Early warning method and device for trusted payment fund backflow

Abstract

The invention discloses an early warning method and device for entrusted payment fund backflow, and relates to the field of artificial intelligence. The method comprises the following steps: acquiring transaction data between a target loan person and a target payee; performing fund backflow risk monitoring on the transaction data based on a first model to obtain a first risk monitoring result; performing fund backflow risk monitoring on the double-layer network by using the first operation and the second operation to obtain a second risk monitoring result; and according to the first risk monitoring result and the second risk monitoring result, determining a fund backflow risk transaction, and carrying out early warning on the fund backflow risk transaction. According to the method and the device, the technical problem of low early warning accuracy caused by low monitoring accuracy when entrusted payment fund backflow monitoring depends on a rule engine and manual review in the prior art is solved.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence, and more specifically, to an early warning method and device for the reflux of entrusted payment funds. Background Art

[0002] As a financial innovation, entrusted payment loans are designed to ensure that loan funds are used for designated legitimate purposes and prevent borrowers from diverting funds to high-risk investments or other unauthorized activities. This loan model helps increase financing convenience, improve efficiency and transparency in the use of funds, and reduce credit risks.

[0003] However, under the entrusted payment model, the monitoring of loan fund repatriation also poses certain challenges to the bank's risk management. Some borrowers may use complex transaction structures to try to circumvent supervision and indirectly repatriate funds to themselves or the companies they control, which will result in the loan funds not being fully used in the real economy. Not only will the funds be misappropriated, but they may also be used for high-risk investments.

[0004] At present, the primary challenge for banks in dealing with entrusted payment risks is the integration of internal data and the acquisition of external data. Although banks have a large amount of transaction data, the data is distributed in different business systems and lacks an effective integration mechanism, making it difficult to grasp the overall picture of capital flows in real time and comprehensively; secondly, banks often rely on rule engines and manual review to monitor risks. This method is not only time-consuming and labor-intensive, but also difficult to adapt to the increasingly complex and changeable capital default risks and reflux methods, especially in the face of highly concealed operations such as fund splitting and multi-level transfers; finally, there is a lack of intelligent risk warning models, which makes it impossible to check sudden risks in a timely manner, and it is easy to miss the best time for warning and intervention.

[0005] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0006] The main purpose of this application is to provide an early warning method and device for the reflux of entrusted payment funds, so as to at least solve the technical problem that when the entrusted payment fund reflux monitoring relies on rule engines and manual review in the prior art, the monitoring accuracy is low, resulting in low early warning accuracy.

[0007] In order to achieve the above-mentioned purpose, according to one aspect of the present application, there is provided an early warning method for the reflux of entrusted payment funds, the method comprising: obtaining transaction data between a target lender and a target payee; monitoring the transaction data for fund reflux risk based on a first model to obtain a first risk monitoring result, wherein the first model is used to analyze the fund flow status that changes over time; monitoring the double-layer network for fund reflux risk using a first operation and a second operation to obtain a second risk monitoring result, wherein the first operation is used to identify abnormal paths in the double-layer network, and the second operation is used to extract transaction network features based on the double-layer network, and determine abnormal transaction behaviors based on the transaction network features, the double-layer network comprising a first relationship network and a second relationship network, wherein the first relationship network is used to characterize the affiliated enterprise information of the lender and the payee, and the second relationship network is used to characterize the flow of account funds of the lender and the payee; determining fund reflux risk transactions based on the first risk monitoring result and the second risk monitoring result, and issuing an early warning for fund reflux risk transactions.

[0008] Optionally, target parameters of the first model are set based on preset rules, wherein the target parameters are used to monitor abnormal flow information of funds; a target algorithm is obtained, wherein the target algorithm is used to identify abnormal flow paths from transactions; transaction data is calculated according to the target algorithm and target parameters to obtain a target sequence, wherein the target sequence includes transaction information of abnormal transactions; and a first risk monitoring result is determined according to the target sequence.

[0009] Optionally, an abnormal node and a first abnormal path are determined based on a double-layer network, wherein the abnormal node is used to characterize a borrower or payee with abnormal transactions, and the first abnormal path is used to characterize the flow trajectory of abnormal funds, wherein the double-layer network includes multiple network paths, and the multiple network paths include the first abnormal path; based on the first operation detection, a second abnormal path in the double-layer network is obtained, wherein the second abnormal path and the first abnormal path are different network paths; features are extracted for each node, each network path, abnormal node, first abnormal path and second abnormal path in the double-layer network to obtain a target feature vector, wherein the target feature vector is used to represent attribute information of the transaction mode; and the target feature vector is classified into abnormal states using a second operation to obtain a second risk monitoring result.

[0010] Optionally, a first set and a second set are determined based on a double-layer network, wherein the first set includes a set of other nodes connected to the target payee through a direct or indirect relationship, and the second set includes a set of other nodes connected to the target lender through a direct or indirect relationship; based on the intersection of the first set and the second set, the abnormal node and the first abnormal path are determined.

[0011] Optionally, feature extraction is performed on each transaction path in the double-layer network to obtain a target feature corresponding to each transaction path, wherein the target feature corresponding to each transaction path is used to characterize a potential abnormal transaction mode of the transaction path; an abnormality score of each transaction path is determined according to the target feature corresponding to each transaction path through a first operation; when the abnormality score of any transaction path in the double-layer network is greater than a preset score, the transaction path is determined to be a second abnormal path; when the abnormality score of any transaction path in the double-layer network is less than or equal to a preset score, the transaction path is determined to be a normal transaction path.

[0012] Optionally, if the first risk monitoring result and the second risk monitoring result of the i-th transaction both indicate that the risk value of the i-th transaction is the first risk value, a first warning value is generated for the i-th transaction according to the risk model, wherein i is an integer greater than or equal to 1, and the first risk value is greater than or equal to a preset risk threshold, and the risk model is used to evaluate and warn of the risk of capital flow in the entrusted payment business; if one of the first risk monitoring result and the second risk monitoring result of the i-th transaction indicates that the risk value of the i-th transaction is the first risk value, and the other risk detection result indicates that the risk value of the i-th transaction is the second risk value, a second warning value is generated for the i-th transaction according to the risk model, wherein the first warning value is greater than the second warning value, and the second risk value is less than the first risk value; if the first risk monitoring result and the second risk monitoring result of the i-th transaction both indicate that the risk value of the i-th transaction is the second risk value, no warning is issued for the i-th transaction.

[0013] Optionally, the double-layer network, abnormal nodes, the first abnormal path and the second abnormal path are analyzed using a target neural network to obtain abnormal transaction classification results, wherein the target neural network is used to identify and warn of different types of capital reflux risks; and the warning method is determined based on the abnormal transaction classification results.

[0014] In order to achieve the above-mentioned purpose, according to another aspect of the present application, there is also provided an early warning device for the reflux of entrusted payment funds, including: a first acquisition unit, which acquires transaction data between a target lender and a target payee; a first monitoring unit, which monitors the risk of fund reflux on the transaction data based on a first model, and obtains a first risk monitoring result, wherein the first model is used to analyze the fund flow status that changes over time; a second monitoring unit, which monitors the risk of fund reflux on the double-layer network using a first operation and a second operation, and obtains a second risk monitoring result, wherein the first operation is used to identify abnormal paths in the double-layer network, and the second operation is used to extract transaction network features based on the double-layer network, and determine abnormal transaction behaviors based on the transaction network features, and the double-layer network includes a first relationship network and a second relationship network, wherein the first relationship network is used to characterize the affiliated enterprise information of the lender and the payee, and the second relationship network is used to characterize the flow of account funds of the lender and the payee; a first early warning unit, which determines fund reflux risk transactions based on the first risk monitoring result and the second risk monitoring result, and issues an early warning for fund reflux risk transactions.

[0015] Optionally, the first monitoring unit includes: a first setting subunit, a first acquisition subunit, a first calculation subunit, and a first determination subunit. The first setting subunit is used to set the target parameters of the first model based on preset rules, wherein the target parameters are used to monitor abnormal flow information of funds; the first acquisition subunit is used to obtain a target algorithm, wherein the target algorithm is used to identify abnormal flow paths from transactions; the first calculation subunit is used to calculate transaction data according to the target algorithm and target parameters to obtain a target sequence, wherein the target sequence includes transaction information of abnormal transactions; the first determination subunit is used to determine the first risk monitoring result according to the target sequence.

