Suspicious customer identification and reporting method and system based on multivariate data

Abstract

The present invention discloses a suspicious customer identification and reporting method and system based on multivariate data, comprising the following steps: obtaining customer information, including external and financial data, and constructing a customer dataset based on the customer information; constructing a suspicious customer identification model and using the customer dataset to identify suspicious customers; identifying the transaction structure graph of the suspicious customer through graph computing and identifying suspicious features within the transaction structure graph; constructing a suspicious group identification model to identify the core transaction structure of the transaction structure graph, analyze capital flow routes, and perform group risk scoring; and constructing a report generation model to generate a suspicious customer analysis report that meets reporting requirements based on the identification results of the suspicious customer identification model, the suspicious features within the transaction structure graph, and the identification results of the suspicious group identification model. This invention can improve the accuracy of suspicious customer identification and the efficiency of reporting report generation.

Description

Technical Field

[0001] The present invention belongs to the technical field of financial risk management, and in particular relates to a method and system for identifying and reporting suspicious customers based on multivariate data. Background Art

[0002] In today's complex financial and social environment, effective anti-money laundering (AML) efforts have become both crucial and challenging. AML refers to the identification and prevention of money laundering activities, preventing illicit funds from flowing into the normal economic system, and safeguarding the stability and security of the financial system. The three most problematic stages of bank AML work are: the development of suspicious customer monitoring models, the analysis of suspicious customers, and the preparation of AML analysis reports. During the analysis phase, existing AML work relies on a vast customer base, requiring the management of tens of thousands of suspicious customers and the investigation of tens of thousands of suspicious transactions annually. Traditional AML processes are complex, requiring multi-dimensional identification across multiple systems and incomplete data elements, making customer investigations time-consuming and labor-intensive. Furthermore, compliance officers must conduct detailed analysis, research, and cross-checking. The average processing time for a single AML report can be measured in days, significantly increasing the burden and complexity of AML work.

[0003] For example, the Chinese invention patent application with publication number CN117217881A discloses a risk monitoring method and device based on customer characteristics, which includes: obtaining customer information; performing target identity identification on the customer information, and extracting data when the identity identification is passed to obtain target customer information; inputting the target customer information into a suspicious transaction monitoring model to obtain a customer risk determination result output by the suspicious transaction monitoring model; wherein the suspicious transaction monitoring model is constructed based on a pre-acquired risk feature set; the risk feature set includes risk features of customers with money laundering risks; the suspicious transaction monitoring model determines whether the corresponding target customer has money laundering risks based on the target customer information and the risk feature set.

[0004] The aforementioned solution uses suspicious transaction monitoring models to assess customer risk. However, these issues include incomplete non-over-the-counter monitoring technology and data products, a lack of technical data sharing for monitoring models and forecasting tools across institutions, a lack of horizontal networking between supervisory departments and institutions, and inaccurate customer profiles within individual institutions. This results in an incomplete picture of customers, which in turn affects the accuracy of customer identification. Furthermore, after identifying suspicious customers involved in money laundering or fraud, financial institutions face the task of generating detailed analytical reports based on the identification results and submitting them to regulatory authorities. This task has long been handled by compliance specialists through detailed analysis, investigation, and reporting, with an average processing time measured in days, significantly increasing the burden and complexity of anti-money laundering efforts. Summary of the Invention

[0005] The present invention provides a suspicious customer identification and reporting method and system based on multivariate data, aiming to solve the problems of the prior art in insufficient accuracy in identifying customers and low efficiency in generating and submitting reports.

[0006] To solve the above technical problems, the present invention proposes a suspicious customer identification and reporting method, comprising the following steps:

[0007] Acquire customer information, including external data and financial data of the customer, and construct a customer dataset based on the customer information;

[0008] Building a suspicious customer identification model and identifying suspicious customers using the customer dataset;

[0009] Identify the transaction structure graph of the suspicious customer through graph computing, and identify suspicious features in the transaction structure graph;

[0010] Constructing a suspicious group identification model to identify the core transaction structure of the transaction structure diagram, analyze capital flow routes, and perform group risk scoring;

[0011] Build a report generation model to generate a suspicious customer analysis report that meets the reporting requirements based on the identification results of the suspicious customer identification model, the suspicious features in the transaction structure diagram, and the identification results of the suspicious gang identification model.

