Methods, devices, electronic equipment, and storage media for identifying abnormal transaction networks

Abstract

This invention discloses a method, apparatus, electronic device, and storage medium for identifying abnormal transaction networks, relating to the fields of artificial intelligence or other related technical fields. The method includes: acquiring a set of all transaction data from financial institutions within a target time period; constructing a transaction network graph based on the transaction data set, wherein the transaction network graph is a network graph constructed with transaction entities as nodes and transaction relationships between transaction entities as boundaries; inputting the transaction network graph into an abnormal transaction network identification model, outputting an abnormal transaction network subgraph; and identifying the abnormal transaction network based on the abnormal transaction network subgraph. This invention solves the technical problem in related technologies where supervised learning methods based on expert rules mainly focus on analyzing transaction information of individual customers or their direct trading partners, resulting in low accuracy in identifying large-scale abnormal transactions.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence or other related technical fields. Specifically, it relates to a method, apparatus, electronic device, and storage medium for identifying abnormal transaction networks. Background Technology

[0002] In related technologies, the identification of abnormal transactions such as illegal fund transfers mostly relies on supervised learning methods based on expert rules. These methods mainly focus on analyzing the transaction information of a single customer or its direct trading partner, but they are difficult to fully capture the complex transaction links and patterns of abnormal transactions, resulting in low efficiency and insufficient accuracy in identifying large-scale abnormal transactions.

[0003] There is currently no effective solution to the above problems. Summary of the Invention

[0004] This invention provides a method, apparatus, electronic device, and storage medium for identifying abnormal transaction networks, to at least address the technical problem in related technologies where supervised learning methods based on expert rules mainly focus on analyzing transaction information of individual customers or their direct trading partners, resulting in low accuracy in identifying large-scale abnormal transactions.

[0005] According to one aspect of the present invention, a method for identifying an abnormal transaction network is provided, comprising: acquiring a set of all transaction data of financial institutions within a target time period, wherein the set of transaction data contains transaction data of M financial transactions, and the transaction data of each financial transaction includes at least: transaction type, transaction subject, and transaction amount, wherein the transaction subject represents the user executing the financial transaction; constructing a transaction network graph based on the set of transaction data, wherein the transaction network graph is a network graph constructed with the transaction subjects as nodes and the transaction relationships between the transaction subjects as boundaries; inputting the transaction network graph into an abnormal transaction network identification model and outputting an abnormal transaction network subgraph, wherein the abnormal transaction network model is a pre-constructed neural network model for identifying large-scale abnormal transactions; and identifying an abnormal transaction network based on the abnormal transaction network subgraph.

[0006] Optionally, the step of constructing a transaction network graph based on the transaction data set includes: constructing an initial transaction network graph based on the transaction data set; extracting transaction behavior feature data of the transaction entities, and configuring weight values ​​for each boundary in the initial transaction network graph based on the transaction behavior feature data and the transaction amount, thereby obtaining the transaction network graph.

[0007] Optionally, the step of extracting the transaction behavior feature data of the transaction entity includes: obtaining historical transaction data involving the transaction entity from the database of the financial institution; and extracting the transaction behavior feature data of the transaction entity within the target time period based on the historical transaction data of the transaction entity and the transaction data within the target time period.

[0008] Optionally, the transaction behavior characteristic data includes at least one of the following: transaction frequency data, common transaction type data, average transaction amount data, and transaction time characteristic data, wherein the common transaction type data represents data in which the frequency of use by the transaction subject is greater than a preset frequency threshold.

[0009] Optionally, the step of configuring weight values ​​for each boundary in the initial transaction network graph based on the transaction behavior feature data and the transaction amount includes: matching the transaction behavior feature data of the transaction entity within a target time period with a pre-configured feature library to obtain a matching result; if the matching result indicates that the transaction behavior feature data matches a target feature in the feature library, configuring weight values ​​for the transaction entity based on the weight value corresponding to the matched target feature to obtain a first weight value for the transaction entity's financial transaction; performing binning on the transaction amount of the financial transaction corresponding to the transaction entity to determine the amount range to which the transaction amount belongs; configuring weight values ​​corresponding to the amount range for the transaction entity's financial transaction to obtain a second weight value for the transaction entity's financial transaction; summing the first weight value and the second weight value of the transaction entity's financial transaction to obtain a weight value for the transaction entity's financial transaction, and configuring weight values ​​for the boundary corresponding to the financial transaction in the initial transaction network graph based on the weight value of the transaction entity's financial transaction amount.

[0010] Optionally, the step of inputting the transaction network graph into the abnormal transaction network identification model and outputting the abnormal transaction network subgraph includes: inputting the transaction network graph into the abnormal transaction network identification model, traversing each node in the transaction network graph through the abnormal transaction network identification model, and identifying the abnormal transaction network, wherein the abnormal transaction network satisfies the following conditions: the abnormal transaction network contains at least three nodes, the geodesic distance between any two nodes in the abnormal transaction network is less than or equal to the model parameters, and any two nodes in the abnormal transaction network have a direct or indirect relationship, wherein the model parameters are obtained based on iterative training of the model, the geodesic distance is the result of accumulating the weight values ​​of all boundaries between two nodes, the direct relationship means that the two nodes are directly connected through a boundary, and the indirect relationship means that the two nodes are indirectly connected through multiple nodes and boundaries; extracting the abnormal transaction network subgraph from the transaction network graph and outputting the abnormal transaction network subgraph.

[0011] Optionally, the abnormal transaction network identification model is pre-built. The steps of building the abnormal transaction network identification model include: obtaining a historical transaction network graph based on historical transaction data within a historical time period; extracting historical abnormal transaction network subgraphs based on the historical transaction network graph, and building a sample dataset based on the historical transaction network graph and the historical abnormal transaction network subgraphs; dividing the sample dataset to obtain a training set and a test set; building a neural network model and configuring model parameters for the neural network model; iteratively training the neural network model based on the training set to obtain an initial abnormal transaction network identification model, wherein the model parameters are updated during iterative training of the neural network model; testing the initial abnormal transaction network identification model based on the test set to obtain test results, and using the test results to indicate the initial abnormal transaction network identification model to obtain the trained abnormal transaction network identification model.

[0012] According to another aspect of the present invention, an apparatus for identifying an abnormal transaction network is also provided, comprising: an acquisition unit, configured to acquire a set of all transaction data of financial institutions within a target time period, wherein the set of transaction data contains transaction data of M financial transactions, and the transaction data of each financial transaction includes at least: transaction type, transaction subject, and transaction amount, wherein the transaction subject represents the user executing the financial transaction; a construction unit, configured to construct a transaction network graph based on the set of transaction data, wherein the transaction network graph is a network graph constructed with the transaction subjects as nodes and the transaction relationships between the transaction subjects as boundaries; an output unit, configured to input the transaction network graph into an abnormal transaction network identification model and output an abnormal transaction network subgraph, wherein the abnormal transaction network model is a pre-constructed neural network model for identifying large-scale abnormal transactions; and an identification unit, configured to identify an abnormal transaction network based on the abnormal transaction network subgraph.

[0013] Optionally, the construction unit includes: the step of constructing a transaction network graph based on the transaction data set includes: a first construction module, used to construct an initial transaction network graph based on the transaction data set; and a first extraction module, used to extract transaction behavior feature data of the transaction subject, and configure weight values ​​for each boundary in the initial transaction network graph based on the transaction behavior feature data and the transaction amount, to obtain the transaction network graph.

