Abnormal transaction network identification method and device, electronic equipment and storage medium

Abstract

The invention discloses an abnormal transaction network identification method and device, electronic equipment and a storage medium, and relates to the field of artificial intelligence or other related technical fields, and the method comprises the steps: obtaining all transaction data sets of a financial institution in a target time period; a transaction network graph is constructed based on the transaction data set, and the transaction network graph is a network graph constructed with transaction subjects as nodes and transaction relations between the transaction subjects as boundaries; inputting the transaction network graph into an abnormal transaction network identification model, and outputting an abnormal transaction network sub-graph; and identifying the abnormal transaction network based on the abnormal transaction network sub-graph. According to the method and the device, the technical problems that a supervised learning method based on expert rules mainly focuses on analyzing transaction information of a single customer or a direct transaction partner of the single customer, and the recognition accuracy of large-scale abnormal transactions is relatively low in related technologies are solved.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence or other related technical fields, and in particular to a method for identifying an abnormal transaction network, a device thereof, an electronic device and a storage medium. Background Art

[0003] In the related technologies, the identification of abnormal transactions such as illegal fund transfers mostly relies on supervised learning methods based on expert rules. These methods mainly focus on analyzing the transaction information of a single customer or his direct trading partners, but it is difficult to fully capture the complex transaction links and patterns of abnormal transactions, resulting in low efficiency and insufficient recognition accuracy for large-scale abnormal transactions.

[0004] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0005] The embodiments of the present invention provide a method for identifying an abnormal transaction network and its device, electronic device and storage medium, so as to at least solve the technical problem in the related art that the supervised learning method based on expert rules mainly focuses on analyzing the transaction information of a single customer or his direct transaction partner, and has a low accuracy rate in identifying large-scale abnormal transactions.

[0006] According to one aspect of an embodiment of the present invention, there is provided a method for identifying an abnormal transaction network, comprising: obtaining a set of all transaction data of a financial institution within a target time period, wherein the transaction data set comprises transaction data of M financial transactions, and the transaction data of each financial transaction comprises at least: a transaction type, a transaction subject, and a transaction amount, wherein the transaction subject represents a user who executes the financial transaction; constructing a transaction network graph based on the transaction data set, wherein the transaction network graph is a network graph constructed with the transaction subjects as nodes and the transaction relationships between the transaction subjects as boundaries; inputting the transaction network graph into an abnormal transaction network identification model, and outputting an abnormal transaction network subgraph, wherein the abnormal transaction network model is a pre-constructed neural network model for identifying large-scale abnormal transactions; and identifying an abnormal transaction network based on the abnormal transaction network subgraph.

[0007] Optionally, the step of constructing a transaction network diagram based on the transaction data set includes: constructing an initial transaction network diagram based on the transaction data set; extracting the transaction behavior characteristic data of the transaction subject, and configuring weight values ​​for each boundary in the initial transaction network diagram based on the transaction behavior characteristic data and the transaction amount to obtain a transaction network diagram.

[0008] Optionally, the step of extracting the transaction behavior characteristic data of the transaction subject includes: obtaining historical transaction data involving the transaction subject from the database of the financial institution; and extracting the transaction behavior characteristic data of the transaction subject within the target time period based on the historical transaction data of the transaction subject and the transaction data within the target time period.

[0009] Optionally, the transaction behavior characteristic data includes at least one of the following: transaction frequency data, common transaction type data, average transaction amount data, and transaction time characteristic data, and the common transaction type data indicates that the transaction subject's usage frequency is greater than a preset frequency threshold.

[0010] Optionally, the step of configuring weight values ​​for each boundary in the initial transaction network diagram based on the transaction behavior characteristic data and the transaction amount includes: matching the transaction behavior characteristic data of the transaction subject within the target time period with a pre-configured feature library to obtain a matching result; when the matching result indicates that the transaction behavior characteristic data hits the target feature in the feature library, configuring a weight value for the transaction subject based on the weight value corresponding to the hit target feature to obtain a first weight value of the financial transaction of the transaction subject; binning the transaction amount of the financial transaction corresponding to the transaction subject to determine the amount range to which the transaction amount belongs; configuring a weight value corresponding to the amount range for the financial transaction of the transaction subject to obtain a second weight value of the financial transaction of the transaction subject; accumulating the first weight value and the second weight value of the financial transaction of the transaction subject to obtain the weight value of the financial transaction of the transaction subject, and configuring a weight value for the boundary corresponding to the financial transaction in the initial transaction network diagram based on the weight value of the financial transaction amount of the transaction subject.

[0011] Optionally, the transaction network graph is input into an abnormal transaction network identification model, and the step of outputting an abnormal transaction network subgraph includes: inputting the transaction network graph into the abnormal transaction network identification model, traversing each node in the transaction network graph through the abnormal transaction network identification model, and identifying the abnormal transaction network, wherein the abnormal transaction network satisfies the following conditions: the abnormal transaction network contains at least three nodes, the geodesic distance between any two nodes in the abnormal transaction network is less than or equal to a model parameter, and there is a direct association relationship or an indirect association relationship between any two nodes in the abnormal transaction network, the model parameter is obtained based on iterative training of the model, the geodesic distance is the result of accumulating weight values ​​of all boundaries between two nodes, the direct association relationship indicates that two nodes are directly connected through a boundary, and the indirect association relationship indicates that two nodes are indirectly connected through multiple nodes and boundaries; extracting the abnormal transaction network subgraph from the transaction network graph, and outputting the abnormal transaction network subgraph.

[0012] Optionally, the abnormal transaction network identification model is pre-constructed, and the steps of constructing the abnormal transaction network identification model include: obtaining a historical transaction network graph constructed based on historical transaction data within a historical time period; extracting a historical abnormal transaction network subgraph based on the historical transaction network graph, and constructing a sample data set based on the historical transaction network graph and the historical abnormal transaction network subgraph; dividing the sample data set to obtain a training set and a test set; constructing a neural network model, and configuring model parameters for the neural network model; iteratively training the neural network model based on the training set to obtain an initial abnormal transaction network identification model, wherein the model parameters are updated when the neural network model is iteratively trained; testing the initial abnormal transaction network identification model based on the test set to obtain a test result, where the test result indicates the initial abnormal transaction network identification model, and the trained abnormal transaction network identification model is obtained.

[0013] According to another aspect of an embodiment of the present invention, there is also provided an apparatus for identifying an abnormal transaction network, comprising: an acquisition unit, for acquiring a set of all transaction data of a financial institution within a target time period, wherein the transaction data set comprises transaction data of M financial transactions, and the transaction data of each financial transaction comprises at least: a transaction type, a transaction subject, and a transaction amount, wherein the transaction subject represents a user who executes the financial transaction; a construction unit, for constructing a transaction network graph based on the transaction data set, wherein the transaction network graph is a network graph constructed with the transaction subjects as nodes and the transaction relationships between the transaction subjects as boundaries; an output unit, for inputting the transaction network graph into an abnormal transaction network identification model and outputting an abnormal transaction network subgraph, wherein the abnormal transaction network model is a pre-constructed neural network model for identifying large-scale abnormal transactions; and an identification unit, for identifying an abnormal transaction network based on the abnormal transaction network subgraph.