[0012] Preferably, the external data includes third-party data, public and government data, which are introduced through privacy computing; the third-party data includes the customer's operator data and water, electricity, gas and other fee data, and the public and government data includes the customer's provident fund payment level, medical insurance payment level, maternity insurance payment level, pension insurance payment level, work-related injury insurance payment level and unemployment insurance payment level.

[0013] Preferably, the method for constructing the customer data set is:

[0014] Conduct time series analysis on financial data to extract abnormal transaction behavior characteristics of customers; perform feature encoding to convert categorical variables into numerical values;

[0015] Identify abnormal and frequently changing data in third-party data and identify abnormal third-party characteristics;

[0016] Build risk profiles of clients through public and government data.

[0017] Preferably, the method for constructing the suspicious customer identification model is specifically as follows:

[0018] Use historically labeled suspicious customer data as positive samples and normal customers as negative samples;

[0019] Build and train a binary classification model using the training set, and use the validation set to check the accuracy and generalization of the model;

[0020] The data to be predicted is input into the trained binary classification model, and the SHAP value is used to analyze the impact of each feature on the model prediction, and the customer score, suspicious features, non-suspicious features and suspicious types are output.

[0021] Preferably, the processing flow of the graph calculation is:

[0022] Graphical modeling is performed based on customer datasets, representing various entities and their corresponding relationships in a graph, building a visual graph structure based on multidimensional data. The nodes in the graph represent entities, including customers, transaction accounts, companies, and financial institutions, while the edges in the graph represent the relationships between entities, including transfers, joint holdings, business transactions, and upstream and downstream partnerships.

[0023] Use social network analysis methods to identify customer-customer, customer-company, and upstream-downstream relationship chains, and analyze potential suspicious behaviors in customers' social networks;

[0024] Use the characteristic information in the graph to identify abnormal nodes or subgraph structures, including frequently associated nodes, high-risk link detection, and abnormal transaction patterns;

[0025] Analyze the shortest path or maximum traffic path between customers and identify high-risk nodes and strong connection nodes.

[0026] Preferably, the graph calculation also applies one or more of random walk, Node2Vec, DeepWalk, isolation forest and density clustering algorithms to the visual graph structure.

[0027] Preferably, the identification steps of the suspicious gang identification model are as follows:

[0028] Acquire suspicious customers;

[0029] Use social network analysis algorithms to analyze the information metrics of each node in the transaction structure graph and obtain key transaction hub nodes;

[0030] Use the K-Cores algorithm to analyze key subnetworks and the minimum spanning tree algorithm to find the edges with the least connectivity in the transaction structure graph and obtain the core transaction structure.

[0031] Use the time series algorithm to analyze the time attributes of the transaction structure graph, use the shortest path algorithm to find the most direct intermediary between suspicious transaction individuals, and use the minimum spanning tree algorithm to obtain the core transaction route;

[0032] The risk is calculated for each transaction within a set time period according to the set rules, and the risk is quantified into a risk score for the group.

[0033] Preferably, the shortest path algorithm is the SPFA algorithm, and the implementation process is as follows:

[0034] Set weights for the edges of the transaction structure graph;

[0035] Select the source suspicious individual and the target suspicious individual, and set the initial path weights of all nodes to infinity;

[0036] Use the queue-optimized relaxation operation to traverse the edges in the transaction structure graph and update the shortest path weight and path nodes from the start point to the end point;

[0037] After finding the shortest path between the source and the target, the nodes in the path are extracted to identify the direct intermediaries between the two suspicious individuals.

[0038] Preferably, the report generation model is a large language model, which is fine-tuned by Lora technology, and the enhanced data used for fine-tuning includes historical anti-money laundering case analysis, industry reports, professional terminology and rule standards.