[0014] Optionally, the first extraction module includes: a first acquisition submodule, used to acquire historical transaction data involving the transaction entity from the database of the financial institution; and a first extraction submodule, used to extract transaction behavior feature data of the transaction entity within the target time period based on the historical transaction data of the transaction entity and the transaction data within the target time period.

[0015] Optionally, the transaction behavior characteristic data includes at least one of the following: transaction frequency data, common transaction type data, average transaction amount data, and transaction time characteristic data, wherein the common transaction type data represents data in which the frequency of use by the transaction subject is greater than a preset frequency threshold.

[0016] Optionally, the first extraction module further includes: a first matching submodule, used to match the transaction behavior feature data of the transaction entity within a target time period with a pre-configured feature library to obtain a matching result; a first configuration submodule, used to configure a weight value for the transaction entity based on the weight value corresponding to the matched target feature in the feature library when the matching result indicates that the transaction behavior feature data matches a target feature in the feature library, to obtain a first weight value for the financial transaction of the transaction entity; a first processing submodule, used to perform binning processing on the transaction amount of the financial transaction corresponding to the transaction entity to determine the amount range to which the transaction amount belongs; a second configuration submodule, used to configure a weight value corresponding to the amount range for the financial transaction of the transaction entity to obtain a second weight value for the financial transaction of the transaction entity; and a first calculation submodule, used to accumulate the first weight value and the second weight value of the financial transaction of the transaction entity to obtain the weight value of the financial transaction of the transaction entity, and configure a weight value based on the weight value of the financial transaction amount of the transaction entity on the boundary corresponding to the financial transaction in the initial transaction network graph.

[0017] Optionally, the output module includes: a first traversal submodule, used to input the transaction network graph into the abnormal transaction network identification model, and traverse each node in the transaction network graph through the abnormal transaction network identification model to identify the abnormal transaction network, wherein the abnormal transaction network satisfies the following conditions: the abnormal transaction network contains at least three nodes, the geodesic distance between any two nodes in the abnormal transaction network is less than or equal to the model parameters, and any two nodes in the abnormal transaction network have a direct or indirect relationship, wherein the model parameters are obtained based on iterative training of the model, the geodesic distance is the result of accumulating the weight values ​​of all boundaries between two nodes, the direct relationship means that the two nodes are directly connected through a boundary, and the indirect relationship means that the two nodes are indirectly connected through multiple nodes and boundaries; and a first output submodule, used to extract the abnormal transaction network subgraph from the transaction network graph and output the abnormal transaction network subgraph.

[0018] Optionally, the abnormal transaction network identification device includes: a first acquisition module, used to acquire a historical transaction network graph constructed based on historical transaction data within a historical time period; a second extraction module, used to extract historical abnormal transaction network subgraphs based on the historical transaction network graph, and construct a sample dataset based on the historical transaction network graph and the historical abnormal transaction network subgraphs; a first partitioning module, used to partition the sample dataset to obtain a training set and a test set; a first construction module, used to construct a neural network model and configure model parameters for the neural network model; a first training module, used to iteratively train the neural network model based on the training set to obtain an initial abnormal transaction network identification model, wherein the model parameters are updated during iterative training of the neural network model; and a first testing module, used to test the initial abnormal transaction network identification model based on the test set to obtain a test result, wherein the test result indicates the initial abnormal transaction network identification model, and the trained abnormal transaction network identification model is obtained.

[0019] According to another aspect of the present invention, a computer-readable storage medium is also provided, the computer-readable storage medium including a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to perform any of the above-described methods for identifying abnormal transaction networks.

[0020] According to another aspect of the present invention, an electronic device is also provided, including one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement any of the above-described methods for identifying abnormal transaction networks.

[0021] In this application, the following steps are taken: First, a set of all transaction data from financial institutions within a target time period is obtained. This set contains transaction data for M financial transactions. Each financial transaction includes at least: transaction type, transaction entity, and transaction amount. The transaction entity represents the user executing the financial transaction. A transaction network graph is constructed based on the transaction data set. This graph is a network graph constructed with transaction entities as nodes and the transaction relationships between transaction entities as boundaries. Then, the transaction network graph is input into an abnormal transaction network identification model, which outputs an abnormal transaction network subgraph. This abnormal transaction network model is a pre-built neural network model for identifying large-scale abnormal transactions. Finally, the abnormal transaction network is identified based on the abnormal transaction network subgraph.

[0022] In this application, a transaction network diagram is constructed to record transaction data and relationships between various transaction entities. Based on the abnormal transaction network model, the fund flow patterns between entities in the abnormal transaction network are analyzed, thereby identifying deeper and more concealed large-scale abnormal transactions. This improves the accuracy of abnormal transaction identification and solves the technical problem in related technologies where supervised learning methods based on expert rules mainly focus on analyzing the transaction information of a single customer or its direct trading partner, resulting in low accuracy in identifying large-scale abnormal transactions. Attached Figure Description

[0023] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, illustrate exemplary embodiments of the invention and, together with their description, serve to explain the invention and do not constitute an undue limitation thereof. In the drawings:

[0024] Figure 1 A hardware structure block diagram of a computer terminal (or mobile device) for implementing a method for identifying abnormal transaction networks is shown.

[0025] Figure 2 This is a flowchart of an optional method for identifying abnormal transaction networks according to an embodiment of the present invention;

[0026] Figure 3 This is an optional transaction network diagram according to an embodiment of the present invention;

[0027] Figure 4 This is a schematic diagram of an optional abnormal transaction network identification device according to an embodiment of the present invention;

[0028] Figure 5 This is a hardware structure block diagram of an electronic device (or mobile device) that performs an optional method for identifying abnormal transaction networks according to an embodiment of the present invention. Detailed Implementation

[0029] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0030] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0031] It should be noted that the method and apparatus for identifying abnormal transaction networks in this application can be used in the field of artificial intelligence to identify large-scale abnormal transactions based on neural network models, and can also be used in any field other than artificial intelligence to identify large-scale abnormal transactions based on neural network models. This application does not limit the application field of the method and apparatus for identifying abnormal transaction networks.

[0032] It should be noted that the information collected in this application (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for display, data used for analysis, etc.) are information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of this data all comply with relevant laws, regulations, and standards, necessary confidentiality measures have been taken, and they do not violate public order and good morals. Corresponding access points are provided for users to choose to authorize or refuse. For example, interfaces are set up between this system and relevant users or organizations, providing users with corresponding access points to choose to agree to or refuse automated decision-making results; if the user chooses to refuse, the process proceeds to the expert decision-making stage.

[0033] The following embodiments of the present invention can be applied to various systems / applications / devices for identifying abnormal transaction networks. By constructing a transaction network diagram and utilizing the N-clique method to analyze the flow of funds between entities, the present invention can identify deeper and more concealed illegal fund transfer groups or organizations, significantly improving accuracy compared to abnormal transaction identification methods based on expert rules. The N-clique method can not only capture direct transaction relationships between group members but also analyze indirect, multi-level fund flow paths, thereby more comprehensively revealing potential abnormal transaction groups or organizations and identifying large-scale abnormal transactions.

