Suspicious customer identification and submission method and system based on multivariate data

Abstract

The invention discloses a suspicious customer identification and submission method and system based on multivariate data, and the method comprises the following steps: obtaining customer information, including external data and financial data of customers, and constructing a customer data set based on the customer information; constructing a suspicious customer identification model, and identifying suspicious customers by using the customer data set; identifying a transaction structure diagram of the suspicious customer through diagram calculation, and identifying suspicious features in the transaction structure diagram; constructing a suspicious gang identification model for identifying a core transaction structure of the transaction structure chart, analyzing a fund flow route and performing gang risk scoring; and constructing a report generation model, and generating a suspicious customer analysis report meeting the submission requirement according to the recognition result of the suspicious customer recognition model, the suspicious features in the transaction structure diagram and the recognition result of the suspicious gang recognition model. According to the invention, the accuracy of suspicious customer identification can be improved, and the efficiency of submitted report generation can be improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of financial risk management, and in particular relates to a suspicious customer identification and reporting method and system based on multivariate data. Background Art

[0002] In today's complex financial and social environment, it has become particularly important and challenging to carry out anti-money laundering work effectively. Anti-money laundering refers to preventing illegal funds from flowing into the normal economic system and protecting the stability and security of the financial system by identifying and preventing money laundering. In the anti-money laundering work of banks, the three most problematic links are: the suspicious customer monitoring model building stage, the suspicious customer analysis stage, and the anti-money laundering analysis report writing stage. In the suspicious customer analysis stage, the existing anti-money laundering work is based on a huge customer base, and tens of thousands of suspicious customers need to be managed and tens of thousands of suspicious transactions need to be checked every year. The traditional anti-money laundering process is complicated, requiring cross-system multi-dimensional identification and incomplete data elements, and customer investigation is time-consuming and laborious. In addition, compliance specialists also need to conduct detailed analysis and mining and horizontal investigation. The average processing time for a single anti-money laundering report is in days, which greatly increases the burden and complexity of anti-money laundering work.

[0003] For example, a Chinese invention patent application with publication number CN117217881A discloses a risk monitoring method and device based on customer characteristics, the method comprising: obtaining customer information; performing target identity recognition on the customer information, and extracting data when the identity recognition passes, to obtain target customer information; inputting the target customer information into a suspicious transaction monitoring model, and obtaining a customer risk determination result output by the suspicious transaction monitoring model; wherein the suspicious transaction monitoring model is constructed based on a pre-acquired risk feature set; the risk feature set includes risk features of customers with money laundering risks; the suspicious transaction monitoring model determines whether the corresponding target customer has money laundering risks based on the target customer information and the risk feature set.

[0004] The above scheme determines customer risk through suspicious transaction monitoring models, but there are problems such as incomplete non-counter business monitoring technology and data products, non-sharing of technical data of monitoring models and prediction tools between institutions, lack of horizontal networking between various supervisory departments and institutions, and inaccurate comprehensive portraits of customers within a single institution, which leads to an incomplete picture of customers and affects the accuracy of customer identification. In addition, after identifying suspicious customers involved in money laundering or fraud, financial institutions are also faced with the task of processing and generating specific analysis reports to be submitted to regulatory authorities based on the identification results. This task has long been carried out by compliance specialists for detailed analysis and mining and horizontal investigation, and the writing and generation of relevant reports. The average processing time is measured in days, which greatly increases the burden and complexity of anti-money laundering work. Summary of the invention

[0005] The present invention provides a suspicious customer identification and reporting method and system based on multivariate data, aiming to solve the problems of insufficient accuracy in customer identification and low efficiency in generating and submitting reports in the prior art.

[0006] In order to solve the above technical problems, the present invention proposes a suspicious customer identification and reporting method, comprising the following steps:

[0007] Acquire customer information, including external data and financial data of the customer, and construct a customer data set based on the customer information;

[0008] Building a suspicious customer identification model, and using the customer data set to identify suspicious customers;

[0009] Identify the transaction structure graph of the suspicious customer through graph computing, and identify suspicious features in the transaction structure graph;

[0010] Constructing a suspicious group identification model to identify the core transaction structure of the transaction structure diagram, analyze the capital flow route and perform group risk scoring;

[0011] Build a report generation model to generate a suspicious customer analysis report that meets the reporting requirements based on the identification results of the suspicious customer identification model, the suspicious features in the transaction structure diagram, and the identification results of the suspicious gang identification model.