[0014] Optionally, the construction unit includes: the step of constructing a transaction network diagram based on the transaction data set includes: a first construction module, used to construct an initial transaction network diagram based on the transaction data set; a first extraction module, used to extract the transaction behavior characteristic data of the transaction subject, and configure weight values ​​for each boundary in the initial transaction network diagram based on the transaction behavior characteristic data and the transaction amount to obtain a transaction network diagram.

[0015] Optionally, the first extraction module includes: a first acquisition submodule, used to acquire historical transaction data involving the transaction subject from the database of the financial institution; and a first extraction submodule, used to extract transaction behavior characteristic data of the transaction subject within the target time period based on the historical transaction data of the transaction subject and the transaction data within the target time period.

[0016] Optionally, the transaction behavior characteristic data includes at least one of the following: transaction frequency data, common transaction type data, average transaction amount data, and transaction time characteristic data, and the common transaction type data indicates that the transaction subject's usage frequency is greater than a preset frequency threshold.

[0017] Optionally, the first extraction module also includes: a first matching submodule, used to match the transaction behavior feature data of the transaction subject within the target time period with a pre-configured feature library to obtain a matching result; a first configuration submodule, used to configure a weight value for the transaction subject based on the weight value corresponding to the hit target feature when the matching result indicates that the transaction behavior feature data hits the target feature in the feature library, so as to obtain a first weight value of the financial transaction of the transaction subject; a first processing submodule, used to bin the transaction amount of the financial transaction corresponding to the transaction subject, and determine the amount range to which the transaction amount belongs; a second configuration submodule, used to configure the weight value corresponding to the amount range for the financial transaction of the transaction subject, so as to obtain a second weight value of the financial transaction of the transaction subject; a first calculation submodule, used to cumulatively calculate the first weight value and the second weight value of the financial transaction of the transaction subject, so as to obtain the weight value of the financial transaction of the transaction subject, and configure the weight value for the boundary corresponding to the financial transaction in the initial transaction network diagram based on the weight value of the financial transaction amount of the transaction subject.

[0018] Optionally, the output module includes: a first traversal submodule, used to input the transaction network graph into the abnormal transaction network identification model, traverse each node in the transaction network graph through the abnormal transaction network identification model, and identify the abnormal transaction network, wherein the abnormal transaction network satisfies the following conditions: the abnormal transaction network contains at least three nodes, the geodesic distance between any two nodes in the abnormal transaction network is less than or equal to a model parameter, and there is a direct association relationship or an indirect association relationship between any two nodes in the abnormal transaction network, the model parameter is obtained based on iterative training of the model, the geodesic distance is the result of accumulating weight values ​​of all boundaries between two nodes, the direct association relationship indicates that the two nodes are directly connected through a boundary, and the indirect association relationship indicates that the two nodes are indirectly connected through multiple nodes and boundaries; a first output submodule, used to extract the abnormal transaction network subgraph from the transaction network graph and output the abnormal transaction network subgraph.

[0019] Optionally, the abnormal transaction network identification device includes: a first acquisition module, used to obtain a historical transaction network graph constructed based on historical transaction data within a historical time period; a second extraction module, used to extract a historical abnormal transaction network subgraph based on the historical transaction network graph, and construct a sample data set based on the historical transaction network graph and the historical abnormal transaction network subgraph; a first partitioning module, used to partition the sample data set to obtain a training set and a test set; a first construction module, used to construct a neural network model and configure model parameters for the neural network model; a first training module, used to iteratively train the neural network model based on the training set to obtain an initial abnormal transaction network identification model, wherein the model parameters are updated when the neural network model is iteratively trained; a first testing module, used to test the initial abnormal transaction network identification model based on the test set to obtain a test result, where the test result indicates the initial abnormal transaction network identification model, and the trained abnormal transaction network identification model is obtained.

[0020] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is provided. The computer-readable storage medium includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute any of the above-mentioned methods for identifying abnormal transaction networks.

[0021] According to another aspect of an embodiment of the present invention, there is also provided an electronic device, comprising one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement any one of the above-mentioned methods for identifying abnormal transaction networks.

[0022] In the present application, the following steps are performed: obtaining a set of all transaction data of a financial institution within a target time period, wherein the transaction data set contains transaction data of M financial transactions, and the transaction data of each financial transaction includes at least: transaction type, transaction subject, and transaction amount, wherein the transaction subject represents a user who performs a financial transaction, and constructing a transaction network graph based on the transaction data set, wherein the transaction network graph is a network graph constructed with transaction subjects as nodes and transaction relationships between transaction subjects as boundaries, and then inputting the transaction network graph into an abnormal transaction network identification model, and outputting an abnormal transaction network subgraph, wherein the abnormal transaction network model is a pre-constructed neural network model for identifying large-scale abnormal transactions, and finally identifying an abnormal transaction network based on the abnormal transaction network subgraph.

[0023] In this application, a transaction network diagram is constructed to record the transaction data and transaction relationships between various transaction entities, and the capital flow pattern between entities in the abnormal transaction network is analyzed based on the abnormal transaction network model, so as to identify deeper and more hidden large-scale abnormal transactions, thereby improving the accuracy of abnormal transaction identification, and further solving the technical problem in related technologies that the supervised learning method based on expert rules mainly focuses on analyzing the transaction information of a single customer or its direct transaction partners, and has a low accuracy rate in identifying large-scale abnormal transactions. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0025] Figure 1 A hardware structure block diagram of a computer terminal (or mobile device) for implementing a method for identifying an abnormal transaction network is shown;

[0026] Figure 2 is a flow chart of an optional method for identifying an abnormal transaction network according to an embodiment of the present invention;

[0027] Figure 3 is an optional transaction network diagram according to an embodiment of the present invention;

[0028] Figure 4 is a schematic diagram of an optional device for identifying an abnormal transaction network according to an embodiment of the present invention;

[0029] Figure 5 The present invention is an optional hardware structure block diagram of an electronic device (or mobile device) for executing a method for identifying an abnormal transaction network according to an embodiment of the present invention. DETAILED DESCRIPTION

[0030] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0031] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0032] It should be noted that the method for identifying abnormal transaction networks and the device thereof in the present application can be used in the field of artificial intelligence when identifying large-scale abnormal transactions based on a neural network model, and can also be used in any field other than the field of artificial intelligence when identifying large-scale abnormal transactions based on a neural network model. The present application does not limit the application field of the method for identifying abnormal transaction networks and the device thereof.

[0033] It should be noted that the collected information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for display, data for analysis, etc.) involved in this application are information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of relevant data are in compliance with relevant laws, regulations and standards, necessary confidentiality measures are taken, and public order and good customs are not violated, and corresponding operation entrances are provided for users to choose to authorize or refuse. For example, an interface is set up between this system and relevant users or institutions to provide users with corresponding operation entrances for users to choose to agree or refuse the results of automated decision-making; if the user chooses to refuse, the expert decision-making process will be entered.