[0034] The present invention will now be described in detail with reference to various embodiments.

[0035] Example 1

[0036] According to an embodiment of the present invention, an embodiment of a method for identifying abnormal transaction networks is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0037] The method embodiment provided in Embodiment 1 of this application can be executed on a mobile terminal, computer terminal, or similar computing device. Figure 1 A hardware block diagram of a computer terminal (or mobile device) for implementing a method for identifying abnormal transaction networks is shown. Figure 1 As shown, the computer terminal 10 (or mobile device) may include one or more processors 102 (shown as 102a, 102b, ..., 102n in the figure) 102 (processor 102 may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of a BUS bus), a network interface, a power supply, and / or a camera. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0038] It should be noted that the aforementioned one or more processors 102 and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the computer terminal 10 (or mobile device). As involved in the embodiments of this application, the data processing circuits serve as a processor control mechanism (e.g., selection of a variable resistor termination path connected to an interface).

[0039] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the abnormal transaction network identification method in this embodiment. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby realizing the above-mentioned abnormal transaction network identification method. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the computer terminal 10 via a network. Examples of the above-mentioned networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0040] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 10. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0041] The display can be, for example, a touchscreen liquid crystal display (LCD) that allows the user to interact with the user interface of the computer terminal 10 (or mobile device).

[0042] Under the above operating environment, this application provides Figure 2 The method for identifying abnormal transaction networks shown is implemented by an abnormal transaction network identification system.

[0043] Figure 2 This is a flowchart of an optional method for identifying abnormal transaction networks according to an embodiment of the present invention, such as... Figure 2As shown, the method includes the following steps:

[0044] Step S201: Obtain the set of all transaction data of financial institutions within the target time period.

[0045] Illegal fund transfers and other abnormal transaction activities take many forms. As transaction models constantly evolve, the types of transactions involved in illegal fund transfers also continuously evolve. They typically involve the following types of transactions, designed to conceal the source of illicit funds, alter their nature, or make them appear to originate from legitimate activities: Cash deposits and withdrawals, especially large cash transactions, are often the initial stage of illegal fund transfers, used to transfer illicit cash into the financial system; Complex network transactions, establishing complex transaction networks to rapidly transfer funds between multiple accounts, multiple financial institutions, and even across borders to obscure the original source and final destination of the funds; Third-party transfers, using third-party accounts or companies as intermediaries to conduct multiple transfers of funds, making the source and purpose of the funds even more difficult to trace; Cryptocurrency transactions, with the popularization of cryptocurrencies, illegal fund transfers may also involve utilizing the anonymity and cross-border circulation characteristics of cryptocurrencies to transfer funds illegally through exchanges, peer-to-peer transactions, etc.; Large installment transactions. Large sums of illicit funds are broken down into multiple smaller transactions to avoid triggering banks' illegal transaction monitoring systems; investments and asset purchases involve investing illicit funds in assets such as real estate, art, jewelry, and antiques, and then selling these assets under legitimate names to "launder" the funds into legal proceeds; circular transactions between multiple accounts are used to conceal the true flow of funds; and cross-regional transactions involve transferring funds between different regions, exploiting differences in laws and varying standards for monitoring illicit fund transfers to evade regulation. In actual illicit fund transfers and abnormal transactions, one or more of the above transaction types are combined depending on the specific circumstances and available resources to achieve the best effect in transferring illicit funds. The complexity and variability of these transaction patterns make the identification of illicit fund transfers increasingly difficult.

[0046] It's important to note that in compliance reviews of abnormal transactions such as illicit fund transfers, obtaining all transaction data from financial institutions within a target timeframe is fundamental to analyzing large-scale abnormal transactions using massive data analytics. Specifically, the process for acquiring the transaction data set includes: transaction system integration. Financial institutions typically have multiple transaction systems to handle different types of transactions, such as retail, corporate, and cross-border transactions. Therefore, it's necessary to integrate these multiple systems and ensure data extraction from each. Then, existing application programming interfaces (APIs) are used to access the financial transaction systems, automating data acquisition from each system, reducing human intervention, and improving the speed and accuracy of data acquisition. The selection of the target timeframe involves defining a specific time range, such as the past 30 days, the previous quarter, or a specific event period, to focus on recent or specific transaction activities, improving the targeting of data analysis. Large amounts of transaction data may contain invalid information such as duplicate transactions, test transactions, or non-financial transactions. Pre-defined filtering rules can remove this noisy data, retaining valuable information for identifying abnormal transactions. Finally, a data integrity check mechanism is set up to ensure that all transaction data within the target timeframe is collected accurately and without omissions or errors. In addition, transaction data often comes from different systems and may have format differences. Therefore, it is necessary to unify the field names and data formats of transaction data to ensure data comparability and consistency.

[0047] It should be noted that the transaction dataset contains transaction data for M financial transactions. Each financial transaction's data includes at least: transaction type, transaction entity, and transaction amount. The transaction entity represents the user executing the financial transaction, and the transaction type indicates the nature of the transaction, which can be various types such as deposit, withdrawal, transfer, remittance, payment, and investment. This information is crucial for understanding the transaction background and identifying abnormal transaction patterns. The transaction entity is the user executing the financial transaction, which may include, but is not limited to, individuals, enterprises, organizational trusts, and cryptocurrency exchanges. Each transaction entity has a unique identifier used to track both parties and identify their trading habits and risk levels. The transaction amount is the monetary value involved in the financial transaction and is a quantitative indicator of the transaction behavior. Understanding the size, frequency, and flow of transaction amounts is crucial for detecting illegal financial activities such as illegal fund transfers. Furthermore, abnormal transactions can be identified through dimensions such as transaction time, currency, channel, and location. The time, currency, location, and channel of the transaction are important for identifying the periodicity and geographical characteristics of illegal fund transfers.

[0048] Step S202: Construct a transaction network graph based on the transaction data set.

[0049] It's important to note that after obtaining the transaction data set from financial institutions, a transaction network diagram is formed based on the transaction data of each transaction. The transaction entity is used as a node, and the relationships between these entities (i.e., the flow of funds between accounts) are used as boundaries. These boundaries connect the nodes, forming a transaction network diagram. Additional transaction information, such as transaction time, amount, and location, is marked on the boundaries. Simultaneously, weight values ​​are assigned to the boundaries, which essentially assign weights to the transaction relationships between the various transaction entities. These weight values ​​can be determined based on indicators such as transaction amount, frequency, and timestamps, reflecting the strength and importance of the transaction relationship. For example, frequent high-amount transactions may result in a higher weight for the boundary.

[0050] Figure 3 This is an optional transaction network diagram according to an embodiment of the present invention, such as... Figure 3 As shown, the circles represent nodes in the transaction network diagram, which are the entities executing financial transactions. Figure 3 (Illustrated by C1, C2, C3, C4, C5, C6, and C7). Straight and dashed lines represent the boundaries of the transaction network diagram, signifying the transaction relationships between various trading entities. Direct financial transactions exist between two nodes directly connected by a boundary. For example... Figure 3 The numbers C1 and C2, C1 and C3, C1 and C4, C2 and C5, C2 and C3, C3 and C4, C2 and C4, C6 and C7 are listed.