[0012] Preferably, the external data includes third-party data, public and government data, which are introduced through privacy computing; the third-party data includes the customer's operator data and water, electricity, gas and other fee data, and the public and government data includes the customer's provident fund payment level, medical insurance payment level, maternity insurance payment level, pension insurance payment level, work-related injury insurance payment level and unemployment insurance payment level.

[0013] Preferably, the method for constructing the customer data set is:

[0014] Conduct time series analysis on financial data to extract abnormal transaction behavior characteristics of customers; perform feature encoding to convert categorical variables into numerical values;

[0015] Identify abnormal and frequently changing data in third-party data and identify abnormal third-party characteristics;

[0016] Build risk profiles of clients through public and government data.

[0017] Preferably, the method for constructing the suspicious customer identification model is specifically as follows:

[0018] Use historically marked suspicious customer data as positive samples and normal customers as negative samples;

[0019] Build and train a binary classification model using the training set, and use the validation set to check the accuracy and generalization of the model;

[0020] The data to be predicted is input into the trained binary classification model, and the SHAP value is used to analyze the impact of each feature on the model prediction, and the customer score, suspicious features, non-suspicious features and suspicious types are output.

[0021] Preferably, the processing flow of the graph calculation is:

[0022] Graphical modeling is performed based on customer data sets, and various entities and corresponding relationships are represented in the graph to build a visual graph structure based on multidimensional data. The nodes in the graph represent entities, including customers, trading accounts, companies, and financial institutions, and the edges in the graph represent the relationships between entities, including transfers, joint holdings, business dealings, and upstream and downstream cooperation relationships.

[0023] Use social network analysis methods to identify customer-customer, customer-company, and upstream-downstream relationship chains, and analyze potential suspicious behaviors in customers’ social networks;

[0024] Use the feature information in the graph to identify abnormal nodes or subgraph structures, including frequently associated nodes, high-risk link detection, and abnormal transaction patterns;

[0025] Analyze the shortest path or maximum traffic path between customers and identify high-risk nodes and strongly connected nodes.

[0026] Preferably, the graph computation also applies one or more of random walk, Node2Vec, DeepWalk, isolation forest and density clustering algorithms to the visualized graph structure.

[0027] Preferably, the identification steps of the suspicious gang identification model are as follows:

[0028] Acquire suspicious customers;

[0029] Use social network analysis algorithms to analyze the information metrics of each node in the transaction structure graph and obtain key transaction hub nodes;

[0030] Use the K-Cores algorithm to implement key sub-network analysis, and use the minimum spanning tree algorithm to find the edges in the transaction structure graph that maintain the least connectivity, and obtain the core transaction structure;

[0031] Use the time series algorithm to analyze the time attributes of the transaction structure graph, use the shortest path algorithm to find the most direct intermediary between suspicious transaction individuals, and use the minimum spanning tree algorithm to obtain the core transaction route;

[0032] The risk is calculated for each transaction within a set time period according to the set rules, and the risk is quantified into the group's risk score.

[0033] Preferably, the shortest path algorithm is the SPFA algorithm, and the implementation process is as follows:

[0034] Set weights for the edges of the transaction structure graph;

[0035] Select the source suspicious individual and the target suspicious individual, and set the initial path weights of all nodes to infinity;

[0036] Use the queue-optimized relaxation operation to traverse the edges in the transaction structure graph and update the shortest path weight and path nodes from the start point to the end point;

[0037] After finding the shortest path from source to target, the nodes in the path are extracted to identify the direct intermediaries between two suspicious individuals.

[0038] Preferably, the report generation model is a large language model, which is fine-tuned by Lora technology, and the enhanced data used for fine-tuning include historical anti-money laundering case analysis, industry reports, professional terminology and rule standards.