[0039] Another aspect of the present invention further provides a suspicious customer identification and reporting system based on multivariate data. The system is used to implement the above-mentioned suspicious customer identification and reporting method, comprising:

[0040] A data collection module is used to collect customer information, including external data and financial data of customers, and build a customer data set based on the customer information. The external data includes third-party data, public and government data, which is introduced through privacy computing;

[0041] a suspicious customer identification module, configured to identify suspicious customers based on the customer data set;

[0042] A graph calculation module, configured to identify a transaction structure graph of the suspicious customer and identify suspicious features in the transaction structure graph;

[0043] A suspicious group identification module is used to identify the core transaction structure of the transaction structure diagram, analyze the capital flow route, and perform group risk scoring;

[0044] The report generation module is used to generate a suspicious customer analysis report that meets the reporting requirements based on the identification results of the suspicious customer identification model, the suspicious features in the transaction structure diagram, and the identification results of the suspicious gang identification model. The report generation model is a large language model fine-tuned by Lora technology. The enhanced data used for fine-tuning includes anti-money laundering case analysis, industry reports, professional terminology and rules and standards over the years.

[0045] Compared with the prior art, the present invention has the following technical effects:

[0046] 1. The suspicious customer identification method proposed in this invention introduces external data through privacy computing and combines it with internal financial data to identify suspicious customers, which can enrich customer portraits and improve the accuracy of customer identification.

[0047] 2. The suspicious customer identification method proposed in the present invention identifies suspicious customers through the constructed suspicious customer identification model, graph computing module and suspicious group identification model, which can effectively improve the accuracy and efficiency of suspicious customer identification.

[0048] 3. The suspicious customer reporting method proposed in this invention fine-tunes a large language model, constructs a prompt, and combines the model's output with a recognition model and relationship chain analysis results. The large model for generating anti-money laundering analysis reports comprehensively analyzes information such as suspicious or non-suspicious characteristics of suspicious customers, whether they are involved in a crime, the type of crime involved, and the relationships between customers. Based on the learned analysis logic, it generates an analysis report that conforms to the business logic of anti-money laundering experts. This effectively improves the efficiency of report generation and reduces labor costs. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 It is a flow chart of the suspicious customer identification and reporting method of the present invention. DETAILED DESCRIPTION

[0050] In order to make the objectives, technical solutions and advantages of the present invention more clear, the technical solutions of the present invention will be clearly and completely described below in combination with specific embodiments of the present application and with reference to the accompanying drawings.

[0051] Example 1

[0052] like Figure 1 As shown, the suspicious customer identification and reporting method based on multivariate data includes the following steps 1 to 5:

[0053] Step 1: Obtain customer information, including external and financial data, and construct a customer dataset based on this information. Financial data refers to the customer data owned by the financial institution itself, including personal information submitted by the customer, as well as data stored by the financial institution, such as customer ID, customer mobile number, transaction channel, transaction type, transaction object, transaction object type, transaction time, transaction amount, account opening time, transaction notes, percentage of transactions at unusual times, percentage of transactions involving specific services, and percentage of transactions with specific customers.

[0054] The external data includes third-party data, public and government data, which are introduced through privacy computing. Privacy computing technologies generally include multi-party secure computing (MPC), homomorphic encryption, federated learning and other methods. Through these technologies, financial institutions and data holders can encrypt or split data to ensure the security of data during the calculation process. Data holders (such as operators or water, electricity, gas and other companies) can encrypt customer data and store it in a distributed manner. Financial institutions can perform calculations and analyses on the encrypted data without directly accessing the original data. The third-party data includes the customer's operator data and water, electricity and gas fee data, and the public and government data includes the customer's provident fund payment level, medical insurance payment level, maternity insurance payment level, pension insurance payment level, work-related injury insurance payment level and unemployment insurance payment level.

[0055] Specifically, the method for constructing the customer dataset is:

[0056] Conduct time series analysis on transaction data to extract characteristics of abnormal customer transaction behavior (e.g., the proportion of abnormal transaction times, the proportion of transactions involving specific businesses or customers, etc.). At the same time, perform feature encoding to convert categorical variables (e.g., transaction type, transaction channel) into numerical values.

[0057] Identify abnormally frequent changes in third-party data and identify abnormal third-party characteristics. For example, use information such as IP addresses and MAC addresses to determine whether there are abnormally frequent changes, and use this as a feature to identify possible suspicious transactions.

[0058] Build a risk profile of the customer through public and government data such as the customer's social security level, payment status and other information.

[0059] In other embodiments of the present invention, after the data preprocessing is completed, feature engineering is performed to generate new features such as transaction frequency, amount fluctuation, transaction partner network, etc. By generating new features from the original data, feature engineering can enable the model to more accurately identify potential abnormal patterns.