[0051] Optionally, the steps of constructing a transaction network graph based on a transaction data set include: constructing an initial transaction network graph based on the transaction data set; extracting transaction behavior feature data of the transaction entities, and configuring weight values ​​for each boundary in the initial transaction network graph based on the transaction behavior feature data and the transaction amount to obtain the transaction network graph.

[0052] When constructing a transaction network graph, the executing entity of each financial transaction is extracted from the acquired transaction data set. Each transaction must involve two executing entities. Using the transaction entities as nodes, the two executing entities with a transaction relationship are connected by boundary lines to form a transaction network framework and obtain an initial transaction network graph. Then, weight values ​​are assigned to the boundaries in the transaction network. The weight values ​​of each boundary are assigned by the transaction behavior characteristic data and transaction amount data of the transaction entities, thus obtaining the transaction network graph.

[0053] Optionally, the steps for extracting transaction behavior characteristic data of the transaction entity include: obtaining historical transaction data involving the transaction entity from the database of a financial institution; and extracting transaction behavior characteristic data of the transaction entity within the target time period based on the historical transaction data and transaction data within the target time period.

[0054] It should be noted that transaction behavior characteristic data can be obtained from the historical transaction data of the transaction entity. By analyzing the transaction characteristics of the transaction entity in the historical period and the transaction behavior in the target period, it is possible to identify whether the transaction entity has any abnormalities in the target period. For example, if the transaction entity has been making small transactions for a long period of time, but suddenly makes large-scale transactions in the target period, then the transaction entity is suspected of having abnormal transactions.

[0055] Optionally, the transaction behavior characteristic data includes at least one of the following: transaction frequency data, commonly used transaction type data, average transaction amount data, and transaction time characteristic data. The commonly used transaction type data represents data whose usage frequency by the transaction entity is greater than a preset frequency threshold.

[0056] It should be noted that transaction behavior characteristic data can include: transaction frequency data, common transaction type data, average transaction amount data, and transaction time characteristic data. Extracting transaction behavior characteristic data of transaction entities within a target time period specifically includes: statistically analyzing the transaction frequency of each transaction entity, including the number of transactions or average transaction interval within a certain period; analyzing the time patterns of transaction occurrences, such as the difference between weekday and weekend transactions, nighttime transactions, etc.; identifying common transaction types of transaction entities, such as regular transfers, large-amount dispersed transfers into and concentrated transfers out, etc.; statistically analyzing the geographical location of transaction occurrences; and calculating the average transaction amount data of transaction entities in monthly or yearly units, etc.

[0057] Optionally, the step of configuring weight values ​​for each boundary in the initial transaction network graph based on transaction behavior feature data and transaction amount includes: matching the transaction behavior feature data of the transaction entity within the target time period with a pre-configured feature library to obtain a matching result; if the matching result indicates that the transaction behavior feature data matches a target feature in the feature library, configuring a weight value for the transaction entity based on the weight value corresponding to the matched target feature to obtain a first weight value for the transaction entity's financial transaction; binning the transaction amount of the financial transaction corresponding to the transaction entity to determine the amount range to which the transaction amount belongs; configuring a weight value corresponding to the amount range for the transaction entity's financial transaction to obtain a second weight value for the transaction entity's financial transaction; summing the first weight value and the second weight value of the transaction entity's financial transaction to obtain a weight value for the transaction entity's financial transaction, and configuring a weight value for the boundary corresponding to the financial transaction in the initial transaction network graph based on the weight value of the transaction entity's financial transaction amount.

[0058] It should be noted that the extracted transaction behavior characteristics data of the transaction entities within the target time period are matched with a pre-configured feature library. The feature library records abnormal transaction behavior characteristics obtained based on historical experience and is updated in real time as the understanding of illegal fund transfer patterns and business environment deepens. By matching the transaction behavior characteristics data of the transaction entities within the target time period with this feature library, it is possible to identify which transaction characteristics match known illegal fund transfer patterns. When the transaction behavior feature data successfully matches the target features in the feature library, a weight value is assigned to the transaction entity based on the importance and risk level of the matched feature, resulting in a first weight value for the transaction entity's financial transaction. This first weight value reflects the potential risk level of the transaction entity based on its transaction behavior features. Then, the transaction amount data between the transaction entities is discretized and divided into different amount intervals, each interval corresponding to a preset weight value. A second weight value is assigned to the transaction entity's financial transaction based on the amount interval to which the transaction amount belongs. This second weight value reflects the risk level based on the transaction amount. The first and second weight values ​​of the transaction entity's financial transaction are summed to obtain a comprehensive weight value, which can comprehensively reflect the potential risk level of the transaction. This value is then assigned to the boundary corresponding to the transaction entity's financial transaction in the transaction network diagram.

[0059] Step S203: Input the transaction network graph into the abnormal transaction network identification model and output the abnormal transaction network subgraph.

[0060] It should be noted that, in this embodiment of the invention, abnormal transaction features in the transaction network graph are extracted based on a pre-built abnormal transaction network identification model, and large-scale abnormal transactions are identified. The abnormal transaction network subgraph is output. The abnormal transaction network identification model can limit the size of the abnormal transaction network subgraph according to the pre-set model parameters to ensure the accuracy of abnormal transaction network identification.

[0061] Optionally, the step of inputting the transaction network graph into the abnormal transaction network identification model and outputting the abnormal transaction network subgraph includes: inputting the transaction network graph into the abnormal transaction network identification model, traversing each node in the transaction network graph through the abnormal transaction network identification model, and identifying large-scale abnormal transaction networks. The abnormal transaction network satisfies the following conditions: the abnormal transaction network contains at least three nodes; the geodesic distance between any two nodes in the abnormal transaction network is less than or equal to the model parameters; and any two nodes in the abnormal transaction network have a direct or indirect relationship. The model parameters are obtained based on iterative training of the model. The geodesic distance is the result of accumulating the weight values ​​of all boundaries between two nodes. A direct relationship indicates that two nodes are directly connected through a boundary, and an indirect relationship indicates that two nodes are indirectly connected through multiple nodes and boundaries. The abnormal transaction network subgraph is extracted from the transaction network graph and output.

[0062] It should be noted that the abnormal transaction network identification model identifies abnormal transaction network subgraphs based on the N-clique identification rule. Specifically, after inputting the transaction network graph into the abnormal transaction network identification model, the model traverses each node in the transaction network graph, identifies large-scale abnormal transaction networks, and constructs an N-clique. The conditions that the N-clique must satisfy include: the abnormal transaction network contains at least three nodes; the geodesic distance between any two nodes in the abnormal transaction network is less than or equal to the model parameter (i.e., N); and any two nodes in the abnormal transaction network have a direct or indirect relationship. Based on the above conditions, the largest abnormal transaction network subgraph is identified and output. The geodesic distance between any two nodes is the result of accumulating the weight values ​​of the boundary between any two nodes. By analyzing the transaction network graph and identifying abnormal transaction network subgraphs through the abnormal transaction network identification model, potential abnormal transaction links between transaction entities can be discovered, improving the identification results of abnormal transaction networks.

