transaction method identifier, it may be determined whether the transaction object involves preset transaction methods, high-consumption transactions, cross-border transactions, etc. in the placement stage.

[0079] For example, an abnormal transaction process may be a market manipulation transaction, which may include a preparation stage. The evaluation indicators of the preparation stage may be the number of asset transactions exceeding a threshold and the cumulative asset gain exceeding a threshold. The number of asset transactions and the cumulative asset gain may be determined from the transaction information of the transaction object, thereby extracting abnormal data of the preparation stage.

[0080] For example, the abnormal data of each stage is normalized to obtain the stage characteristics of the transaction object.

[0081] For example, the abnormal data of each stage are integrated in chronological order to ensure that the abnormal data of each stage conforms to the chronological order. The integrated abnormal data are normalized to obtain the stage characteristics of the transaction object.

[0082] According to the embodiments of the present disclosure, by processing the abnormal data at each stage, the stage characteristics of the transaction object are obtained, and potentially hidden abnormal transaction information can be accurately mined.

[0083] According to an embodiment of the present disclosure, determining the weight of a node and the weight of an edge according to stage characteristics includes: determining the number of abnormal stages corresponding to a transaction object according to the stage characteristics; and determining the weight of a node and the weight of an edge according to the number of abnormal stages and transaction information of the transaction object.

[0084] According to an embodiment of the present disclosure, the stage feature has valid feature values ​​of each stage, so the number of abnormal stages corresponding to the transaction object can be determined. For example, the transaction object involves participating in 2 abnormal stages.

[0085] According to an embodiment of the present disclosure, transaction sub-information of the abnormal stage corresponding to the transaction object is determined from the transaction information. The transaction sub-information includes the transaction frequency between the transaction object and other transaction objects in the abnormal stage.

[0086] According to an embodiment of the present disclosure, by determining the weight of the node and the weight of the edge according to the number of abnormal stages and the transaction information of the transaction object, the graph model has better expressiveness in abnormal transaction analysis.

[0087] According to an embodiment of the present disclosure, determining the weight of a node and the weight of an edge according to the number of abnormal stages and the transaction information of a transaction object includes: determining the weight of a node according to the transaction volume of the transaction object within a preset time and the number of abnormal stages; determining an associated object having a transaction relationship with the transaction object according to the abnormal stage information; and determining the weight of an edge according to the transaction information between the transaction object and the associated object.

[0088] According to an embodiment of the present disclosure, value information can be locked from transaction information of a transaction object according to abnormal phase information, and an associated object having a transaction relationship with the transaction object can be determined from the value information.

[0089] According to the embodiments of the present disclosure, both the transaction object and the associated object are involved in the two parties of the abnormal transaction, and the weight of the edge between the transaction object and the associated object is determined according to the transaction information between the transaction object and the associated object. For example, the transaction information between the transaction object and the associated object may be the transaction volume, transaction frequency, transaction cumulative volume, transaction method, etc.

[0090] According to the embodiments of the present disclosure, the node weight is determined according to the transaction volume and the number of abnormal stages; the edge weight is determined according to the transaction information between the transaction object and the associated object. Therefore, the node weight represents the number of abnormal stages participated by the transaction object, and the edge weight represents the correlation of the abnormal behavior. This improves the interpretability of subsequent community structure updates and the accuracy of identifying abnormal transaction objects.

[0091] According to an embodiment of the present disclosure, the transaction information between the transaction object and the associated object includes at least one of the following: transaction times, transaction time, and common transaction objects between the transaction object and the associated object.

[0092] For example, the greater the number of transactions, the more common transaction objects, and the shorter the transaction time interval between adjacent transactions, the greater the weight of the edge.

[0093] For example, if the number of transactions is large, the number of common transaction objects is small, and the time interval between adjacent transactions is long, the weight of the edge is small.

[0094] It should be noted that, according to the evaluation indicators of each abnormal stage in the abnormal transaction process, the weight of the edge can be reasonably set according to the number of transactions, transaction time, and the common transaction objects between the transaction objects and the related objects.