[0016] Optionally, the second monitoring unit includes: a second determination subunit, a first detection subunit, a first extraction subunit, and a first classification subunit. The second determination subunit is used to determine abnormal nodes and first abnormal paths according to the double-layer network, wherein the abnormal nodes are used to characterize borrowers or payees with abnormal transactions, and the first abnormal path is used to characterize the flow trajectory of abnormal funds, wherein the double-layer network includes multiple network paths, and the multiple network paths include the first abnormal path; the first detection subunit is used to obtain the second abnormal path in the double-layer network based on the first operation detection, wherein the second abnormal path and the first abnormal path are different network paths; the first extraction subunit is used to extract features from each node, each network path, abnormal node, first abnormal path, and second abnormal path in the double-layer network to obtain a target feature vector, wherein the target feature vector is used to represent the attribute information of the transaction mode; the first classification subunit is used to classify the abnormal state of the target feature vector using the second operation to obtain a second risk monitoring result.

[0017] Optionally, the second determination subunit includes: a first determination module and a second determination module. The first determination module is used to determine a first set and a second set according to the double-layer network, wherein the first set includes a set of other nodes connected to the target payee through a direct or indirect relationship, and the second set includes a set of other nodes connected to the target lender through a direct or indirect relationship; the second determination module is used to determine the abnormal node and the first abnormal path according to the intersection of the first set and the second set.

[0018] Optionally, the first detection subunit includes: a first extraction module, a third determination module, a fourth determination module, and a fifth determination module. The first extraction module is used to extract features from each transaction path in the double-layer network to obtain target features corresponding to each transaction path, wherein the target features corresponding to each transaction path are used to characterize the potential abnormal transaction mode of the transaction path; the third determination module is used to determine the abnormality score of each transaction path according to the target features corresponding to each transaction path through the first operation; the fourth determination module is used to determine that the transaction path is a second abnormal path when the abnormality score of any transaction path in the double-layer network is greater than a preset score; the fifth determination module is used to determine that the transaction path is a normal transaction path when the abnormality score of any transaction path in the double-layer network is less than or equal to the preset score.

[0019] Optionally, the first warning unit includes: a first generating subunit, a second generating subunit, and a first processing subunit. In the first generating subunit, if the first risk monitoring result and the second risk monitoring result of the i-th transaction both indicate that the risk value of the i-th transaction is the first risk value, a first warning value is generated for the i-th transaction according to the risk model, wherein i is an integer greater than or equal to 1, the first risk value is greater than or equal to a preset risk threshold, and the risk model is used to evaluate and warn the risk of capital flow in the entrusted payment business; in the second generating subunit, if one of the first risk monitoring result and the second risk monitoring result of the i-th transaction indicates that the risk value of the i-th transaction is the first risk value, and the other risk detection result indicates that the risk value of the i-th transaction is the second risk value, a second warning value is generated for the i-th transaction according to the risk model, wherein the first warning value is greater than the second warning value, and the second risk value is less than the first risk value; in the first processing subunit, if the first risk monitoring result and the second risk monitoring result of the i-th transaction both indicate that the risk value of the i-th transaction is the second risk value, no warning is issued for the i-th transaction.

[0020] Optionally, the early warning device for entrusted payment fund reflux further includes: an analysis unit and a determination unit. The analysis unit is used to analyze the double-layer network, abnormal nodes, the first abnormal path and the second abnormal path using a target neural network to obtain abnormal transaction classification results, wherein the target neural network is used to identify and warn different types of fund reflux risks; the determination unit is used to determine the early warning method according to the abnormal transaction classification results.

[0021] According to another aspect of an embodiment of the present application, a computer-readable storage medium is also provided, the computer-readable storage medium including a stored executable program, wherein when the executable program is running, the device where the computer-readable storage medium is located is controlled to execute the above-mentioned early warning method for the reflux of entrusted payment funds.

[0022] According to another aspect of an embodiment of the present application, there is also provided an electronic device, comprising: a memory storing an executable program; and a processor for running the program, wherein the above-mentioned early warning method for the reflux of entrusted payment funds is executed when the program is running.

[0023] According to another aspect of the embodiment of the present application, a computer program product is also provided, including computer instructions, which, when executed by a processor, implement the steps of the above-mentioned early warning method for the reflux of entrusted payment funds.

[0024] In the present application, the transaction data between the target lender and the target payee is first obtained, and then the transaction data is monitored for capital reflux risk based on the first model to obtain a first risk monitoring result, wherein the first model is used to analyze the capital flow state that changes over time, and then the double-layer network is monitored for capital reflux risk using the first operation and the second operation to obtain a second risk monitoring result, wherein the first operation is used to identify abnormal paths in the double-layer network, and the second operation is used to extract transaction network features based on the double-layer network, and determine abnormal transaction behavior based on the transaction network features, the double-layer network includes a first relationship network and a second relationship network, wherein the first relationship network is used to characterize the loan The second relationship network is used to characterize the flow of funds in the lender's and the payee's accounts, and finally, the capital reflux risk transactions are determined based on the first risk monitoring result and the second risk monitoring result, and early warnings are issued for capital reflux risk transactions, that is, by combining the double-layer monitoring and early warning method of time series analysis and network structure analysis, the purpose of real-time, comprehensive and intelligent capital reflux risk early warning is achieved, thereby achieving the technical effect of improving the accuracy of entrusted payment capital reflux early warning, and further solving the technical problem of low monitoring accuracy and low early warning accuracy when relying on rule engines and manual review to monitor entrusted payment capital reflux in the prior art. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] The drawings constituting a part of the present application are used to provide a further understanding of the present application. The illustrative embodiments and descriptions of the present application are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0026] Figure 1 A hardware structure block diagram of a computer terminal for implementing an early warning method for entrusted payment fund reflux is shown;

[0027] Figure 2 is a flow chart of an optional early warning method for entrusted payment fund reflux according to an embodiment of the present application;

[0028] Figure 3 is a schematic diagram of an optional company-associated account relationship network according to an embodiment of the present application;

[0029] Figure 4 is a schematic diagram of an optional HMM model application according to an embodiment of the present application;

[0030] Figure 5 is a schematic diagram of an optional node m-degree association network structure according to an embodiment of the present application;

[0031] Figure 6 is a schematic diagram of an optional risk warning drawn based on a fusion risk model according to an embodiment of the present application;

[0032] Figure 7 is a schematic diagram of an optional early warning device for entrusted payment fund reflux according to an embodiment of the present application;

[0033] Figure 8 It is a structural block diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0034] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0035] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0036] It should be noted that the collected information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for display, data for analysis, etc.) involved in this application are information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of relevant data are in compliance with relevant laws, regulations and standards, necessary confidentiality measures are taken, and public order and good customs are not violated, and corresponding operation entrances are provided for users to choose to authorize or refuse. For example, an interface is set up between this system and relevant users or institutions to provide users with corresponding operation entrances for users to choose to agree or refuse the results of automated decision-making; if the user chooses to refuse, the expert decision-making process will be entered.

[0037] Example 1

[0038] According to an embodiment of the present application, an embodiment of an early warning method for the reflux of entrusted payment funds is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0039] It should be noted that an intelligent early warning system can be used as the execution subject of the early warning method for entrusted payment fund reflux in the embodiment of the present application. It is understandable that the early warning method for entrusted payment fund reflux provided in the embodiment of the present application can also be executed by other systems or devices, and the embodiment of the present application does not specifically limit this.

[0040] The method embodiments provided in the present application may be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 1 The hardware structure block diagram of a computer terminal (or mobile device) for implementing an early warning method for entrusted payment fund reflux is shown. Figure 1As shown, the computer terminal 10 (or mobile device) may include one or more (102a, 102b, ..., 102n are used to illustrate) processors 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the BUS bus), a network interface, a power supply and / or a camera. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations shown.