[0060]

[0061] Table 1 Transaction data example

[0062] The specific feature engineering method uses the sample data in Table 1 as an example. First, calculate the transaction frequency, which measures the number or total amount of transactions a customer makes within a specific time period. Assuming a one-week time window, calculate the number and total amount of transactions for each customer each week. For customer A001, the transaction frequency from October 1st to October 7th was 2, with a total amount of 12,000 yuan; the transaction frequency from October 8th to October 15th was 2, with a total amount of 25,000 yuan.

[0063] Next, we calculate the fluctuation characteristics of transaction amounts, which reflect changes in customer transaction amounts. Abnormal fluctuations in transaction amounts may indicate scattered transactions that are part of money laundering (for example, a small, regular transfer suddenly becomes a large one). For each customer, we calculate the average transaction amount. Within a window or a specific time period, we calculate the standard deviation of the transaction amount. The coefficient of variation (CV) = standard deviation / average is used to assess the magnitude of fluctuation. Customers with a larger CV have higher volatility. Suppose we calculate the average and standard deviation of customer A001's transaction amounts in October. Average amount = (5,000 + 7,000 + 15,000 + 10,000) / 4 = 9,250. Assuming the calculated result is 4,000 yuan, the CV is 4,000 / 9,250 ≈ 0.43.

[0064] The trading partnership network then constructs the network relationships between customers and their trading counterparties. Using network metrics from Social Network Analysis (SNA), such as node degree and network density, we can explore the characteristics of customers' trading behaviors. Each customer and trading counterparty is considered a node in the network graph, and trading behaviors are considered edges. For each customer, the number of their trading partners (node ​​degree) is calculated to measure the customer's connectivity with other accounts. The network density of a customer and their trading counterparties is calculated to reflect the closeness of the customer's social network. For example, customer A001's trading partners are B001, B002, and C001, with a node degree of 3. Assuming that A001's relationship network density is 0.5, this indicates that their trading relationships are relatively close.

[0065] The abnormal transaction ratio is then calculated to measure the proportion of a customer's abnormal transaction count or amount in their total transactions. This is a key feature in money laundering detection. Abnormal transactions are flagged based on rules such as transaction type and amount threshold. The abnormal transaction ratio is calculated by dividing the number or amount of abnormal transactions by the total number or amount of transactions. For example, if customer A001 has a total of four transactions, of which one is abnormal, the abnormal transaction ratio is 1 / 4 = 0.25.

[0066] Finally, after feature engineering is complete, the generated features are integrated into the model input dataset to enhance the model's predictive capabilities. These integrated features may include: transaction frequency (e.g., monthly and weekly transactions); amount volatility (e.g., mean, standard deviation, and coefficient of variation); transaction partnerships (e.g., node degree and network density); and abnormal transaction ratios (e.g., the ratio of abnormal transactions to total transactions).

[0067]

[0068] Table 2 Feature set examples

[0069] An example of the feature set obtained after feature engineering is shown in Table 2.

[0070] Step 2: Build a suspicious customer identification model and use the customer dataset to identify suspicious customers.

[0071] The method for constructing the suspicious customer identification model is specifically as follows:

[0072] Use historically labeled suspicious customer data as positive samples, and normal customers as negative samples. Those skilled in the art will appreciate that data preprocessing is necessary before use, including removing features with high missing rates, interpolating or filling data with fewer missing values, and filtering out obvious anomalous data points, such as highly unreasonable transaction amounts, invalid IP addresses, or MAC addresses. Categorical variables (such as transaction type and counterparty type) are encoded using one-hot encoding or label encoding. Numerical features can also be normalized to ensure model convergence.

[0073] Build and train a binary classification model using the training set, and use the validation set to check the model's accuracy and generalization. Use the aforementioned features and labeled data to perform supervised learning training on the model. Use cross-validation to optimize the model's hyperparameters to improve accuracy and generalization. After the initial model training is complete, business personnel can provide feedback to the model based on the output scores and results to further fine-tune and optimize the model's features and weights.