[0039] Another aspect of the present invention is to provide a suspicious customer identification and reporting system based on multivariate data, the system being used to implement the suspicious customer identification and reporting method, comprising:

[0040] A data collection module is used to collect customer information, including external data and financial data of customers, and build a customer data set based on the customer information. The external data includes third-party data, public and government data, which are introduced through privacy computing;

[0041] A suspicious customer identification module, used to identify suspicious customers based on the customer data set;

[0042] A graph calculation module, used to identify the transaction structure graph of the suspicious customer and identify suspicious features in the transaction structure graph;

[0043] A suspicious group identification module is used to identify the core transaction structure of the transaction structure diagram, analyze the capital flow route and perform group risk scoring;

[0044] The report generation module is used to generate a suspicious customer analysis report that meets the reporting requirements based on the identification results of the suspicious customer identification model, the suspicious features in the transaction structure diagram, and the identification results of the suspicious gang identification model; the report generation model is a large language model fine-tuned by Lora technology, and the enhanced data used for fine-tuning includes anti-money laundering case analysis, industry reports, professional terminology and rule standards over the years.

[0045] Compared with the prior art, the present invention has the following technical effects:

[0046] 1. The suspicious customer identification method proposed in the present invention introduces external data through privacy computing and combines internal financial data to identify suspicious customers, which can enrich customer portraits and improve the accuracy of customer identification.

[0047] 2. The suspicious customer identification method proposed in the present invention identifies suspicious customers through the constructed suspicious customer identification model, graph computing module and suspicious group identification model, which can effectively improve the accuracy and efficiency of suspicious customer identification.

[0048] 3. The suspicious customer reporting method proposed in the present invention fine-tunes the large language model, constructs the recognition model and relationship chain analysis results of the prompt combined with the model output, and the large model for generating anti-money laundering analysis reports comprehensively judges the suspicious characteristics or non-suspicious characteristics of suspicious customers, whether they are involved in crimes, the types of crimes involved, and the relationship between customers, and generates an analysis report that conforms to the business logic of anti-money laundering experts according to the learned analysis logic. It can effectively improve the efficiency of reporting report generation and reduce labor costs. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 It is a flow chart of the suspicious customer identification and reporting method of the present invention. DETAILED DESCRIPTION

[0050] In order to make the objectives, technical solutions and advantages of the present invention more clear, the technical solutions of the present invention will be clearly and completely described below in combination with specific embodiments of the present application and with reference to the accompanying drawings.

[0051] Embodiment 1

[0052] like Figure 1 As shown, the suspicious customer identification and reporting method based on multivariate data includes the following steps 1 to 5:

[0053] Step 1: Obtain customer information, including external data and financial data of the customer, and construct a customer data set based on the customer information. Financial data refers to the customer data owned by the financial institution itself, including personal information submitted by the customer, as well as customer ID, customer mobile phone number, transaction channel, transaction type, transaction object, transaction object type, transaction time, transaction amount, account opening time, transaction notes, abnormal time transaction ratio, specific business transaction number ratio, specific customer transaction number ratio and other data stored by the financial institution.

[0054] The external data includes third-party data, public and government data, which are introduced through privacy computing. Privacy computing technologies generally include multi-party secure computing (MPC), homomorphic encryption, federated learning and other methods. Through these technologies, financial institutions and data holders can encrypt or split data to ensure the security of data during the calculation process. Data holders (such as operators or water, electricity and gas companies) can encrypt customer data and store it in a distributed manner. Financial institutions obtain encrypted data for calculation and analysis without directly contacting the original data. The third-party data includes the customer's operator data and water, electricity and gas fee data, and the public and government data includes the customer's provident fund payment level, medical insurance payment level, maternity insurance payment level, pension insurance payment level, work-related injury insurance payment level and unemployment insurance payment level.

[0055] Specifically, the method for constructing the customer data set is:

[0056] Perform time series analysis on transaction data to extract abnormal transaction behavior characteristics of customers (e.g., abnormal transaction time ratio, transaction volume ratio of specific business or customers, etc.). At the same time, perform feature encoding to convert categorical variables (such as transaction type, transaction channel) into numerical values;

[0057] Identify abnormal and frequently changing data in third-party data and identify abnormal third-party characteristics; for example, use information such as IP addresses and MAC addresses to determine whether there are abnormal and frequent changes, and use this as a feature to identify possible suspicious transactions;

[0058] Build a risk profile of the customer through public and government data such as the customer’s social security level, payment status and other information.

[0059] In other embodiments of the present invention, after the above data preprocessing is completed, feature engineering is performed to generate new features such as transaction frequency, amount fluctuation, transaction partnership network, etc. Feature engineering generates new features for the original data, and the model can more accurately identify potential abnormal patterns.

