Transaction behavior auditing method and device, equipment and medium

Abstract

The invention discloses a transaction behavior auditing method and device, equipment and a medium, and relates to the technical field of financial information, and the method comprises the steps: determining a target violation mode graph based on a mode query instruction, determining a time window and a matching search tree, and determining target flow data based on the time window; constructing a data graph by taking the transaction participants as vertexes and the transaction behaviors as edges, and determining to-be-matched edges; matching the to-be-matched edge with a target violation mode graph, and after a target matched edge exists, pruning and updating the matched search tree by using a preset pruning strategy to determine whether the current to-be-matched edge meets a time constraint condition of the target violation mode graph; and judging whether a violation mode is detected based on a determination result, and skipping to the step of determining the edge to be matched until a plurality of edges of the data graph are matched. Therefore, the problem of low auditing efficiency caused by difficulty in identifying violation operation with time constraint due to the fact that a complex sequential relationship between transactions cannot be captured can be solved.

Description

Technical Field

[0001] The present invention relates to the field of financial information technology, and in particular to a transaction behavior auditing method, device, equipment and medium. Background Art

[0002] With the development of financial markets, fund transactions have become an important part of the daily operations of financial institutions, involving a large amount of capital flows and employee trading operations. However, employee violations, such as insider trading, profit transfer, market manipulation, etc., may have a serious impact on the fairness of the company and the market, so it is necessary to audit employee trading behaviors. Most of the existing transaction behavior auditing methods rely on graph topological structure analysis or simple time window analysis. For this simple transaction behavior auditing method, when faced with large-scale transaction data and complex behavior patterns, the analysis efficiency is low, and it is difficult to accurately identify complex, time-dependent violations to meet audit needs.

[0003] In summary, how to solve the problem of low audit efficiency due to the inability to capture the complex temporal relationship between transactions, which makes it difficult to identify time-constrained illegal operations, is an urgent problem that needs to be solved. Summary of the invention

[0004] In view of this, the purpose of the present invention is to provide a transaction behavior audit method, device, equipment and medium, which can solve the problem of low audit efficiency due to the inability to capture the complex time sequence relationship between transactions, which makes it difficult to identify time-constrained illegal operations. The specific scheme is as follows:

[0005] In a first aspect, the present application provides a transaction behavior audit method, comprising:

[0006] Determine a target violation pattern graph to be queried based on the received pattern query instruction, and determine a time window corresponding to the target violation pattern graph and a matching search tree for storing matching information, so as to determine corresponding target transaction flow data from cached transaction flow data based on the time window;

[0007] A data graph is constructed with transaction participants in the target flow data as vertices and transaction behaviors in the target flow data as edges, and edges to be matched are determined from a plurality of edges in the data graph; the edges to be matched are unmatched edges randomly selected from the plurality of edges;

[0008] Matching the edge to be matched with the target violation pattern graph, and after the obtained matching result indicates that there is a target matching edge in the target violation pattern graph that matches the edge to be matched, pruning and updating the matching search tree using a preset pruning strategy, so as to determine whether the current edge to be matched satisfies the time constraint condition of the target violation pattern graph according to the timing relationship and the matching search tree, and obtain a corresponding determination result;

[0009] Based on the determination result, it is determined whether a violation pattern that matches the target violation pattern graph is detected, and the process jumps to the step of determining the edges to be matched from the edges of the data graph until all the edges of the data graph are matched.

[0010] Optionally, determining corresponding target transaction flow data from cached transaction flow data based on the time window includes:

[0011] Clean and standardize the cached transaction flow data to obtain processed data;

[0012] Target data corresponding to a timestamp of the time window is determined from the processed data, and the target data is used as target pipeline data corresponding to the time window.

[0013] Optionally, the matching of the edge to be matched with the target violation pattern graph, and after the obtained matching result indicates that there is a target matching edge in the target violation pattern graph that matches the edge to be matched, the matching search tree is pruned and updated using a preset pruning strategy, so as to determine whether the current edge to be matched satisfies the time constraint condition of the target violation pattern graph according to the timing relationship and the matching search tree, and obtain a corresponding determination result, including:

[0014] Determine the transaction information corresponding to the edge to be matched, and match the edge to be matched with the edge in the target violation pattern graph based on the transaction information to obtain a corresponding matching result;

[0015] If the matching result indicates that there is a target matching edge in the target violation pattern graph that matches the edge to be matched, constructing an auxiliary matching graph based on the target violation pattern graph based on a greedy algorithm to determine a number of time constraints corresponding to the target violation pattern graph;

[0016] Add the edge to be matched to the matching search tree, and use a preset pruning strategy to prune and update the matching search tree, so as to associate the edge to be matched with the historical matching information cached in the matching search tree to obtain a corresponding association result;

[0017] If the association result indicates that there is no matching information associated with the edge to be matched in the historical matching information, a determination result is obtained that the edge to be matched currently does not satisfy the time constraint condition of the target violation pattern graph;

[0018] If the association result represents that there is matching information associated with the edge to be matched in the historical matching information, the timing relationship obtained after the association is compared with the target time constraint condition, and the determination result is determined based on the comparison result; the target time constraint condition is a condition related to the timing relationship among the several time constraints.

[0019] Optionally, determining the determination result based on the obtained comparison result includes:

[0020] If the comparison result obtained indicates that the timing relationship does not match the target time constraint condition, a determination result is obtained that the current edge to be matched does not satisfy the time constraint condition of the target violation pattern graph;

[0021] If the comparison result indicates that the timing relationship matches the target time constraint condition, a determination result is obtained that the current edge to be matched satisfies the time constraint condition of the target violation pattern graph.

