Abnormal transaction object identification method, device, equipment, medium and program product

Abstract

The disclosure provides an abnormal transaction object identification method, which can be applied to the fields of big data technology and financial technology. The abnormal transaction object identification method comprises: acquiring a graph model representing a plurality of transaction objects, the graph model comprising nodes and edges, the nodes representing the transaction objects, and the edges representing transaction relationships between the plurality of transaction objects; performing feature extraction on transaction information of the transaction objects according to abnormal stage information to obtain stage features of the transaction objects, the abnormal stage information representing evaluation indexes of each abnormal stage in an abnormal transaction process; determining weights of the nodes and weights of the edges according to the stage features; performing community structure updating on an initial community of the graph model according to the weights of the nodes and the weights of the edges to obtain a target community, the initial community comprising at least one node; and identifying the plurality of transaction objects according to attribute information of each node in the target community to obtain abnormal transaction objects.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of big data and the technical field of financial technology, and more particularly to an abnormal transaction object identification method, device, equipment, medium and program product. BACKGROUND

[0002] With the continuous improvement of technology, abnormal transaction methods are more flexible and more concealed. Usually, abnormal transaction methods will go through a series of complex transaction processes, thereby concealing the transaction source.

[0003] In the process of implementing the present disclosure, the inventors found that at least the following problem exists in the related art: it is difficult to accurately lock the user participating in abnormal transactions in massive transaction data. SUMMARY

[0004] In view of the above problems, the present disclosure provides an abnormal transaction object identification method, device, equipment, medium and program product.

[0005] According to a first aspect of the present disclosure, an abnormal transaction object identification method is provided, comprising: obtaining a graph model representing a plurality of transaction objects, the graph model comprising nodes and edges, the nodes representing the transaction objects, and the edges representing transaction relationships between the plurality of transaction objects; performing feature extraction on transaction information of the transaction objects according to abnormal phase information to obtain phase features of the transaction objects, the abnormal phase information representing evaluation indexes of each abnormal phase in an abnormal transaction process; determining weights of the nodes and weights of the edges according to the phase features; performing community structure updating on an initial community of the graph model according to the weights of the nodes and the weights of the edges to obtain a target community, the initial community comprising at least one node; identifying the plurality of transaction objects according to attribute information of each node in the target community to obtain abnormal transaction objects.

[0006] According to an embodiment of the present disclosure, the feature extraction on the transaction information of the transaction objects according to the abnormal phase information to obtain the phase features of the transaction objects comprises: performing feature extraction on the transaction information of the transaction objects according to the abnormal phase information to obtain abnormal data of the transaction objects in each abnormal phase in the abnormal transaction process; performing data processing on the abnormal data of each phase to obtain the phase features of the transaction objects.

[0007] According to an embodiment of the present disclosure, the determination of the weights of the nodes and the weights of the edges according to the phase features comprises: determining a number of abnormal phases corresponding to the transaction objects according to the phase features; and determining the weights of the nodes and the weights of the edges according to the number of abnormal phases and the transaction information of the transaction objects.

[0008] According to an embodiment of the present disclosure, the determining the weight of the node and the weight of the edge according to the number of abnormal stages and the transaction information of the transaction object comprises: determining the weight of the node according to the transaction volume of the transaction object within a preset time and the number of abnormal stages; determining the associated object having a transaction relationship with the transaction object according to the abnormal stage information; and determining the weight of the edge according to the transaction information between the transaction object and the associated object.

[0009] According to an embodiment of the present disclosure, the transaction information between the transaction object and the associated object comprises at least one of the following: the number of transactions, the transaction time, and the common transaction object between the transaction object and the associated object.

[0010] According to an embodiment of the present disclosure, the updating the initial community structure of the graph model according to the weight of the node and the weight of the edge to obtain a target community of the graph model comprises: calculating the modularity gain of the node moving from a current initial community to a target initial community according to the weight of the node and the weight of the edge; and updating the initial community structure of the graph model according to the modularity gain to obtain the target community.

[0011] According to an embodiment of the present disclosure, the identifying the plurality of transaction objects according to the attribute information of the nodes in the target community to obtain the abnormal transaction object comprises: clustering the plurality of nodes in the target community according to the attribute information of the plurality of nodes in the target community to obtain a clustering result of the plurality of transaction objects; and identifying the plurality of transaction objects according to the clustering result to obtain a group of abnormal transaction objects.

[0012] According to an embodiment of the present disclosure, the clustering the plurality of nodes in the target community according to the attribute information of the plurality of nodes in the target community to obtain a clustering result of the plurality of transaction objects comprises: calculating the similarity between the plurality of nodes in the target community according to the attribute information of the plurality of nodes in the target community; determining a plurality of clustering nodes having a similarity reaching a preset threshold from the plurality of nodes; merging the plurality of clustering nodes to obtain an updated node; and repeating the above operations until the target community includes a preset number of clustering nodes to obtain the clustering result of the plurality of transaction objects.

[0013] The second aspect of the present disclosure provides an identification device of an abnormal transaction object, comprising: an acquisition module configured to acquire a graph model representing a plurality of transaction objects, the graph model comprising nodes and edges, the nodes representing the transaction objects, and the edges representing transaction relationships between the plurality of transaction objects; a feature extraction module configured to perform feature extraction on transaction information of the transaction objects according to abnormal stage information to obtain stage features of the transaction objects, the abnormal stage information representing evaluation indexes of each abnormal stage in an abnormal transaction process; a determination module configured to determine weights of the nodes and weights of the edges according to the stage features; an update module configured to perform community structure update on an initial community of the graph model according to the weights of the nodes and the weights of the edges to obtain a target community, the initial community comprising at least one node; and an identification module configured to identify the plurality of transaction objects according to attribute information of each node in the target community to obtain the abnormal transaction object.

[0014] The third aspect of the present disclosure provides an electronic device, comprising: one or more processors; a memory configured to store one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the method.

[0015] The fourth aspect of the present disclosure further provides a computer-readable storage medium having stored thereon a computer program or instructions, wherein the computer program or instructions, when executed by a processor, implement the steps of the method.