[0060]

[0061] Table 1 Transaction data example

[0062] Specific method of feature engineering Taking the sample data in Table 1 as an example, first calculate the transaction frequency, which is used to measure the number of transactions or the total amount of a customer in a specific time period; assuming that a week is used as the time window, calculate the number of transactions and the total amount of each customer per week. Assuming that a week is used as the time window, calculate the number of transactions and the total amount of each customer per week. For customer A001, the transaction frequency from October 1 to October 7 is 2 times, and the total amount is 12,000 yuan; the transaction frequency from October 8 to October 15 is 2 times, and the total amount is 25,000 yuan.

[0063] Then calculate the amount fluctuation characteristics, which reflects the changes in the customer's transaction amount. Abnormal amount fluctuations may represent dispersed transactions of money laundering (for example, small regular transfers suddenly become large transfers). For each customer, calculate the average of their transaction amounts. Within the window or a specific time period, calculate the standard deviation of the transaction amount. Evaluate the fluctuation range through the formula coefficient of variation = standard deviation / average. Customers with a large coefficient of variation have higher volatility. Suppose we calculate the average and standard deviation of customer A001's transaction amount in October. Average amount = (5000+7000+15000+10000) / 4 = 9250; assuming the calculation result is 4000 yuan, the coefficient of variation is 4000 / 9250≈0.43.

[0064] Then, the network relationship between the customer and his trading counterparty is constructed through the trading partnership network. The network indicators (such as node degree and network density) in social network analysis (SNA) can be used to explore the characteristics of the customer's trading behavior. Each customer and trading counterparty is regarded as a node in the network graph, and the trading behavior is regarded as an edge. For each customer, the number of its trading partners (node ​​degree) is calculated to measure the degree of connection between the customer and other accounts. The network density of a certain customer and its trading counterparty is calculated to reflect the closeness of the customer's social network. For example, the trading partners of customer A001 are B001, B002, and C001, and the node degree is 3; assuming that the relationship network density of A001 is 0.5, it means that its trading relationship is relatively close.

[0065] Then calculate the abnormal transaction ratio to measure the proportion of the customer's abnormal transaction times or amounts in the total transactions, which is an important feature in money laundering detection. Abnormal transactions are marked according to rules such as transaction type and amount threshold; the number of abnormal transactions or amounts are divided by the total number of transactions or total amounts to obtain the abnormal transaction ratio. For example, if the total number of transactions of customer A001 is 4, of which 1 is an abnormal transaction, the abnormal transaction ratio is 1 / 4 = 0.25.

[0066] Finally, after feature engineering is completed, the generated features are integrated into the model input data set to improve the model's predictive ability. The integrated features may include: transaction frequency such as monthly transaction times and weekly transaction times, amount volatility such as amount mean, amount standard deviation, coefficient of variation, transaction partnership such as node degree, network density, etc., and abnormal transaction ratio such as the ratio of abnormal transaction times to total transaction times.

[0067]

[0068] Table 2 Feature set examples

[0069] An example of the feature set obtained after feature engineering is shown in Table 2.

[0070] Step 2: construct a suspicious customer identification model and use the customer data set to identify suspicious customers.

[0071] The method for constructing the suspicious customer identification model is specifically as follows:

[0072] Use historically marked suspicious customer data as positive samples and normal customers as negative samples; those skilled in the art will understand that data should be preprocessed before use, including: removing features with high missing rates, or interpolating or filling data with fewer missing values, or filtering obviously abnormal data points, such as very unreasonable transaction amounts, invalid IP addresses or MAC addresses, etc. One-hot encoding or label encoding is performed for categorical variables (such as transaction type, counterparty type). Numerical features can also be normalized to ensure the convergence of the model.

[0073] Build and use the training set to train a binary classification model, and use the validation set to check the accuracy and generalization of the model; use the above features and label data to perform supervised learning training on the model. Cross-validation can be used to optimize the model's hyperparameters to improve the model's accuracy and generalization. After the initial training of the model is completed, business personnel can provide feedback to the model based on the output scores and results to continue to fine-tune and optimize the model's features and weights.