[0034] The following embodiments of the present invention can be applied to various abnormal transaction network identification systems / applications / devices. By constructing a transaction network diagram and using the N-sect method to analyze the fund flow pattern between entities, the present invention can identify deeper and more hidden illegal fund transfer groups or organizations. Compared with the abnormal transaction identification method based on expert rules, the accuracy rate has been significantly improved. The N-sect method can not only capture the direct transaction relationship between gang members, but also analyze the indirect, multi-level fund flow path, thereby more comprehensively revealing potential abnormal transaction gangs or organizations and identifying large-scale abnormal transactions.

[0035] The present invention is described in detail below in conjunction with various embodiments.

[0036] Embodiment 1

[0037] According to an embodiment of the present invention, an embodiment of a method for identifying an abnormal transaction network is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0038] The method embodiment provided in the first embodiment of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 1 The hardware structure block diagram of a computer terminal (or mobile device) for implementing a method for identifying an abnormal transaction network is shown. Figure 1 As shown, the computer terminal 10 (or mobile device) may include one or more (102a, 102b, ..., 102n are used to illustrate) processors 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the BUS bus), a network interface, a power supply and / or a camera. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations are shown.

[0039] It should be noted that the one or more processors 102 and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the computer terminal 10 (or mobile device). As described in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0040] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the method for identifying an abnormal transaction network in the embodiment of the present application. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, that is, the above-mentioned method for identifying an abnormal transaction network is realized. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the computer terminal 10 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0041] The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the computer terminal 10. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0042] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the computer terminal 10 (or mobile device).

[0043] Under the above operating environment, this application provides Figure 2 The method for identifying an abnormal transaction network shown is implemented by an abnormal transaction network identification system.

[0044] Figure 2 is a flow chart of an optional method for identifying an abnormal transaction network according to an embodiment of the present invention, such as Figure 2As shown, the method comprises the following steps:

[0045] Step S201, obtaining a set of all transaction data of a financial institution within a target time period.

[0046] Abnormal transaction activities such as illegal fund transfers take various forms. Based on the continuous updating of transaction patterns, the transaction types of illegal fund transfer activities are also constantly updated. They usually involve the following types of transactions, which are intended to conceal the source of illegal funds, change their nature or make them appear to come from legal activities: cash deposits and withdrawals. Frequent cash deposits and withdrawals, especially large cash transactions, are often the initial stage of illegal fund transfers and are used to transfer illegal cash into the financial system; complex network transactions. By establishing a complex transaction network, funds are quickly transferred between multiple accounts, multiple financial institutions, and even across borders to confuse the original source and final destination of funds. Third-party transfers. Using third-party accounts or companies as intermediaries to transfer funds multiple times, which makes the source and purpose of funds more difficult to track. Digital currency transactions. With the popularization of digital currencies, illegal fund transfers may also involve taking advantage of the anonymity and cross-border circulation characteristics of digital currencies to transfer illegal funds through exchanges, peer-to-peer transactions, etc.; large installment transactions. Split large amounts of illegal funds into multiple small transactions to avoid triggering the bank's illegal transaction monitoring system; invest and purchase assets, invest illegal funds in real estate, artwork, jewelry, antiques and other assets, and then sell these assets in the name of legality to "launder" the funds into legal income; circular transactions between accounts, through circular transactions of funds between multiple accounts to cover up the true flow path of funds. Cross-regional transactions, by transferring funds between different regions, taking advantage of the legal differences in different regions and the different monitoring standards for illegal fund transfers, to evade supervision, etc. In the actual process of illegal fund transfer and abnormal transactions, one or more of the above transaction types will be selected and used in combination according to the specific situation and available resources to achieve the best effect of illegal fund transfer. The complexity and variability of transaction patterns make it increasingly difficult to identify illegal fund transfers.

[0047] It should be noted that in the compliance review of abnormal transactions such as illegal fund transfers, obtaining all transaction data of financial institutions within the target time period is based on the analysis of large-scale abnormal transactions based on massive data. Specifically, the process of obtaining a collection of transaction data includes: transaction system integration. Financial institutions usually have multiple transaction systems for processing different types of transactions, such as retail transactions, corporate transactions, cross-border transactions, etc. Therefore, it is necessary to integrate the above multiple transaction systems and ensure that data can be extracted from each system. Then, the existing application program interface is used to access the financial transaction system to automatically obtain data from each transaction system, reduce human intervention, and improve the speed and accuracy of data acquisition. The selection of the target time period defines a specific time range, such as the past 30 days, the last quarter, or a specific event time period, which is used to focus on recent or specific period transaction activities and improve the pertinence of data analysis. In a large amount of transaction data, invalid information such as duplicate transactions, test transactions, or non-financial transactions may be included. Through the preset filtering rules, these noise data can be removed and valuable information for identifying abnormal transactions can be retained. A data integrity check mechanism is set up to perform data integrity checks to ensure that all transaction data within the target time period is collected accurately without omissions or errors. In addition, transaction data often comes from different systems and may have format differences. Therefore, it is necessary to unify the field names and data formats of transaction data to ensure the comparability and consistency of the data.

[0048] It should be noted that the transaction data set contains transaction data of M financial transactions. The transaction data of each financial transaction at least includes: transaction type, transaction subject, and transaction amount. The transaction subject indicates the user who performs the financial transaction. The transaction type indicates the nature of the transaction, which can be deposit, withdrawal, transfer, remittance, payment, investment and other types. This information is of great significance for understanding the transaction background and identifying abnormal transaction patterns; the transaction subject is the user who performs the financial transaction, including but not limited to individuals, enterprises, organizational trusts, digital currency exchanges, etc. Each transaction subject has a unique identifier, which is used to track the two parties of the transaction and identify their transaction habits and risk levels; the transaction amount is the monetary value involved in the financial transaction, which is a quantitative indicator of the transaction behavior. Understanding the size, frequency, flow, etc. of the transaction amount is crucial for discovering illegal financial activities such as illegal fund transfers; in addition, abnormal transactions can also be identified through dimensions such as transaction time, transaction currency, transaction channel, and transaction location. The time when the transaction occurs, the transaction currency, the transaction location, and the transaction channel are of great significance for identifying the periodicity and regionality of illegal fund transfers.

[0049] Step S202, constructing a transaction network diagram based on the transaction data set.

[0050] It should be noted that after obtaining the transaction data set of a financial institution, based on the transaction data of each transaction in the transaction data set, the transaction subject is used as a node, and the relationship between the transaction subjects is used as a boundary, that is, the flow of funds between accounts, so as to connect each node through the boundary to form a transaction network diagram, and annotate the additional information of the transaction on the boundary, such as transaction time, transaction amount, transaction location, etc., and configure weight values ​​for the boundaries at the same time, which is actually to configure weight values ​​for the transaction relationship between each transaction subject. The weight value of the boundary can be determined based on indicators such as transaction amount, transaction frequency, and transaction timestamp, reflecting the strength and importance of the transaction relationship. For example, frequent high-value transactions may result in a higher weight for the boundary.

[0051] Figure 3 is an optional transaction network diagram according to an embodiment of the present invention, such as Figure 3 As shown, the circles are nodes in the transaction network diagram, which are the transaction entities that perform financial transactions ( Figure 3 In the figure, C1, C2, C3, C4, C5, C6, and C7 are used as schematics. The straight lines and dotted lines represent the boundaries of the transaction network diagram, which are the transaction relationships between various transaction entities. There are direct financial transactions between two nodes directly connected by the boundary, for example Figure 3 C1 and C2, C1 and C3, C1 and C4, C2 and C5, C2 and C3, C3 and C4, C2 and C4, C6 and C7.