[0063] Optionally, the abnormal transaction network identification model is pre-built. The steps for building the abnormal transaction network identification model include: obtaining a historical transaction network graph based on historical transaction data within a historical time period; extracting historical abnormal transaction network subgraphs based on the historical transaction network graph, and constructing a sample dataset based on the historical transaction network graph and the historical abnormal transaction network subgraphs; dividing the sample dataset to obtain a training set and a test set; building a neural network model and configuring model parameters for the neural network model; iteratively training the neural network model based on the training set to obtain an initial abnormal transaction network identification model, wherein the model parameters are updated during iterative training of the neural network model; testing the initial abnormal transaction network identification model based on the test set to obtain test results, and obtaining the trained abnormal transaction network identification model based on the test results.

[0064] It should be noted that building an abnormal transaction network identification model is a multi-stage process involving data processing, model selection, training, and testing. By continuously optimizing model parameters, feature engineering, and algorithm selection, the ability to identify abnormal transaction network subgraphs can be improved, effectively preventing illegal fund transfer activities. The steps for building an abnormal transaction network identification model are as follows: 1. Obtain historical transaction data: Construct a historical transaction network graph by collecting historical transaction data, including detailed information on all transactions, such as the parties involved, transaction amount, and transaction time. 2. Based on this data, construct a historical transaction network graph, where nodes represent transaction entities, edges represent transaction relationships, and edge weights may be based on transaction amount and / or other transaction characteristics. 3. Extract historical abnormal transaction network subgraphs: Based on past cases of illegal fund transfers and suspicious transaction reports, as well as expert rules, identify abnormal transaction network subgraphs in the historical transaction data. These subgraphs demonstrate typical fund flow patterns in abnormal transactions. 4. Construct a sample dataset: Combine the historical transaction network graph and historical abnormal transaction network subgraphs to construct a sample dataset containing "normal" and "abnormal" transaction network subgraphs. This dataset is the foundation for model training, allowing the model to learn the features that distinguish normal and abnormal transaction subgraphs. The sample dataset is divided into a training set and a test set. The training set is used for model training, while the test set is used to evaluate the model's performance, ensuring that the model performs well not only on training data but also accurately identifies anomalies on unseen data. A neural network model is built and its parameters are configured. A suitable neural network model for identifying transaction network structures is selected, and iterative training is performed to obtain the initial model. The neural network model is then iteratively trained using the training set data. During training, the model parameters are gradually adjusted to limit the size of the output anomaly transaction network subgraph. By continuously iterating and selecting the optimal model parameters, the model output achieves the highest similarity to the anomaly transaction network subgraph in the test set, thereby improving the ability to identify anomaly transaction network subgraphs. The model is then tested and adjusted using the test set data to evaluate its performance metrics, such as accuracy, recall, and F1 score in identifying anomaly transaction network subgraphs. If the model performs poorly, it may be necessary to adjust the model parameters, optimize the model structure, or increase the amount of training data, and then retrain and test until the model performance meets the requirements. Model deployment and monitoring involve deploying the trained anomaly transaction network identification model into a real-time transaction monitoring system to continuously monitor abnormal changes in the transaction network graph. Simultaneously, the model's prediction results undergo regular expert review to ensure accuracy and stability, and the model is continuously optimized based on feedback.

[0065] Step S204: Identify abnormal transaction networks based on the abnormal transaction network subgraph.

[0066] It should be noted that an abnormal transaction network can be obtained based on the abnormal transaction network subgraph. The abnormal transaction network contains multiple abnormal transaction entities. The specific abnormal transaction is located according to the abnormal transaction entity corresponding to each node in the abnormal transaction network subgraph. Based on the abnormal transaction entities and the abnormal transactions between the entities, the identification result of the abnormal transaction network is obtained and provided to the abnormal transaction review end. The review end can verify the flow groups or organizations that carry out abnormal transaction activities such as illegal fund transfers, and take measures such as restricting the financial accounts involved in the abnormal transaction flow groups or organizations to prevent the risk of illegal fund transfers.

[0067] Through the above steps, a set of transaction data from all financial institutions within the target time period is obtained. This set contains transaction data for M financial transactions. Each financial transaction includes at least the following information: transaction type, transaction entity, and transaction amount. The transaction entity represents the user executing the financial transaction. A transaction network graph is constructed based on the transaction data set. This graph is built with transaction entities as nodes and the transaction relationships between them as boundaries. The transaction network graph is then input into an abnormal transaction network identification model, which outputs an abnormal transaction network subgraph. This abnormal transaction network model is a pre-built neural network model for identifying large-scale abnormal transactions. Finally, the abnormal transaction network is identified based on the abnormal transaction network subgraph.

[0068] In this embodiment, a transaction network diagram is constructed to record the transaction data and relationships between various transaction entities. Based on the abnormal transaction network model, the fund flow patterns between entities in the abnormal transaction network are analyzed, thereby identifying deeper and more concealed large-scale abnormal transactions. This improves the accuracy of abnormal transaction identification and solves the technical problem in related technologies where supervised learning methods based on expert rules mainly focus on analyzing the transaction information of a single customer or its direct trading partner, resulting in low accuracy in identifying large-scale abnormal transactions.

[0069] The following describes in detail another optional implementation method.

[0070] The abnormal transaction network identification system of this invention is used to execute the above-described abnormal transaction network identification method to identify illegal fund transfer groups or organizations (i.e., abnormal transaction networks). Specifically, the system includes: a transaction data acquisition module, a transaction network graph construction module, a data processing module, an illegal fund transfer group or organization identification module, and an illegal fund transfer information output module.

[0071] Identifying illicit money transfer groups or organizations is based on multi-dimensional transaction data from financial institutions over a period of time. Specifically, the transaction data acquisition module collects information on every transaction within the target time frame, including but not limited to user identifiers of both parties and transaction amounts. This data forms the foundation for constructing the transaction network diagram.

[0072] The transaction network diagram construction module utilizes the aforementioned transaction data, treating each transaction entity (customer) as a node, and the transaction relationship as the boundary between nodes. Weights are assigned to these boundaries, typically determined based on the transaction amount and the transaction behavior characteristics of the entities. In this way, a comprehensive network diagram reflecting fund flows can be formed. This diagram not only includes direct transactions but can also reveal complex, indirect transaction chains, which is particularly important for identifying the organizational structure of illicit fund transfer activities.

[0073] The data processing module can discretize the transaction amount, bin the transaction amount of the non-negative real number set, and assign weight values ​​to the boundaries of the transaction network graph based on the binning results.

[0074] In the module for identifying illicit fund transfer groups or organizations, a pre-built abnormal transaction network identification model uses the N-clique screening rule from social network analysis to analyze the processed transaction data and identify potential illicit fund transfer groups or organizations. This process, based on the connectivity and shortest path length between nodes in the transaction network graph, can effectively identify closely connected individuals or sets of entities involved in illicit fund transfer activities.

[0075] Finally, through the illegal fund transfer information output module, the identified illegal fund transfer groups or organizations, as well as the abnormal transaction entities and the abnormal financial transactions involved in the abnormal transaction entities, are output as identification results, providing data support and decision-making basis for financial institutions to prevent illegal fund transfers.

[0076] In this embodiment of the invention, by constructing a transaction network diagram and using the N-clique method to analyze the fund flow patterns between entities, deeper and more concealed illegal fund transfer groups or organizations can be identified. Compared with abnormal transaction identification methods based on expert rules, the accuracy is significantly improved. The N-clique method can not only capture the direct transaction relationships between group members, but also analyze indirect, multi-level fund flow paths, thereby more comprehensively revealing potential abnormal transaction groups or organizations and identifying large-scale abnormal transactions.