[0074] The data to be predicted is input into the trained binary classification model. Due to the complexity of suspicious transactions and the compliance requirements of the anti-money laundering model, the interpretability analysis of the model is very critical. The SHAP (Shapley Additive Explanations) method can be used to explain the contribution value of each feature in the model prediction results, and to clarify suspicious features and non-suspicious features. The model output includes: using the SHAP value to analyze the impact of each feature on the model prediction, outputting the customer score (a quantitative score value such as 0-1, used to characterize the customer's suspicion), suspicious features (such as high-value frequent transactions, transactions in different places, abnormal transaction times, etc.), non-suspicious features (such as regular small transactions, trustworthy counterparties, etc.) and suspicious types (such as money laundering, terrorist financing, etc.).

[0075] After the model gives a score, business personnel can review and score the results based on their professional judgment, and provide feedback to the model for continued training and adjustment of the model’s feature weights. This feedback mechanism can help the model continue to optimize in subsequent iterations to achieve higher accuracy and interpretability.

[0076] Step three, identifying the transaction structure graph of the suspicious customer through graph computing, and identifying suspicious features in the transaction structure graph.

[0077] The processing flow of the graph calculation is as follows:

[0078] Graphical modeling is performed based on the customer data set, and various entities and corresponding relationships are represented in the graph to build a visual graph structure based on multidimensional data; the nodes in the graph represent entities, including customers, transaction accounts, companies and financial institutions, and the edges in the graph represent the associations between entities, including transfers, joint holdings, business dealings, and upstream and downstream cooperation. Specifically, it includes customer nodes, transaction nodes, account nodes and association edges. Customer nodes contain basic attributes of customers, such as customer ID, name, contact information, geographic location, etc.; transaction nodes represent single transaction events, recording information such as transaction ID, transaction amount, transaction time, and transaction type; account nodes include bank accounts, securities accounts, payment accounts, etc.; association edges include transfer behaviors between customers, jointly participated projects or companies, and business relationships with upstream suppliers and downstream customers. By mapping these entities and events to nodes and edges, a visual graph structure based on multidimensional data such as finance, social, and finance can be constructed. These data can be stored using graph databases (such as Neo4j, TigerGraph, etc.), and the association of these data can be displayed through node and edge relationships.

[0079] Use social network analysis (SNA) to identify customer-customer, customer-company, and upstream-downstream relationship chains, and analyze potential suspicious behaviors in customers' social networks. Specifically, indicators such as degree centrality, closeness centrality, and betweenness centrality can be used to identify the most critical customers and relationships in the network; use community discovery algorithms (such as Louvain or Label Propagation) to discover possible illegal gangs, capital flow groups, etc.

[0080] Use the characteristic information in the graph to identify abnormal nodes or subgraph structures, including frequently associated nodes, high-risk link detection, and abnormal transaction patterns. Anomaly detection includes the following dimensions: frequently associated nodes, such as frequent fund transactions between customers, even forming a closed loop or mesh structure, which may be money laundering; high-risk link detection, nodes in certain transaction chains have a high concentration or transactions are abnormally active, which can be monitored in detail; abnormal transaction patterns, if it is found that the customer's trading account frequently trades with multiple high-risk accounts, or there are abnormal changes in transaction volume, it can be identified as potential suspicious behavior.

[0081] Analyze the shortest path or maximum flow path between customers to identify high-risk nodes and strongly connected nodes. The shortest path or maximum flow path can use the shortest path algorithm to find the capital flow path between two customers; strong connection nodes can be found by analyzing the relationship between customers with high transaction frequency.

[0082] The graph computing also applies one or more of random walks, Node2Vec, DeepWalk, isolation forest and density clustering algorithms in the visualization graph structure. Among them, random walks are used to sample node paths in the graph to generate a customer's trading habit graph. The main process includes: starting a random walk from a certain customer node; gradually randomly selecting the next node on the graph, walking according to the specified step size, and selecting the path based on unbiased or weighted probability to control the access frequency of certain nodes during the walk, helping to discover the common trading behavior patterns of customers; repeating the above process to generate multiple paths, through multiple sampling, the customer's trading behavior data in the graph can be obtained, and these paths provide data support for subsequent graph embedding; the generated paths reflect the customer's transaction links and associations, and are used to train the graph embedding model to construct the customer's behavior feature map.