[0016] The fifth aspect of the present disclosure further provides a computer program product comprising a computer program or instructions, wherein the computer program or instructions, when executed by a processor, implement the steps of the method.

[0017] According to the embodiments of the present disclosure, by acquiring a graph model representing a plurality of transaction objects, performing feature extraction on transaction information of the transaction objects according to abnormal stage information to obtain stage features of the transaction objects, the stage features can represent information of each abnormal stage in an abnormal transaction process of the transaction objects. The weights of the nodes and the weights of the edges are determined according to the stage features. The initial community of the graph model is updated according to the weights of the nodes and the weights of the edges to obtain a target community. The target community can be used to accurately lock users participating in abnormal transactions. Therefore, the plurality of transaction objects are identified according to attribute information of each node in the target community to obtain the abnormal transaction object, thereby improving the identification accuracy. BRIEF DESCRIPTION OF DRAWINGS

[0018] The above and other objects, features and advantages of the present disclosure will become more apparent from the following description of embodiments of the present disclosure, taken in conjunction with the accompanying drawings, in which:

[0019] Figure 1 An application scenario diagram of the identification method of the abnormal transaction object according to the embodiments of the present disclosure is schematically shown;

[0020] Figure 2 A flowchart of a method for identifying an abnormal transaction object is shown schematically according to an embodiment of the present disclosure;

[0021] Figure 3 A flowchart of a method for identifying an abnormal transaction object is shown schematically according to another embodiment of the present disclosure;

[0022] Figure 4 A flowchart of a method for identifying a plurality of transaction objects according to attribute information of each node in a target community to obtain an abnormal transaction object is shown schematically according to an embodiment of the present disclosure;

[0023] Figure 5 A block diagram of a structure of an apparatus for identifying an abnormal transaction object is shown schematically according to an embodiment of the present disclosure; and

[0024] Figure 6 A block diagram of an electronic device suitable for implementing a method for identifying an abnormal transaction object is shown schematically according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0025] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. It is to be understood, however, that the description is merely exemplary and is not intended to limit the scope of the present disclosure. In the following detailed description of the embodiments of the present disclosure, numerous specific details are set forth in order to provide a thorough understanding of the present disclosure. However, it would be apparent to those skilled in the art that the present disclosure can be practiced without these specific details. In other instances, well-known structures and functions have not been described in detail in order to avoid obscuring the concepts of the present disclosure.

[0026] The terms used herein are merely used to describe specific embodiments and are not intended to limit the present disclosure. The terms "include", "comprise" and the like used herein indicate the presence of the described features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0027] All terms used herein, including technical and scientific terms, have the same meanings as those generally understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having meanings consistent with the context of the present specification, and should not be interpreted in an idealized or excessively formal manner.

[0028] In the case of using expressions similar to "at least one of A, B, and C, etc.", it should generally be interpreted to include at least one of the items enumerated, but not limited to the items enumerated (e.g., "a system having at least one of A, B, and C" should include a system having A alone, a system having B alone, a system having C alone, a system having A and B together, a system having A and C together, a system having B and C together, and / or a system having A, B, and C together, etc.).

[0029] In the technical solutions of the present disclosure, the user information (including but not limited to user personal information, user image information, user device information such as location information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved are all information and data authorized by the user or authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of related data comply with relevant laws, regulations and standards, take necessary security measures, do not violate public order and good customs, and provide corresponding operation portal for user selection authorization or refusal.

[0030] In the scenario of using personal information for automated decision-making, the method, device and system provided by the embodiments of the present disclosure all provide corresponding operation portal for the user to select to agree or refuse the automated decision-making result; if the user chooses to refuse, the expert decision-making process is entered. The expression "automated decision-making" here refers to the activity of automatically analyzing, evaluating the behavior habits, interests and hobbies or economic, health, credit status of individuals, etc. by computer programs and making decisions. The expression "expert decision-making" here refers to the activity of making decisions by personnel who are engaged in a certain field of work, have specialized experience, knowledge and skills and reach a certain professional level.

[0031] With the continuous improvement of technology, abnormal transaction methods are more flexible and more concealed. Usually, abnormal transaction methods will go through a series of complex transaction processes, so as to cover up the source of funds. It is difficult to accurately lock the user participating in abnormal transactions in massive transaction data.

[0032] Embodiments of the present disclosure provide an abnormal transaction object identification method, comprising: acquiring a graph model representing a plurality of transaction objects, the graph model comprising nodes and edges, the nodes representing the transaction objects, and the edges representing transaction relationships between the plurality of transaction objects; performing feature extraction on transaction information of the transaction objects according to abnormal stage information to obtain stage features of the transaction objects, the abnormal stage information representing evaluation indexes of each abnormal stage in an abnormal transaction process; determining weights of the nodes and weights of the edges according to the stage features; performing community structure updating on an initial community of the graph model according to the weights of the nodes and the weights of the edges to obtain a target community, the initial community comprising at least one node; identifying the plurality of transaction objects according to attribute information of each node in the target community to obtain abnormal transaction objects.

[0033] Figure 1 An application scenario diagram of the abnormal transaction object identification method according to an embodiment of the present disclosure is schematically shown.

[0034] As Figure 1As shown, the application scenario 100 according to this embodiment can include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 is a medium for providing a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 can include various connection types, such as wired, wireless communication links, or fiber optic cables, and the like.

[0035] A user can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 through the network 104 to receive or send messages, and the like. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, and the like (only as examples).

[0036] The first terminal device 101, the second terminal device 102, and the third terminal device 103 can be various electronic devices with display screens and supporting web browsing, including but not limited to smartphones, tablet computers, laptop computers, desktop computers, and the like.

[0037] The server 105 can be a server providing various services, such as a background management server providing support for a website browsed by a user using the first terminal device 101, the second terminal device 102, and the third terminal device 103 (only as an example). The background management server can analyze and process received user requests and the like, and feed back the processing results (such as web pages, information, or data, and the like obtained or generated according to user requests) to the terminal device.