[0022] Optionally, the pruning and updating the matching search tree by using a preset pruning strategy includes:

[0023] Determine unmatched edges in the auxiliary matching graph based on the matching search tree;

[0024] If the target matching edge does not correspond to any of the unmatched edges, the matching information corresponding to the edge to be matched is deleted from the matching search tree, and the process jumps to the step of determining the edge to be matched from the edges of the data graph;

[0025] If the target matching edge corresponds to any one of the unmatched edges, determining the earliest matching timestamp corresponding to the auxiliary matching edge; the auxiliary matching edge is the edge among the unmatched edges corresponding to the target matching edge;

[0026] If the timestamp of the edge to be matched is earlier than the earliest matching timestamp, the matching information corresponding to the edge to be matched is deleted from the matching search tree, and the process jumps to the step of determining the edge to be matched from the edges of the data graph.

[0027] Optionally, the determining whether a violation pattern conforming to the target violation pattern graph is detected based on the determination result includes:

[0028] When the determination result indicates that the current edge to be matched satisfies the time constraint condition of the target violation pattern graph, and the target matching edge is the edge with the latest timestamp in the target violation pattern graph, it is determined that a violation pattern that conforms to the target violation pattern graph is detected, a visual display is performed according to the determination result, and a corresponding audit report is generated for the determination result;

[0029] When the determination result indicates that the current edge to be matched does not satisfy the time constraint condition of the target violation pattern graph, the matching information corresponding to the edge to be matched in the matching search tree is deleted.

[0030] Optionally, the transaction behavior audit method further includes:

[0031] When the time window slides, the newly added flow data in the time window is added to the data graph, and the to-be-removed flow data that exceeds the time range corresponding to the time window is removed from the data graph to obtain an updated data graph;

[0032] Deleting the matching information related to the pipeline data to be removed in the matching search tree, and determining the newly added edge corresponding to the newly added pipeline data in the updated data graph;

[0033] The newly added edge is determined as the edge to be matched, and the process jumps to the step of matching the edge to be matched with the target violation pattern graph.

[0034] In a second aspect, the present application provides a transaction behavior auditing device, comprising:

[0035] A search tree determination module, used to determine a target violation pattern graph to be queried based on the received pattern query instruction, and to determine a time window corresponding to the target violation pattern graph and a matching search tree for storing matching information, so as to determine corresponding target transaction flow data from cached transaction flow data based on the time window;

[0036] A to-be-matched edge determination module is used to construct a data graph using the transaction participants in the target flow data as vertices and the transaction behaviors in the target flow data as edges, and to determine to-be-matched edges from a plurality of edges in the data graph; the to-be-matched edges are unmatched edges randomly selected from the plurality of edges;

[0037] A pruning and updating module is used to match the edge to be matched with the target violation pattern graph, and after the obtained matching result indicates that there is a target matching edge in the target violation pattern graph that matches the edge to be matched, prune and update the matching search tree using a preset pruning strategy, so as to determine whether the current edge to be matched satisfies the time constraint condition of the target violation pattern graph according to the timing relationship and the matching search tree, and obtain a corresponding determination result;

[0038] A step jump module is used to determine whether a violation pattern that meets the target violation pattern graph is detected based on the determination result, and jump to the step of determining the edges to be matched from the edges of the data graph until all the edges of the data graph are matched.

[0039] In a third aspect, the present application provides an electronic device, including:

[0040] Memory, used to store computer programs;

[0041] The processor is used to execute the computer program to implement the aforementioned transaction behavior audit method.

[0042] In a fourth aspect, the present application provides a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the aforementioned transaction behavior auditing method is implemented.

[0043] In this embodiment, a target violation pattern graph to be queried is determined based on the received pattern query instruction, and a time window corresponding to the target violation pattern graph and a matching search tree for storing matching information are determined, so as to determine the corresponding target transaction flow data from the cached transaction flow data based on the time window; a data graph is constructed with transaction participants in the target transaction flow data as vertices and transaction behaviors in the target transaction flow data as edges, and an edge to be matched is determined from a plurality of edges of the data graph; the edge to be matched is an unmatched edge randomly selected from the plurality of edges; the edge to be matched is matched with the target violation pattern graph; The pattern graph is matched, and after the obtained matching result indicates that there is a target matching edge matching the edge to be matched in the target violation pattern graph, the matching search tree is pruned and updated using a preset pruning strategy to determine whether the current edge to be matched meets the time constraint of the target violation pattern graph according to the timing relationship and the matching search tree, and obtain a corresponding determination result; based on the determination result, it is determined whether a violation pattern that meets the target violation pattern graph is detected, and jumps to the step of determining the edge to be matched from the multiple edges of the data graph until all the multiple edges of the data graph are matched. As can be seen from the above, the present application first determines the target violation pattern graph to be queried based on the received pattern query instruction, and determines the corresponding time window and the matching search tree, so as to determine the target pipeline data based on the time window, construct a data graph according to the target pipeline data, determine the edge to be matched from several edges of the data graph, match the edge to be matched with the target violation pattern graph, and after the obtained matching result indicates that there is a target matching edge in the target violation pattern graph that matches the edge to be matched, use a preset pruning strategy to prune and update the matching search tree to determine whether the current edge to be matched meets the time constraint of the target violation pattern graph, obtain a corresponding determination result, and determine whether a violation pattern that meets the target violation pattern graph is detected based on the determination result, jump to the step of determining the edge to be matched from several edges of the data graph, until several edges of the data graph are matched. In this way, through the above process of this application, when auditing transaction behavior, in addition to analyzing the topological structure of the graph, the time dependency between transactions is also considered, and time constraints are added. It is possible to identify transaction behavior patterns that conform to a specific time sequence in the fund transaction flow data, and to prune and update the matching search tree during the matching process, thereby reducing the complexity of transaction pattern recognition, thereby solving the problem of low audit efficiency due to the inability to capture the complex temporal relationship between transactions, which makes it difficult to identify illegal operations with time constraints. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0045] Figure 1 A flow chart of a transaction behavior audit method disclosed in this application;

[0046] Figure 2 A schematic diagram of a violation pattern diagram disclosed in this application;

[0047] Figure 3 A timing diagram of a transaction behavior audit method disclosed in this application;

[0048] Figure 4 A schematic diagram of an auxiliary matching graph disclosed in this application;

[0049] Figure 5 A schematic diagram of a matching search tree disclosed in this application;

[0050] Figure 6 This is a schematic diagram of the structure of a transaction behavior audit device disclosed in this application;

[0051] Figure 7 This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION

[0052] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0053] Most existing transaction behavior auditing methods rely on graph topology analysis or simple time window analysis. For such simple transaction behavior auditing methods, when faced with large-scale transaction data and complex behavior patterns, the analysis efficiency is low, and it is difficult to accurately identify complex violations that rely on time sequence to meet auditing needs.