[0083] Isolation forest can be used to detect abnormal subgraphs in a graph, that is, to detect abnormal transaction behaviors and relationship chains. The input data is low-dimensional vector data after graph embedding, and the customer nodes and their associated transaction relationships are encoded into the isolation forest model. Isolation forest generates multiple random decision trees based on randomly selected features and splitting processes, and calculates the path length of each customer node. If a node is always separated early in the path in different trees, it is considered that the node has high "isolation" and is more likely to be an anomaly. Nodes are scored according to the path length, and those with higher scores are potential abnormal nodes. These abnormal subgraphs can reveal suspicious transaction patterns or abnormal relationship chains.

[0084] Step 4: Construct a suspicious group identification model to identify the core transaction structure of the transaction structure diagram, analyze the capital flow route and perform group risk scoring.

[0085] The identification steps of the suspicious gang identification model are as follows:

[0086] Obtain suspicious customers. Use social network analysis algorithms to analyze the information metrics of each node in the transaction structure diagram and obtain key transaction hub nodes.

[0087] The K-Cores algorithm is used to implement key sub-network analysis, and the minimum spanning tree algorithm is used to find the edges in the transaction structure graph that maintain the least connectivity, and obtain the core transaction structure.

[0088] The time series algorithm is used to analyze the time attributes of the transaction structure diagram, the shortest path algorithm is used to find the most direct intermediary between suspicious transaction individuals, and the minimum spanning tree algorithm is used to obtain the core transaction route. The time series algorithm of this embodiment adopts the LSTM (Long Short-Term Memory) algorithm.

[0089] The shortest path algorithm of this embodiment is the SPFA (Shortest Path Faster Algorithm) algorithm, and the implementation process is as follows:

[0090] Weights are set for the edges of the transaction structure graph; weights can be set in the following ways: higher transaction frequencies can be considered as paths with smaller weights (or higher risks); larger amounts can be given lower weights because transactions with larger amounts usually require priority attention; if transactions occur in inconsistent geographical locations, the weights can be increased to show the potential risk of geographical changes.

[0091] The minimum spanning tree algorithm for obtaining the core transaction route in this embodiment is one of the Prim and Kruskal algorithms. For the Kruskal algorithm, all edges are sorted by weight, and then edges are gradually added until all nodes are covered; for the Prim algorithm, starting from an initial node, edges with the smallest weight are continuously selected to extend to other nodes until all nodes are covered. In the structure obtained by the minimum spanning tree, the core transaction path is composed of nodes and edges that connect the most frequent and largest transaction amounts. The minimum spanning tree is structured into a core path starting from the root node and connecting key nodes to identify the key routes in the entire transaction network.

[0092] The risk is calculated for each transaction within a set time period according to the set rules, and the risk is quantified into the group's risk score.

[0093] Select the source suspicious individual and the target suspicious individual, and set the initial path weights of all nodes to infinity.

[0094] Use the queue-optimized relaxation operation to traverse the edges in the transaction structure graph and update the shortest path weight and path nodes from the start point to the end point.

[0095] After finding the shortest path from source to target, the nodes in the path are extracted to identify the direct intermediaries between two suspicious individuals.

[0096] The suspicious group identification model mainly uses the above data to analyze transaction flow data such as transaction time, transaction volume, and transaction amount. The risk is calculated for each transaction in a short period of time, and the risk is quantified into a score. The corresponding percentile chart is drawn to divide the risk level of the community according to different percentile ranges. It can be divided into four levels according to the quartiles: Level 1: ultra-high risk; Level 2: extremely high risk; Level 3: high risk; Level 4: risky. The scoring results can be handed over to the review department for further manual investigation.

[0097] Step 5: Build a report generation model to generate a suspicious customer analysis report that meets the reporting requirements based on the identification results of the suspicious customer identification model, the suspicious features in the transaction structure diagram, and the identification results of the suspicious group identification model.

[0098] The report generation model is a large language model, which is fine-tuned through Lora technology. The enhanced data used for fine-tuning includes historical anti-money laundering case analysis, industry reports, professional terminology and rule standards.

[0099] The anti-money laundering model conducts comprehensive analysis and judgment based on the suspicious or non-suspicious characteristics of suspicious customers, whether they are involved in a crime, the type of crime involved, and other information, and generates an analysis report that conforms to the logic of anti-money laundering experts according to the learned analysis logic. Audit analysts can review, fine-tune and supplement the reports automatically generated by the big model to generate a more reasonable analysis report. The overall process is divided into two stages: the anti-money laundering big model training stage and the anti-money laundering report generation stage.