[0038] It should be noted that the method for identifying an abnormal transaction object provided by the embodiments of the present disclosure can generally be executed by the server 105. Accordingly, the device for identifying an abnormal transaction object provided by the embodiments of the present disclosure can generally be arranged in the server 105. The method for identifying an abnormal transaction object provided by the embodiments of the present disclosure can also be executed by a server or a server cluster different from the server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or the server 105. Accordingly, the device for identifying an abnormal transaction object provided by the embodiments of the present disclosure can also be arranged in a server or a server cluster different from the server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or the server 105.

[0039] It should be understood that, Figure 1The number of terminal devices, networks and servers in the figure is only illustrative. According to the implementation needs, there can be any number of terminal devices, networks and servers.

[0040] Figure 2 A flowchart of an abnormal transaction object identification method according to an embodiment of the present disclosure is schematically shown.

[0041] As Figure 2 The abnormal transaction object identification method of this embodiment includes operations S210-S250, which can be performed by a server.

[0042] In operation S210, a graph model representing a plurality of transaction objects is obtained, the graph model including nodes and edges, the nodes representing the transaction objects, and the edges representing transaction relationships between the plurality of transaction objects.

[0043] According to an embodiment of the present disclosure, the graph model is an undirected graph, the nodes representing the transaction objects, and the edges being transaction relationships between the nodes.

[0044] In operation S220, feature extraction is performed on transaction information of the transaction objects according to abnormal phase information, to obtain phase features of the transaction objects.

[0045] According to an embodiment of the present disclosure, the abnormal phase information represents evaluation indexes of each abnormal phase in the abnormal transaction process.

[0046] According to an embodiment of the present disclosure, the transaction information includes transaction type, transaction amount, transaction frequency, transaction manner, etc.

[0047] For example, the abnormal transaction process can be illegal transaction, and the abnormal phases of the illegal transaction can include a placement phase, a layering phase and an integration phase.

[0048] The evaluation index of the placement phase can include preset transaction manners, high-consumption transactions, cross-border transactions, etc. The preset transaction manners and cross-border transactions can be determined according to the transaction manner identifiers in the transaction information. The high-consumption transactions can be determined from the transaction summary or transaction remarks in the transaction details data.

[0049] The evaluation index of the layering phase is a transaction index. As follows:

[0050] The transaction index Z1 is that the ratio of the cumulative amount of the debit side to the cumulative amount of the credit side of the account within the transaction day is between A and B, and the single-side cumulative transaction amount is greater than a transaction threshold amount.

[0051] The transaction index Z2 is that the transaction object makes multiple remittances to foreign countries within the transaction day, and the single-remittance transaction amount is greater than a transaction threshold amount.

[0052] The transaction index Z3 is that the number of transactions of the client in the transaction day is greater than or equal to the threshold number of transactions.

[0053] The transaction index Z4 is that the number of metal transactions of the client in the transaction day is greater than or equal to the threshold number of metal transactions, and the cumulative amount of metal transactions is greater than or equal to the threshold cumulative amount.

[0054] The transaction index Z5 is that the number of transactions of the client in the transaction day involving the resources of the preset channel in the transaction source and purpose is greater than or equal to the threshold number of resource transactions, and the transaction amount of the resources of the preset channel is greater than or equal to the threshold amount of resource transactions.

[0055] The evaluation index of the integration stage can be investment, asset consumption, enterprise transaction, etc. Investment, asset consumption, and enterprise transaction can be determined from the transaction summary or transaction postscript in the transaction detail data.

[0056] For example, the abnormal transaction process can be a market manipulation transaction, which can include a preparation stage, an operation stage, and an exit stage.

[0057] The evaluation index of the preparation stage can be that the number of asset transactions exceeds the threshold value, and the cumulative asset gain amount exceeds the threshold amount.

[0058] The evaluation index of the operation stage can be that the number of transactions is much higher than the threshold value.

[0059] The evaluation index of the exit stage can be that all transaction assets are quickly recovered within a preset time.

[0060] In an embodiment of the present disclosure, before obtaining the transaction information of the transaction object, the consent or authorization of the user can be obtained. For example, before operation S220, a request for obtaining transaction information can be sent to the transaction object. In the case where the transaction object agrees or authorizes to obtain the transaction information, the operation S220 is performed.

[0061] According to an embodiment of the present disclosure, the stage feature can represent the information of the transaction object in each abnormal stage in the abnormal transaction process.

[0062] In operation S230, the weight of the node and the weight of the edge are determined according to the stage feature.

[0063] According to an embodiment of the present disclosure, since the node represents the transaction object and the edge represents the transaction relationship between the plurality of transaction objects, the participation degree of the transaction object in the abnormal transaction process and the transaction relationship with other transaction objects in each abnormal stage can be reflected in the stage feature.

[0064] For example, the stage feature has an effective feature value of each stage, so the transaction object participates in each abnormal stage, and the weight of the node is greater.

[0065] For example, the transaction information of the transaction object is also included in the stage feature, and the transaction frequency and transaction correlation of the transaction object with other transaction objects in each abnormal stage can be obtained. Therefore, the greater the transaction frequency and the stronger the transaction correlation of the transaction object with other transaction objects in the abnormal stage, the greater the weight of the edge.

[0066] In operation S240, the initial community of the graph model is updated according to the weight of the node and the weight of the edge, and a target community is obtained.

[0067] According to an embodiment of the present disclosure, the initial community includes at least one node.

[0068] For example, the initial community can be a single node. The change in modularity after moving from the initial community to the adjacent community can be calculated according to the weight of the node and the weight of the edge. If it is a positive contribution to modularity, the node and the adjacent node can be classified into the same community, and the community weight can be obtained according to the sum of the weight of the node and the weight of the adjacent node. The above operation is repeatedly performed until the nodes in each community no longer change, and the updated community is obtained. The updated community is taken as the target community.

[0069] For example, the initial community can be a single node. The change in modularity after moving from the initial community to the adjacent community can be calculated according to the weight of the node and the weight of the edge. If it is a positive contribution to modularity, the node and the adjacent node can be classified into the same community. The above operation is repeatedly performed until the nodes in each community no longer change, and the multiple target communities of the graph model are obtained.