[0054] In order to overcome the above technical problems, the present application provides a transaction behavior audit method to solve the problem of low audit efficiency due to the inability to capture the complex temporal relationship between transactions, which makes it difficult to identify time-constrained illegal operations.

[0055] See also Figure 1As shown, the embodiment of the present invention discloses a transaction behavior audit method, including:

[0056] Step S11, based on the received pattern query instruction, determine the target violation pattern graph to be queried, and determine the time window corresponding to the target violation pattern graph and the matching search tree for storing matching information, so as to determine the corresponding target transaction flow data from the cached transaction flow data based on the time window.

[0057] In this embodiment, the target violation pattern graph to be queried is determined based on the received pattern query instruction, and the time window corresponding to the target violation pattern graph and the matching search tree for storing matching information are determined, so as to determine the corresponding target transaction flow data from the cached transaction flow data based on the time window. Among them, the pattern query instruction is an instruction initiated by the user from the preset interface to query the specified violation pattern according to his own query needs; the target violation pattern graph is constructed according to the rules of the existing violation transaction behavior pattern, or a graph constructed according to the rules of the violation transaction behavior pattern summarized by relevant experts based on experience; the time window refers to a set fixed time period, which is used to count or calculate the data within the fixed time period, and has a step length attribute as the sliding interval of the time window.

[0058] It should be noted that the target violation pattern graph is determined from a number of preset violation pattern graphs, the time window and the matching search tree are attributes of the violation pattern graph, and each violation pattern graph corresponds to a time window and a matching search tree, which contain the topological structure of the corresponding violation transaction behavior and the time sequence relationship corresponding to each edge. Figure 2 The figure shows a schematic diagram of a violation pattern diagram provided by the present application. Capital letters such as A, B, and C are used to indicate the types of transaction participants. It is used to represent the vertices of the violation pattern graph, the subscript is used to distinguish between the vertices, ε is used to represent the timestamp corresponding to each transaction behavior, and ≺ is used to represent the temporal relationship between two timestamps. The determined time window can determine the data time range that needs to be counted to identify the violation pattern corresponding to the target violation pattern graph, and the processing flow is as follows: the cached transaction flow data is cleaned and standardized to obtain processed data; the target data corresponding to the timestamp and the time window is determined from the processed data, and the target data is used as the target flow data corresponding to the time window. Among them, the transaction flow data is collected from multiple data sources, and the data sources include but are not limited to databases, log systems, APIs (i.e., Application Programming Interfaces), etc. That is, first clean the cached transaction flow data, that is, deal with problems such as outliers and missing values ​​in the data to ensure the quality of the data, and standardize the transaction flow data to obtain processed data with a consistent format for easy matching, and then determine the target data corresponding to the timestamp and the time window from the processed data, that is, the target data whose timestamp is within the time range of the time window, and use the target data as the target flow data corresponding to the time window. In this way, after receiving the pattern query instruction, this embodiment first determines the target violation pattern graph according to the pattern query instruction, and determines the corresponding time window and matching search tree according to the target violation pattern graph for subsequent matching, and determines the target flow data based on the time window, and before that, preprocesses the data to ensure the quality of the data, and unifies the format of the data to facilitate the use of the data for violation pattern matching.

[0059] Step S12, constructing a data graph with the transaction participants in the target transaction data as vertices and the transaction behaviors in the target transaction data as edges, and determining edges to be matched from several edges of the data graph; the edges to be matched are unmatched edges randomly selected from the several edges.

[0060] In this embodiment, the transaction participants in the target flow data are used as vertices, and the transaction behaviors in the target flow data are used as edges to construct a data graph, and the edges to be matched are randomly extracted from the unmatched edges in the data graph. The vertices represent accounts or transaction entities, and the edges are used to represent the flow of funds. Each edge is accompanied by attributes such as timestamps and transaction amounts.

[0061] It is understandable that, since the data graph is a subgraph constructed by the target flow data determined by the set time window, it can reflect the transaction activities in a specific time period, so the data graph can also be a dynamic graph snapshot. In order to store these dynamic graph snapshots, this embodiment can use the form of an adjacency list to maintain the data structure between vertices and edges, and each vertex contains an adjacency list for storing the transaction edges related to the current vertex. Figure 3 The timing diagram of a transaction behavior audit method provided by the present application is shown. The streaming processing method is adopted, and the transaction flow containing only the basic characteristics of the transaction is used as input. After matching the transaction flow with the matching pattern graph, that is, the target violation pattern graph, the violation behavior identified by the transaction behavior audit method provided by the present application is output. Considering that new transaction flows will continue to appear with the passage of time, the dynamic memory graph in the figure represents the dynamic form of the data graph, and the edges in the dynamic memory graph will increase or decrease accordingly as the time window slides. In this way, after determining the target flow data, this embodiment will construct a data graph based on the target flow data, and determine the unmatched edges to be matched therefrom, so as to match the edges to be matched with the target violation pattern graph to determine whether there is a violation pattern that corresponds to the target violation pattern graph.

[0062] Step S13, matching the edge to be matched with the target violation pattern graph, and after the obtained matching result indicates that there is a target matching edge in the target violation pattern graph that matches the edge to be matched, pruning and updating the matching search tree using a preset pruning strategy, so as to determine whether the current edge to be matched satisfies the time constraint of the target violation pattern graph according to the timing relationship and the matching search tree, and obtain a corresponding determination result.