[0095] According to the embodiments of the present disclosure, the transaction information is refined, the weight of the edge can be accurately determined, and the computer processing speed can be improved.

[0096] Figure 3 The following schematically shows a flow chart of a method for identifying an abnormal transaction object according to another embodiment of the present disclosure.

[0097] like Figure 3 As shown, the method for identifying abnormal transaction objects in this embodiment includes operations S310 to S390.

[0098] In operation S310, a graph model representing multiple transaction objects is obtained, where the graph model includes nodes and edges, where the nodes represent transaction objects and the edges represent transaction relationships between the multiple transaction objects.

[0099] In operation S320, feature extraction is performed on the transaction information of the transaction object according to the abnormal stage information to obtain abnormal data of the transaction object at each abnormal stage in the abnormal transaction process.

[0100] In operation S330, data processing is performed on the abnormal data of each stage to obtain the stage characteristics of the transaction object.

[0101] In operation S340, the number of abnormal stages corresponding to the transaction object is determined according to the stage characteristics.

[0102] In operation S350, the weight of the node is determined according to the transaction volume and the number of abnormal stages of the transaction object within a preset time.

[0103] In operation S360, an associated object having a transaction relationship with the transaction object is determined according to the abnormal phase information.

[0104] In operation S370 , the weight of the edge is determined according to the transaction information between the transaction object and the associated object.

[0105] In operation S380 , the community structure of the initial community of the graph model is updated according to the weights of the nodes and the weights of the edges to obtain a target community.

[0106] In operation S390, multiple transaction objects are identified according to the attribute information of each node in the target community to obtain abnormal transaction objects.

[0107] According to an embodiment of the present disclosure, the community structure of the initial community of the graph model is updated according to the weights of the nodes and the weights of the edges to obtain the target community of the graph model, including: calculating the modularity gain of the node moving from the current initial community to the target initial community according to the weights of the nodes and the weights of the edges; and updating the community structure of the initial community of the graph model according to the modularity gain to obtain the target community.

[0108] According to an embodiment of the present disclosure, community structure update can be implemented based on the Louvain algorithm. For example, the initial community can be a single node, and the number of initial communities is the same as the number of nodes. The modularity gain after moving from the initial community to the adjacent community is calculated based on the weight of the edge. Determine whether the modularity gain is greater than 0. If the modularity gain is greater than 0, put the node into the initial community where the adjacent node is located. And add the weight of the node and the weight of the adjacent node to obtain the community weight. Repeat the above operation until the nodes in each community no longer change, and obtain the updated community. Compress all nodes in each updated community into one node, convert the weight of the node in the updated community into the weight of the new node ring, and convert the weight between the updated communities into the weight of the new node edge. Until the weight of the updated community and the weight of the edge converge, the target community is obtained.

[0109] According to the embodiments of the present disclosure, by only calculating the modularity gain before and after the node is moved, rather than recalculating the modularity of the entire graph, the amount of calculation is significantly reduced. The incremental update method greatly speeds up the process of node community division, especially when the number of nodes and edges is large. There is no need to store and update the modularity of the entire graph, and the memory usage is lower.

[0110] According to an embodiment of the present disclosure, multiple transaction objects are identified according to attribute information of each node in a target community to obtain abnormal transaction objects, including: clustering multiple nodes in the target community according to attribute information of multiple nodes in the target community to obtain clustering results of multiple transaction objects; identifying multiple transaction objects according to the clustering results to obtain a group with abnormal transaction objects.

[0111] According to an embodiment of the present disclosure, multiple nodes in a target community are clustered according to the attribute information of the multiple nodes in the target community, and multiple transaction objects in the same target community can be classified based on the attribute information.

[0112] For example, the clustering result can indicate whether the transaction object is involved in abnormal transactions. The transaction object indicated by the clustering result as being involved in abnormal transactions is determined as an abnormal transaction object.

[0113] For example, when there are multiple abnormal transaction objects, they can be grouped.