[0070] For example, the initial community can be composed of multiple historical nodes. The multiple historical nodes are the graph model constructed by the historical transaction objects. The weight of the node and the weight of the edge corresponding to the historical transaction object are also determined according to the stage feature. The historical nodes associated with the node are determined from the graph model. The initial community of the graph model is updated according to the weight of the node and the weight of the edge, and a target community is obtained.

[0071] In operation S250, multiple transaction objects are identified according to the attribute information of each node in the target community, and an abnormal transaction object is obtained.

[0072] According to an embodiment of the present disclosure, the attribute information can include the unique identifier, address, account identifier, transaction type, educational background, etc. of the transaction object.

[0073] According to an embodiment of the present disclosure, the multiple transaction objects are identified according to the attribute information, and the abnormal transaction object is obtained, which can balance the role of the abnormal stage information in identification and facilitate the identification of the abnormal transaction object between the transaction objects belonging to the same target community.

[0074] For example, the abnormal transaction object can be weakly associated with other transaction objects in the attribute information in the target community.

[0075] For example, the abnormal transaction object can be a transaction object that is strongly associated with some transaction objects in attribute information in the target community, but weakly associated with other transaction objects in attribute information.

[0076] According to an embodiment of the present disclosure, by obtaining a graph model representing a plurality of transaction objects, transaction information of the transaction objects is feature extracted according to abnormal stage information, to obtain stage features of the transaction objects, which can represent information of each abnormal stage of the transaction objects in an abnormal transaction process. The weight of a node and the weight of an edge are determined according to the stage features. The initial community of the graph model is updated in a community structure according to the weight of the node and the weight of the edge, to obtain a target community. The target community can be used to accurately lock a user participating in abnormal transactions. Therefore, the plurality of transaction objects are identified according to attribute information of each node in the target community, to obtain abnormal transaction objects, thereby improving the identification accuracy.

[0077] According to an embodiment of the present disclosure, the transaction information of the transaction objects is feature extracted according to the abnormal stage information, to obtain stage features of the transaction objects, including: the transaction information of the transaction objects is feature extracted according to the abnormal stage information, to obtain abnormal data of each abnormal stage of the transaction objects in the abnormal transaction process; and the abnormal data of each stage is processed, to obtain the stage features of the transaction objects.

[0078] For example, the abnormal transaction process can be illegal transactions, and the abnormal stages of the illegal transactions can include a placement stage. The evaluation index of the placement stage can include a preset transaction mode, high-consumption transactions, cross-border transactions, etc. The transaction mode identifier can be determined from the transaction information of the transaction objects, and the transaction objects can be determined to be involved in the preset transaction mode, high-consumption transactions, cross-border transactions, etc. in the placement stage according to the transaction mode identifier.

[0079] For example, the abnormal transaction process can be market manipulation transactions, and the market manipulation transactions can include a preparation stage. The evaluation index of the preparation stage can be that the number of asset transactions exceeds a threshold value, and the cumulative asset gain amount exceeds a threshold value. The number of asset transactions and the cumulative asset gain amount can be determined from the transaction information of the transaction objects, so as to extract abnormal data of the preparation stage.

[0080] For example, the abnormal data of each stage is normalized to obtain the stage features of the transaction objects.

[0081] For example, the abnormal data of each stage is integrated in chronological order to ensure that the stage abnormal data conforms to the chronological order. The integrated abnormal data is normalized to obtain the stage features of the transaction objects.

[0082] According to an embodiment of the present disclosure, by performing data processing on the abnormal data of each stage, the stage features of the transaction object are obtained, and potential hidden abnormal transaction information can be accurately mined.

[0083] According to an embodiment of the present disclosure, determining the weight of the node and the weight of the edge according to the stage features comprises: determining the number of abnormal stages corresponding to the transaction object according to the stage features; and determining the weight of the node and the weight of the edge according to the number of abnormal stages and the transaction information of the transaction object.

[0084] According to an embodiment of the present disclosure, the stage features have effective feature values of each stage, so the number of abnormal stages corresponding to the transaction object can be determined. For example, the transaction object involves participating in 2 abnormal stages.

[0085] According to an embodiment of the present disclosure, the transaction sub-information of the abnormal stage corresponding to the transaction object is determined from the transaction information. The transaction sub-information includes the transaction frequency of the transaction object with other transaction objects in the abnormal stage, etc.

[0086] According to an embodiment of the present disclosure, by determining the weight of the node and the weight of the edge according to the number of abnormal stages and the transaction information of the transaction object, the graph model has better performance in abnormal transaction analysis.

[0087] According to an embodiment of the present disclosure, determining the weight of the node and the weight of the edge according to the number of abnormal stages and the transaction information of the transaction object comprises: determining the weight of the node according to the transaction volume of the transaction object within a preset time and the number of abnormal stages; determining the associated object having a transaction relationship with the transaction object according to the abnormal stage information; and determining the weight of the edge according to the transaction information between the transaction object and the associated object.

[0088] According to an embodiment of the present disclosure, the value information can be locked from the transaction information of the transaction object according to the abnormal stage information. The associated object having a transaction relationship with the transaction object is determined from the value information.

[0089] According to an embodiment of the present disclosure, the transaction object and the associated object are both parties involved in abnormal transactions, and the weight of the edge between the transaction object and the associated object is determined according to the transaction information between the transaction object and the associated object. For example, the transaction information between the transaction object and the associated object can be transaction volume, transaction frequency, transaction cumulative volume, transaction mode, etc.

[0090] According to an embodiment of the present disclosure, the weight of the node is determined according to the transaction volume and the number of abnormal stages, and the weight of the edge is determined according to the transaction information between the transaction object and the associated object, so the weight of the node represents the number of abnormal stages participated by the transaction object, the weight of the edge represents the correlation of abnormal behavior, the explainability of subsequent community structure update is improved, and the identification accuracy of abnormal transaction objects is also improved.

[0091] According to an embodiment of the present disclosure, the transaction information between the transaction object and the associated object includes at least one of the following: the transaction frequency, the transaction time, and the common transaction object between the transaction object and the associated object.