[0041] It should be noted that the above-mentioned one or more processors 102 and / or other data processing circuits may generally be referred to as "data processing circuits" in this article. The data processing circuit may be embodied in whole or in part as software, hardware, firmware or any other combination. In addition, the data processing circuit may be a single independent processing module, or may be fully or partially integrated into any of the other components in the computer terminal 10 (or mobile device). As in the early warning method for the reflux of entrusted payment funds involved in the embodiments of the present application, the data processing circuit serves as a processor control (for example, the selection of the variable resistance terminal path connected to the interface).

[0042] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the early warning method for the reflux of entrusted payment funds in the embodiment of the present application. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, that is, the early warning method for the reflux of entrusted payment funds mentioned above is realized. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the computer terminal 10 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0043] The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the computer terminal 10. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0044] The display may be a touch screen type liquid crystal display (LCD) that enables a user to interact with a user interface of the computer terminal 10 (or mobile device).

[0045] Under the above operating environment, this application provides Figure 2 The early warning method for the return of entrusted payment funds is shown. Figure 2 FIG. 1 is a flow chart of an optional early warning method for entrusted payment fund reflux according to an embodiment of the present application. Figure 2 As shown, the method comprises the following steps:

[0046] Step S201, obtaining transaction data between a target lender and a target payee.

[0047] Optionally, the intelligent early warning system will obtain relevant transaction flow details of the lender and the payee, including but not limited to transfers, remittances, collections, and withdrawals.

[0048] Step S202: monitoring the capital repatriation risk of the transaction data based on the first model to obtain a first risk monitoring result.

[0049] In step S202, the first model is used to analyze the capital flow status that changes over time.

[0050] Optionally, there are three main forms of fund reflow, namely direct split reflow, indirect reflow and invisible reflow. Among them, direct split reflow means that the beneficiary of the entrusted payment splits the funds into multiple payments and transfers them to the borrower's account over multiple days; indirect reflow means that the beneficiary of the entrusted payment transfers the funds to an external bank and then reflows them to the borrower within the bank; invisible reflow means that the funds are reflowed to the borrower's affiliated companies or transferred across banks and then reflowed to the borrower through affiliated companies.

[0051] Optionally, in order to reduce labor and time costs and further improve the accuracy of risk identification for such fund return methods, the HMM model is used for monitoring, that is, the first model is HMM (Hidden Markov Model). HMM is a statistical model. In HMM, the system is regarded as a state sequence that changes randomly according to the Markov process, and the observed data sequence is generated by these states. In the embodiment of the present application, it is used to parse the state of fund flow that changes over time and identify whether there is a risk of direct splitting and reflux, that is, the payee directly or indirectly flows funds back to the borrower's account. HMM provides a method for identifying instant and cross-day splitting behaviors, which can support real-time processing of data streams, identify abnormal transaction timing dependencies, estimate the probability of transaction status in a dynamic environment, and implement hierarchical early warning monitoring for suspicious transactions.

[0052] Optionally, after analyzing the transaction data through the HMM model, the intelligent early warning system obtains preliminary assessment results on the risk of capital repatriation, including normal status, low-risk status, medium-risk status and high-risk status of the transaction.

[0053] Step S203, using the first operation and the second operation to monitor the risk of capital reflow on the double-layer network, and obtaining a second risk monitoring result.

[0054] In step S203, the first operation is used to identify abnormal paths in the double-layer network, and the second operation is used to extract transaction network features based on the double-layer network and determine abnormal transaction behaviors according to the transaction network features. The double-layer network includes a first relationship network and a second relationship network.

[0055] In step S203, the first relationship network is used to represent the information of the associated enterprises of the lender and the payee, and the second relationship network is used to represent the flow of funds in the accounts of the lender and the payee.

[0056] Optionally, abnormal transactions include but are not limited to abnormal amount, abnormal transaction frequency, abnormal time, abnormal transaction counterparty, abnormal purpose, and abnormal pattern. Among them, abnormal amount means that the transaction amount far exceeds the average or regular range of historical transactions, or the amount shows regular changes, such as splitting into multiple small transactions to evade supervision; abnormal transaction frequency means that the frequency of transactions suddenly increases or decreases, which is inconsistent with the historical transaction pattern, and may indicate unusual capital flow; abnormal time means that the time when the transaction occurs does not conform to the usual transaction time pattern, such as large transactions during non-business hours, or frequent transactions in a short period of time; abnormal transaction counterparty means that the transaction counterparty is an uncommon or business-irrelevant entity, especially when funds flow to the borrower's affiliated companies or accounts, which may be a signal of capital reflux; abnormal purpose means that unusual descriptions appear in the transaction summary or purpose notes, such as purposes unrelated to the borrower's business, or vague descriptions, which may mean that the purpose of the use of funds is improper; abnormal pattern means that the transaction pattern changes suddenly, such as from the usual physical transactions to frequent electronic transfers, or the emergence of a complex chain of capital flow, all of which may involve illegal activities.

[0057] Optionally, the intelligent early warning system is driven by the fusion of internal and external data to build a two-layer network. First, it builds a comprehensive, three-dimensional, and highly accurate customer-related enterprise relationship network. Second, it builds an account-level capital flow dynamic network based on embedded text and time series of transaction events. Third, between the two levels of networks, the account nodes in the transaction network are connected with the enterprise nodes in the enterprise relationship network to form a two-layer network, accurately depicting the panoramic view of capital flows. The intelligent early warning system monitors the indirect and hidden capital reflux risks through the two-layer network.

[0058] Optionally, the intelligent early warning system builds an anomaly detection model based on a two-layer network, which integrates transaction information between accounts, information about associated companies of accounts, and relationship information between customers. Based on the two-layer network, indirect multi-layer fund flow monitoring can be performed in cross-cycle, multi-time series, and multi-transaction scenarios, realizing intelligent risk control early warning from "one-point" detection to "comprehensive" prevention and control.

[0059] Optionally, Figure 3 is a schematic diagram of an optional company-associated account relationship network according to an embodiment of the present application, such as Figure 3As shown, the company's associated account relationship network includes but is not limited to third-party asset mortgage relationships, family relationships, other relationships (such as contacts with the same mobile phone number, contacts with the same address), common cardholders, credit relationships, equity relationships, guarantee relationships, and corporate executive / legal person relationships, among which, third-party asset mortgage relationships include third-party legal person customer asset mortgages, third-party legal person representative customer asset mortgages, and third-party individual customer asset mortgages. Family relationships include husband-wife relationships and other family relationships. Common cardholders include joint business card customers, joint credit card-related customers, and joint cardholders of customer leaders. Credit relationships include credit association numbers and credit amounts. Equity relationships include controlling shareholders, largest shareholders, and general shareholders. Guarantee relationships include customer mutual insurance, shareholder guarantees, and customer joint insurance. Corporate executive / legal person relationships include corporate legal representatives, the same legal representatives, legal representatives serving in other places, and common executives.

[0060] Optionally, the first operation is to identify abnormal paths through network node association analysis to capture possible indirect or invisible capital reflux. The second operation is based on Isolation Forest (Isolation Forest Algorithm) and XGBoost (Extreme Gradient Boosting Algorithm) algorithms to extract transaction network features, identify abnormal transaction behaviors, and further refine capital reflux risk monitoring.

[0061] It should be noted that Isolation Forest is an anomaly detection algorithm in unsupervised learning, which is mainly used to identify a small number of outliers or outliers in a data set. The Isolation Forest algorithm uses two quantitative properties of sample abnormal data: few and different, where few means that there are a small number of abnormal data points, and different means that there is a large difference between the attribute values ​​of abnormal data points and the attribute values ​​of normal data points. Compared with normal data points, they are easier to isolate and are more suitable for anomaly detection of a large number of network node data; the XGBoost algorithm is a machine learning algorithm based on gradient boosting decision trees. It performs well in tasks such as classification, regression, and sorting, especially in processing large-scale data with high efficiency and accuracy. XGBoost constructs multiple decision trees and uses an additive model to combine the prediction results of these trees to form the final output. Due to the characteristics of XGboost's high efficiency, superior performance, and strong ability to process heterogeneous data, the embodiment of the present application selects the XGboost model as a classifier for monitoring whether capital repatriation is abnormal.

[0062] Step S204, determining the capital reflow risk transaction according to the first risk monitoring result and the second risk monitoring result, and issuing an early warning for the capital reflow risk transaction.