[0114] According to the embodiments of the present disclosure, clustering multiple nodes based on attribute information not only balances the role of abnormal stage information in identification, but also mines common attributes between transaction objects, making the identified group with abnormal transaction objects more accurate.

[0115] According to an embodiment of the present disclosure, clustering is performed on multiple nodes in a target community according to attribute information of multiple nodes in a target community to obtain clustering results of multiple transaction objects, including: calculating similarities between multiple nodes in the target community according to attribute information of multiple nodes in the target community; determining multiple clustering nodes whose similarities reach a preset threshold from the multiple nodes; merging the multiple clustering nodes to obtain updated nodes; and repeatedly performing the above operations until a preset number of clustering nodes are included in the target community to obtain clustering results of multiple transaction objects.

[0116] According to an embodiment of the present disclosure, attribute information (such as educational background, age, address, etc.) of multiple nodes in a target community is used to identify abnormal transaction objects.

[0117] According to an embodiment of the present disclosure, similarity calculation may be Euclidean distance, cosine similarity, Manhattan distance, etc.

[0118] For example, the attribute information of the nodes in each target community is numerically normalized. The Euclidean distance between multiple nodes in the target community is calculated. The two clustering nodes with the closest Euclidean distance are merged to obtain an updated node. The above steps are repeated until each target community includes a preset number of clustering nodes. The transaction objects corresponding to the preset number of clustering nodes are determined as abnormal transaction objects. And multiple abnormal transaction objects are determined to belong to the same group.

[0119] The risk level can be determined based on the node weight of the abnormal transaction object. The abnormal transaction object and its corresponding risk level are added to the suspicious warning library, and its risk level is continuously monitored and synchronized to the relevant departments in a timely manner.

[0120] Obtain a graph model that represents multiple transaction objects, extract features from the transaction information of the transaction objects based on the abnormal stage information, and obtain the stage features of the transaction objects. The stage features can represent the information of the transaction objects at each abnormal stage in the abnormal transaction process. Determine the weights of the nodes and the weights of the edges based on the stage features, and update the community structure of the initial community of the graph model based on the weights of the nodes and the weights of the edges, effectively dealing with the situation where it is difficult to accurately identify abnormal transaction objects and inaccurate monitoring due to the large amount of transaction data.

[0121] The clustering algorithm based on Euclidean distance is used to identify abnormal transaction objects, which effectively addresses the problem of being unable to accurately locate key personnel in the group, greatly reduces human resource costs, and improves the timeliness of abnormal object identification.

[0122] The risk level is determined based on the node weight of the abnormal transaction object. The abnormal transaction object and its corresponding risk level are added to the suspicious warning library. The risk level is continuously monitored and synchronized to the relevant departments in a timely manner, which helps maintain the stability of the economy, finance and society and improves the efficiency of monitoring abnormal transaction behaviors.

[0123] Figure 4 The flowchart schematically shows a method of identifying multiple transaction objects according to the attribute information of each node in the target community to obtain abnormal transaction objects according to an embodiment of the present disclosure.

[0124] like Figure 4 As shown, this embodiment identifies multiple transaction objects according to the attribute information of each node in the target community, and obtains abnormal transaction objects, including operations S410 to S460.

[0125] In operation S410 , similarities between multiple nodes in the target community are calculated based on attribute information of multiple nodes in the target community.

[0126] In operation S420, a plurality of clustering nodes whose similarities reach a preset threshold are determined from the plurality of nodes.

[0127] In operation S430, a plurality of cluster nodes are merged to obtain updated nodes.

[0128] In operation S440, it is determined whether the number of clustering nodes reaches a preset number. If so, operation S450 is performed; if not, operation S410 is performed.

[0129] In operation S450, a clustering result of a plurality of transaction objects is obtained.

[0130] In operation S460, multiple transaction objects are identified according to the clustering result to obtain a group with abnormal transaction objects.

[0131] Figure 5The structural block diagram of the device for identifying abnormal transaction objects according to an embodiment of the present disclosure is schematically shown.