[0052] Optionally, the step of constructing a transaction network diagram based on a transaction data set includes: constructing an initial transaction network diagram based on the transaction data set; extracting transaction behavior characteristic data of the transaction subject, and configuring weight values ​​for each boundary in the initial transaction network diagram based on the transaction behavior characteristic data and the transaction amount to obtain a transaction network diagram.

[0053] When constructing a transaction network diagram, the executor of each financial transaction is extracted from the acquired transaction data set. Each transaction must involve two executors. The transaction subject is used as a node, and the two executors with a transaction relationship are connected through a boundary line to form a transaction network framework and obtain an initial transaction network diagram. Then, weight values ​​are configured for the boundaries in the transaction network. Weight values ​​are configured for each boundary through the transaction behavior feature data and transaction amount data of the transaction subject, thereby obtaining a transaction network diagram.

[0054] Optionally, the step of extracting the transaction behavior characteristic data of the transaction subject includes: obtaining historical transaction data involving the transaction subject from a database of a financial institution; and extracting the transaction behavior characteristic data of the transaction subject within a target time period based on the historical transaction data of the transaction subject and the transaction data within a target time period.

[0055] It should be noted that transaction behavior characteristic data can be obtained through the historical transaction data of the transaction subject. The transaction characteristics of the transaction subject in the historical time period and the transaction behavior in the target time period can be analyzed by historical transaction data to identify whether there are any abnormalities in the target time period. For example, if the transaction subject has been conducting small transactions for a long period of time, but suddenly there are large-scale transactions in the target time period, then the transaction subject is suspected of abnormal transactions.

[0056] Optionally, the transaction behavior characteristic data includes at least one of the following: transaction frequency data, common transaction type data, average transaction amount data, and transaction time characteristic data. Common transaction type data indicates data whose usage frequency of the transaction subject is greater than a preset frequency threshold.

[0057] It should be noted that transaction behavior characteristic data may include: transaction frequency data, common transaction type data, average transaction amount data, transaction time characteristic data. Extracting the transaction behavior characteristic data of the transaction subject in the target time period specifically includes: counting the transaction frequency of each transaction subject, including the number of transactions or the average transaction interval within a certain period of time, analyzing the time pattern of transactions, such as the difference in transactions between weekdays and weekends, night transactions, etc., identifying common transaction types of transaction subjects, such as regular transfers, large-scale dispersed transfers in and concentrated transfers out, etc., counting the geographical locations where transactions occur, and calculating the average transaction amount data of transaction subjects in months or years.

[0058] Optionally, the step of configuring weight values ​​for each boundary in the initial transaction network diagram based on the transaction behavior characteristic data and the transaction amount includes: matching the transaction behavior characteristic data of the transaction subject within the target time period with a pre-configured feature library to obtain a matching result; when the matching result indicates that the transaction behavior characteristic data hits the target feature in the feature library, configuring a weight value for the transaction subject based on the weight value corresponding to the hit target feature to obtain a first weight value of the financial transaction of the transaction subject; binning the transaction amount of the financial transaction corresponding to the transaction subject to determine the amount range to which the transaction amount belongs; configuring a weight value corresponding to the amount range for the financial transaction of the transaction subject to obtain a second weight value of the financial transaction of the transaction subject; accumulating the first weight value and the second weight value of the financial transaction of the transaction subject to obtain the weight value of the financial transaction of the transaction subject, and configuring a weight value for the boundary corresponding to the financial transaction in the initial transaction network diagram based on the weight value of the financial transaction amount of the transaction subject.

[0059] It should be noted that the extracted transaction behavior feature data of the transaction subject during the target time period is matched with the pre-configured feature library. The feature library records the abnormal transaction behavior features based on historical experience, and is updated in real time as the understanding of illegal fund transfer patterns and business environment continues to deepen. By matching the transaction behavior feature data of the transaction subject during the target time period with the feature library, it is possible to identify which transaction features are consistent with known illegal fund transfer patterns. When the transaction behavior feature data successfully matches the target feature in the feature library, a weight value is assigned to the transaction subject according to the importance and risk level of the hit feature, and a first weight value of the financial transaction of the transaction subject is obtained. The first weight value reflects the potential risk level of the transaction subject based on the transaction behavior feature; then the transaction amount data between the transaction subjects are discretized and divided into different amount intervals, each interval corresponds to a preset weight value, and a second weight value is configured for the financial transaction of the transaction subject according to the amount interval to which the transaction amount belongs. The second weight value reflects the risk level based on the magnitude of the transaction amount. The first weight value and the second weight value of the financial transaction of the transaction subject are cumulatively calculated to obtain a comprehensive weight value, which can comprehensively reflect the potential risk level of the transaction, and the value is configured to the boundary corresponding to the financial transaction of the transaction subject in the transaction network diagram.

[0060] Step S203, inputting the transaction network graph into the abnormal transaction network identification model, and outputting the abnormal transaction network subgraph.

[0061] It should be noted that the embodiment of the present invention extracts abnormal transaction features in the transaction network graph based on a pre-constructed abnormal transaction network identification model, identifies large-scale abnormal transactions, and outputs an abnormal transaction network subgraph. The abnormal transaction network identification model can limit the size of the abnormal transaction network subgraph according to pre-set model parameters to ensure the accuracy of identifying the abnormal transaction network.

[0062] Optionally, the transaction network graph is input into the abnormal transaction network identification model, and the step of outputting the abnormal transaction network subgraph includes: inputting the transaction network graph into the abnormal transaction network identification model, traversing each node in the transaction network graph through the abnormal transaction network identification model, and identifying a large-scale abnormal transaction network, wherein the abnormal transaction network satisfies the following conditions: the abnormal transaction network contains at least three nodes, the geodesic distance between any two nodes in the abnormal transaction network is less than or equal to the model parameter, and there is a direct or indirect association relationship between any two nodes in the abnormal transaction network, the model parameter is obtained based on iterative training of the model, the geodesic distance is the result of accumulating the weight values ​​of all boundaries between two nodes, the direct association relationship indicates that the two nodes are directly connected through the boundary, and the indirect association relationship indicates that the two nodes are indirectly connected through multiple nodes and boundaries; extracting the abnormal transaction network subgraph from the transaction network graph, and outputting the abnormal transaction network subgraph.

[0063] It should be noted that the abnormal transaction network identification model identifies abnormal transaction network subgraphs based on the identification rules of N-sects. Specifically, after the transaction network graph is input into the abnormal transaction network identification model, the model will traverse each node in the transaction network graph, identify large-scale abnormal transaction networks, and construct N-sects. The conditions satisfied by N-sects include: the abnormal transaction network contains at least three nodes, the geodesic distance between any two nodes in the abnormal transaction network is less than or equal to the model parameter (i.e., N), and there is a direct or indirect association between any two nodes in the abnormal transaction network. According to the above conditions, the largest abnormal transaction network subgraph is identified and output. The geodesic distance between any two nodes is the result of accumulating the weight values ​​of the boundaries between any two nodes. Through the analysis of the transaction network graph and the identification of abnormal transaction network subgraphs by the abnormal transaction network identification model, potential abnormal transaction links between transaction entities can be explored, and the identification results of abnormal transaction networks can be improved.