[0063] In this embodiment, the edge to be matched is matched with the target violation pattern graph, and after the obtained matching result indicates that there is a target matching edge matching the edge to be matched in the target violation pattern graph, the matching search tree is pruned and updated using a preset pruning strategy to determine whether the current edge to be matched satisfies the time constraint of the target violation pattern graph according to the timing relationship and the matching search tree, and obtain a corresponding determination result. The target matching edge is an edge whose transaction information is completely consistent with the edge to be matched, and the transaction information includes but is not limited to information such as transaction participants, transaction amount, and transaction time in the flow data corresponding to the current edge.

[0064] It should be pointed out that the specific processing flow of this embodiment is as follows: determine the transaction information corresponding to the edge to be matched, and match the edge to be matched with the edge in the target violation pattern graph based on the transaction information to obtain a corresponding matching result; if the matching result indicates that there is a target matching edge in the target violation pattern graph that matches the edge to be matched, then construct an auxiliary matching graph based on the target violation pattern graph based on a greedy algorithm to determine a number of time constraints corresponding to the target violation pattern graph; add the edge to be matched to the matching search tree, and use a preset pruning strategy to prune and update the matching search tree to add the edge to be matched. The matching edge is associated with the historical matching information cached in the matching search tree to obtain a corresponding association result; if the association result represents that there is no matching information associated with the edge to be matched in the historical matching information, then a determination result is obtained that the current edge to be matched does not meet the time constraint condition of the target violation pattern graph; if the association result represents that there is matching information associated with the edge to be matched in the historical matching information, then the timing relationship obtained after the association is compared with the target time constraint condition, and the determination result is determined based on the comparison result obtained; the target time constraint condition is a condition related to the timing relationship among the several time constraints. That is, for the process of matching the edge to be matched with the target violation pattern graph, this embodiment first determines the transaction information corresponding to the edge to be matched, and matches the edge to be matched with the edge in the target violation pattern graph according to the transaction information. When there is no edge in the target violation pattern graph whose transaction information matches the edge to be matched, it means that for the edge to be matched, there is no possibility of illegal transaction behavior corresponding to the target violation pattern graph, and the edge to be matched can be directly excluded, and the step of directly jumping to the step of determining the edge to be matched from the edges of the data graph; and when there is an edge in the target violation pattern graph whose transaction information matches the edge to be matched, it can be preliminarily determined that the illegal transaction behavior corresponding to the target violation pattern graph may exist, and further confirmation is required. Therefore, this embodiment first constructs an auxiliary matching graph based on the target violation pattern graph based on the greedy algorithm to increase the number of timing relationship pairs in the auxiliary matching graph, obtain the optimal matching order, determine several time constraints corresponding to the target violation pattern graph, and construct the pseudo code of the auxiliary matching graph as shown below:

[0065] Input: Query graph , the root node

[0066] Output: Auxiliary query graph , Evaluation indicators

[0067] ;

[0068] for :

[0069] ;

[0070] while :

[0071] ;

[0072] ;

[0073] for each :

[0074] if :

[0075] ;

[0076] else:

[0077] if

[0078] ;

[0079] ;

[0080] ;

[0081] return

[0082] in, It is defined as, represents the set of vertices of the query graph, Indicates a time sequence pair. Figure 4 Shown is a schematic diagram of an auxiliary matching graph provided by the present application. It can be understood that the auxiliary matching graph is a directed acyclic graph, which helps to improve the efficiency of pruning. After determining the several time constraints, the present embodiment can add the edge to be matched to the matching search tree, and use a preset pruning strategy to prune and update the matching search tree to associate the edge to be matched with the matching search tree. Among them, if there is no matching information associated with the edge to be matched in the historical matching information, then the determination result that the current edge to be matched does not meet the time constraint of the target violation pattern graph is obtained; if there is matching information associated with the edge to be matched in the historical matching information, then the timing relationship obtained after the association is compared with the target time constraint, and the determination result is determined based on the comparison result obtained.

[0083] It should be further pointed out that the determination result is determined based on the obtained comparison result, and its processing flow is as follows: if the obtained comparison result indicates that the timing relationship does not match the target time constraint condition, then the determination result that the current edge to be matched does not meet the time constraint condition of the target violation pattern graph is obtained; if the comparison result indicates that the timing relationship matches the target time constraint condition, then the determination result that the current edge to be matched meets the time constraint condition of the target violation pattern graph is obtained. That is, when the obtained comparison result indicates that the timing relationship does not match the target time constraint condition, it means that there will be no violation in the current transaction behavior on the timing relationship, and the determination result that the current edge to be matched does not meet the time constraint condition of the target violation pattern graph is obtained; and when the comparison result indicates that the timing relationship matches the target time constraint condition, it means that there may be violation in the current transaction behavior on the timing relationship, and it needs to be retained so as to be used as a reference when matching the next edge to be matched, thereby reducing the process of repeated auditing, improving efficiency, and obtaining the determination result that the current edge to be matched meets the time constraint condition of the target violation pattern graph.