[0074] The data to be predicted is input into a trained binary classification model. Due to the complexity of suspicious transactions and the compliance requirements of anti-money laundering models, model interpretability analysis is crucial. The SHAP (Shapley Additive Explanations) method can be used to explain the contribution of each feature to the model's prediction results, clarifying suspicious and non-suspicious features. Model output includes: using SHAP values ​​to analyze the impact of each feature on the model's predictions, outputting a customer score (a quantitative score between 0 and 1 that represents the customer's level of suspicion), suspicious characteristics (such as high-value frequent transactions, long-distance transactions, unusual transaction times, etc.), non-suspicious characteristics (such as regular small-value transactions, trustworthy counterparties, etc.), and suspicious types (such as money laundering, terrorist financing, etc.).

[0075] After the model generates a score, business personnel can review and score the result based on their professional judgment, and provide feedback to the model for continued training and adjustment of the model's feature weights. This feedback mechanism helps the model continuously optimize in subsequent iterations to achieve higher accuracy and interpretability.

[0076] Step three: Identify the transaction structure graph of the suspicious customer through graph computing, and identify suspicious features in the transaction structure graph.

[0077] The processing flow of the graph calculation is as follows:

[0078] Graphical modeling is performed based on customer datasets, representing various entities and their corresponding relationships within a graph, creating a visual graph structure based on multidimensional data. Nodes in the graph represent entities, including customers, transaction accounts, companies, and financial institutions, while edges represent relationships between entities, including transfers, joint holdings, business dealings, and upstream and downstream collaborations. Specifically, the model includes customer nodes, transaction nodes, account nodes, and relationship edges. Customer nodes contain basic customer attributes, such as customer ID, name, contact information, and location. Transaction nodes represent single transaction events, recording information such as transaction ID, transaction amount, transaction time, and transaction type. Account nodes include bank accounts, securities accounts, and payment accounts. Relationship edges represent transfers between customers, joint projects or companies, and business relationships with upstream suppliers and downstream customers. By mapping these entities and events into nodes and edges, a visual graph structure based on multidimensional data, such as financial, social, and financial data, can be constructed. This data can be stored in graph databases (such as Neo4j and TigerGraph), and the relationships between these data can be displayed through node and edge relationships.

[0079] Use social network analysis (SNA) to identify customer-to-customer, customer-to-company, and upstream-to-downstream relationships, analyzing potentially suspicious behavior within customers' social networks. Specifically, metrics such as degree centrality, closeness centrality, and betweenness centrality can be used to identify the most critical customers and relationships within the network. Community discovery algorithms (such as Louvain or Label Propagation) can also be used to identify potential illegal groups and capital flow groups.

[0080] Using graph feature information, we identify abnormal nodes or subgraph structures, including frequently associated nodes, high-risk link detection, and abnormal transaction patterns. Anomaly detection encompasses the following dimensions: Frequently associated nodes, such as frequent fund flows between customers, even forming closed loops or mesh structures, may indicate money laundering; high-risk link detection: Certain transaction chains with high node concentration or unusually active transactions warrant close monitoring; and abnormal transaction patterns: Frequent transactions between a customer's trading account and multiple high-risk accounts, or unusual changes in transaction volume, can be identified as potentially suspicious activity.

[0081] Analyze the shortest paths or maximum flow paths between customers to identify high-risk nodes and strongly connected nodes. The shortest paths or maximum flow paths can be identified using shortest path algorithms to find the capital flow path between two customers. Strongly connected nodes can be identified by analyzing relationships between customers with high transaction frequency.

[0082] The graph computing also applies one or more of the following algorithms: Random Walks, Node2Vec, DeepWalk, Isolation Forest, and Density Clustering in the visualization graph structure. Among them, Random Walk is used to sample node paths in the graph to generate a customer's trading habit graph. The main process includes: starting a random walk from a certain customer node; gradually randomly selecting the next node on the graph and walking according to the specified step size. The path can be selected based on unbiased or weighted probability, and the access frequency of certain nodes during the walk can be controlled to help discover the common trading behavior patterns of customers; repeating the above process to generate multiple paths. Through multiple sampling, the customer's trading behavior data in the graph can be obtained. These paths provide data support for subsequent graph embedding; the generated paths reflect the customer's transaction links and associations, and are used to train the graph embedding model to construct the customer's behavioral feature map.