[0063] Optionally, the intelligent early warning system integrates the detection results of the HMM model and the two-layer network to issue warnings for transactions that are judged to be at risk of capital repatriation, prompting banks to take timely measures to prevent the expansion of credit risks and ensure the safety of funds.

[0064] It can be seen from the contents of step S201 to step S204 that in the present application, the transaction data between the target lender and the target payee is first obtained, and then the transaction data is monitored for capital reflux risk based on the first model to obtain a first risk monitoring result, wherein the first model is used to analyze the capital flow state that changes over time, and then the double-layer network is monitored for capital reflux risk using the first operation and the second operation to obtain a second risk monitoring result, wherein the first operation is used to identify abnormal paths in the double-layer network, and the second operation is used to extract transaction network features based on the double-layer network, and determine abnormal transaction behavior based on the transaction network features, the double-layer network includes a first relationship network and a second relationship network, wherein the first operation is used to identify abnormal paths in the double-layer network, and the second operation is used to extract transaction network features based on the double-layer network, and determine abnormal transaction behavior based on the transaction network features, the double-layer network includes a first relationship network and a second relationship network, The first relationship network is used to characterize the information of the affiliated enterprises of the lender and the payee, and the second relationship network is used to characterize the flow of funds in the accounts of the lender and the payee. Finally, the capital reflux risk transactions are determined based on the first risk monitoring result and the second risk monitoring result, and early warnings are issued for the capital reflux risk transactions. That is, by combining the double-layer monitoring and early warning method of time series analysis and network structure analysis, the purpose of real-time, comprehensive and intelligent capital reflux risk early warning is achieved, thereby achieving the technical effect of improving the accuracy of entrusted payment capital reflux early warning, and further solving the technical problem of low monitoring accuracy and low early warning accuracy when relying on rule engines and manual review to monitor entrusted payment capital reflux in the prior art.

[0065] In an optional embodiment, the intelligent early warning system first sets the target parameters of the first model based on preset rules, wherein the target parameters are used to monitor abnormal flow information of funds; secondly, a target algorithm is obtained, wherein the target algorithm is used to identify abnormal flow paths from transactions; and then the transaction data is calculated according to the target algorithm and the target parameters to obtain a target sequence, wherein the target sequence includes transaction information of abnormal transactions; and finally, a first risk monitoring result is determined according to the target sequence.

[0066] Optionally, the target algorithm is the Viterbi algorithm, which is a dynamic programming algorithm for finding the most likely state sequence in an HMM model. In an HMM, the true state of the system is hidden, but the system produces observable outputs based on its internal state. The task of the Viterbi algorithm is to find the most likely hidden state sequence that produces this observation sequence given an observation sequence. In short, it is used to decode the HMM and infer the most likely hidden state sequence from a known observation sequence.

[0067] Optionally, the intelligent early warning system sets the parameters of the HMM model according to data exploration and rules derived by relevant business experts, and then uses the obtained HMM model in combination with the Viterbi algorithm to calculate the most likely implicit state sequence corresponding to the currently observed capital transaction sequence, thereby classifying each capital transaction into normal, medium-risk, and high-risk transactions, and realizing a risk monitoring and early warning mechanism with real-time monitoring and hierarchical management.

[0068] Optionally, Figure 4 is a schematic diagram of an optional HMM model application according to an embodiment of the present application, such as Figure 4 As shown, first of all, data preparation is carried out, including the transaction history records, observation sequences O, and implicit state space Q of customer accounts stored in the banking system. The observation sequence is composed of the flow details of each fund transaction in the historical transaction data, including transfers, remittances, collections, withdrawals, etc., involving transaction amounts, transaction types, etc. These attributes are directly observable; the implicit state space refers to a set of possible internal states, such as the normal state of transactions, low-risk state, medium-risk state, high-risk state, etc. These states are defined based on the potential risk level of transaction behaviors. Then, relevant personnel formulate rules to set the three parameters of the HMM model based on the prepared data. The three parameters are π, A, and B, respectively. π is a vector indicating the probability that the model is in each hidden state at the beginning, and A is the state transition probability matrix (describing the probability of transitioning between any two hidden states, that is, the previous state transitions to the next state The probability of a transaction is determined by the model. A is the probability of generating a specific observation result under a given hidden state, that is, the probability of observing a certain transaction attribute when the model is in a certain state). Then, based on the Viterbi algorithm, each newly added transaction (such as o1, o2…ot, each new transaction data received by the bank will be added to the existing transaction data sequence to form a continuously updated sequence. This is a dynamic process, because new transactions occur in the account every day, and these transaction data need to be processed by the model in real time) is analyzed. The Viterbi algorithm will predict the most likely implicit sequence that this transaction is most likely to correspond to based on historical transaction data and model parameters, that is, the risk state (which one of normal, low risk, medium risk, and high risk it belongs to). Finally, based on real-time monitoring and hierarchical management, the most likely implicit state sequence is output, and transactions with different risk states are managed in a hierarchical manner.

[0069] From the above content, it can be seen that the intelligent early warning system has achieved efficient and accurate identification of the direct splitting and reflux risk of entrusted payment funds through the combined application of the HMM model and the Viterbi algorithm. The system can monitor each fund transaction in real time, dynamically capture abnormal patterns in the transaction sequence, and timely warn of abnormal transactions, which significantly improves the defense capabilities of banks and financial institutions against credit risks. At the same time, the introduction of the Viterbi algorithm ensures that the true state of fund flow can still be accurately estimated in a complex transaction environment. Even in scenarios with frequent transactions and large fluctuations in amounts, it can effectively identify whether funds are flowing back to the borrower or its controlled affiliated companies. In addition, the use of the intelligent early warning system reduces the reliance on manual review, improves the degree of automation of risk monitoring, and reduces response time, which helps banks take measures at the first time to prevent the expansion of credit risks and ensure the safety of funds.

[0070] In an optional embodiment, the intelligent early warning system determines abnormal nodes and a first abnormal path based on a double-layer network, wherein the abnormal nodes are used to characterize borrowers or payees with abnormal transactions, and the first abnormal path is used to characterize the flow trajectory of abnormal funds, wherein the double-layer network includes multiple network paths, and the multiple network paths include the first abnormal path, and then the second abnormal path in the double-layer network is obtained based on the first operation detection, wherein the second abnormal path and the first abnormal path are different network paths, and feature extraction is performed on each node, each network path, abnormal node, first abnormal path and second abnormal path in the double-layer network to obtain a target feature vector, wherein the target feature vector is used to represent attribute information of the transaction mode, and finally the target feature vector is classified into abnormal states using the second operation to obtain a second risk monitoring result.

[0071] Optionally, the intelligent early warning system determines the abnormal nodes and the first abnormal path based on the analysis of the network node-associated nodes. On the basis of determining the first abnormal path, the system detects a second abnormal path different from the first abnormal path through further network analysis. These paths may involve more complex or hidden means of capital repatriation, such as multi-layer transfers, inter-bank transactions, etc. Then, for each node and each network path, including abnormal nodes and abnormal paths, the system performs feature extraction and constructs a target feature vector. These features include but are not limited to the centrality index of the node, path length, transaction amount, transaction time interval, transaction summary text, etc. The target feature vector integrates the multi-dimensional information of the capital transaction and provides rich attribute information for the classification of abnormal states. Then, XGBoost is used to classify the abnormal state of the target feature vector to obtain the second risk monitoring result.

[0072] Optionally, before building the XGBoost model, it is necessary to carefully annotate the subgraphs or nodes that have been initially identified as possibly abnormal. If there is no problem, that is, the transaction is normal, it is annotated as 0. If there is a doubt, the transaction may be abnormal or risky, it is annotated as 1. Then, in the XGBoost model training, the annotated data is randomly divided into a training set and a validation set in an 8:2 ratio and input into the XGboost model for training, and the F1-score (an indicator used in statistics to measure the performance of a classifier) ​​is used to evaluate the performance of the model.

[0073] Optionally, the intelligent early warning system combines the node features, edge features, embedded time features, text features of the double-layer network, the above-mentioned early warning information, and abnormal nodes and abnormal paths (first abnormal path, second abnormal path) as transaction features (target feature vectors) and puts them into the XGBoost model for abnormal state classification to obtain the second risk monitoring result.