[0100] In the model training phase, excellent anti-money laundering reports are collected to construct a supervised data set for training the anti-money laundering report generation model. Each piece of data contains input data and expected output. The input data consists of two parts:

[0101] Input elements include various suspicious or non-suspicious characteristics of suspicious customers, whether they are involved in a crime, the type of crime involved, and other data;

[0102] Prompt is the instruction given to the big model. In simple terms, it is what task you want the big model to do and what purpose you want it to achieve. Here, our task and purpose is to generate an excellent anti-money laundering report. Therefore, the quality inspection and scoring standards for suspicious transaction reports and non-suspicious transaction reports can be used as prompts to instruct the big model.

[0103] Expected outputs and expected anti-money laundering reports, including anti-money laundering transaction customers and non-suspicious transaction customers analysis reports.

[0104] Through fine-tuning training on the above supervised data set, the large model has learned the ability to generate anti-money laundering reports: based on the given suspicious transaction information (various suspicious or non-suspicious characteristics of suspicious customers, whether they are involved in a crime, the type of crime, etc.), it has learned how to follow prompt instructions (quality inspection and scoring standards for suspicious transaction reports and non-suspicious transaction reports) and generate excellent anti-money laundering reports.

[0105] In the model reasoning stage (i.e. the money laundering suspicion report generation stage), the input elements are spliced ​​with the prompt instruction as input data and input into the big model to generate an anti-money laundering report.

[0106] Embodiment 2

[0107] This embodiment is a suspicious customer identification and reporting system based on multivariate data, and the system is used to implement the suspicious customer identification and reporting method as described in the first embodiment, including:

[0108] A data collection module is used to collect customer information, including external data and financial data of customers, and build a customer data set based on the customer information. The external data includes third-party data, public and government data, which are introduced through privacy computing;

[0109] A suspicious customer identification module, used to identify suspicious customers based on the customer data set;

[0110] A graph calculation module, used to identify the transaction structure graph of the suspicious customer and identify suspicious features in the transaction structure graph;

[0111] A suspicious group identification module is used to identify the core transaction structure of the transaction structure diagram, analyze the capital flow route and perform group risk scoring;

[0112] The report generation module is used to generate a suspicious customer analysis report that meets the reporting requirements based on the identification results of the suspicious customer identification model, the suspicious features in the transaction structure diagram, and the identification results of the suspicious gang identification model; the report generation model is a large language model fine-tuned by Lora technology, and the enhanced data used for fine-tuning includes anti-money laundering case analysis, industry reports, professional terminology and rule standards over the years.

[0113] The above is only a preferred embodiment of the present invention. It should be pointed out that a person skilled in the art can make several modifications and improvements without departing from the inventive concept of the present invention, which all belong to the protection scope of the present invention.

Claims

1. A suspicious customer identification and reporting method based on multivariate data, characterized in that: The following steps are involved: Acquire customer information, including external data and financial data of the customer, and construct a customer data set based on the customer information; Building a suspicious customer identification model, and using the customer data set to identify suspicious customers; Identify the transaction structure graph of the suspicious customer through graph computing, and identify suspicious features in the transaction structure graph; Constructing a suspicious group identification model to identify the core transaction structure of the transaction structure diagram, analyze the capital flow route and perform group risk scoring; Build a report generation model to generate a suspicious customer analysis report that meets the reporting requirements based on the identification results of the suspicious customer identification model, the suspicious features in the transaction structure diagram, and the identification results of the suspicious gang identification model.

2. The suspicious customer identification and reporting method based on multivariate data according to claim 1 is characterized in that: The external data includes third-party data, public and government data, which are introduced through privacy computing; the third-party data includes the customer's operator data and water, electricity, gas and other fee data; the public and government data includes the customer's provident fund payment level, medical insurance payment level, maternity insurance payment level, pension insurance payment level, work-related injury insurance payment level and unemployment insurance payment level.

3. The suspicious customer identification and reporting method based on multivariate data according to claim 2 is characterized in that: The method for constructing the customer data set is: Conduct time series analysis on financial data to extract abnormal transaction behavior characteristics of customers; Perform feature encoding to convert categorical variables into numerical values; Identify abnormal and frequently changing data in third-party data and identify abnormal third-party characteristics; Build risk profiles of clients through public and government data.