[0132] like Figure 5 As shown, the apparatus 500 for identifying abnormal transaction objects in this embodiment includes an acquisition module 510 , a feature extraction module 520 , a determination module 530 , an update module 540 and an identification module 550 .

[0133] The acquisition module 510 is used to acquire a graph model representing multiple transaction objects, the graph model includes nodes and edges, the nodes represent transaction objects, and the edges represent transaction relationships between multiple transaction objects. In one embodiment, the acquisition module 510 can be used to perform the operation S210 described above, which will not be repeated here.

[0134] The feature extraction module 520 is used to extract features from the transaction information of the transaction object according to the abnormal stage information to obtain the stage features of the transaction object, and the abnormal stage information represents the evaluation index of each abnormal stage in the abnormal transaction process. In one embodiment, the feature extraction module 520 can be used to perform the operation S220 described above, which will not be repeated here.

[0135] The determination module 530 is used to determine the weight of the node and the weight of the edge according to the stage characteristics. In one embodiment, the determination module 530 can be used to perform the operation S230 described above, which will not be described in detail here.

[0136] The updating module 540 is used to update the community structure of the initial community of the graph model according to the weight of the node and the weight of the edge to obtain a target community, wherein the initial community includes at least one node. In one embodiment, the updating module 540 can be used to perform the operation S240 described above, which will not be described in detail here.

[0137] The identification module 550 is used to identify multiple transaction objects according to the attribute information of each node in the target community to obtain abnormal transaction objects. In one embodiment, the identification module 550 can be used to perform the operation S250 described above, which will not be repeated here.

[0138] According to an embodiment of the present disclosure, the feature extraction module 520 includes a feature extraction submodule and a data processing submodule. The feature extraction submodule is used to extract features from the transaction information of the transaction object according to the abnormal stage information, and obtain the abnormal data of each abnormal stage of the transaction object in the abnormal transaction process; the data processing submodule is used to process the abnormal data of each stage and obtain the stage features of the transaction object.

[0139] According to an embodiment of the present disclosure, the determination module 530 includes a first determination submodule and a second determination submodule. The first determination submodule is used to determine the number of abnormal stages corresponding to the transaction object according to the stage characteristics; the second determination submodule is used to determine the weight of the node and the weight of the edge according to the number of abnormal stages and the transaction information of the transaction object.

[0140] According to an embodiment of the present disclosure, the second determination submodule includes a first determination unit, a second determination unit and a third determination unit. The first determination unit is used to determine the weight of the node according to the transaction volume and the number of abnormal stages of the transaction object within a preset time; the second determination unit is used to determine the associated object having a transaction relationship with the transaction object according to the abnormal stage information; the third determination unit is used to determine the weight of the edge according to the transaction information between the transaction object and the associated object.

[0141] According to an embodiment of the present disclosure, the transaction information between the transaction object and the associated object includes at least one of the following: transaction times, transaction time, and common transaction objects between the transaction object and the associated object.

[0142] According to an embodiment of the present disclosure, the update module 540 includes a calculation submodule and an update submodule. The calculation submodule is used to calculate the modularity gain of the node moving from the current initial community to the target initial community according to the weight of the node and the weight of the edge; the update submodule is used to update the community structure of the initial community of the graph model according to the modularity gain to obtain the target community.

[0143] According to an embodiment of the present disclosure, the identification module 550 includes a clustering submodule and an identification submodule. The clustering submodule is used to cluster multiple nodes in the target community according to the attribute information of multiple nodes in the target community to obtain clustering results of multiple transaction objects; the identification submodule is used to identify multiple transaction objects according to the clustering results to obtain a group with abnormal transaction objects.

[0144] According to an embodiment of the present disclosure, the clustering submodule includes a calculation unit, a fourth determination unit, a merging unit, and an execution unit. The calculation unit is used to calculate the similarity between multiple nodes in the target community based on the attribute information of multiple nodes in the target community; the fourth determination unit is used to determine multiple clustering nodes whose similarity reaches a preset threshold from multiple nodes; the merging unit is used to merge multiple clustering nodes to obtain updated nodes; the execution unit is used to repeatedly perform the above operations until the target community includes a preset number of clustering nodes, and obtains the clustering results of multiple transaction objects.