[0074] Optionally, Table 1 is an example of an optional model feature according to an embodiment of the present application. As shown in Table 1, the input features of the XGBoost model include but are not limited to node features, edge features, time features, text features, warning features, and isolation features (i.e., anomaly scores).

[0075] Table 1

[0076]

[0077] From the above content, it can be seen that the intelligent early warning system ensures the comprehensiveness of risk monitoring by constructing and analyzing a two-layer network for various capital reflux modes such as indirect reflux and implicit reflux. Through the comprehensive application of feature extraction and machine learning algorithms, the system can more accurately identify abnormal nodes and abnormal paths, reduce false alarm and omission rates, and improve the accuracy of risk warnings. The construction and analysis of the two-layer network can dynamically reflect the flow of funds, support real-time monitoring and immediate response, so that banks can take quick measures to avoid or reduce losses after discovering risk signals. At the same time, because the system automatically monitors and warns of abnormal capital flows, it greatly reduces dependence on manual review and shortens risk response time.

[0078] In an optional embodiment, the intelligent early warning system determines a first set and a second set based on a double-layer network, wherein the first set includes a set of other nodes connected to the target payee through a direct or indirect relationship, and the second set includes a set of other nodes connected to the target lender through a direct or indirect relationship, and determines the abnormal node and the first abnormal path based on the intersection of the first set and the second set.

[0079] Optionally, in a business scenario, when a fund reflux occurs, such as when the entrusted payment payee transfers the funds to an outside bank and then flows them back to the bank's lender, and the funds eventually flow back to the lender's affiliated enterprise, or when the funds flow back to the lender through an affiliated enterprise after being transferred across banks, it is reflected in the network as the associated node set of the entrusted payment payee node and the associated node set of the lender node having the same nodes, that is, there is an intersection. Therefore, the intelligent early warning system detects fund reflux in two steps. The first step is to calculate the set of associated nodes of the entrusted payment payee and the lender, and the second step is to determine whether the associated nodes of the payee and the lender have an intersection.

[0080] Optionally, the first step is to calculate the first set of n-degree associated nodes of the entrusted payment payee. The goal here is to find the set of nodes directly or indirectly associated with the entrusted payment payee, select the payee as the starting calculation node, calculate the shortest distance from other nodes in the graph to the payee through the graph traversal algorithm, and collect the nodes within the n-degree range (i.e., nodes that can be reached within n steps) into a set. This set represents the associated enterprises or accounts that the payee may repatriate funds through direct or indirect transactions; calculate the second set of users associated with the lender's m-degree fund transaction relationship, take the lender as the starting node, calculate the shortest distance of all nodes in the graph that have a fund transaction relationship with the lender, and collect the nodes with a distance less than or equal to m into the second set. This set reflects the directly or indirectly associated enterprises or accounts with which the lender may conduct fund transactions, where the values ​​of n and m can be equal or unequal.

[0081] Optionally, the second step is to determine whether there is an intersection between the first set and the second set, that is, to check whether there is a node in the n-degree associated node of the payee that is also an m-degree associated node of the lender. The existence of an intersection means that funds may have formed a backflow between the payee and the lender or between their affiliated enterprises.

[0082] For example, Figure 5 is a schematic diagram of an optional node m-degree association network structure according to an embodiment of the present application, such as Figure 5As shown in the figure, when the value of m is 3, it is necessary to traverse all the destination nodes in the capital transaction graph three times. The starting calculation node B is taken as the source node. In the first traversal, node B sends information to nodes C and D, indicating that the distance between these two nodes and node B is 1, which meets the condition (i.e. m>=1), and can be regarded as directly associated nodes of node B; in the second traversal, since nodes C and D have been explored, their distance from node B has exceeded 1, but not more than 3, so the algorithm continues to explore the connection starting from nodes C and D. When node D sends information to node E, it indicates that the distance between node E and node B is 2, which meets the condition (i.e. m>=2). , so the E node is added to the m-degree associated node set of the B node. In the second traversal, the B node tries to send information to the C and D nodes again. However, since the C and D nodes have been explored in the first traversal, and reaching the C and D nodes again from the B node does not increase the breadth or depth of the network exploration, the conditions for further exploration are not met and the information will not be sent repeatedly. Similarly, in the third traversal, the F node is added to the m-degree associated node set of the B node; therefore, the 3-degree fund transaction relationship user set of the B node is {C, D, E, F}.

[0083] From the above content, it can be seen that the intelligent early warning system uses graph algorithms to check whether there is an intersection between the first set and the second set. The appearance of an intersection means that funds may have formed a reflux between the payee and the lender or their affiliated companies. This intersection analysis method based on network structure can quickly and accurately locate potential risk points, providing key information for timely early warning and intervention. By analyzing the intersection of the first set and the second set, the intelligent early warning system can identify abnormal nodes, that is, borrowers or payees who exhibit abnormal transaction behavior, and the first abnormal path, that is, the capital flow trajectory with suspected capital reflux, thereby improving the coverage of risk warnings.

[0084] In an optional embodiment, the intelligent early warning system extracts features from each transaction path in the double-layer network to obtain target features corresponding to each transaction path, wherein the target features corresponding to each transaction path are used to characterize potential abnormal transaction patterns of the transaction path, and then determines the abnormality score of each transaction path based on the target features corresponding to each transaction path through a first operation, and when the abnormality score of any transaction path in the double-layer network is greater than a preset score, the transaction path is determined to be a second abnormal path, and when the abnormality score of any transaction path in the double-layer network is less than or equal to a preset score, the transaction path is determined to be a normal transaction path.

[0085] Alternatively, in the scenario of identifying fund reflow, the purpose is actually to identify transactions that are different from normal fund transactions. In actual scenarios, many objects have rich mutual relationships, which provide valuable supplementary information for anomaly detection. Taking a two-layer network as an example, fund reflows may have the same structural characteristics as general fund transactions, but there may be differences in time frequency and counterparties. Therefore, these abnormal fund reflows may form dense and unexpected connections to indicate that they are deviating from benign behavior. The graph anomaly detection problem is to use the structural information contained in the graph to identify abnormal graph objects (nodes, edges or subgraphs) in the graph and abnormal graphs in the graph collection\database. That is, in our abnormal fund reflow detection, the purpose is to identify abnormal nodes (i.e., payees, lenders), abnormal edges (i.e., abnormal fund transactions) and abnormal subgraphs (i.e., abnormal fund reflows). Therefore, Isolation Forest is used for anomaly detection in such a scenario.

[0086] Optionally, the intelligent early warning system first performs deep feature extraction on each transaction path in the double-layer network to obtain the target feature corresponding to each path. The target feature integrates multiple key attributes on the transaction path, including but not limited to transaction amount (the amount of each transaction, reflecting the scale of capital flow), transaction frequency (the number of transactions within a specific time window, revealing the activity of capital flow), transaction time interval (the time interval between consecutive transactions, analyzing the continuity and regularity of transactions), path length (the length of the transfer path from the lender to the payee and then to the potential reflux node, evaluating the complexity of capital flow), account node attributes (including account centrality indicators, clustering coefficients, etc., reflecting the importance and relevance of accounts in the network), transaction summary embedding (using natural language processing technology to convert transaction summary text into vector representation to capture the semantic features of transactions), use the trained Isolation Forest model to predict the extracted features, output the anomaly score of each path, set a threshold based on the anomaly score, and identify abnormal paths.

[0087] From the above content, it can be seen that the intelligent early warning system can accurately identify potential abnormal transaction patterns, especially those complex and hidden capital repatriation behaviors, by extracting features from transaction paths and combining them with the IsolationForest algorithm, which significantly improves the accuracy of risk monitoring. At the same time, the system supports online processing of streaming transaction data and instant calculation of anomaly scores. It can quickly respond to changes in capital flow status and achieve real-time early warning of abnormal transactions, reducing the lag of risk monitoring. In addition, the Isolation Forest algorithm can automatically screen and isolate abnormal transaction paths, reducing reliance on manual review, improving the efficiency of risk warning, and shortening the time from risk identification to taking countermeasures.