[0077] The following is a detailed description with reference to another embodiment.

[0078] Example 2

[0079] The abnormal transaction network identification device provided in this embodiment includes multiple implementation units, each of which corresponds to a specific implementation step in the above embodiment one. The specific implementation method and beneficial effects can be referred to the foregoing method embodiment, and will not be repeated here.

[0080] Figure 4 This is a schematic diagram of an optional abnormal transaction network identification device according to an embodiment of the present invention, such as... Figure 4 As shown, the identification device for this abnormal transaction network may include: an acquisition unit 41, a construction unit 42, an output unit 43, and an identification unit 44, wherein,

[0081] The acquisition unit 41 is used to acquire a set of all transaction data of financial institutions within a target time period. The set of transaction data contains transaction data of M financial transactions. The transaction data of each financial transaction includes at least: transaction type, transaction subject, and transaction amount. The transaction subject represents the user who executes the financial transaction.

[0082] Construction unit 42 is used to construct a transaction network graph based on the transaction data set, wherein the transaction network graph is a network graph constructed with transaction entities as nodes and the transaction relationships between transaction entities as boundaries;

[0083] Output unit 43 is used to input the transaction network graph into the abnormal transaction network identification model and output an abnormal transaction network subgraph, wherein the abnormal transaction network model is a pre-built neural network model for identifying large-scale abnormal transactions.

[0084] The identification unit 44 is used to identify abnormal transaction networks based on the abnormal transaction network subgraph.

[0085] The aforementioned abnormal transaction network identification device acquires a set of all transaction data of financial institutions within a target time period through acquisition unit 41. This set contains transaction data for M financial transactions, with each transaction including at least: transaction type, transaction entity, and transaction amount. The transaction entity represents the user executing the financial transaction. The construction unit 42 constructs a transaction network graph based on the transaction data set. This graph is constructed with transaction entities as nodes and the transaction relationships between them as boundaries. The output unit 43 inputs the transaction network graph into the abnormal transaction network identification model and outputs an abnormal transaction network subgraph. This abnormal transaction network model is a pre-constructed neural network model for identifying large-scale abnormal transactions. The identification unit 44 identifies the abnormal transaction network based on the abnormal transaction network subgraph.

[0086] In this embodiment, a transaction network diagram is constructed to record the transaction data and relationships between various transaction entities. Based on the abnormal transaction network model, the fund flow patterns between entities in the abnormal transaction network are analyzed, thereby identifying deeper and more concealed large-scale abnormal transactions. This improves the accuracy of abnormal transaction identification and solves the technical problem in related technologies where supervised learning methods based on expert rules mainly focus on analyzing the transaction information of a single customer or its direct trading partner, resulting in low accuracy in identifying large-scale abnormal transactions.

[0087] Optionally, the construction unit includes: the step of constructing a transaction network graph based on a transaction data set includes: a first construction module, used to construct an initial transaction network graph based on the transaction data set; and a first extraction module, used to extract transaction behavior feature data of the transaction subjects, and configure weight values ​​for each boundary in the initial transaction network graph based on the transaction behavior feature data and the transaction amount, to obtain the transaction network graph.

[0088] Optionally, the first extraction module includes: a first acquisition submodule, used to acquire historical transaction data involving the transaction entity from the database of a financial institution; and a first extraction submodule, used to extract transaction behavior feature data of the transaction entity within the target time period based on the historical transaction data of the transaction entity and the transaction data within the target time period.

[0089] Optionally, the transaction behavior characteristic data includes at least one of the following: transaction frequency data, commonly used transaction type data, average transaction amount data, and transaction time characteristic data. The commonly used transaction type data represents data whose usage frequency by the transaction entity is greater than a preset frequency threshold.

[0090] Optionally, the first extraction module further includes: a first matching submodule, used to match the transaction behavior feature data of the transaction entity within a target time period with a pre-configured feature library to obtain a matching result; a first configuration submodule, used to configure a weight value for the transaction entity based on the weight value corresponding to the matched target feature in the feature library when the matching result indicates that the transaction behavior feature data matches the target feature in the feature library, to obtain a first weight value for the financial transaction of the transaction entity; a first processing submodule, used to perform binning processing on the transaction amount of the financial transaction corresponding to the transaction entity to determine the amount range to which the transaction amount belongs; a second configuration submodule, used to configure a weight value corresponding to the amount range for the financial transaction of the transaction entity, to obtain a second weight value for the financial transaction of the transaction entity; and a first calculation submodule, used to accumulate the first weight value and the second weight value of the financial transaction of the transaction entity to obtain a weight value for the financial transaction of the transaction entity, and configure a weight value for the boundary corresponding to the financial transaction in the initial transaction network graph based on the weight value of the financial transaction amount of the transaction entity.

[0091] Optionally, the output module includes: a first traversal submodule, used to input the transaction network graph into the abnormal transaction network identification model, and traverse each node in the transaction network graph through the abnormal transaction network identification model to identify large-scale abnormal transaction networks. The abnormal transaction network satisfies the following conditions: the abnormal transaction network contains at least three nodes, the geodesic distance between any two nodes in the abnormal transaction network is less than or equal to the model parameters, and any two nodes in the abnormal transaction network have a direct or indirect relationship. The model parameters are obtained based on the iterative training of the model, the geodesic distance is the result of accumulating the weight values ​​of all boundaries between two nodes, a direct relationship means that two nodes are directly connected through a boundary, and an indirect relationship means that two nodes are indirectly connected through multiple nodes and boundaries; and a first output submodule, used to extract the abnormal transaction network subgraph from the transaction network graph and output the abnormal transaction network subgraph.

[0092] Optionally, the device for identifying abnormal transaction networks includes: a first acquisition module for acquiring a historical transaction network graph constructed based on historical transaction data within a historical time period; a second extraction module for extracting historical abnormal transaction network subgraphs based on the historical transaction network graph, and constructing a sample dataset based on the historical transaction network graph and the historical abnormal transaction network subgraphs; a first partitioning module for partitioning the sample dataset to obtain a training set and a test set; a first construction module for constructing a neural network model and configuring model parameters for the neural network model; a first training module for iteratively training the neural network model based on the training set to obtain an initial abnormal transaction network identification model, wherein the model parameters are updated during iterative training of the neural network model; and a first testing module for testing the initial abnormal transaction network identification model based on the test set to obtain test results, wherein the initial abnormal transaction network identification model is tested based on the test results to obtain a trained abnormal transaction network identification model.

[0093] It should be noted that the acquisition unit 41, construction unit 42, output unit 43, and identification unit 44 mentioned above correspond to steps S201 to S204 in Embodiment 1. The instances and application scenarios implemented by the above units and corresponding steps are the same, but are not limited to the content disclosed in Embodiment 1. It should be noted that the above modules or units can be hardware or software components stored in memory (e.g., memory 104) and processed by one or more processors (e.g., processors 102a, 102b, ..., 102n). The above modules or units can also run as part of a device in the computer terminal 10 provided in Embodiment 1.

[0094] The invention will now be described in conjunction with another alternative embodiment.