[0092] For example, the more the transaction frequency, the more the common transaction object, and the shorter the interval of the transaction time of the adjacent transaction, the greater the weight of the edge.

[0093] For example, the more the transaction frequency, the less the common transaction object, and the longer the interval of the transaction time of the adjacent transaction, the smaller the weight of the edge.

[0094] It should be noted that according to the evaluation index of each abnormal stage in the abnormal transaction process, the weight of the edge can be reasonably set according to the transaction frequency, the transaction time, and the common transaction object between the transaction object and the associated object.

[0095] According to an embodiment of the present disclosure, the transaction information is refined, the weight of the edge can be accurately determined, and the computer processing speed is improved.

[0096] Figure 3 The flowchart of the method for identifying the abnormal transaction object according to another embodiment of the present disclosure is schematically shown.

[0097] As shown in the figure, the method for identifying the abnormal transaction object according to the embodiment includes operations S310-S390. Figure 3

[0098] In operation S310, a graph model representing a plurality of transaction objects is obtained, the graph model including nodes and edges, the nodes representing the transaction objects, and the edges representing the transaction relationship between the plurality of transaction objects.

[0099] In operation S320, the transaction information of the transaction object is feature extracted according to the abnormal stage information, to obtain the abnormal data of the transaction object in each abnormal stage in the abnormal transaction process.

[0100] In operation S330, the abnormal data of each stage is processed to obtain the stage feature of the transaction object.

[0101] In operation S340, the number of abnormal stages corresponding to the transaction object is determined according to the stage feature.

[0102] In operation S350, the weight of the node is determined according to the transaction volume of the transaction object within a preset time and the number of abnormal stages.

[0103] In operation S360, the associated object having a transaction relationship with the transaction object is determined according to the abnormal stage information.

[0104] In operation S370, the weight of the edge is determined according to the transaction information between the transaction object and the associated object. ​

[0105] In operation S380, the initial community of the graph model is updated in community structure according to the weights of the nodes and the weights of the edges, to obtain a target community.

[0106] In operation S390, a plurality of transaction objects are identified according to attribute information of each node in the target community, to obtain an abnormal transaction object.

[0107] According to an embodiment of the present disclosure, updating the initial community of the graph model in community structure according to the weights of the nodes and the weights of the edges to obtain a target community of the graph model comprises: calculating a modularity gain of a node moving from a current initial community to a target initial community according to the weights of the nodes and the weights of the edges; and updating the initial community of the graph model in community structure according to the modularity gain to obtain the target community.

[0108] According to an embodiment of the present disclosure, the community structure updating can be implemented based on the Louvain algorithm. For example, the initial community can be a single node, and the number of initial communities is the same as the number of nodes. The modularity gain after moving from the initial community to the adjacent community is calculated according to the weight of the edge. It is judged whether the modularity gain is greater than 0. If the modularity gain is greater than 0, the node is put into the initial community where the adjacent node is located. And the community weight is obtained by adding the weight of the node and the weight of the adjacent node. The above operation is repeatedly executed until the nodes in each community no longer change, to obtain the updated community. All nodes in each updated community are compressed into a node, the weight of the node in the updated community is converted into the weight of the new node ring, and the weight between the updated communities is converted into the weight of the new node edge. Until the weights of the updated communities and the weights of the edges converge, to obtain the target community.

[0109] According to an embodiment of the present disclosure, by only calculating the modularity gain before and after the node moves, instead of recalculating the modularity of the entire graph, the amount of calculation is significantly reduced. The incremental updating method greatly speeds up the process of node community division, especially when the number of nodes and the number of edges are large. There is no need to store and update the modularity of the entire graph, and the memory occupation is lower.

[0110] According to an embodiment of the present disclosure, identifying a plurality of transaction objects according to attribute information of each node in the target community to obtain an abnormal transaction object comprises: clustering a plurality of nodes in the target community according to attribute information of the plurality of nodes in the target community, to obtain a clustering result of the plurality of transaction objects; and identifying the plurality of transaction objects according to the clustering result, to obtain a group of abnormal transaction objects.

[0111] According to an embodiment of the present disclosure, clustering a plurality of nodes in the target community according to attribute information of the plurality of nodes in the target community can classify a plurality of transaction objects in the same target community based on the attribute information.

[0112] For example, the clustering result can represent whether to participate in abnormal transactions. The transaction object represented by the clustering result as participating in abnormal transactions is determined as an abnormal transaction object.

[0113] For example, in the case of multiple abnormal transaction objects, a group can be formed.

[0114] According to an embodiment of the present disclosure, the multiple nodes are clustered based on the attribute information, not only balancing the role of abnormal stage information in identification, but also mining the common attributes between transaction objects, so that the group of abnormal transaction objects identified is more accurate.

[0115] According to an embodiment of the present disclosure, the multiple nodes in the target community are clustered based on the attribute information of the multiple nodes in the target community, and the clustering result of the multiple transaction objects includes: calculating the similarity between the multiple nodes in the target community based on the attribute information of the multiple nodes in the target community; determining multiple clustering nodes with a similarity reaching a preset threshold from the multiple nodes; merging the multiple clustering nodes to obtain updated nodes; repeating the above operations until the target community includes a preset number of clustering nodes, and obtaining the clustering result of the multiple transaction objects.

[0116] According to an embodiment of the present disclosure, the attribute information (such as education background, age, address, etc.) of the multiple nodes in the target community is used for abnormal transaction object identification.

[0117] According to an embodiment of the present disclosure, the similarity calculation can be Euclidean distance, cosine similarity, Manhattan distance, etc.

[0118] For example, the attribute information of the nodes in each target community is calculated by numerical normalization. The Euclidean distance between the multiple nodes in the target community is calculated. The two clustering nodes with the closest Euclidean distance are merged to obtain updated nodes. Repeat the above steps until each target community includes a preset number of clustering nodes. The transaction objects corresponding to the preset number of clustering nodes are determined as abnormal transaction objects. And the multiple abnormal transaction objects are determined to belong to the same group.