[0084] It should be noted that the processing flow of pruning and updating the matching search tree using a preset pruning strategy is as follows: based on the matching search tree, the unmatched edges in the auxiliary matching graph are determined; if the target matching edge does not correspond to any of the unmatched edges, the matching information corresponding to the edge to be matched is deleted from the matching search tree, and the process jumps to the step of determining the edge to be matched from the edges of the data graph; if the target matching edge corresponds to any of the unmatched edges, the earliest matching timestamp corresponding to the auxiliary matching edge is determined; the auxiliary matching edge is the edge among the unmatched edges that corresponds to the target matching edge; if the timestamp of the edge to be matched is earlier than the earliest matching timestamp, the matching information corresponding to the edge to be matched is deleted from the matching search tree, and the process jumps to the step of determining the edge to be matched from the edges of the data graph. That is, first determine the unmatched unmatched edges in the auxiliary matching graph based on the matching search tree, and judge whether the target matching edge belongs to the unmatched edge. If the target matching edge does not correspond to any of the unmatched edges, it means that the target matching edge does not belong to the unmatched edge, and there is no need to perform further matching on the edge to be matched. The matching information corresponding to the edge to be matched is directly deleted from the matching search tree, and jump to the step of determining the edge to be matched from the edges of the data graph to match the next edge to be matched. When the target matching edge corresponds to any of the unmatched edges, it means that the target matching edge belongs to the unmatched edge, and further judgment is needed on the target matching edge. Figure 5The figure shows a schematic diagram of a matching search tree provided by the present application. The matching search tree belongs to the data structure of the search tree, which is used to store matching information, that is, the data structure of the timing matching edge, which is used to represent the matching relationship between the edge in the data graph and the edge in the auxiliary matching graph under the time constraint. When an edge in the auxiliary matching graph satisfies part of the time constraint with an edge in the data graph under a specific time window or sequence requirement, it can be defined as a timing matching edge, thereby helping to determine whether the data graph conforms to the matching pattern of the target violation pattern graph. Among them, σ represents the timestamp of the edge, v represents the vertex of the data graph, each node represents a match of any one of the several time constraints, and the edge represents the operation of adding the edge to be matched to the current match. The root node of the tree is an empty initial match, and the leaf nodes of the tree represent all matches that meet the time constraints.

[0085] It can be understood that, since the edge to be matched is randomly selected from several unmatched edges, the timestamp of the edge to be matched may be earlier than the timestamp of the previously matched edge. When this happens, it can be determined that the edge to be matched cannot conform to the violation pattern of the target violation pattern graph, and therefore there is no need to perform further matching on the edge to be matched. This embodiment calculates the minimum timestamp in the time series descendant set of each vertex in the target violation pattern graph, that is, the earliest timestamp of the edge corresponding to the target matching edge in the unmatched edge, which helps to quickly find and determine the time range of the pattern that meets the target violation pattern graph in the data graph, and facilitates pruning. Therefore, this embodiment first determines the earliest matching timestamp corresponding to the auxiliary matching edge, and when the timestamp of the edge to be matched is earlier than the earliest matching timestamp, the matching information corresponding to the edge to be matched is deleted from the matching search tree, and jumps to the step of determining the edge to be matched from the edges of the data graph. When the timestamp of the edge to be matched is not earlier than the earliest matching timestamp, it cannot be directly determined that the edge to be matched cannot meet the violation pattern of the target violation pattern graph, so the matching information corresponding to the edge to be matched is retained for reference when matching the new edge to be matched. In this way, this embodiment removes matches that do not meet the constraints by pruning the matching search tree according to a preset pruning strategy after adding the edge to be matched to the matching search tree, reducing the matching burden of the system, improving the matching efficiency, and constructing an auxiliary matching graph to further improve the efficiency of pruning.

[0086] Step S14: determine whether a violation pattern that matches the target violation pattern graph is detected based on the determination result, and jump to the step of determining the edges to be matched from the edges of the data graph until all the edges of the data graph are matched.

[0087] In this embodiment, whether a violation pattern that matches the target violation pattern graph is detected is determined based on the determination result, and the process jumps to the step of determining the edges to be matched from the edges of the data graph until all the edges of the data graph are matched.

[0088] It should be noted that the processing flow of determining whether a violation pattern that conforms to the target violation pattern graph is detected based on the determination result is as follows: when the determination result indicates that the current edge to be matched meets the time constraint of the target violation pattern graph, and the target matching edge is the edge with the latest timestamp in the target violation pattern graph, then it is determined that a violation pattern that conforms to the target violation pattern graph is detected, a visual display is performed based on the determination result, and a corresponding audit report is generated for the determination result; when the determination result indicates that the current edge to be matched does not meet the time constraint of the target violation pattern graph, the matching information corresponding to the edge to be matched in the matching search tree is deleted. Among them, the content of the visual display includes but is not limited to transaction behavior trends, suspicious activity distribution, etc., and the form includes but is not limited to charts, dashboards, etc.; the audit report includes transaction details, detected abnormal behaviors, risk assessment results, and improvement suggestions. That is, after the determination result indicates that the current edge to be matched meets the time constraint of the target violation pattern graph, it is determined whether the target matching edge is the edge with the latest timestamp in the target violation pattern graph. If so, it means that the edge matched this time is the last edge that needs to be matched in the target violation pattern graph, and the current timing relationship completely conforms to the pattern of the target violation pattern graph. Therefore, it is determined that the violation pattern conforming to the target violation pattern graph is detected, and a visual display is performed based on the determination result, and a corresponding audit report is generated for the determination result, which can support auditors to make decisions quickly and accurately and improve the efficiency and accuracy of risk control. When the determination result indicates that the current edge to be matched does not meet the time constraint of the target violation pattern graph, it indicates that this matching does not conform to the pattern of the target violation pattern graph, and the matching information corresponding to the edge to be matched in the matching search tree can be directly deleted for exclusion.

[0089] It should be pointed out that, since the time window will slide accordingly according to its own step size attribute as time goes by, new flow data and expired flow data may appear, which need to be processed accordingly. The processing flow is as follows: when the time window slides, the new flow data in the time window is added to the data graph, and the flow data to be removed that exceeds the time range corresponding to the time window is removed from the data graph to obtain an updated data graph; the matching information related to the flow data to be removed in the matching search tree is deleted, and the new edge corresponding to the new flow data in the updated data graph is determined; the new edge is determined as the edge to be matched, and the step of matching the edge to be matched with the target violation pattern graph is jumped to. That is, when the time window slides, this embodiment can update the data graph based on the principle of incremental update. Specifically, the newly added flow data in the time window is added to the data graph, and the flow data to be removed that exceeds the time range corresponding to the time window is removed from the data graph to obtain an updated data graph, which can not only improve the memory usage efficiency, but also ensure the real-time and accuracy of the matching method. Subsequently, the matching search tree needs to be pruned and updated according to the changes in the data graph. Specifically, the matching information related to the flow data to be removed in the matching search tree is deleted, and the newly added edges corresponding to the newly added flow data in the updated data graph are determined, and the newly added edges are determined as the edges to be matched, and the step of matching the edges to be matched with the target violation pattern graph is jumped to, so that the matching search tree is updated with the newly added edges according to the matching situation. It can be understood that due to the changes in the data graph, the changed parts may also need to be updated due to the changes in the changed edges, such as the earliest timestamp, so the update formula can be as follows:

[0090] ;

[0091] in, represents the earliest timestamp, represents the edges of the target violation pattern graph, Represents a function for obtaining other vertices connected to a vertex. In this way, after detecting a violation pattern that conforms to the target violation pattern graph, this embodiment visualizes the relevant results and generates an audit report, which can support auditors to make decisions quickly and accurately, and improve the efficiency and accuracy of risk control. At the same time, when the time window slides, the data graph is updated based on the principle of incremental update, which can not only improve the memory usage efficiency, but also ensure the real-time and accuracy of the matching method, thereby improving the efficiency of transaction behavior auditing.

[0092] As can be seen from the above, the embodiment of the present application first determines the target violation pattern graph to be queried based on the received pattern query instruction, and determines the corresponding time window and the matching search tree, so as to determine the target pipeline data based on the time window, construct a data graph according to the target pipeline data, determine the edge to be matched from several edges of the data graph, match the edge to be matched with the target violation pattern graph, and after the obtained matching result indicates that there is a target matching edge in the target violation pattern graph that matches the edge to be matched, the matching search tree is pruned and updated using a preset pruning strategy to determine whether the current edge to be matched meets the time constraint of the target violation pattern graph, obtain a corresponding determination result, and determine whether a violation pattern that meets the target violation pattern graph is detected based on the determination result, and jump to the step of determining the edge to be matched from several edges of the data graph until several edges of the data graph are matched. In this way, through the above process of the embodiment of the present application, when auditing transaction behavior, in addition to analyzing the topological structure of the graph, the time dependency between transactions is also considered, and time constraints are added, so that transaction behavior patterns that conform to a specific time sequence can be identified in the fund transaction flow data; on the one hand, the matching search tree is pruned and updated during the matching process to reduce the complexity of transaction pattern recognition; on the one hand, the data is preprocessed before determining the target flow data based on the time window to ensure the quality of the data, and the format of the data is unified to facilitate the use of the data to match violation patterns; on the other hand, after the edge to be matched is added to the matching search tree, the matching search tree is pruned according to a preset pruning strategy to remove matches that do not meet the constraints, reduce the matching burden of the system, and improve matching efficiency. At the same time, an auxiliary matching graph is constructed to further improve the efficiency of pruning, thereby solving the problem of low audit efficiency due to the inability to capture the complex temporal relationship between transactions and the difficulty in identifying illegal operations with time constraints.

[0093] Accordingly, see Figure 6 As shown, the embodiment of the present application also provides a transaction behavior auditing device, including:

[0094] A search tree determination module 11 is used to determine a target violation pattern graph to be queried based on the received pattern query instruction, and to determine a time window corresponding to the target violation pattern graph and a matching search tree for storing matching information, so as to determine corresponding target transaction flow data from cached transaction flow data based on the time window;

[0095] The to-be-matched edge determination module 12 is used to construct a data graph with the transaction participants in the target flow data as vertices and the transaction behaviors in the target flow data as edges, and determine the to-be-matched edges from a plurality of edges in the data graph; the to-be-matched edges are unmatched edges randomly selected from the plurality of edges;

[0096] A pruning and updating module 13 is used to match the edge to be matched with the target violation pattern graph, and after the obtained matching result indicates that there is a target matching edge in the target violation pattern graph that matches the edge to be matched, prune and update the matching search tree using a preset pruning strategy, so as to determine whether the current edge to be matched satisfies the time constraint condition of the target violation pattern graph according to the timing relationship and the matching search tree, and obtain a corresponding determination result;

[0097] The step jump module 14 is used to determine whether a violation pattern that meets the target violation pattern graph is detected based on the determination result, and jump to the step of determining the edges to be matched from the edges of the data graph until all the edges of the data graph are matched.

[0098] As can be seen from the above, the embodiment of the present application first determines the target violation pattern graph to be queried based on the received pattern query instruction, and determines the corresponding time window and the matching search tree, so as to determine the target pipeline data based on the time window, construct a data graph according to the target pipeline data, determine the edge to be matched from several edges of the data graph, match the edge to be matched with the target violation pattern graph, and after the obtained matching result indicates that there is a target matching edge in the target violation pattern graph that matches the edge to be matched, the matching search tree is pruned and updated using a preset pruning strategy to determine whether the current edge to be matched meets the time constraint of the target violation pattern graph, obtain a corresponding determination result, and determine whether a violation pattern that meets the target violation pattern graph is detected based on the determination result, and jump to the step of determining the edge to be matched from several edges of the data graph until several edges of the data graph are matched. In this way, through the above process of the embodiment of the present application, when auditing transaction behavior, in addition to analyzing the topological structure of the graph, the time dependency between transactions is also considered, and time constraints are added. It is possible to identify transaction behavior patterns that conform to a specific time sequence in the fund transaction flow data, and to prune and update the matching search tree during the matching process, thereby reducing the complexity of transaction pattern recognition, thereby solving the problem of low audit efficiency due to the inability to capture the complex temporal relationship between transactions, which makes it difficult to identify illegal operations with time constraints.

[0099] In some specific implementations, the search tree determination module 11 may specifically include:

[0100] A data processing unit, used to clean and standardize the cached transaction flow data to obtain processed data;

[0101] A data determination unit is used to determine target data whose timestamp corresponds to the time window from the processed data, and use the target data as target pipeline data corresponding to the time window.