[0095] Example 3

[0096] The present invention can also provide an electronic device. Figure 5 This is a hardware structure block diagram of an electronic device (or mobile device) for implementing an optional method for identifying abnormal transaction networks according to an embodiment of the present invention, such as... Figure 5 As shown, the electronic device may include: one or more ( Figure 5 Only one of the components is shown: processor 502, memory 504, memory controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module, and display.

[0097] The memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the methods and apparatus in the embodiments of this application. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, thereby implementing the above-described methods. The memory may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include memory remotely located relative to the processor, and these remote memories can be connected to the terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0098] The processor can access information and applications stored in memory via a transmission device to perform the following steps: acquiring a set of all transaction data from financial institutions within a target time period, wherein the set contains transaction data for M financial transactions, and each financial transaction includes at least: transaction type, transaction entity, and transaction amount, where the transaction entity represents the user executing the financial transaction; constructing a transaction network graph based on the transaction data set, wherein the transaction network graph is a network graph constructed with transaction entities as nodes and the transaction relationships between transaction entities as boundaries; inputting the transaction network graph into an abnormal transaction network identification model, outputting an abnormal transaction network subgraph, wherein the abnormal transaction network model is a pre-built neural network model for identifying large-scale abnormal transactions; and identifying the abnormal transaction network based on the abnormal transaction network subgraph.

[0099] The processor can access the information and application programs stored in the memory via the transmission device to perform the following steps: construct an initial transaction network graph based on the transaction data set; extract the transaction behavior feature data of the transaction subjects, and assign weight values ​​to each boundary in the initial transaction network graph based on the transaction behavior feature data and the transaction amount to obtain the transaction network graph.

[0100] The processor can access information and applications stored in memory via a transmission device to perform the following steps: retrieve historical transaction data involving the trading entity from the financial institution's database; and extract transaction behavior characteristic data of the trading entity within the target time period based on the trading entity's historical transaction data and transaction data within the target time period.

[0101] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: the transaction behavior characteristic data includes at least one of the following: transaction frequency data, common transaction type data, average transaction amount data, and transaction time characteristic data. The common transaction type data represents data in which the frequency of use by the transaction entity is greater than a preset frequency threshold.

[0102] The processor can invoke information and application programs stored in the memory via a transmission device to perform the following steps: matching the transaction behavior feature data of the trading entity within a target time period with a pre-configured feature library to obtain a matching result; if the matching result indicates that the transaction behavior feature data matches a target feature in the feature library, configuring a weight value for the trading entity based on the weight value corresponding to the matched target feature to obtain the first weight value of the trading entity's financial transaction; binning the transaction amount of the financial transaction corresponding to the trading entity to determine the amount range to which the transaction amount belongs; configuring a weight value corresponding to the amount range for the trading entity's financial transaction to obtain the second weight value of the trading entity's financial transaction; summing the first weight value and the second weight value of the trading entity's financial transaction to obtain the weight value of the trading entity's financial transaction, and configuring a weight value for the boundary corresponding to the financial transaction in the initial transaction network diagram based on the weight value of the trading entity's financial transaction amount.

[0103] The processor can access information and applications stored in memory via a transmission device to perform the following steps: inputting the transaction network graph into an abnormal transaction network identification model; traversing each node in the transaction network graph through the abnormal transaction network identification model to identify large-scale abnormal transaction networks, wherein the abnormal transaction network meets the following conditions: the abnormal transaction network contains at least three nodes; the geodesic distance between any two nodes in the abnormal transaction network is less than or equal to the model parameters; and any two nodes in the abnormal transaction network have a direct or indirect relationship. The model parameters are obtained based on iterative training of the model, and the geodesic distance is the result of accumulating the weight values ​​of all boundaries between two nodes. A direct relationship means that two nodes are directly connected through a boundary, and an indirect relationship means that two nodes are indirectly connected through multiple nodes and boundaries; extracting an abnormal transaction network subgraph from the transaction network graph and outputting the abnormal transaction network subgraph.

[0104] The processor can access information and applications stored in memory via a transmission device to execute the following steps: acquiring a historical transaction network graph constructed based on historical transaction data within a historical time period; extracting historical abnormal transaction network subgraphs from the historical transaction network graph, and constructing a sample dataset based on the historical transaction network graph and the historical abnormal transaction network subgraphs; dividing the sample dataset to obtain a training set and a test set; constructing a neural network model and configuring model parameters for the neural network model; iteratively training the neural network model based on the training set to obtain an initial abnormal transaction network identification model, wherein the model parameters are updated during iterative training of the neural network model; testing the initial abnormal transaction network identification model based on the test set to obtain test results, and obtaining the trained abnormal transaction network identification model based on the test results.

[0105] This invention provides a method for identifying abnormal transaction networks to detect large-scale abnormal transactions. By constructing a transaction network graph to record transaction data and relationships between various transaction entities, and analyzing the fund flow patterns among entities in the abnormal transaction network based on an abnormal transaction network model, the method can identify deeper and more concealed large-scale abnormal transactions, thereby improving the accuracy of abnormal transaction identification. This solves the technical problem in related technologies where supervised learning methods based on expert rules mainly focus on analyzing transaction information of individual customers or their direct trading partners, resulting in low accuracy in identifying large-scale abnormal transactions.

[0106] Those skilled in the art will understand that Figure 5 The structure shown is for illustrative purposes only. Electronic devices can also be smartphones, tablets, handheld computers, mobile internet devices (MIDs), PADs, and other terminal devices. Figure 5 This does not limit the structure of the aforementioned electronic device. For example, electronic devices may also include components that are more... Figure 5 The more or fewer components shown (such as network interfaces, display devices, etc.), or having the same Figure 5 The different configurations shown.

[0107] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a computer-readable storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0108] The invention will now be described in conjunction with another alternative embodiment.

[0109] Example 4

[0110] This invention also provides a computer-readable storage medium. Optionally, in this invention, the computer-readable storage medium can be used to store the program code executed by the abnormal transaction network identification method provided in Embodiment 1.

[0111] Optionally, in this embodiment of the invention, the storage medium may be located in any computer terminal in a group of computer terminals in a computer network, or in any mobile terminal in a group of mobile terminals.

[0112] This invention also provides a computer program product, which, when executed on a data processing device, is suitable for performing the steps of an abnormal transaction network identification method: acquiring a set of all transaction data of financial institutions within a target time period, wherein the transaction data set contains transaction data of M financial transactions, and the transaction data of each financial transaction includes at least: transaction type, transaction subject, and transaction amount, where the transaction subject represents the user executing the financial transaction; constructing a transaction network graph based on the transaction data set, wherein the transaction network graph is a network graph constructed with transaction subjects as nodes and the transaction relationships between transaction subjects as boundaries; inputting the transaction network graph into an abnormal transaction network identification model and outputting an abnormal transaction network subgraph, wherein the abnormal transaction network model is a pre-constructed neural network model for identifying large-scale abnormal transactions; and identifying the abnormal transaction network based on the abnormal transaction network subgraph.

[0113] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0114] In the above embodiments of the present invention, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0115] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For instance, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0116] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0117] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0118] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0119] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as within the scope of protection of the present invention.