[0119] The risk level can be determined according to the node weight of the abnormal transaction object. The abnormal transaction object and its corresponding risk level are added to the suspicious warning library, and the risk level is continuously monitored and timely synchronized to the relevant departments.

[0120] The graph model representing a plurality of transaction objects is acquired, the transaction information of the transaction objects is extracted according to the abnormal stage information, and the stage features of the transaction objects are obtained. The stage features can represent the information of each abnormal stage of the transaction objects in the abnormal transaction process. The weights of the nodes and the weights of the edges are determined according to the stage features, and the initial community structure of the graph model is updated according to the weights of the nodes and the weights of the edges, so as to effectively cope with the situation that it is difficult to accurately identify abnormal transaction objects and inaccurate monitoring due to too large transaction data.

[0121] The abnormal transaction objects are identified by using the clustering algorithm based on the Euclidean distance, so as to effectively cope with the problem that the key personnel in the group cannot be accurately positioned, greatly reduce the human resource cost, and improve the timeliness of the abnormal object identification.

[0122] The risk level is determined according to the node weight of the abnormal transaction object. The abnormal transaction object and the corresponding risk level are added to the suspicious early warning library, and the risk level is continuously monitored and timely synchronized to the relevant departments, which helps to maintain the stability of the economy, finance and society, and improves the monitoring efficiency of the abnormal transaction behavior.

[0123] Figure 4 A flowchart for identifying a plurality of transaction objects according to attribute information of each node in a target community to obtain abnormal transaction objects is schematically shown according to an embodiment of the present disclosure.

[0124] As shown in Figure 4 , the operation of identifying a plurality of transaction objects according to attribute information of each node in a target community to obtain abnormal transaction objects in this embodiment includes operations S410-S460.

[0125] In operation S410, the similarity between a plurality of nodes in the target community is calculated according to the attribute information of the plurality of nodes in the target community.

[0126] In operation S420, a plurality of clustering nodes whose similarity reaches a preset threshold are determined from the plurality of nodes.

[0127] In operation S430, the plurality of clustering nodes are merged to obtain updated nodes.

[0128] In operation S440, it is determined whether the number of clustering nodes reaches a preset number. If yes, operation S450 is performed; if no, operation S410 is performed.

[0129] In operation S450, a clustering result of a plurality of transaction objects is obtained.

[0130] In operation S460, a plurality of transaction objects are identified according to the clustering result to obtain a group with abnormal transaction objects.

[0131] Figure 5A structural block diagram of an abnormal transaction object identification apparatus according to an embodiment of the present disclosure is shown schematically.

[0132] As shown in Figure 5 The abnormal transaction object identification apparatus 500 of this embodiment includes an acquisition module 510, a feature extraction module 520, a determination module 530, an update module 540, and an identification module 550.

[0133] The acquisition module 510 is configured to acquire a graph model representing a plurality of transaction objects, the graph model including nodes representing the transaction objects and edges representing transaction relationships between the transaction objects. In an embodiment, the acquisition module 510 can be configured to perform operation S210 described above, and thus repeated details are not provided herein.

[0134] The feature extraction module 520 is configured to perform feature extraction on transaction information of the transaction objects according to abnormal phase information to obtain phase features of the transaction objects, the abnormal phase information representing evaluation indexes of abnormal phases in an abnormal transaction process. In an embodiment, the feature extraction module 520 can be configured to perform operation S220 described above, and thus repeated details are not provided herein.

[0135] The determination module 530 is configured to determine weights of the nodes and weights of the edges according to the phase features. In an embodiment, the determination module 530 can be configured to perform operation S230 described above, and thus repeated details are not provided herein.

[0136] The update module 540 is configured to perform community structure update on an initial community of the graph model according to the weights of the nodes and the weights of the edges to obtain a target community, the initial community including at least one node. In an embodiment, the update module 540 can be configured to perform operation S240 described above, and thus repeated details are not provided herein.

[0137] The identification module 550 is configured to identify the plurality of transaction objects according to attribute information of the nodes in the target community to obtain abnormal transaction objects. In an embodiment, the identification module 550 can be configured to perform operation S250 described above, and thus repeated details are not provided herein.

[0138] According to an embodiment of the present disclosure, the feature extraction module 520 includes a feature extraction sub-module and a data processing sub-module. The feature extraction sub-module is configured to perform feature extraction on transaction information of the transaction objects according to abnormal phase information to obtain abnormal data of the transaction objects in abnormal phases in an abnormal transaction process; and the data processing sub-module is configured to perform data processing on the abnormal data of the phases to obtain phase features of the transaction objects.

[0139] According to an embodiment of the present disclosure, the determining module 530 comprises a first determining sub-module and a second determining sub-module. The first determining sub-module is configured to determine the number of abnormal stages corresponding to the transaction object according to the stage features; and the second determining sub-module is configured to determine the weight of the node and the weight of the edge according to the number of abnormal stages and the transaction information of the transaction object.

[0140] According to an embodiment of the present disclosure, the second determining sub-module comprises a first determining unit, a second determining unit and a third determining unit. The first determining unit is configured to determine the weight of the node according to the transaction volume of the transaction object within a preset time and the number of abnormal stages; the second determining unit is configured to determine the associated object having a transaction relationship with the transaction object according to the abnormal stage information; and the third determining unit is configured to determine the weight of the edge according to the transaction information between the transaction object and the associated object.

[0141] According to an embodiment of the present disclosure, the transaction information between the transaction object and the associated object comprises at least one of the following: the number of transactions, the transaction time and the common transaction object between the transaction object and the associated object.

[0142] According to an embodiment of the present disclosure, the updating module 540 comprises a calculating sub-module and an updating sub-module. The calculating sub-module is configured to calculate the modularity gain of the node moving from the current initial community to the target initial community according to the weight of the node and the weight of the edge; and the updating sub-module is configured to update the community structure of the initial community of the graph model according to the modularity gain, to obtain the target community.

[0143] According to an embodiment of the present disclosure, the identifying module 550 comprises a clustering sub-module and an identifying sub-module. The clustering sub-module is configured to cluster the plurality of nodes in the target community according to the attribute information of the plurality of nodes in the target community, to obtain the clustering result of the plurality of transaction objects; and the identifying sub-module is configured to identify the plurality of transaction objects according to the clustering result, to obtain the group of abnormal transaction objects.