[0083] Isolation Forest can be used to detect anomalous subgraphs within a graph, specifically unusual transaction behaviors and relationship chains. The input data is low-dimensional vector data after graph embedding. Customer nodes and their associated transaction relationships are encoded into the Isolation Forest model. Based on randomly selected features and a splitting process, Isolation Forest generates multiple randomized decision trees and calculates the path length for each customer node. If a node is consistently separated early in the path across different trees, it is considered highly isolated and likely an outlier. Nodes are scored based on path length, with those with higher scores indicating potential anomalous nodes. These anomalous subgraphs can reveal suspicious transaction patterns or unusual relationship chains.

[0084] Step 4: Build a suspicious group identification model to identify the core transaction structure of the transaction structure diagram, analyze the capital flow route, and perform group risk scoring.

[0085] The identification steps of the suspicious gang identification model are as follows:

[0086] Identify suspicious customers. Use social network analysis algorithms to analyze the information metrics of each node in the transaction structure graph and identify key transaction hub nodes.

[0087] The K-Cores algorithm is used to analyze key subnetworks, and the minimum spanning tree algorithm is used to find the edges that maintain the least connectivity in the transaction structure graph to obtain the core transaction structure.

[0088] The time series algorithm is used to analyze the time attributes of the transaction structure diagram, the shortest path algorithm is used to find the most direct intermediary between suspicious transaction individuals, and the minimum spanning tree algorithm is used to obtain the core transaction route. The time series algorithm of this embodiment adopts the LSTM (Long Short-Term Memory) algorithm.

[0089] The shortest path algorithm of this embodiment is the SPFA (Shortest Path Faster Algorithm) algorithm, and the implementation process is as follows:

[0090] Weights are set for the edges of the transaction structure graph. Weights can be set in the following ways: higher transaction frequencies can be considered as paths with lower weights (or higher risks); larger amounts can be given lower weights because transactions with larger amounts usually require priority attention; if transactions occur in inconsistent geographical locations, the weights can be increased to indicate the potential risk of geographical changes.

[0091] The minimum spanning tree algorithm used in this embodiment to obtain the core transaction route is one of the Prim and Kruskal algorithms. For the Kruskal algorithm, all edges are sorted by weight, and then edges are gradually added until all nodes are covered; for the Prim algorithm, starting from an initial node, edges with the smallest weight are continuously selected and extended to other nodes until all nodes are covered. In the structure obtained by the minimum spanning tree, the core transaction path is composed of nodes and edges connecting the most frequent and largest transaction amounts. The minimum spanning tree is structured into a core path starting from the root node and connecting key nodes to identify the key routes in the entire transaction network.

[0092] The risk is calculated for each transaction within a set time period according to the set rules, and the risk is quantified into a risk score for the group.

[0093] Select the source suspicious individual and the target suspicious individual, and set the initial path weights of all nodes to infinity.

[0094] Use the queue-optimized relaxation operation to traverse the edges in the transaction structure graph and update the shortest path weight and path nodes from the start point to the end point.

[0095] After finding the shortest path between the source and the target, the nodes in the path are extracted to identify the direct intermediaries between the two suspicious individuals.

[0096] The suspicious group identification model primarily utilizes the aforementioned data to analyze transaction flow data, including transaction time, volume, and amount. The model calculates risk for each transaction within a short timeframe, quantifies the risk into a score, and plots corresponding percentiles. The risk level of the group is then assigned based on the percentile range. Quartiles allow for four levels: Level 1: Ultra-High Risk; Level 2: Extremely High Risk; Level 3: High Risk; and Level 4: Risky. The scoring results are then submitted to the review department for further manual investigation.

[0097] Step 5: Build a report generation model to generate a suspicious customer analysis report that meets the reporting requirements based on the identification results of the suspicious customer identification model, the suspicious features in the transaction structure diagram, and the identification results of the suspicious group identification model.

[0098] The report generation model is a large language model, which is fine-tuned using Lora technology. The enhanced data used for fine-tuning includes historical anti-money laundering case analysis, industry reports, professional terminology, and rule standards.

[0099] The AML model conducts a comprehensive analysis based on information such as suspicious or non-suspicious characteristics, criminal involvement, and the type of crime. It then generates an analysis report based on the learned analysis logic, consistent with the logic of AML experts. Auditors and analysts can review, fine-tune, and supplement the report automatically generated by the model to produce a more comprehensive analysis report. The overall process consists of two phases: AML model training and AML report generation.