Claims

1. A method for identifying abnormal transaction networks, characterized in that, include: Obtain a set of all transaction data of financial institutions within a target time period. The set of transaction data contains transaction data of M financial transactions. The transaction data of each financial transaction includes at least: transaction type, transaction subject, and transaction amount. The transaction subject represents the user executing the financial transaction. A transaction network graph is constructed based on the transaction data set, wherein the transaction network graph is a network graph constructed with the transaction entities as nodes and the transaction relationships between the transaction entities as boundaries; The transaction network graph is input into the abnormal transaction network identification model, and an abnormal transaction network subgraph is output. The abnormal transaction network model is a pre-built neural network model for identifying large-scale abnormal transactions. Identify abnormal transaction networks based on the aforementioned abnormal transaction network subgraph; The step of constructing a transaction network graph based on the transaction data set includes: constructing an initial transaction network graph based on the transaction data set; extracting transaction behavior feature data of the transaction entities, and configuring weight values ​​for each boundary in the initial transaction network graph based on the transaction behavior feature data and the transaction amount to obtain the transaction network graph; Specifically, this includes matching the transaction behavior feature data of the transaction entity within the target time period with a pre-configured feature library to obtain the matching result; If the matching result indicates that the transaction behavior feature data matches the target feature in the feature library, the first weight value of the financial transaction of the transaction entity is obtained by configuring the weight value of the transaction entity based on the weight value corresponding to the matched target feature. The transaction amounts of the financial transactions corresponding to the aforementioned transaction entities are binned to determine the range to which the transaction amounts belong. Assign a weight value corresponding to the amount range to the financial transactions of the trading entity to obtain the second weight value of the financial transactions of the trading entity; The first weight value and the second weight value of the financial transaction of the trading entity are accumulated to obtain the weight value of the financial transaction of the trading entity, and the weight value of the financial transaction corresponding to the financial transaction in the initial transaction network diagram is configured based on the weight value of the financial transaction amount of the trading entity. The steps of inputting the transaction network graph into the abnormal transaction network identification model and outputting the abnormal transaction network subgraph include: The transaction network graph is input into the abnormal transaction network identification model. The abnormal transaction network identification model traverses each node in the transaction network graph to identify the abnormal transaction network. The abnormal transaction network satisfies the following conditions: the abnormal transaction network contains at least three nodes; the geodesic distance between any two nodes in the abnormal transaction network is less than or equal to the model parameters; and any two nodes in the abnormal transaction network have a direct or indirect relationship. The model parameters are obtained based on iterative training of the model. The geodesic distance is the result of accumulating the weight values ​​of all boundaries between two nodes. The direct relationship means that the two nodes are directly connected through a boundary, and the indirect relationship means that the two nodes are indirectly connected through multiple nodes and boundaries. Extract the abnormal transaction network subgraph from the transaction network graph and output the abnormal transaction network subgraph.

2. The method according to claim 1, characterized in that, The steps for extracting the transaction behavior feature data of the transaction entity include: Obtain historical transaction data involving the transaction entity from the database of the financial institution; Based on the historical transaction data of the trading entity and the transaction data within the target time period, the transaction behavior characteristic data of the trading entity within the target time period are extracted.

3. The method according to claim 2, characterized in that, The transaction behavior characteristic data includes at least one of the following: transaction frequency data, common transaction type data, average transaction amount data, and transaction time characteristic data. The common transaction type data represents data where the frequency of use by the transaction entity is greater than a preset frequency threshold.

4. The method according to claim 1, characterized in that, The abnormal transaction network identification model is pre-built, and the steps for building the abnormal transaction network identification model include: Obtain a historical transaction network diagram constructed based on historical transaction data within a historical time period; Based on the historical transaction network graph, extract historical abnormal transaction network subgraphs, and construct a sample dataset based on the historical transaction network graph and the historical abnormal transaction network subgraphs; The sample dataset is divided into a training set and a test set; Construct a neural network model and configure model parameters for the neural network model; The neural network model is iteratively trained based on the training set to obtain an initial abnormal transaction network identification model, wherein the model parameters are updated during the iterative training of the neural network model. The initial abnormal transaction network identification model is tested based on the test set to obtain test results. The test results indicate the initial abnormal transaction network identification model, thus obtaining the trained abnormal transaction network identification model.

5. A device for identifying abnormal transaction networks, characterized in that, include: The acquisition unit is used to acquire a set of all transaction data of financial institutions within a target time period. The set of transaction data contains transaction data of M financial transactions. The transaction data of each financial transaction includes at least: transaction type, transaction subject, and transaction amount. The transaction subject represents the user who executes the financial transaction. A construction unit is used to construct a transaction network graph based on the transaction data set, wherein the transaction network graph is a network graph constructed with the transaction entities as nodes and the transaction relationships between the transaction entities as boundaries; The output unit is used to input the transaction network graph into the abnormal transaction network identification model and output an abnormal transaction network subgraph, wherein the abnormal transaction network model is a pre-built neural network model for identifying large-scale abnormal transactions. The identification unit is used to identify abnormal transaction networks based on the abnormal transaction network subgraph. The construction unit includes: a first construction module, used to construct an initial transaction network graph based on the transaction data set; and a first extraction module, used to extract transaction behavior feature data of the transaction subject, and configure weight values ​​for each boundary in the initial transaction network graph based on the transaction behavior feature data and the transaction amount, thereby obtaining the transaction network graph. The first extraction module includes: a first matching submodule, used to match the transaction behavior feature data of the transaction entity within a target time period with a pre-configured feature library to obtain a matching result; a first configuration submodule, used to configure a weight value for the transaction entity based on the weight value corresponding to the hit target feature in the feature library when the matching result indicates that the transaction behavior feature data hits a target feature in the feature library, to obtain a first weight value for the financial transaction of the transaction entity; a first processing submodule, used to perform binning processing on the transaction amount of the financial transaction corresponding to the transaction entity to determine the amount range to which the transaction amount belongs; a second configuration submodule, used to configure a weight value corresponding to the amount range for the financial transaction of the transaction entity to obtain a second weight value for the financial transaction of the transaction entity; and a first calculation submodule, used to accumulate the first weight value and the second weight value of the financial transaction of the transaction entity to obtain the weight value of the financial transaction of the transaction entity, and configure a weight value based on the weight value of the financial transaction amount of the transaction entity on the boundary corresponding to the financial transaction in the initial transaction network graph. The output module includes: a first traversal submodule, used to input the transaction network graph into the abnormal transaction network identification model, and traverse each node in the transaction network graph through the abnormal transaction network identification model to identify the abnormal transaction network, wherein the abnormal transaction network satisfies the following conditions: the abnormal transaction network contains at least three nodes, the geodesic distance between any two nodes in the abnormal transaction network is less than or equal to the model parameters, and any two nodes in the abnormal transaction network have a direct or indirect relationship, wherein the model parameters are obtained based on iterative training of the model, the geodesic distance is the result of accumulating the weight values ​​of all boundaries between two nodes, the direct relationship means that the two nodes are directly connected through a boundary, and the indirect relationship means that the two nodes are indirectly connected through multiple nodes and boundaries; and a first output submodule, used to extract the abnormal transaction network subgraph from the transaction network graph and output the abnormal transaction network subgraph.

6. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored computer program, wherein, when the computer program is executed, it controls the device on which the computer-readable storage medium is located to perform the method for identifying abnormal transaction networks as described in any one of claims 1 to 4.

7. An electronic device, characterized in that, It includes one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the method for identifying abnormal transaction networks as described in any one of claims 1 to 4.

Images