[0145] According to an embodiment of the present disclosure, any multiple modules of the acquisition module 510, the feature extraction module 520, the determination module 530, the update module 540 and the identification module 550 can be combined into one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the acquisition module 510, the feature extraction module 520, the determination module 530, the update module 540 and the identification module 550 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware and firmware or in a suitable combination of any of them. Alternatively, at least one of the acquisition module 510, the feature extraction module 520, the determination module 530, the update module 540 and the identification module 550 may be at least partially implemented as a computer program module, and when the computer program module is executed, a corresponding function may be performed.

[0146] Figure 6 A block diagram of an electronic device suitable for implementing a method for identifying an abnormal transaction object according to an embodiment of the present disclosure is schematically shown.

[0147] like Figure 6 As shown, the electronic device 600 according to an embodiment of the present disclosure includes a processor 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage part 608 to a random access memory (RAM) 603. The processor 601 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a dedicated microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 601 may also include an onboard memory for caching purposes. The processor 601 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0148] In RAM 603, various programs and data required for the operation of electronic device 600 are stored. Processor 601, ROM 602 and RAM 603 are connected to each other via bus 604. Processor 601 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 602 and / or RAM 603. It should be noted that the program can also be stored in one or more memories other than ROM 602 and RAM 603. Processor 601 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in the one or more memories.

[0149] According to an embodiment of the present disclosure, the electronic device 600 may further include an input / output (I / O) interface 605, which is also connected to the bus 604. The electronic device 600 may further include one or more of the following components connected to the input / output (I / O) interface 605: an input portion 606 including a keyboard, a mouse, etc.; an output portion 607 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 608 including a hard disk, etc.; and a communication portion 609 including a network interface card such as a LAN card, a modem, etc. The communication portion 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the input / output (I / O) interface 605 as needed. A removable medium 611, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 610 as needed, so that a computer program read therefrom is installed into the storage portion 608 as needed.

[0150] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0151] According to an embodiment of the present disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, it may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus or a device. For example, according to an embodiment of the present disclosure, the computer-readable storage medium may include the ROM 602 and / or RAM 603 described above and / or one or more memories other than ROM 602 and RAM 603.

[0152] The embodiment of the present disclosure also includes a computer program product, which includes a computer program, and the computer program contains program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the method for identifying abnormal transaction objects provided by the embodiment of the present disclosure.

[0153] The above functions defined in the system / device of the embodiment of the present disclosure are performed when the computer program is executed by the processor 601. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0154] In one embodiment, the computer program may rely on tangible storage media such as optical storage devices, magnetic storage devices, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of signals on a network medium, and downloaded and installed through the communication part 609, and / or installed from a removable medium 611. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0155] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 609, and / or installed from the removable medium 611. When the computer program is executed by the processor 601, the above functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the system, device, apparatus, module, unit, etc. described above can be implemented by a computer program module.

[0156] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0157] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0158] It will be appreciated by those skilled in the art that the features described in the various embodiments of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations or combinations are not explicitly described in the present disclosure. In particular, without departing from the spirit and teachings of the present disclosure, the features described in the various embodiments of the present disclosure may be combined and / or combined in a variety of ways. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0159] The embodiments of the present disclosure are described above. However, these embodiments are only for illustrative purposes and are not intended to limit the scope of the present disclosure. Although the embodiments are described above, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. Without departing from the scope of the present disclosure, those skilled in the art may make a variety of substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A method for identifying abnormal transaction objects, characterized in that: The method comprises: Acquire a graph model representing multiple transaction objects, the graph model comprising nodes and edges, the nodes representing the transaction objects, and the edges representing transaction relationships between the multiple transaction objects; Extracting features from the transaction information of the transaction object according to the abnormal stage information to obtain stage features of the transaction object, wherein the abnormal stage information represents evaluation indicators of each abnormal stage in the abnormal transaction process; Determining the weight of the node and the weight of the edge according to the stage characteristics; updating the community structure of the initial community of the graph model according to the weight of the node and the weight of the edge to obtain a target community, wherein the initial community includes at least one node; The plurality of transaction objects are identified according to the attribute information of each node in the target community to obtain abnormal transaction objects.