[0064] Optionally, the abnormal transaction network identification model is pre-constructed, and the steps of constructing the abnormal transaction network identification model include: obtaining a historical transaction network graph constructed based on historical transaction data within a historical time period; extracting a historical abnormal transaction network subgraph based on the historical transaction network graph, and constructing a sample data set based on the historical transaction network graph and the historical abnormal transaction network subgraph; dividing the sample data set to obtain a training set and a test set; constructing a neural network model, and configuring model parameters for the neural network model; iteratively training the neural network model based on the training set to obtain an initial abnormal transaction network identification model, wherein the model parameters are updated when the neural network model is iteratively trained; testing the initial abnormal transaction network identification model based on the test set to obtain a test result, and when the test result indicates the initial abnormal transaction network identification model, a trained abnormal transaction network identification model is obtained.

[0065] It should be noted that building an abnormal transaction network identification model is a multi-stage process involving data processing, model selection, training and testing. By continuously optimizing model parameters, feature engineering and algorithm selection, the ability to identify abnormal transaction network subgraphs can be improved, and illegal fund transfer activities can be effectively prevented. Steps for building an abnormal transaction network identification model: Obtain historical transaction data to build a historical transaction network graph. Collect historical transaction data, including detailed information of all transactions, such as the transaction parties, transaction amount, transaction time, etc. Based on these data, build a historical transaction network graph. The nodes in the graph represent the transaction subjects, the edges represent the transaction relationships, and the weights of the edges may be based on the transaction amount and / or other transaction features. Extract historical abnormal transaction network subgraphs, and identify abnormal transaction network subgraphs in historical transaction data based on previous illegal fund transfer cases and suspicious transaction reports, as well as expert rules. These subgraphs show the typical fund flow patterns of abnormal transactions. Construct a sample data set, combine the historical transaction network graph and the historical abnormal transaction network subgraph, and construct a sample data set containing "normal" and "abnormal" transaction network subgraphs. This data set is the basis for model training and is used to allow the model to learn the features that distinguish normal and abnormal transaction subgraphs. Sample data set division: divide the sample data set into a training set and a test set. The training set is used for model training, while the test set is used to evaluate the performance of the model, ensuring that the model not only performs well on the training data, but also accurately identifies anomalies on unseen data. Build a neural network model and configure model parameters, select a neural network model suitable for identifying the transaction network structure, iteratively train to obtain the initial model, and iteratively train the neural network model using the training set data. During the training process, the model will gradually adjust the model parameters, which are used to limit the scale of the output abnormal transaction network subgraph. By continuously iteratively selecting the best model parameters, the model output has the highest similarity with the abnormal transaction network subgraph of the test set, thereby improving the ability to identify abnormal transaction network subgraphs. Model testing and adjustment: test the trained model with the test set data to evaluate its performance indicators such as accuracy, recall rate, and F1 score for identifying abnormal transaction network subgraphs. If the model performs poorly, it may be necessary to adjust the model parameters, optimize the model structure, or increase the amount of training data, and then retrain and test until the model performance meets the requirements. Model deployment and monitoring: deploy the trained abnormal transaction network identification model to the real-time transaction monitoring system to continuously monitor abnormal changes in the transaction network diagram. At the same time, regular expert review of the model's prediction results is carried out to ensure the accuracy and stability of the model, and the model is continuously optimized based on the feedback results.

[0066] Step S204: identifying an abnormal transaction network based on the abnormal transaction network subgraph.

[0067] It should be noted that, based on the abnormal transaction network subgraph, an abnormal transaction network can be obtained. The abnormal transaction network contains multiple abnormal transaction subjects. The specific abnormal transactions are located according to the abnormal transaction subjects corresponding to each node in the abnormal transaction network subgraph, and the identification results of the abnormal transaction network are obtained based on multiple abnormal transaction subjects and abnormal transactions between transaction subjects, and provided to the abnormal transaction review end. The review end can verify the circulation groups or organizations that carry out abnormal transaction activities such as illegal fund transfer, and restrict the financial accounts involved in the abnormal transaction circulation groups or organizations according to the abnormal transactions, so as to prevent the risk of illegal fund transfer.

[0068] Through the above steps, all transaction data sets of financial institutions within the target time period are obtained, wherein the transaction data set contains transaction data of M financial transactions, and the transaction data of each financial transaction at least includes: transaction type, transaction subject, transaction amount, and the transaction subject represents the user who performs the financial transaction. A transaction network graph is constructed based on the transaction data set, wherein the transaction network graph is a network graph constructed with transaction subjects as nodes and transaction relationships between transaction subjects as boundaries. The transaction network graph is then input into an abnormal transaction network identification model to output an abnormal transaction network subgraph, wherein the abnormal transaction network model is a pre-constructed neural network model for identifying large-scale abnormal transactions. Finally, the abnormal transaction network is identified based on the abnormal transaction network subgraph.

[0069] In this embodiment, a transaction network diagram is constructed to record the transaction data and transaction relationships between various transaction entities, and the capital flow pattern between entities in the abnormal transaction network is analyzed based on the abnormal transaction network model, so as to identify deeper and more hidden large-scale abnormal transactions, thereby improving the accuracy of abnormal transaction identification, and further solving the technical problem in related technologies that the supervised learning method based on expert rules mainly focuses on analyzing the transaction information of a single customer or its direct transaction partners, and has a low accuracy rate in identifying large-scale abnormal transactions.

[0070] Another optional specific implementation is described in detail below.

[0071] The abnormal transaction network identification system of the embodiment of the present invention is used to execute the above-mentioned abnormal transaction network identification method to realize the identification of illegal fund transfer circulation groups or organizations (i.e., abnormal transaction networks). The system specifically includes: a transaction data acquisition module, a transaction network diagram construction module, a data processing module, an illegal fund transfer circulation group or organization identification module, and an illegal fund transfer information output module. Specifically,

[0072] When identifying illegal fund transfer groups or organizations, it is based on multi-dimensional transaction data of financial institutions over a period of time. Specifically, the transaction data acquisition module collects information about each transaction within the target time, including but not limited to the user IDs of both parties to the transaction, the transaction amount, etc. These data are the cornerstone of building a transaction network diagram.

[0073] The transaction network diagram construction module uses the above transaction data to treat each transaction subject (customer) as a node, and the transaction relationship is represented as the boundary between the nodes, and the weight value is configured for the boundary. The weight is usually determined according to the size of the transaction amount and the transaction behavior characteristics of the transaction subject. In this way, a network diagram that fully reflects the flow of funds can be formed. The diagram not only includes direct transactions, but can also be used to reveal complex and indirect transaction links, which is particularly important for identifying organizational structures in illegal fund transfer activities.

[0074] The data processing module can discretize the transaction amount, bin the transaction amount of the non-negative real number set, and configure weight values ​​for the boundaries of the transaction network diagram based on the binning results.