[0088] In an optional embodiment, if the first risk monitoring result and the second risk monitoring result of the i-th transaction both indicate that the risk value of the i-th transaction is the first risk value, a first warning value is generated for the i-th transaction according to the risk model, wherein i is an integer greater than or equal to 1, and the first risk value is greater than or equal to a preset risk threshold, and the risk model is used to evaluate and warn of the risk of capital flow in the entrusted payment business; if one of the first risk monitoring result and the second risk monitoring result of the i-th transaction indicates that the risk value of the i-th transaction is the first risk value, and the other risk detection result indicates that the risk value of the i-th transaction is the second risk value, a second warning value is generated for the i-th transaction according to the risk model, wherein the first warning value is greater than the second warning value, and the second risk value is less than the first risk value; if the first risk monitoring result and the second risk monitoring result of the i-th transaction both indicate that the risk value of the i-th transaction is the second risk value, no warning is issued for the i-th transaction.

[0089] Optionally, the intelligent early warning system uses the time series data stream of account transaction details to detect whether a series of capital flow behaviors are abnormal at a certain moment based on the HMM model, uses XGboost to detect abnormalities in the nodes or paths of the transactions based on the features on the double-layer network, and establishes a fusion risk model. The fusion risk model is a comprehensive risk warning solution that combines direct capital split reflux monitoring based on the hidden Markov model (HMM) and indirect and implicit capital reflux monitoring based on the double-layer network, and detects and warns each transaction.

[0090] Optionally, Figure 6 is a schematic diagram of an optional risk warning drawn based on a fusion risk model according to an embodiment of the present application, such as Figure 6 As shown in the figure, when a transaction shows high risk in both anomaly detection models, the transaction needs to be warned, and it may be a transaction that generates capital reflux in the entrusted payment business; when a transaction has an abnormally high risk path, such as a capital transaction loop, but no high-risk abnormal state is detected on the HMM, the transaction may belong to an ongoing capital transaction and may require further attention; when a transaction has an abnormally high risk time, such as too frequent transactions, but no high-risk path anomalies occur, the transaction may be a normal refund operation and requires further understanding; when a transaction is not detected as a high-risk anomaly in both models, we can consider the transaction to be a normal transaction.

[0091] From the above content, it can be seen that the risk warning quadrant diagram drawn by the intelligent early warning system through the fusion risk model is helpful to optimize the overall warning effect and facilitate risk stratification and refined management, and better support decision optimization. On the one hand, by integrating the HMM model and the two-layer complex network, the temporal dependency relationship and path correlation relationship of capital flow can be organically combined, multi-dimensional risk factors can be comprehensively considered, and the complementary effects of various models can be brought into play, which improves the comprehensiveness and accuracy of risk monitoring and early warning; on the other hand, the risk display form of the quadrant diagram can intuitively display the distribution of different risk levels, so that management and decision makers can understand the risk situation more quickly, which is convenient for them to identify high-risk areas at a glance, and the refined risk score provided by the fusion model helps to divide the risk level more accurately in the quadrant diagram, and managers can implement differentiated management strategies accordingly to improve risk management efficiency.

[0092] In an optional embodiment, the intelligent early warning system uses a target neural network to analyze the double-layer network, abnormal nodes, the first abnormal path, and the second abnormal path to obtain abnormal transaction classification results, wherein the target neural network is used to identify and warn of different types of capital reflux risks, and then determine the early warning method based on the abnormal transaction classification results.

[0093] Optionally, in view of the following two aspects: first, the capital transaction flow has obvious network structures such as nodes and edges, and the graph neural network is just suitable for this structure, and the characteristics of capital reflux are more obvious, mainly related to the amount and time, and have obvious structural characteristics; second, the graph neural network mainly focuses on the out-degree (debit transaction) and in-degree (credit transaction) of the starting point to determine whether the funds are refluxed, and does not pay attention to the capital flow process, and has a certain generalization ability. The intelligent early warning system uses GNN (Graph Neural Network) technology to conduct in-depth analysis of abnormal nodes, first abnormal paths and second abnormal paths involved in the double-layer network, aiming to identify and warn different types of capital reflux risks.

[0094] It should be noted that GNN is a neural network model specially designed to process graph structured data. Unlike traditional neural networks that mainly process one-dimensional sequence data or two-dimensional image data, GNN can learn and predict directly on the graph. The nodes in the graph can represent entities, such as users, objects, molecules, etc., and the edges represent the relationship or interaction between entities. It can input structured data and unstructured data at the same time, and can well integrate text sequences and time series into the model, so as to better identify the capital repatriation scenario.

[0095] Optionally, in order to better warn of various risks of capital reflux and improve the generalization ability of the model, the intelligent early warning system uses a graph neural network to conduct in-depth analysis of the abnormal nodes, the first abnormal path and the second abnormal path involved in the double-layer network, that is, the graph neural network is used to mine the structure of the graph, and according to the downstream graph classification task, the constructed network is divided into specific risk types, the capital reflux link is identified, and the risk types of abnormal transactions are identified, including direct split reflux, indirect reflux and invisible reflux, etc. The system can classify each abnormal transaction and determine the corresponding early warning method, so as to deal with complex and changeable capital abnormality scenarios with refined risk management strategies.

[0096] From the above content, it can be seen that the intelligent early warning system can more accurately identify and classify various capital reflux risks by further using graph neural networks for structure mining and downstream graph classification tasks, achieve accurate early warning of abnormal transaction links, and improve the model's generalization ability for newly emerging complex transaction patterns.

[0097] The method for entrusted payment fund return provided in the embodiment of the present application solves the technical problem of low monitoring accuracy and thus low warning accuracy when relying on rule engines and manual review to monitor the entrusted payment fund return in the prior art, by combining a two-layer monitoring and early warning method with time series analysis and network structure analysis, thereby achieving the effect of high accuracy of entrusted payment fund return warning.

[0098] Example 2

[0099] The embodiment of the present application also provides an early warning device for the reflux of entrusted payment funds. It should be noted that the early warning device for the reflux of entrusted payment funds in the embodiment of the present application can be used to execute the early warning method for the reflux of entrusted payment funds provided in the embodiment of the present application. The early warning device for the reflux of entrusted payment funds provided in the embodiment of the present application is introduced below.

[0100] According to an embodiment of the present application, there is also provided a warning device for implementing the above-mentioned backflow of entrusted payment funds. Figure 7 is a schematic diagram of an optional early warning device for entrusted payment fund reflux according to an embodiment of the present application, such as Figure 7 As shown, the device includes: a first acquisition unit 701, a first monitoring unit 702, a second monitoring unit 703, and a first early warning unit 704.

[0101] Optionally, the first acquisition unit 701 acquires transaction data between a target lender and a target payee; the first monitoring unit 702 performs fund reflux risk monitoring on the transaction data based on a first model to obtain a first risk monitoring result, wherein the first model is used to analyze the fund flow status that changes over time; the second monitoring unit 703 performs fund reflux risk monitoring on the double-layer network using a first operation and a second operation to obtain a second risk monitoring result, wherein the first operation is used to identify abnormal paths in the double-layer network, and the second operation is used to extract transaction network features based on the double-layer network, and determine abnormal transaction behaviors based on the transaction network features, the double-layer network includes a first relationship network and a second relationship network, wherein the first relationship network is used to characterize the affiliated enterprise information of the lender and the payee, and the second relationship network is used to characterize the flow of account funds of the lender and the payee; the first early warning unit 704 determines fund reflux risk transactions based on the first risk monitoring result and the second risk monitoring result, and issues an early warning for fund reflux risk transactions.

[0102] Optionally, the first monitoring unit 702 includes: a first setting subunit, a first acquisition subunit, a first calculation subunit, and a first determination subunit. The first setting subunit is used to set the target parameters of the first model based on preset rules, wherein the target parameters are used to monitor abnormal flow information of funds; the first acquisition subunit is used to obtain a target algorithm, wherein the target algorithm is used to identify abnormal flow paths from transactions; the first calculation subunit is used to calculate transaction data according to the target algorithm and target parameters to obtain a target sequence, wherein the target sequence includes transaction information of abnormal transactions; the first determination subunit is used to determine the first risk monitoring result according to the target sequence.