2. The method according to claim 1, characterized in that The extracting features of the transaction information of the transaction object according to the abnormal stage information to obtain the stage features of the transaction object includes: Extracting features from the transaction information of the transaction object according to the abnormal stage information to obtain abnormal data of the transaction object at each abnormal stage during the abnormal transaction process; Data processing is performed on the abnormal data of each stage to obtain the stage characteristics of the transaction object.

3. The method according to claim 2, characterized in that Determining the weight of the node and the weight of the edge according to the stage characteristics includes: Determining the number of abnormal stages corresponding to the transaction object according to the stage characteristics; The weight of the node and the weight of the edge are determined according to the number of the abnormal stages and the transaction information of the transaction object.

4. The method according to claim 3, characterized in that: The determining the weight of the node and the weight of the edge according to the number of the abnormal stages and the transaction information of the transaction object includes: Determining the weight of the node according to the transaction volume of the transaction object within a preset time and the number of the abnormal stages; Determine, according to the abnormal phase information, an associated object having a transaction relationship with the transaction object; The weight of the edge is determined according to the transaction information between the transaction object and the associated object.

5. The method according to claim 4, characterized in that The transaction information between the transaction object and the associated object includes at least one of the following: transaction times, transaction time, and a common transaction object between the transaction object and the associated object.

6. The method according to claim 1, characterized in that The updating of the community structure of the initial community of the graph model according to the weight of the node and the weight of the edge to obtain the target community of the graph model includes: Calculating the modularity gain of the node moving from the current initial community to the target initial community according to the weight of the node and the weight of the edge; The community structure of the initial community of the graph model is updated according to the modularity gain to obtain the target community.

7. The method according to claim 1, characterized in that The identifying of the plurality of transaction objects according to the attribute information of each node in the target community to obtain abnormal transaction objects includes: Clustering the multiple nodes in the target community according to the attribute information of the multiple nodes in the target community to obtain a clustering result of the multiple transaction objects; The plurality of transaction objects are identified according to the clustering result to obtain a group of abnormal transaction objects.

8. The method according to claim 7, characterized in that The clustering of the multiple nodes in the target community according to the attribute information of the multiple nodes in the target community to obtain the clustering result of the multiple transaction objects includes: Calculating similarities between the multiple nodes in the target community according to the attribute information of the multiple nodes in the target community; Determine, from the plurality of nodes, a plurality of clustering nodes whose similarity reaches a preset threshold; Merging a plurality of the clustering nodes to obtain an updated node; The above operations are repeatedly performed until the target community includes a preset number of clustering nodes, and the clustering results of the multiple transaction objects are obtained.

9. A device for identifying abnormal transaction objects, characterized in that: The device comprises: An acquisition module, configured to acquire a graph model representing a plurality of transaction objects, wherein the graph model includes nodes and edges, wherein the nodes represent the transaction objects, and the edges represent transaction relationships between the plurality of transaction objects; A feature extraction module is used to extract features from the transaction information of the transaction object according to the abnormal stage information to obtain the stage features of the transaction object, wherein the abnormal stage information represents the evaluation index of each abnormal stage in the abnormal transaction process; A determination module, used to determine the weight of the node and the weight of the edge according to the stage characteristics; An updating module, configured to update the community structure of the initial community of the graph model according to the weight of the node and the weight of the edge to obtain a target community, wherein the initial community includes at least one node; The identification module is used to identify the multiple transaction objects according to the attribute information of each node in the target community to obtain abnormal transaction objects.

10. An electronic device, comprising: one or more processors; a memory for storing one or more computer programs, It is characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 8.

11. A computer-readable storage medium having a computer program or instruction stored thereon, characterized in that: When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

12. A computer program product comprising a computer program or instructions, characterized in that When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

Images