[0144] According to an embodiment of the present disclosure, the clustering sub-module comprises a calculating unit, a fourth determining unit, a merging unit and an executing unit. The calculating unit is configured to calculate the similarity between the plurality of nodes in the target community according to the attribute information of the plurality of nodes in the target community; the fourth determining unit is configured to determine a plurality of clustering nodes having a similarity reaching a preset threshold from the plurality of nodes; the merging unit is configured to merge the plurality of clustering nodes, to obtain the updated node; and the executing unit is configured to repeatedly execute the above operations until the target community comprises a preset number of clustering nodes, to obtain the clustering result of the plurality of transaction objects.

[0145] According to an embodiment of the present disclosure, any of the modules of the acquiring module 510, the feature extraction module 520, the determining module 530, the updating module 540 and the identifying module 550 can be combined in one module, or any of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of the modules can be combined with at least part of the functions of other modules, and implemented in one module. According to an embodiment of the present disclosure, at least one of the acquiring module 510, the feature extraction module 520, the determining module 530, the updating module 540 and the identifying module 550 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on chip, a system on board, a system on package, an application specific integrated circuit (ASIC), or any other reasonable manner of integrating or packaging a circuit, etc. or implemented by hardware or firmware, or implemented in any one of software, hardware and firmware or in a proper combination of any of them. Alternatively, at least one of the acquiring module 510, the feature extraction module 520, the determining module 530, the updating module 540 and the identifying module 550 can be at least partially implemented as a computer program module which, when executed, can perform the corresponding functions.

[0146] Figure 6 A block diagram of an electronic device suitable for implementing the method of identifying an abnormal transaction object according to an embodiment of the present disclosure is schematically shown.

[0147] As shown in Figure 6 The electronic device 600 according to an embodiment of the present disclosure includes a processor 601 which can perform various appropriate actions and processes according to programs stored in a read-only memory (ROM) 602 or loaded from a storage portion 608 into a random access memory (RAM) 603. The processor 601 can include, for example, a general-purpose microprocessor (such as a CPU), an instruction set processor and / or a related chipset, and / or a special-purpose microprocessor (such as an application specific integrated circuit (ASIC)), etc. The processor 601 can also include an on-board memory for cache use. The processor 601 can include a single processing unit or a plurality of processing units for performing different actions of the method processes according to an embodiment of the present disclosure.

[0148] In the RAM 603, various programs and data required for the operation of the electronic device 600 are stored. The processor 601, the ROM 602, and the RAM 603 are connected to each other via the bus 604. The processor 601 performs various operations of the method flow according to the embodiments of the present disclosure by executing the programs in the ROM 602 and / or the RAM 603. It should be noted that the programs can also be stored in one or more memories other than the ROM 602 and the RAM 603. The processor 601 can also perform various operations of the method flow according to the embodiments of the present disclosure by executing the programs stored in the one or more memories.

[0149] According to an embodiment of the present disclosure, the electronic device 600 can further include an input / output (I / O) interface 605, which is also connected to the bus 604. The electronic device 600 can further include one or more of the following components connected to the input / output (I / O) interface 605: an input part 606 including a keyboard, a mouse, and the like; an output part 607 including a cathode ray tube (CRT), a liquid crystal display (LCD), and the like, and a speaker, and the like; a storage part 608 including a hard disk, and the like; and a communication part 609 including a network interface card such as a LAN card, a modem, and the like. The communication part 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the input / output (I / O) interface 605 as necessary. A removable medium 611 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, and the like is mounted on the drive 610 as necessary, so that a computer program read therefrom is installed in the storage part 608 as necessary.

[0150] The present disclosure also provides a computer readable storage medium, which can be included in the device / apparatus / system described in the above embodiments; or can exist separately without being assembled into the device / apparatus / system. The above computer readable storage medium carries one or more programs, when the one or more programs are executed, the method according to the embodiments of the present disclosure is implemented.

[0151] According to an embodiment of the present disclosure, the computer readable storage medium can be a nonvolatile computer readable storage medium, for example, can include, but is not limited to, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any appropriate combination thereof. In the present disclosure, the computer readable storage medium can be any tangible medium that contains or stores a program that can be used by or in connection with an instruction execution system, apparatus, or device. For example, according to an embodiment of the present disclosure, the computer readable storage medium can include one or more memories, such as the ROM 602 and / or the RAM 603 described above, and / or one or more memory chips other than the ROM 602 and the RAM 603.

[0152] Embodiments of the present disclosure also include a computer program product, which includes a computer program containing program codes for executing the methods shown in the flowcharts. When the computer program product is run in a computer system, the program codes are used to make the computer system implement the method for identifying an abnormal transaction object provided by the embodiments of the present disclosure.

[0153] The above-described functions defined in the system / device of the embodiments of the present disclosure are performed when the computer program is executed by the processor 601. According to an embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by computer program modules.

[0154] In one embodiment, the computer program can rely on a tangible storage medium such as an optical storage device, a magnetic storage device, etc. In another embodiment, the computer program can also be transmitted, distributed, and downloaded in the form of a signal on a network medium, and be downloaded and installed through the communication part 609, and / or be installed from the detachable medium 611. The program codes contained in the computer program can be transmitted by any appropriate network medium, including but not limited to wireless, wired, etc., or any appropriate combination thereof.

[0155] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 609, and / or be installed from the detachable medium 611. When the computer program is executed by the processor 601, the above-described functions defined in the system of the embodiments of the present disclosure are performed. According to an embodiment of the present disclosure, the system, device, apparatus, module, unit, etc. described above can be implemented by computer program modules.

[0156] According to embodiments of the present disclosure, program code of the computer programs provided by the embodiments of the present disclosure can be written in any combination of one or more programming languages, and specifically, these computer programs can be implemented using a high-level procedural and / or object-oriented programming language, and / or an assembly / machine language. The programming language includes, but is not limited to, a programming language such as Java, C++, Python, "C" language, or a similar programming language. The program code can be executed entirely on a user computing device, partially on a user device, partially on a remote computing device, or entirely on a remote computing device or server. In the case involving a remote computing device, the remote computing device can be connected to the user computing device through any kind of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, connected to the Internet through an Internet service provider).