4. The suspicious customer identification and reporting method based on multivariate data according to claim 1 is characterized in that: The method for constructing the suspicious customer identification model is specifically as follows: Use historically marked suspicious customer data as positive samples and normal customers as negative samples; Build and train a binary classification model using the training set, and use the validation set to check the accuracy and generalization of the model; The data to be predicted is input into the trained binary classification model, and the SHAP value is used to analyze the impact of each feature on the model prediction, and the customer score, suspicious features, non-suspicious features and suspicious types are output.

5. The suspicious customer identification and reporting method based on multivariate data according to claim 1 is characterized in that: The processing flow of the graph calculation is as follows: Graphical modeling is performed based on customer data sets, and various entities and corresponding relationships are represented in the graph to build a visual graph structure based on multidimensional data. The nodes in the graph represent entities, including customers, trading accounts, companies, and financial institutions, and the edges in the graph represent the relationships between entities, including transfers, joint holdings, business dealings, and upstream and downstream cooperation relationships. Use social network analysis methods to identify customer-customer, customer-company, and upstream-downstream relationship chains, and analyze potential suspicious behaviors in customers’ social networks; Use the feature information in the graph to identify abnormal nodes or subgraph structures, including frequently associated nodes, high-risk link detection, and abnormal transaction patterns; Analyze the shortest path or maximum traffic path between customers and identify high-risk nodes and strongly connected nodes.

6. The suspicious customer identification and reporting method based on multivariate data according to claim 5 is characterized in that: The graph computing also applies one or more of random walk, Node2Vec, DeepWalk, isolation forest and density clustering algorithms to visualize the graph structure.

7. The suspicious customer identification and reporting method based on multivariate data according to claim 1 is characterized in that: The identification steps of the suspicious gang identification model are as follows: Acquire suspicious customers; Use social network analysis algorithms to analyze the information metrics of each node in the transaction structure graph and obtain key transaction hub nodes; Use the K-Cores algorithm to implement key sub-network analysis, and use the minimum spanning tree algorithm to find the edges in the transaction structure graph that maintain the least connectivity, and obtain the core transaction structure; Use the time series algorithm to analyze the time attributes of the transaction structure graph, use the shortest path algorithm to find the most direct intermediary between suspicious transaction individuals, and use the minimum spanning tree algorithm to obtain the core transaction route; The risk is calculated for each transaction within a set time period according to the set rules, and the risk is quantified into the group's risk score.

8. The suspicious customer identification and reporting method based on multivariate data according to claim 7 is characterized in that: The shortest path algorithm is the SPFA algorithm, and the implementation process is as follows: Set weights for the edges of the transaction structure graph; Select the source suspicious individual and the target suspicious individual, and set the initial path weights of all nodes to infinity; Use the queue-optimized relaxation operation to traverse the edges in the transaction structure graph and update the shortest path weight and path nodes from the start point to the end point; After finding the shortest path from source to target, the nodes in the path are extracted to identify the direct intermediaries between two suspicious individuals.

9. The suspicious customer identification and reporting method based on multivariate data according to claim 1 is characterized in that: The report generation model is a large language model, which is fine-tuned through Lora technology. The enhanced data used for fine-tuning includes historical anti-money laundering case analysis, industry reports, professional terminology and rule standards.

10. The suspicious customer identification and reporting system based on multivariate data is characterized by: The system is used to implement the suspicious customer identification and reporting method according to any one of claims 1 to 9, including: A data collection module is used to collect customer information, including external data and financial data of customers, and build a customer data set based on the customer information. The external data includes third-party data, public and government data, which are introduced through privacy computing; A suspicious customer identification module, used to identify suspicious customers based on the customer data set; A graph calculation module, used to identify the transaction structure graph of the suspicious customer and identify suspicious features in the transaction structure graph; A suspicious group identification module is used to identify the core transaction structure of the transaction structure diagram, analyze the capital flow route and perform group risk scoring; The report generation module is used to generate a suspicious customer analysis report that meets the reporting requirements based on the identification results of the suspicious customer identification model, the suspicious features in the transaction structure diagram, and the identification results of the suspicious gang identification model; the report generation model is a large language model fine-tuned by Lora technology, and the enhanced data used for fine-tuning includes anti-money laundering case analysis, industry reports, professional terminology and rule standards over the years.

Images