[0075] In the module for identifying illegal fund transfer groups or organizations, the pre-built model for identifying abnormal transaction networks will use the N-sect screening rules in social network analysis to analyze the processed transaction data and identify possible illegal fund transfer groups or organizations. This process is based on the connection relationship and shortest path length between nodes in the transaction network graph, and can effectively identify closely connected individuals or entity groups involved in illegal fund transfer behavior.

[0076] Finally, through the illegal funds transfer information output module, the identified illegal funds transfer circulation groups or organizations and their abnormal transaction entities, as well as the abnormal financial transactions involved in the abnormal transaction entities are output as identification results, providing data support and decision-making basis for financial institutions to prevent illegal funds transfer.

[0077] In the embodiment of the present invention, by constructing a transaction network diagram and using the N-sect method to analyze the fund flow pattern between entities, deeper and more hidden illegal fund transfer groups or organizations can be identified, and the accuracy rate is significantly improved compared to the abnormal transaction identification method based on expert rules. The N-sect method can not only capture the direct transaction relationship between gang members, but also analyze the indirect and multi-level fund flow path, thereby more comprehensively revealing potential abnormal transaction gangs or organizations and identifying large-scale abnormal transactions.

[0078] The following is a detailed description in conjunction with another embodiment.

[0079] Embodiment 2

[0080] An abnormal transaction network identification device provided in this embodiment includes multiple implementation units, each implementation unit corresponds to each implementation step in the above-mentioned embodiment 1. Its specific implementation method and beneficial effects can refer to the above-mentioned method embodiment and will not be repeated here.

[0081] Figure 4 is a schematic diagram of an optional abnormal transaction network identification device according to an embodiment of the present invention, such as Figure 4 As shown, the abnormal transaction network identification device may include: an acquisition unit 41, a construction unit 42, an output unit 43, and an identification unit 44, wherein:

[0082] The acquisition unit 41 is used to acquire all transaction data sets of the financial institution within the target time period, wherein the transaction data set includes transaction data of M financial transactions, and the transaction data of each financial transaction includes at least: transaction type, transaction subject, and transaction amount, and the transaction subject represents the user who performs the financial transaction;

[0083] A construction unit 42 is used to construct a transaction network diagram based on the transaction data set, wherein the transaction network diagram is a network diagram constructed with transaction subjects as nodes and transaction relationships between transaction subjects as boundaries;

[0084] An output unit 43 is used to input the transaction network graph into an abnormal transaction network identification model and output an abnormal transaction network subgraph, wherein the abnormal transaction network model is a pre-built neural network model for identifying large-scale abnormal transactions;

[0085] The identification unit 44 is used to identify the abnormal transaction network based on the abnormal transaction network subgraph.

[0086] The above-mentioned abnormal transaction network identification device obtains all transaction data sets of financial institutions within the target time period through the acquisition unit 41, wherein the transaction data set contains transaction data of M financial transactions, and the transaction data of each financial transaction at least includes: transaction type, transaction subject, transaction amount, and the transaction subject represents the user who performs the financial transaction; constructs a transaction network graph based on the transaction data set through the construction unit 42, wherein the transaction network graph is a network graph constructed with transaction subjects as nodes and transaction relationships between transaction subjects as boundaries; inputs the transaction network graph into the abnormal transaction network identification model through the output unit 43, and outputs the abnormal transaction network subgraph, wherein the abnormal transaction network model is a pre-constructed neural network model for identifying large-scale abnormal transactions; and identifies the abnormal transaction network based on the abnormal transaction network subgraph through the identification unit 44.

[0087] In this embodiment, a transaction network diagram is constructed to record the transaction data and transaction relationships between various transaction entities, and the capital flow pattern between entities in the abnormal transaction network is analyzed based on the abnormal transaction network model, so as to identify deeper and more hidden large-scale abnormal transactions, thereby improving the accuracy of abnormal transaction identification, and further solving the technical problem in related technologies that the supervised learning method based on expert rules mainly focuses on analyzing the transaction information of a single customer or its direct transaction partners, and has a low accuracy rate in identifying large-scale abnormal transactions.

[0088] Optionally, the construction unit includes: the step of constructing a transaction network diagram based on a transaction data set includes: a first construction module, used to construct an initial transaction network diagram based on the transaction data set; a first extraction module, used to extract transaction behavior feature data of the transaction subject, and configure weight values ​​for each boundary in the initial transaction network diagram based on the transaction behavior feature data and the transaction amount to obtain a transaction network diagram.

[0089] Optionally, the first extraction module includes: a first acquisition submodule, used to obtain historical transaction data involving the transaction subject from the database of the financial institution; a first extraction submodule, used to extract transaction behavior characteristic data of the transaction subject within the target time period based on the historical transaction data of the transaction subject and the transaction data within the target time period.

[0090] Optionally, the transaction behavior characteristic data includes at least one of the following: transaction frequency data, common transaction type data, average transaction amount data, and transaction time characteristic data. Common transaction type data indicates data whose usage frequency of the transaction subject is greater than a preset frequency threshold.

[0091] Optionally, the first extraction module also includes: a first matching submodule, which is used to match the transaction behavior feature data of the transaction subject within the target time period with a pre-configured feature library to obtain a matching result; a first configuration submodule, which is used to configure a weight value for the transaction subject based on the weight value corresponding to the hit target feature when the matching result indicates that the transaction behavior feature data hits the target feature in the feature library, so as to obtain a first weight value of the financial transaction of the transaction subject; a first processing submodule, which is used to bin the transaction amount of the financial transaction corresponding to the transaction subject and determine the amount range to which the transaction amount belongs; a second configuration submodule, which is used to configure the weight value corresponding to the amount range for the financial transaction of the transaction subject, so as to obtain a second weight value of the financial transaction of the transaction subject; a first calculation submodule, which is used to accumulate the first weight value and the second weight value of the financial transaction of the transaction subject to obtain the weight value of the financial transaction of the transaction subject, and configure the weight value of the boundary corresponding to the financial transaction in the initial transaction network diagram based on the weight value of the financial transaction amount of the transaction subject.

[0092] Optionally, the output module includes: a first traversal submodule, used to input the transaction network graph into the abnormal transaction network identification model, traverse each node in the transaction network graph through the abnormal transaction network identification model, and identify a large-scale abnormal transaction network, wherein the abnormal transaction network satisfies the following conditions: the abnormal transaction network contains at least three nodes, the geodesic distance between any two nodes in the abnormal transaction network is less than or equal to the model parameter, and there is a direct or indirect association relationship between any two nodes in the abnormal transaction network, the model parameter is obtained based on iterative training of the model, the geodesic distance is the result of accumulating the weight values ​​of all boundaries between two nodes, the direct association relationship indicates that the two nodes are directly connected through the boundary, and the indirect association relationship indicates that the two nodes are indirectly connected through multiple nodes and boundaries; a first output submodule, used to extract the abnormal transaction network subgraph from the transaction network graph and output the abnormal transaction network subgraph.