[0103] Optionally, the second monitoring unit 703 includes: a second determination subunit, a first detection subunit, a first extraction subunit, and a first classification subunit. The second determination subunit is used to determine abnormal nodes and first abnormal paths according to the double-layer network, wherein the abnormal nodes are used to characterize borrowers or payees with abnormal transactions, and the first abnormal path is used to characterize the flow trajectory of abnormal funds, wherein the double-layer network includes multiple network paths, and the multiple network paths include the first abnormal path; the first detection subunit is used to obtain the second abnormal path in the double-layer network based on the first operation detection, wherein the second abnormal path and the first abnormal path are different network paths; the first extraction subunit is used to extract features from each node, each network path, abnormal node, first abnormal path, and second abnormal path in the double-layer network to obtain a target feature vector, wherein the target feature vector is used to represent the attribute information of the transaction mode; the first classification subunit is used to classify the abnormal state of the target feature vector using the second operation to obtain a second risk monitoring result.

[0104] Optionally, the second determination subunit includes: a first determination module and a second determination module. The first determination module is used to determine a first set and a second set according to the double-layer network, wherein the first set includes a set of other nodes connected to the target payee through a direct or indirect relationship, and the second set includes a set of other nodes connected to the target lender through a direct or indirect relationship; the second determination module is used to determine the abnormal node and the first abnormal path according to the intersection of the first set and the second set.

[0105] Optionally, the first detection subunit includes: a first extraction module, a third determination module, a fourth determination module, and a fifth determination module. The first extraction module is used to extract features from each transaction path in the double-layer network to obtain target features corresponding to each transaction path, wherein the target features corresponding to each transaction path are used to characterize the potential abnormal transaction mode of the transaction path; the third determination module is used to determine the abnormality score of each transaction path according to the target features corresponding to each transaction path through the first operation; the fourth determination module is used to determine that the transaction path is a second abnormal path when the abnormality score of any transaction path in the double-layer network is greater than a preset score; the fifth determination module is used to determine that the transaction path is a normal transaction path when the abnormality score of any transaction path in the double-layer network is less than or equal to the preset score.

[0106] Optionally, the first warning unit 704 includes: a first generating subunit, a second generating subunit, and a first processing subunit. In the first generating subunit, if the first risk monitoring result and the second risk monitoring result of the i-th transaction both indicate that the risk value of the i-th transaction is the first risk value, a first warning value is generated for the i-th transaction according to the risk model, wherein i is an integer greater than or equal to 1, the first risk value is greater than or equal to a preset risk threshold, and the risk model is used to evaluate and warn the risk of capital flow in the entrusted payment business; in the second generating subunit, if one of the first risk monitoring result and the second risk monitoring result of the i-th transaction indicates that the risk value of the i-th transaction is the first risk value, and the other risk detection result indicates that the risk value of the i-th transaction is the second risk value, a second warning value is generated for the i-th transaction according to the risk model, wherein the first warning value is greater than the second warning value, and the second risk value is less than the first risk value; in the first processing subunit, if the first risk monitoring result and the second risk monitoring result of the i-th transaction both indicate that the risk value of the i-th transaction is the second risk value, no warning is issued for the i-th transaction.

[0107] Optionally, the early warning device for entrusted payment fund reflux further includes: an analysis unit and a determination unit. The analysis unit is used to analyze the double-layer network, abnormal nodes, the first abnormal path and the second abnormal path using a target neural network to obtain abnormal transaction classification results, wherein the target neural network is used to identify and warn different types of fund reflux risks; the determination unit is used to determine the early warning method according to the abnormal transaction classification results.

[0108] Example 3

[0109] An embodiment of the present application may provide an electronic device, Figure 8 is a structural block diagram of an electronic device according to an embodiment of the present application. Figure 8 As shown, the electronic device may include: one or more ( Figure 8 (only one is shown) processor 802, memory 804, storage controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.

[0110] Among them, the memory can be used to store software programs and modules, such as program instructions / modules corresponding to the methods and devices in the embodiments of the present application, and the processor executes various functional applications and data processing by running the software programs and modules stored in the memory, that is, realizing the above-mentioned method. The memory may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include a memory remotely arranged relative to the processor, and these remote memories may be connected to the terminal via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0111] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: obtain transaction data between the target lender and the target payee; monitor the transaction data for capital reflux risk based on the first model to obtain a first risk monitoring result, wherein the first model is used to analyze the capital flow status that changes over time; use the first operation and the second operation to monitor the capital reflux risk of the double-layer network to obtain a second risk monitoring result, wherein the first operation is used to identify abnormal paths in the double-layer network, and the second operation is used to extract transaction network features based on the double-layer network, and determine abnormal transaction behavior based on the transaction network features, the double-layer network includes a first relationship network and a second relationship network, wherein the first relationship network is used to characterize the affiliated enterprise information of the lender and the payee, and the second relationship network is used to characterize the flow of account funds of the lender and the payee; determine capital reflux risk transactions based on the first risk monitoring result and the second risk monitoring result, and issue an early warning for capital reflux risk transactions.

[0112] The processor can also call the information and application programs stored in the memory through the transmission device to perform the following steps: set the target parameters of the first model based on preset rules, wherein the target parameters are used to monitor abnormal flow information of funds; obtain the target algorithm, wherein the target algorithm is used to identify abnormal flow paths from transactions; calculate the transaction data according to the target algorithm and the target parameters to obtain a target sequence, wherein the target sequence includes transaction information of abnormal transactions; determine the first risk monitoring result according to the target sequence.

[0113] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: determine the abnormal node and the first abnormal path according to the double-layer network, wherein the abnormal node is used to characterize the borrower or payee with abnormal transactions, and the first abnormal path is used to characterize the flow trajectory of abnormal funds, wherein the double-layer network includes multiple network paths, and the multiple network paths include the first abnormal path; based on the first operation detection, obtain the second abnormal path in the double-layer network, wherein the second abnormal path and the first abnormal path are different network paths; extract features from each node, each network path, abnormal node, first abnormal path and second abnormal path in the double-layer network to obtain a target feature vector, wherein the target feature vector is used to represent the attribute information of the transaction mode; use the second operation to classify the abnormal state of the target feature vector to obtain a second risk monitoring result.

[0114] The processor can also call the information and application programs stored in the memory through the transmission device to perform the following steps: determine a first set and a second set based on the double-layer network, wherein the first set includes a set of other nodes connected to the target payee through a direct or indirect relationship, and the second set includes a set of other nodes connected to the target lender through a direct or indirect relationship; determine the abnormal node and the first abnormal path based on the intersection of the first set and the second set.

[0115] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: extract features for each transaction path in the two-layer network to obtain the target features corresponding to each transaction path, wherein the target features corresponding to each transaction path are used to characterize the potential abnormal transaction mode of the transaction path; determine the abnormality score of each transaction path according to the target features corresponding to each transaction path through a first operation; when the abnormality score of any transaction path in the two-layer network is greater than a preset score, determine that the transaction path is a second abnormal path; when the abnormality score of any transaction path in the two-layer network is less than or equal to the preset score, determine that the transaction path is a normal transaction path.

[0116] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: if the first risk monitoring result and the second risk monitoring result of the i-th transaction both indicate that the risk value of the i-th transaction is the first risk value, generate a first warning value for the i-th transaction according to the risk model, wherein i is an integer greater than or equal to 1, the first risk value is greater than or equal to the preset risk threshold, and the risk model is used to evaluate and warn the risk of capital flow in the entrusted payment business; if one of the first risk monitoring result and the second risk monitoring result of the i-th transaction indicates that the risk value of the i-th transaction is the first risk value, and the other risk detection result indicates that the risk value of the i-th transaction is the second risk value, generate a second warning value for the i-th transaction according to the risk model, wherein the first warning value is greater than the second warning value, and the second risk value is less than the first risk value; if the first risk monitoring result and the second risk monitoring result of the i-th transaction both indicate that the risk value of the i-th transaction is the second risk value, no warning is issued for the i-th transaction.

[0117] The processor can also call the information and application programs stored in the memory through the transmission device to perform the following steps: use the target neural network to analyze the double-layer network, abnormal nodes, the first abnormal path and the second abnormal path to obtain abnormal transaction classification results, wherein the target neural network is used to identify and warn of different types of capital reflux risks; determine the warning method based on the abnormal transaction classification results.