[0157] The flow diagrams and the block diagrams in the drawings are illustrations of possible architectures, functions, and operations of systems, methods, and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flow diagrams or block diagrams can represent a module, a segment, or a portion of code, which comprises one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions noted in the blocks can occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently or in the reverse order, depending on the functionality involved. It will also be noted that each block of the block diagrams and / or flow diagrams, and combinations thereof, can be implemented by special purpose hardware-based systems that perform the specified functions or operations, or combinations of special purpose hardware and computer instructions.

[0158] Those skilled in the art will understand that features recited in the various embodiments of the present disclosure can be combined and / or integrated in a variety of ways, even if such combinations or integrations have not been explicitly stated in the present disclosure. In particular, features recited in the various embodiments of the present disclosure can be combined and / or integrated in a variety of ways without departing from the spirit and teachings of the present disclosure. All such combinations and / or integrations are within the scope of the present disclosure.

[0159] The embodiments of the present disclosure are described above. However, these embodiments are merely for illustrative purposes, and are not intended to limit the scope of the present disclosure. Although each embodiment is described above separately, this does not mean that the measures in each embodiment cannot be used advantageously in combination. Those skilled in the art can make various substitutions and modifications without departing from the scope of the present disclosure, and these substitutions and modifications should all fall within the scope of the present disclosure.

Claims

1. A method of identifying an abnormal transaction object, characterized by, The method comprises: acquiring a graph model representing a plurality of transaction objects, the graph model comprising nodes and edges, the nodes representing the transaction objects, and the edges representing transaction relationships between the transaction objects; extracting features of transaction information of the transaction objects according to abnormal stage information, to obtain stage features of the transaction objects, the abnormal stage information representing evaluation indexes of each abnormal stage in an abnormal transaction process; determining weights of the nodes and weights of the edges according to the stage features; updating a community structure of an initial community of the graph model according to the weights of the nodes and the weights of the edges, to obtain a target community, the initial community comprising at least one node; identifying a plurality of the transaction objects according to attribute information of each node in the target community, to obtain abnormal transaction objects; the extracting features of the transaction information of the transaction objects according to the abnormal stage information, to obtain the stage features of the transaction objects comprises: extracting features of transaction information of the transaction objects according to the abnormal stage information, to obtain abnormal data of each abnormal stage in an abnormal transaction process of the transaction objects; processing the abnormal data of each stage, to obtain the stage features of the transaction objects; the determining the weights of the nodes and the weights of the edges according to the stage features comprises: determining a number of abnormal stages corresponding to the transaction objects according to the stage features; determining the weights of the nodes according to a transaction volume of the transaction objects within a preset time and the number of abnormal stages; determining associated objects having transaction relationships with the transaction objects according to the abnormal stage information; determining the weights of the edges according to transaction information between the transaction objects and the associated objects.

2. The method of claim 1, wherein, The transaction information between the transaction objects and the associated objects comprises at least one of the following: a transaction frequency, a transaction time, and a common transaction object between the transaction objects and the associated objects.

3. The method of claim 1, wherein, the updating the community structure of the initial community of the graph model according to the weights of the nodes and the weights of the edges, to obtain the target community of the graph model comprises: calculating a modularity gain of the nodes moving from a current initial community to a target initial community according to the weights of the nodes and the weights of the edges; updating the community structure of the initial community of the graph model according to the modularity gain, to obtain the target community.

4. The method of claim 1, wherein, the identifying a plurality of the transaction objects according to attribute information of each node in the target community, to obtain abnormal transaction objects comprises: clustering a plurality of the nodes in the target community according to attribute information of a plurality of nodes in the target community, to obtain a clustering result of the plurality of transaction objects; identifying the plurality of the transaction objects according to the clustering result, to obtain a group of abnormal transaction objects.

5. The method of claim 4, wherein, the clustering a plurality of the nodes in the target community according to attribute information of a plurality of nodes in the target community, to obtain a clustering result of the plurality of transaction objects comprises: calculating a similarity between a plurality of the nodes in the target community according to the attribute information of a plurality of the nodes in the target community; determine a plurality of clustering nodes from the plurality of nodes, wherein the plurality of clustering nodes satisfy a preset threshold of the similarity; merge the plurality of clustering nodes to obtain updated nodes; repeat the operations until the target community includes a preset number of clustering nodes, and obtain the clustering result of the plurality of transaction objects.

6. An apparatus for identifying anomalous transaction objects for performing the method of any one of claims 1 to 5, characterized in that The device comprises: an acquisition module configured to acquire a graph model representing a plurality of transaction objects, wherein the graph model comprises nodes and edges, the nodes represent the transaction objects, and the edges represent transaction relationships between the transaction objects; a feature extraction module configured to extract features of the transaction objects according to abnormal stage information, wherein the abnormal stage information represents evaluation indexes of each abnormal stage in an abnormal transaction process, and the stage features are obtained by extracting features of the transaction information of the transaction objects according to the abnormal stage information; a determination module configured to determine weights of the nodes and weights of the edges according to the stage features; an update module configured to update a community structure of an initial community to obtain a target community according to the weights of the nodes and the weights of the edges, wherein the initial community includes at least one node; an identification module configured to identify the plurality of transaction objects according to attribute information of each node in the target community, and obtain abnormal transaction objects.

7. An electronic device comprising: one or more processors; a memory for storing one or more computer programs, characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1-5.

8. A computer readable storage medium having stored thereon a computer program or instructions, characterized in that, The computer program or instructions are executed by the processor to implement the steps of the method according to any one of claims 1-5.

9. A computer program product comprising computer programs or instructions, characterized in that, The computer program or instructions are executed by the processor to implement the steps of the method according to any one of claims 1-5. The computer program or instructions are executed by the processor to implement the steps of the method according to any one of claims 1-5.

Images