[0102] In some specific implementations, the pruning update module 13 may specifically include:

[0103] An edge matching unit, used to determine the transaction information corresponding to the edge to be matched, and match the edge to be matched with the edge in the target violation pattern graph based on the transaction information to obtain a corresponding matching result;

[0104] a matching graph construction unit, configured to construct an auxiliary matching graph based on the target violation pattern graph based on a greedy algorithm if the matching result indicates that there is a target matching edge in the target violation pattern graph that matches the edge to be matched, so as to determine a plurality of time constraints corresponding to the target violation pattern graph;

[0105] A pruning and updating submodule, used for adding the edge to be matched to the matching search tree, and pruning and updating the matching search tree using a preset pruning strategy, so as to associate the edge to be matched with the historical matching information cached in the matching search tree, and obtain a corresponding association result;

[0106] A first result determination unit, configured to obtain a determination result that the current edge to be matched does not satisfy a time constraint condition of the target violation pattern graph if the association result indicates that there is no matching information associated with the edge to be matched in the historical matching information;

[0107] A result determination submodule is used to compare the timing relationship obtained after the association with the target time constraint condition if the association result represents that there is matching information associated with the to-be-matched edge in the historical matching information, and determine the determination result based on the comparison result obtained; the target time constraint condition is a condition related to the timing relationship among the several time constraints.

[0108] In some specific implementations, the result determination submodule may specifically include:

[0109] A second result determination unit is used to obtain a determination result that the current edge to be matched does not satisfy the time constraint condition of the target violation pattern graph if the obtained comparison result indicates that the timing relationship does not match the target time constraint condition;

[0110] The third result determination unit is used to obtain a determination result that the current edge to be matched satisfies the time constraint condition of the target violation pattern graph if the comparison result indicates that the timing relationship matches the target time constraint condition.

[0111] In some specific implementations, the pruning update submodule may specifically include:

[0112] an unmatched edge determining unit, configured to determine unmatched edges in the auxiliary matching graph based on the matching search tree;

[0113] The first step jump unit is used for deleting the matching information corresponding to the edge to be matched from the matching search tree if the target matching edge does not correspond to any of the unmatched edges, and jumping to the step of determining the edge to be matched from the plurality of edges of the data graph;

[0114] A timestamp determination unit, configured to determine the earliest matching timestamp corresponding to an auxiliary matching edge if the target matching edge corresponds to any one of the unmatched edges; the auxiliary matching edge is an edge among the unmatched edges corresponding to the target matching edge;

[0115] The second step is a jump unit, which is used to delete the matching information corresponding to the edge to be matched from the matching search tree if the timestamp of the edge to be matched is earlier than the earliest matching timestamp, and jump to the step of determining the edge to be matched from the edges of the data graph.

[0116] In some specific implementations, the step jump module 14 may specifically include:

[0117] A report generating unit, configured to determine that a violation pattern that conforms to the target violation pattern graph is detected when the determination result indicates that the current edge to be matched satisfies the time constraint condition of the target violation pattern graph, and the target matching edge is the edge with the latest timestamp in the target violation pattern graph, perform a visual display according to the determination result, and generate a corresponding audit report for the determination result;

[0118] An information deleting unit is used to delete the matching information corresponding to the edge to be matched in the matching search tree when the determination result indicates that the current edge to be matched does not meet the time constraint condition of the target violation pattern graph.

[0119] In some specific implementations, the transaction behavior auditing device may further include:

[0120] A data removal unit, used for adding the newly added flow data in the time window to the data graph when the time window slides, and removing the to-be-removed flow data that exceeds the time range corresponding to the time window from the data graph, so as to obtain an updated data graph;

[0121] A newly added edge determination unit, used to delete the matching information related to the pipeline data to be removed in the matching search tree, and determine the newly added edge corresponding to the newly added pipeline data in the updated data graph;

[0122] The third step is a jump unit, which is used to determine the newly added edge as the edge to be matched, and jump to the step of matching the edge to be matched with the target violation pattern graph.

[0123] Furthermore, the present application also discloses an electronic device. Figure 7 This is a structural diagram of an electronic device 20 according to an exemplary embodiment, and the content in the figure cannot be regarded as any limitation on the scope of use of this application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the transaction behavior audit method disclosed in any of the aforementioned embodiments. In addition, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0124] In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0125] In addition, the memory 22 as a carrier for storing resources may be a read-only memory, a random access memory, a disk or an optical disk, etc. The resources stored thereon may include an operating system 221, a computer program 222, etc., and the storage method may be temporary storage or permanent storage.

[0126] The operating system 221 is used to manage and control the hardware devices and computer programs 222 on the electronic device 20, and can be Windows Server, Netware, Unix, Linux, etc. In addition to computer programs that can be used to complete the transaction behavior audit method performed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can further include computer programs that can be used to complete other specific tasks.

[0127] Furthermore, the present application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the transaction behavior audit method disclosed above is implemented. The specific steps of the method can refer to the corresponding contents disclosed in the above embodiments, and will not be repeated here.

[0128] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0129] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0130] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0131] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0132] The technical solution provided by the present application is introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for general technicians in this field, according to the idea of ​​the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A transaction behavior audit method, characterized in that: include: Determine a target violation pattern graph to be queried based on the received pattern query instruction, and determine a time window corresponding to the target violation pattern graph and a matching search tree for storing matching information, so as to determine corresponding target transaction flow data from cached transaction flow data based on the time window; A data graph is constructed with transaction participants in the target flow data as vertices and transaction behaviors in the target flow data as edges, and edges to be matched are determined from a plurality of edges in the data graph; the edges to be matched are unmatched edges randomly selected from the plurality of edges; Matching the edge to be matched with the target violation pattern graph, and after the obtained matching result indicates that there is a target matching edge in the target violation pattern graph that matches the edge to be matched, pruning and updating the matching search tree using a preset pruning strategy, so as to determine whether the current edge to be matched satisfies the time constraint condition of the target violation pattern graph according to the timing relationship and the matching search tree, and obtain a corresponding determination result; Based on the determination result, it is determined whether a violation pattern that matches the target violation pattern graph is detected, and the process jumps to the step of determining the edges to be matched from the edges of the data graph until all the edges of the data graph are matched.