[0093] Optionally, the abnormal transaction network identification device includes: a first acquisition module, which is used to obtain a historical transaction network graph constructed based on historical transaction data within a historical time period; a second extraction module, which is used to extract a historical abnormal transaction network subgraph based on the historical transaction network graph, and construct a sample data set based on the historical transaction network graph and the historical abnormal transaction network subgraph; a first division module, which is used to divide the sample data set to obtain a training set and a test set; a first construction module, which is used to construct a neural network model and configure model parameters for the neural network model; a first training module, which is used to iteratively train the neural network model based on the training set to obtain an initial abnormal transaction network identification model, wherein the model parameters are updated when the neural network model is iteratively trained; a first testing module, which is used to test the initial abnormal transaction network identification model based on the test set to obtain a test result, and when the test result indicates the initial abnormal transaction network identification model, a trained abnormal transaction network identification model is obtained.

[0094] It should be noted that the acquisition unit 41, construction unit 42, output unit 43, and identification unit 44 correspond to steps S201 to S204 in the first embodiment, and the examples and application scenarios implemented by the above units and corresponding steps are the same, but are not limited to the contents disclosed in the first embodiment. It should be noted that the above modules or units can be hardware components or software components stored in a memory (e.g., memory 104) and processed by one or more processors (e.g., processors 102a, 102b, ..., 102n), and the above modules or units can also be part of the device and can be run in the computer terminal 10 provided in the first embodiment.

[0095] The present invention is described below in conjunction with another optional embodiment.

[0096] Embodiment 3

[0097] An embodiment of the present invention may also provide an electronic device, Figure 5 is a hardware structure block diagram of an electronic device (or mobile device) for executing an optional method for identifying an abnormal transaction network according to an embodiment of the present invention, such as Figure 5 As shown, the electronic device may include: one or more ( Figure 5 (only one is shown) processor 502, memory 504, storage controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.

[0098] Among them, the memory can be used to store software programs and modules, such as program instructions / modules corresponding to the methods and devices in the embodiments of the present application, and the processor executes various functional applications and data processing by running the software programs and modules stored in the memory, that is, realizing the above-mentioned method. The memory may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include a memory remotely arranged relative to the processor, and these remote memories may be connected to the terminal via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0099] The processor can call the information and application programs stored in the memory through the transmission device to perform the following steps: obtain a set of all transaction data of a financial institution within a target time period, wherein the transaction data set includes transaction data of M financial transactions, and the transaction data of each financial transaction includes at least: transaction type, transaction subject, and transaction amount, and the transaction subject represents the user who performs the financial transaction; construct a transaction network graph based on the transaction data set, wherein the transaction network graph is a network graph constructed with transaction subjects as nodes and transaction relationships between transaction subjects as boundaries; input the transaction network graph into an abnormal transaction network identification model, and output an abnormal transaction network subgraph, wherein the abnormal transaction network model is a pre-constructed neural network model for identifying large-scale abnormal transactions; identify abnormal transaction networks based on the abnormal transaction network subgraph.

[0100] The processor can call the information and application programs stored in the memory through the transmission device to perform the following steps: construct an initial transaction network diagram based on the transaction data set; extract the transaction behavior characteristic data of the transaction subject, and configure weight values ​​for each boundary in the initial transaction network diagram based on the transaction behavior characteristic data and the transaction amount to obtain a transaction network diagram.

[0101] The processor can call the information and application programs stored in the memory through the transmission device to perform the following steps: obtaining historical transaction data involving the transaction subject from the database of the financial institution; extracting the transaction behavior characteristic data of the transaction subject within the target time period based on the historical transaction data of the transaction subject and the transaction data within the target time period.

[0102] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: the transaction behavior characteristic data includes at least one of the following: transaction frequency data, common transaction type data, average transaction amount data, transaction time characteristic data, and the common transaction type data indicates that the transaction subject's usage frequency is greater than a preset frequency threshold.

[0103] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: match the transaction behavior feature data of the transaction subject within the target time period with the pre-configured feature library to obtain a matching result; when the matching result indicates that the transaction behavior feature data hits the target feature in the feature library, configure a weight value for the transaction subject based on the weight value corresponding to the hit target feature to obtain a first weight value of the financial transaction of the transaction subject; bin the transaction amount of the financial transaction corresponding to the transaction subject to determine the amount range to which the transaction amount belongs; configure a weight value corresponding to the amount range for the financial transaction of the transaction subject to obtain a second weight value of the financial transaction of the transaction subject; cumulatively calculate the first weight value and the second weight value of the financial transaction of the transaction subject to obtain the weight value of the financial transaction of the transaction subject, and configure a weight value for the boundary corresponding to the financial transaction in the initial transaction network diagram based on the weight value of the financial transaction amount of the transaction subject.

[0104] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: input the transaction network diagram into the abnormal transaction network identification model, traverse each node in the transaction network diagram through the abnormal transaction network identification model, and identify a large-scale abnormal transaction network, wherein the abnormal transaction network meets the following conditions: the abnormal transaction network contains at least three nodes, the geodesic distance between any two nodes in the abnormal transaction network is less than or equal to the model parameter, and there is a direct or indirect association relationship between any two nodes in the abnormal transaction network. The model parameter is obtained based on iterative training of the model, and the geodesic distance is the result of accumulating the weight values ​​of all boundaries between two nodes. The direct association relationship indicates that the two nodes are directly connected through the boundary, and the indirect association relationship indicates that the two nodes are indirectly connected through multiple nodes and boundaries; extract the abnormal transaction network subgraph from the transaction network diagram, and output the abnormal transaction network subgraph.

[0105] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: obtain a historical transaction network diagram constructed based on historical transaction data within a historical time period; extract a historical abnormal transaction network subgraph based on the historical transaction network diagram, and construct a sample data set based on the historical transaction network diagram and the historical abnormal transaction network subgraph; divide the sample data set to obtain a training set and a test set; construct a neural network model, and configure model parameters for the neural network model; iteratively train the neural network model based on the training set to obtain an initial abnormal transaction network recognition model, wherein the model parameters are updated when the neural network model is iteratively trained; test the initial abnormal transaction network recognition model based on the test set to obtain a test result, and when the test result indicates the initial abnormal transaction network recognition model, a trained abnormal transaction network recognition model is obtained.

[0106] By adopting the embodiment of the present invention, a method for identifying abnormal transaction networks is provided to identify large-scale abnormal transactions. By constructing a transaction network diagram to record the transaction data and transaction relationship between various transaction entities, and analyzing the capital flow pattern between entities in the abnormal transaction network based on the abnormal transaction network model, it is possible to identify deeper and more hidden large-scale abnormal transactions, thereby improving the accuracy of abnormal transaction identification, and thus solving the technical problem that the supervised learning method based on expert rules in the related technology mainly focuses on analyzing the transaction information of a single customer or its direct transaction partner, and has a low accuracy rate in identifying large-scale abnormal transactions.

[0107] It can be understood by those skilled in the art that Figure 5 The structure shown is for illustration only, and the electronic device may also be a smart phone, a tablet computer, a PDA, a mobile Internet device (MID), a PAD or other terminal device. Figure 5 The structure of the electronic device is not limited. Figure 5 More or fewer components (such as network interfaces, display devices, etc.) shown in, or having Figure 5 Different configurations are shown.

[0108] A person of ordinary skill in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing the hardware related to the terminal device through a program, and the program can be stored in a computer-readable storage medium, and the storage medium may include: a flash drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0109] The present invention is described below in conjunction with another optional embodiment.