[0100] During the model training phase, we collected excellent anti-money laundering reports and constructed a supervised dataset for training the anti-money laundering report generation model. Each data entry contains input data and expected output. The input data consists of two parts:

[0101] Input factors include various suspicious or non-suspicious characteristics of suspicious customers, whether they are involved in a crime, and the type of crime involved;

[0102] Prompts are instructions to the big model. Simply put, they describe the tasks we want the big model to perform and the goals we want it to achieve. In this case, our task and goal is to generate excellent anti-money laundering reports. Therefore, we can use the quality inspection and scoring criteria for suspicious transaction reports and non-suspicious transaction reports as prompts to instruct the big model.

[0103] Expected outputs and expected anti-money laundering reports, including analysis reports on anti-money laundering transaction customers and non-suspicious transaction customers.

[0104] Through fine-tuning training on the above supervised dataset, the large model has learned the ability to generate anti-money laundering reports: based on given suspicious transaction information (various suspicious or non-suspicious characteristics of suspicious customers, whether they are involved in a crime, the type of crime, and other data), it has learned how to follow prompt instructions (quality inspection and scoring standards for suspicious transaction reports and non-suspicious transaction reports) to generate excellent anti-money laundering reports.

[0105] In the model inference stage (i.e., the money laundering suspicion report generation stage), the input elements are spliced ​​with the prompt instruction as input data and input into the large model to generate an anti-money laundering report.

[0106] Example 2

[0107] This embodiment is a suspicious customer identification and reporting system based on multivariate data. The system is used to implement the suspicious customer identification and reporting method described in Example 1, including:

[0108] A data collection module is used to collect customer information, including external data and financial data of customers, and build a customer data set based on the customer information. The external data includes third-party data, public and government data, which is introduced through privacy computing;

[0109] a suspicious customer identification module, configured to identify suspicious customers based on the customer data set;

[0110] A graph calculation module, configured to identify a transaction structure graph of the suspicious customer and identify suspicious features in the transaction structure graph;

[0111] A suspicious group identification module is used to identify the core transaction structure of the transaction structure diagram, analyze the capital flow route, and perform group risk scoring;

[0112] The report generation module is used to generate a suspicious customer analysis report that meets the reporting requirements based on the identification results of the suspicious customer identification model, the suspicious features in the transaction structure diagram, and the identification results of the suspicious gang identification model. The report generation model is a large language model fine-tuned by Lora technology. The enhanced data used for fine-tuning includes anti-money laundering case analysis, industry reports, professional terminology and rules and standards over the years.

[0113] The above description is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this field, several variations and improvements can be made without departing from the creative concept of the present invention, which all fall within the scope of protection of the present invention.

Claims

1. A suspicious customer identification and reporting method based on multivariate data, characterized in that: The following steps are involved: Obtain customer information, including external and financial data, and build a customer dataset based on the customer information; the external data includes third-party data, public and government data, which is introduced through privacy computing; Building a suspicious customer identification model and identifying suspicious customers using the customer dataset; Identify the transaction structure graph of the suspicious customer through graph computing, and identify suspicious features in the transaction structure graph; A suspicious group identification model is constructed to identify the core transaction structure of the transaction structure diagram, analyze the capital flow route, and perform group risk scoring. The identification steps of the suspicious group identification model are as follows: Identify suspicious customers; use a social network analysis algorithm to analyze the information metrics of each node in the transaction structure graph to identify key transaction hub nodes; use the K-Cores algorithm to perform key subnetwork analysis, and use the minimum spanning tree algorithm to find the edges that maintain the least connectivity in the transaction structure graph to obtain the core transaction structure; use a time series algorithm to analyze the time attributes of the transaction structure graph, use the shortest path algorithm to find the most direct intermediaries between suspicious transaction individuals, and use the minimum spanning tree algorithm to obtain the core transaction route; calculate the risk of each transaction within a set time period according to the set rules, and quantify the risk into a risk score for the group; A report generation model is constructed to generate a suspicious customer analysis report that meets the reporting requirements based on the identification results of the suspicious customer identification model, the suspicious features in the transaction structure diagram, and the identification results of the suspicious gang identification model. The report generation model is a large language model, which is fine-tuned using Lora technology. The enhanced data used for fine-tuning includes historical anti-money laundering case analysis, industry reports, professional terminology, and rules and standards.