[0118] It can be understood by those skilled in the art that Figure 8 The structure shown is for illustration only, and the electronic device may also be a smart phone (such as an Android phone, an iOS phone, etc.), a tablet computer, a PDA, a mobile Internet device (Mobile Internet Devices, MID), a PAD, or other terminal devices. Figure 8 The structure of the electronic device is not limited. Figure 8 More or fewer components (such as network interfaces, display devices, etc.) shown in, or having Figure 8 Different configurations are shown.

[0119] A person of ordinary skill in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing the hardware related to the terminal device through a program, and the program can be stored in a computer-readable storage medium, and the storage medium may include: a flash drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0120] Example 4

[0121] The embodiment of the present application further provides a storage medium. Optionally, in this embodiment, the storage medium can be used to store the program code executed by the early warning method for the reflux of entrusted payment funds provided in the first embodiment.

[0122] Optionally, in this embodiment, the above storage medium may be located in any computer terminal in a computer terminal group in a computer network, or in any mobile terminal in a mobile terminal group.

[0123] The present application also provides a computer program product, which, when executed on a data processing device, is suitable for executing the program steps of the early warning method for the reflux of entrusted payment funds.

[0124] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0125] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0126] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0127] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0128] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0129] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, in essence, or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk and other media that can store program codes.

[0130] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A warning method for the reflux of entrusted payment funds, characterized in that: include: Obtaining transaction data between target lenders and target payees; Performing fund reflow risk monitoring on the transaction data based on a first model to obtain a first risk monitoring result, wherein the first model is used to analyze the fund flow status that changes over time; The double-layer network is used to monitor the risk of capital reflux by using a first operation and a second operation to obtain a second risk monitoring result, wherein the first operation is used to identify abnormal paths in the double-layer network, and the second operation is used to extract transaction network features based on the double-layer network, and determine abnormal transaction behaviors according to the transaction network features, and the double-layer network includes a first relationship network and a second relationship network, wherein the first relationship network is used to characterize the information of the associated enterprises of the lender and the payee, and the second relationship network is used to characterize the flow of account funds of the lender and the payee; Determine capital reflow risk transactions based on the first risk monitoring result and the second risk monitoring result, and issue an early warning for the capital reflow risk transactions.

2. The early warning method for entrusted payment fund reflux according to claim 1, characterized in that: The capital repatriation risk monitoring is performed on the transaction data based on the first model to obtain a first risk monitoring result, including: Setting target parameters of the first model based on preset rules, wherein the target parameters are used to monitor abnormal flow information of funds; obtaining a target algorithm, wherein the target algorithm is used to identify abnormal flow paths from transactions; Calculating the transaction data according to the target algorithm and the target parameters to obtain a target sequence, wherein the target sequence includes transaction information of abnormal transactions; The first risk monitoring result is determined according to the target sequence.

3. The early warning method for entrusted payment fund reflux according to claim 1, characterized in that: The first operation and the second operation are used to monitor the risk of capital reflux on the double-layer network, and the second risk monitoring result is obtained, including: Determining an abnormal node and a first abnormal path according to the double-layer network, wherein the abnormal node is used to characterize a borrower or a payee with abnormal transactions, and the first abnormal path is used to characterize a flow track of abnormal funds, wherein the double-layer network includes a plurality of network paths, and the plurality of network paths includes the first abnormal path; Detecting and obtaining a second abnormal path in the double-layer network based on the first operation, wherein the second abnormal path and the first abnormal path are different network paths; Performing feature extraction on each node, each network path, the abnormal node, the first abnormal path, and the second abnormal path in the double-layer network to obtain a target feature vector, wherein the target feature vector is used to represent attribute information of a transaction mode; The second operation is used to classify the target feature vector into abnormal states to obtain a second risk monitoring result.

4. The early warning method for entrusted payment fund reflux according to claim 3, characterized in that: Determining an abnormal node and a first abnormal path according to the double-layer network includes: Determine a first set and a second set according to the two-layer network, wherein the first set includes a set of other nodes connected to the target payee through a direct or indirect relationship, and the second set includes a set of other nodes connected to the target lender through a direct or indirect relationship; The abnormal node and the first abnormal path are determined according to the intersection of the first set and the second set.

5. The early warning method for entrusted payment fund reflux according to claim 3, characterized in that: Detecting and obtaining a second abnormal path in the two-layer network based on the first operation includes: Performing feature extraction on each transaction path in the double-layer network to obtain a target feature corresponding to each transaction path, wherein the target feature corresponding to each transaction path is used to characterize a potential abnormal transaction mode of the transaction path; Determining, through the first operation, an abnormality score of each transaction path according to the target feature corresponding to each transaction path; When the abnormality score of any transaction path in the two-layer network is greater than a preset score, determining the transaction path as the second abnormal path; When the abnormality score of any transaction path in the two-layer network is less than or equal to the preset score, the transaction path is determined to be a normal transaction path.

6. The early warning method for entrusted payment fund reflux according to claim 1, characterized in that: Determining a capital reflow risk transaction according to the first risk monitoring result and the second risk monitoring result, and issuing an early warning for the capital reflow risk transaction, including: If the first risk monitoring result and the second risk monitoring result of the i-th transaction both indicate that the risk value of the i-th transaction is a first risk value, a first warning value is generated for the i-th transaction according to a risk model, wherein i is an integer greater than or equal to 1, the first risk value is greater than or equal to a preset risk threshold, and the risk model is used to evaluate and warn the risk of capital flow in the entrusted payment business; If one of the first risk monitoring result and the second risk monitoring result of the i-th transaction indicates that the risk value of the i-th transaction is a first risk value, and the other risk detection result indicates that the risk value of the i-th transaction is a second risk value, a second warning value is generated for the i-th transaction according to the risk model, wherein the first warning value is greater than the second warning value, and the second risk value is less than the first risk value; If the first risk monitoring result and the second risk monitoring result of the i-th transaction both indicate that the risk value of the i-th transaction is the second risk value, no warning is issued for the i-th transaction.

7. The early warning method for entrusted payment fund reflux according to claim 3, characterized in that: After determining the capital reflux risk transaction according to the first risk monitoring result and the second risk monitoring result and issuing an early warning for the capital reflux risk transaction, the early warning method for entrusted payment capital reflux further includes: Analyzing the double-layer network, the abnormal nodes, the first abnormal path, and the second abnormal path using a target neural network to obtain abnormal transaction classification results, wherein the target neural network is used to identify and warn different types of capital reflux risks; The warning method is determined according to the abnormal transaction classification result.

8. An early warning device for the reflux of entrusted payment funds, characterized in that: include: A first acquisition unit acquires transaction data between a target lender and a target payee; a first monitoring unit, which performs fund reflow risk monitoring on the transaction data based on a first model to obtain a first risk monitoring result, wherein the first model is used to analyze the fund flow status that changes over time; The second monitoring unit performs fund reflux risk monitoring on the double-layer network by using the first operation and the second operation to obtain a second risk monitoring result, wherein the first operation is used to identify abnormal paths in the double-layer network, and the second operation is used to extract transaction network features based on the double-layer network, and determine abnormal transaction behavior according to the transaction network features, and the double-layer network includes a first relationship network and a second relationship network, wherein the first relationship network is used to characterize the associated enterprise information of the lender and the payee, and the second relationship network is used to characterize the flow of account funds of the lender and the payee; The first determining unit determines a capital reflow risk transaction according to the first risk monitoring result and the second risk monitoring result, and issues an early warning for the capital reflow risk transaction.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored executable program, wherein when the executable program is running, the device where the computer-readable storage medium is located is controlled to execute the early warning method for the reflux of entrusted payment funds as described in any one of claims 1 to 7.

10. An electronic device, characterized in that: include: A memory storing an executable program; A processor is used to run the program, wherein when the program is running, the early warning method for the reflux of entrusted payment funds as described in any one of claims 1 to 7 is executed.

11. A computer program product comprising computer instructions, characterized in that: When the computer instructions are executed by the processor, the steps of the early warning method for the reflux of entrusted payment funds as described in any one of claims 1 to 7 are implemented.

Images