[0110] Embodiment 4

[0111] The embodiment of the present invention further provides a computer-readable storage medium. Optionally, in the embodiment of the present invention, the computer-readable storage medium can be used to store the program code executed by the abnormal transaction network identification method provided in the first embodiment.

[0112] Optionally, in an embodiment of the present invention, the above-mentioned storage medium may be located in any computer terminal in a computer terminal group in a computer network, or in any mobile terminal in a mobile terminal group.

[0113] An embodiment of the present invention also provides a computer program product, which, when executed on a data processing device, is suitable for executing the steps of a method for identifying an abnormal transaction network: obtaining a set of all transaction data of a financial institution within a target time period, wherein the transaction data set contains transaction data of M financial transactions, and the transaction data of each financial transaction includes at least: transaction type, transaction subject, and transaction amount, and the transaction subject represents a user who performs the financial transaction; constructing a transaction network graph based on the transaction data set, wherein the transaction network graph is a network graph constructed with transaction subjects as nodes and transaction relationships between transaction subjects as boundaries; inputting the transaction network graph into an abnormal transaction network identification model, and outputting an abnormal transaction network subgraph, wherein the abnormal transaction network model is a pre-constructed neural network model for identifying large-scale abnormal transactions; identifying an abnormal transaction network based on the abnormal transaction network subgraph.

[0114] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0115] In the above embodiments of the present invention, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0116] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0117] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0118] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0119] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and other media that can store program codes.

[0120] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for identifying an abnormal transaction network, characterized in that: include: Acquire a set of all transaction data of a financial institution within a target time period, wherein the transaction data set includes transaction data of M financial transactions, and the transaction data of each financial transaction includes at least: transaction type, transaction subject, and transaction amount, wherein the transaction subject represents a user who executes the financial transaction; Constructing a transaction network graph based on the transaction data set, wherein the transaction network graph is a network graph constructed with the transaction subjects as nodes and the transaction relationships between the transaction subjects as boundaries; Inputting the transaction network graph into an abnormal transaction network identification model, and outputting an abnormal transaction network subgraph, wherein the abnormal transaction network model is a pre-built neural network model for identifying large-scale abnormal transactions; An abnormal transaction network is identified based on the abnormal transaction network subgraph.

2. The method according to claim 1, characterized in that The step of constructing a transaction network graph based on the transaction data set includes: Constructing an initial transaction network graph based on the transaction data set; The transaction behavior characteristic data of the transaction subject is extracted, and based on the transaction behavior characteristic data and the transaction amount, a weight value is configured for each boundary in the initial transaction network diagram to obtain a transaction network diagram.

3. The method according to claim 2, characterized in that The step of extracting the transaction behavior characteristic data of the transaction subject comprises: Acquiring historical transaction data involving the transaction subject from a database of the financial institution; The transaction behavior characteristic data of the transaction subject within the target time period is extracted based on the historical transaction data of the transaction subject and the transaction data within the target time period.

4. The method according to claim 3, characterized in that The transaction behavior characteristic data includes at least one of the following: transaction frequency data, common transaction type data, average transaction amount data, and transaction time characteristic data. The common transaction type data indicates that the transaction subject's usage frequency is greater than a preset frequency threshold.

5. The method according to claim 2, characterized in that: The step of configuring a weight value for each boundary in the initial transaction network diagram based on the transaction behavior characteristic data and the transaction amount includes: Matching the transaction behavior feature data of the transaction subject within the target time period with a pre-configured feature library to obtain a matching result; In the case where the matching result indicates that the transaction behavior feature data hits the target feature in the feature library, configuring a weight value for the transaction subject based on the weight value corresponding to the hit target feature to obtain a first weight value of the financial transaction of the transaction subject; The transaction amount of the financial transaction corresponding to the transaction subject is processed by binning to determine the amount range to which the transaction amount belongs; Configuring a weight value corresponding to the amount range for the financial transaction of the transaction subject to obtain a second weight value for the financial transaction of the transaction subject; The first weight value and the second weight value of the financial transaction of the transaction subject are cumulatively calculated to obtain the weight value of the financial transaction of the transaction subject, and the boundary configuration weight value corresponding to the financial transaction in the initial transaction network diagram is configured based on the weight value of the financial transaction amount of the transaction subject.

6. The method according to claim 1, characterized in that The step of inputting the transaction network graph into the abnormal transaction network identification model and outputting the abnormal transaction network subgraph comprises: The transaction network graph is input into the abnormal transaction network identification model, and each node in the transaction network graph is traversed by the abnormal transaction network identification model to identify the abnormal transaction network, wherein the abnormal transaction network satisfies the following conditions: the abnormal transaction network contains at least three nodes, the geodesic distance between any two nodes in the abnormal transaction network is less than or equal to the model parameter, and there is a direct association relationship or an indirect association relationship between any two nodes in the abnormal transaction network, the model parameter is obtained based on iterative training of the model, the geodesic distance is the result of accumulating weight values ​​of all boundaries between two nodes, the direct association relationship indicates that the two nodes are directly connected through the boundary, and the indirect association relationship indicates that the two nodes are indirectly connected through multiple nodes and boundaries; The abnormal transaction network subgraph is extracted from the transaction network graph, and the abnormal transaction network subgraph is output.

7. The method according to claim 1, characterized in that The abnormal transaction network identification model is pre-constructed, and the steps of constructing the abnormal transaction network identification model include: Obtain a historical transaction network diagram based on historical transaction data within a historical time period; Extracting a historical abnormal transaction network subgraph based on the historical transaction network graph, and constructing a sample data set based on the historical transaction network graph and the historical abnormal transaction network subgraph; Dividing the sample data set into a training set and a test set; Constructing a neural network model and configuring model parameters for the neural network model; Iteratively training the neural network model based on the training set to obtain an initial abnormal transaction network recognition model, wherein when iteratively training the neural network model, model parameters are updated; The initial abnormal transaction network identification model is tested based on the test set to obtain a test result, and the test result indicates the initial abnormal transaction network identification model to obtain the trained abnormal transaction network identification model.

8. A device for identifying an abnormal transaction network, characterized in that: include: an acquisition unit, configured to acquire a set of all transaction data of a financial institution within a target time period, wherein the set of transaction data includes transaction data of M financial transactions, and the transaction data of each financial transaction includes at least: a transaction type, a transaction subject, and a transaction amount, wherein the transaction subject represents a user who executes the financial transaction; A construction unit, configured to construct a transaction network graph based on the transaction data set, wherein the transaction network graph is a network graph constructed with the transaction subjects as nodes and the transaction relationships between the transaction subjects as boundaries; An output unit, used to input the transaction network graph into an abnormal transaction network identification model, and output an abnormal transaction network subgraph, wherein the abnormal transaction network model is a pre-built neural network model for identifying large-scale abnormal transactions; An identification unit is used to identify an abnormal transaction network based on the abnormal transaction network subgraph.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored computer program, wherein when the computer program is executed, the device where the computer-readable storage medium is located is controlled to execute the method for identifying an abnormal transaction network according to any one of claims 1 to 7.

10. An electronic device, characterized in that: It includes one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the method for identifying an abnormal transaction network as described in any one of claims 1 to 7.

Images