2. The transaction behavior audit method according to claim 1, characterized in that: The determining corresponding target transaction flow data from the cached transaction flow data based on the time window includes: Clean and standardize the cached transaction flow data to obtain processed data; Target data corresponding to a timestamp of the time window is determined from the processed data, and the target data is used as target pipeline data corresponding to the time window.

3. The transaction behavior audit method according to claim 1, characterized in that: The matching of the edge to be matched with the target violation pattern graph, and after the obtained matching result indicates that there is a target matching edge in the target violation pattern graph that matches the edge to be matched, the matching search tree is pruned and updated using a preset pruning strategy, so as to determine whether the current edge to be matched satisfies the time constraint condition of the target violation pattern graph according to the timing relationship and the matching search tree, and obtain a corresponding determination result, including: Determine the transaction information corresponding to the edge to be matched, and match the edge to be matched with the edge in the target violation pattern graph based on the transaction information to obtain a corresponding matching result; If the matching result indicates that there is a target matching edge in the target violation pattern graph that matches the edge to be matched, constructing an auxiliary matching graph based on the target violation pattern graph based on a greedy algorithm to determine a number of time constraints corresponding to the target violation pattern graph; Add the edge to be matched to the matching search tree, and use a preset pruning strategy to prune and update the matching search tree, so as to associate the edge to be matched with the historical matching information cached in the matching search tree to obtain a corresponding association result; If the association result indicates that there is no matching information associated with the edge to be matched in the historical matching information, a determination result is obtained that the edge to be matched currently does not satisfy the time constraint condition of the target violation pattern graph; If the association result represents that there is matching information associated with the edge to be matched in the historical matching information, the timing relationship obtained after the association is compared with the target time constraint condition, and the determination result is determined based on the comparison result; the target time constraint condition is a condition related to the timing relationship among the several time constraints.

4. The transaction behavior audit method according to claim 3 is characterized in that: The determining the determination result based on the obtained comparison result includes: If the comparison result obtained indicates that the timing relationship does not match the target time constraint condition, a determination result is obtained that the current edge to be matched does not satisfy the time constraint condition of the target violation pattern graph; If the comparison result indicates that the timing relationship matches the target time constraint condition, a determination result is obtained that the current edge to be matched satisfies the time constraint condition of the target violation pattern graph.

5. The transaction behavior audit method according to claim 4 is characterized in that: The pruning and updating of the matching search tree by using a preset pruning strategy includes: Determine unmatched edges in the auxiliary matching graph based on the matching search tree; If the target matching edge does not correspond to any of the unmatched edges, the matching information corresponding to the edge to be matched is deleted from the matching search tree, and the process jumps to the step of determining the edge to be matched from the edges of the data graph; If the target matching edge corresponds to any one of the unmatched edges, determining the earliest matching timestamp corresponding to the auxiliary matching edge; the auxiliary matching edge is the edge among the unmatched edges corresponding to the target matching edge; If the timestamp of the edge to be matched is earlier than the earliest matching timestamp, the matching information corresponding to the edge to be matched is deleted from the matching search tree, and the process jumps to the step of determining the edge to be matched from the edges of the data graph.

6. The transaction behavior audit method according to claim 1, characterized in that: The determining whether a violation pattern that conforms to the target violation pattern graph is detected based on the determination result includes: When the determination result indicates that the current edge to be matched satisfies the time constraint condition of the target violation pattern graph, and the target matching edge is the edge with the latest timestamp in the target violation pattern graph, it is determined that a violation pattern that conforms to the target violation pattern graph is detected, a visual display is performed according to the determination result, and a corresponding audit report is generated for the determination result; When the determination result indicates that the current edge to be matched does not satisfy the time constraint condition of the target violation pattern graph, the matching information corresponding to the edge to be matched in the matching search tree is deleted.

7. The transaction behavior audit method according to any one of claims 1 to 6, characterized in that: Also includes: When the time window slides, the newly added flow data in the time window is added to the data graph, and the to-be-removed flow data that exceeds the time range corresponding to the time window is removed from the data graph to obtain an updated data graph; Deleting the matching information related to the pipeline data to be removed in the matching search tree, and determining the newly added edge corresponding to the newly added pipeline data in the updated data graph; The newly added edge is determined as the edge to be matched, and the process jumps to the step of matching the edge to be matched with the target violation pattern graph.

8. A transaction behavior auditing device, characterized in that: include: A search tree determination module, used to determine a target violation pattern graph to be queried based on the received pattern query instruction, and to determine a time window corresponding to the target violation pattern graph and a matching search tree for storing matching information, so as to determine corresponding target transaction flow data from cached transaction flow data based on the time window; A to-be-matched edge determination module is used to construct a data graph using the transaction participants in the target flow data as vertices and the transaction behaviors in the target flow data as edges, and to determine to-be-matched edges from a plurality of edges in the data graph; the to-be-matched edges are unmatched edges randomly selected from the plurality of edges; A pruning and updating module is used to match the edge to be matched with the target violation pattern graph, and after the obtained matching result indicates that there is a target matching edge in the target violation pattern graph that matches the edge to be matched, prune and update the matching search tree using a preset pruning strategy, so as to determine whether the current edge to be matched satisfies the time constraint condition of the target violation pattern graph according to the timing relationship and the matching search tree, and obtain a corresponding determination result; A step jump module is used to determine whether a violation pattern that meets the target violation pattern graph is detected based on the determination result, and jump to the step of determining the edges to be matched from the edges of the data graph until all the edges of the data graph are matched.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to execute the computer program to implement the transaction behavior audit method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: Used to store computer programs; wherein, when the computer program is executed by a processor, it implements the transaction behavior audit method as described in any one of claims 1 to 7.

Images