2. The suspicious customer identification and reporting method based on multivariate data according to claim 1 is characterized in that: The third-party data includes the customer's operator data and water, electricity, gas and other fee data; the public and government data includes the customer's provident fund payment level, medical insurance payment level, maternity insurance payment level, pension insurance payment level, work-related injury insurance payment level and unemployment insurance payment level.

3. The suspicious customer identification and reporting method based on multivariate data according to claim 2 is characterized in that: The method for constructing the customer dataset is as follows: Conduct time series analysis on financial data to extract abnormal transaction behavior characteristics of customers; Perform feature encoding to convert categorical variables into numerical values; Identify abnormal and frequently changing data in third-party data and identify abnormal third-party characteristics; Build risk profiles of clients through public and government data.

4. The suspicious customer identification and reporting method based on multivariate data according to claim 1 is characterized in that: The method for constructing the suspicious customer identification model is specifically as follows: Use historically labeled suspicious customer data as positive samples and normal customers as negative samples; Build and train a binary classification model using the training set, and use the validation set to check the accuracy and generalization of the model; The data to be predicted is input into the trained binary classification model, and the SHAP value is used to analyze the impact of each feature on the model prediction, and the customer score, suspicious features, non-suspicious features and suspicious types are output.

5. The suspicious customer identification and reporting method based on multivariate data according to claim 1 is characterized in that: The processing flow of the graph calculation is as follows: Graphical modeling is performed based on customer datasets, representing various entities and their corresponding relationships in a graph, building a visual graph structure based on multidimensional data. The nodes in the graph represent entities, including customers, transaction accounts, companies, and financial institutions, while the edges in the graph represent the relationships between entities, including transfers, joint holdings, business transactions, and upstream and downstream partnerships. Use social network analysis methods to identify customer-customer, customer-company, and upstream-downstream relationship chains, and analyze potential suspicious behaviors in customers' social networks; Use the characteristic information in the graph to identify abnormal nodes or subgraph structures, including frequently associated nodes, high-risk link detection, and abnormal transaction patterns; Analyze the shortest path or maximum traffic path between customers and identify high-risk nodes and strong connection nodes.

6. The suspicious customer identification and reporting method based on multivariate data according to claim 5 is characterized in that: The graph computing also applies one or more of random walk, Node2Vec, DeepWalk, isolation forest and density clustering algorithms to visualize the graph structure.

7. The suspicious customer identification and reporting method based on multivariate data according to claim 1 is characterized in that: The shortest path algorithm is the SPFA algorithm, and the implementation process is as follows: Set weights for the edges of the transaction structure graph; Select the source suspicious individual and the target suspicious individual, and set the initial path weights of all nodes to infinity; Use the queue-optimized relaxation operation to traverse the edges in the transaction structure graph and update the shortest path weight and path nodes from the start point to the end point; After finding the shortest path between the source and the target, the nodes in the path are extracted to identify the direct intermediaries between the two suspicious individuals.

8. The suspicious customer identification and reporting system based on multivariate data is characterized by: The system is used to implement the suspicious customer identification and reporting method according to any one of claims 1 to 7, comprising: A data collection module is used to collect customer information, including external data and financial data of customers, and build a customer data set based on the customer information. The external data includes third-party data, public and government data, which is introduced through privacy computing; a suspicious customer identification module, configured to identify suspicious customers based on the customer data set; A graph calculation module, configured to identify a transaction structure graph of the suspicious customer and identify suspicious features in the transaction structure graph; A suspicious group identification module is used to identify the core transaction structure of the transaction structure diagram, analyze the capital flow route, and perform group risk scoring; The report generation module is used to generate a suspicious customer analysis report that meets the reporting requirements based on the identification results of the suspicious customer identification model, the suspicious features in the transaction structure diagram, and the identification results of the suspicious gang identification model. The report generation model is a large language model fine-tuned by Lora technology. The enhanced data used for fine-tuning includes anti-money laundering case analysis, industry reports, professional terminology and rules and standards over the years.

Images