A transaction behavior auditing method, device, equipment and medium

Abstract

The application discloses a transaction behavior auditing method and device, equipment and medium, and relates to the technical field of financial information. The method comprises the following steps: determining a target violation mode graph based on a mode query instruction, and determining a time window and a matching search tree to determine target flow data based on the time window; constructing a data graph with transaction participants as vertices and transaction behaviors as edges, and determining edges to be matched; matching the edges to be matched with the target violation mode graph, and pruning and updating the matching search tree using a preset pruning strategy when there is a target matching edge to determine whether the current edge to be matched meets the time constraint condition of the target violation mode graph; determining whether a violation mode is detected based on the determination result, and jumping to the step of determining the edge to be matched until several edges of the data graph are matched. Thus, the problem of low auditing efficiency caused by the difficulty in identifying violation operations with time constraints due to the inability to capture complex time sequence relationships between transactions can be solved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of financial information technology, and in particular to a transaction behavior auditing method, device, equipment and medium. BACKGROUND

[0002] With the development of the financial market, fund transactions have become an important part of the daily business of financial institutions, involving a large amount of capital flow and employee transaction operations. However, the irregular operations of employees, such as insider trading, interest delivery, market manipulation and the like, can have a serious impact on the fairness of the company and the market, and therefore the transaction behavior of employees needs to be audited. The existing transaction behavior auditing methods mostly rely on graph topology analysis or simple time window analysis. For such simple transaction behavior auditing methods, when facing large-scale transaction data and complex behavior patterns, the analysis efficiency is low, and it is difficult to accurately identify complex, time-sequential irregular operations, thus failing to meet the auditing needs.

[0003] In summary, how to solve the problem of low auditing efficiency due to the inability to capture the complex time sequence relationship between transactions and the difficulty in identifying irregular operations with time constraints is a problem that needs to be solved. SUMMARY

[0004] Therefore, the purpose of the present application is to provide a transaction behavior auditing method, device, equipment and medium, which can solve the problem of low auditing efficiency due to the inability to capture the complex time sequence relationship between transactions and the difficulty in identifying irregular operations with time constraints. The specific solutions are as follows:

[0005] In a first aspect, the present application provides a transaction behavior auditing method, comprising:

[0006] determining a target irregular pattern graph to be queried based on the received pattern query instruction, and determining a time window corresponding to the target irregular pattern graph and a matching search tree for saving matching information, so as to determine corresponding target transaction data from the cached transaction transaction data based on the time window;

[0007] constructing a data graph with the transaction participants in the target transaction data as vertices and the transaction behaviors in the target transaction data as edges, and determining a to-be-matched edge from a plurality of edges of the data graph; the to-be-matched edge is an un-matched edge randomly selected from the plurality of edges;

[0008] match the edge to be matched with the target violation pattern graph, and after a matching result is obtained indicating that there is a target matching edge in the target violation pattern graph that matches the edge to be matched, prune and update the matching search tree using a preset pruning strategy to determine whether the edge to be matched satisfies a time constraint condition of the target violation pattern graph according to a time sequence relationship and the matching search tree, and obtain a corresponding determination result;

[0009] determine whether a violation pattern conforming to the target violation pattern graph is detected based on the determination result, and jump to the step of determining the edge to be matched from the plurality of edges of the data graph until all the plurality of edges of the data graph are matched.

[0010] Optionally, the determining of the target transaction data corresponding to the time window from the cached transaction data includes:

[0011] cleaning and standardizing the cached transaction data to obtain processed data;

[0012] determining target data corresponding to the time window from the processed data according to timestamps, and taking the target data as the target transaction data corresponding to the time window.

[0013] Optionally, the matching of the edge to be matched with the target violation pattern graph, and the pruning and updating of the matching search tree using a preset pruning strategy after a matching result is obtained indicating that there is a target matching edge in the target violation pattern graph that matches the edge to be matched, to determine whether the edge to be matched satisfies a time constraint condition of the target violation pattern graph according to a time sequence relationship and the matching search tree, and obtain a corresponding determination result, includes:

[0014] determining transaction information corresponding to the edge to be matched, and matching the edge to be matched with edges in the target violation pattern graph based on the transaction information to obtain a corresponding matching result;

[0015] if the matching result indicates that there is a target matching edge in the target violation pattern graph that matches the edge to be matched, constructing an auxiliary matching graph based on the target violation pattern graph using a greedy algorithm to determine a plurality of time constraint conditions corresponding to the target violation pattern graph;

[0016] adding the edge to be matched to the matching search tree, and pruning and updating the matching search tree using a preset pruning strategy to associate the edge to be matched with historical matching information cached in the matching search tree to obtain a corresponding association result;

[0017] if the association result represents that there is no matching information associated with the to-be-matched edge in the historical matching information, a determination result that the to-be-matched edge does not satisfy the time constraint condition of the target violation mode graph is obtained;

[0018] if the association result represents that there is matching information associated with the to-be-matched edge in the historical matching information, a comparison between the obtained time sequence relationship after association and a target time constraint condition is performed, and the determination result is determined based on an obtained comparison result; the target time constraint condition is a condition related to the time sequence relationship in the time constraint conditions.

[0019] Optionally, the determination result is determined based on the obtained comparison result, including:

[0020] if the obtained comparison result represents that the time sequence relationship does not match the target time constraint condition, the determination result that the to-be-matched edge does not satisfy the time constraint condition of the target violation mode graph is obtained;

[0021] if the comparison result represents that the time sequence relationship matches the target time constraint condition, the determination result that the to-be-matched edge satisfies the time constraint condition of the target violation mode graph is obtained.

[0022] Optionally, the pruning and updating of the matching search tree by using the preset pruning strategy includes:

[0023] the unmatched edge in the auxiliary matching graph is determined based on the matching search tree;

[0024] if the target matching edge does not correspond to any edge in the unmatched edge, the matching information corresponding to the to-be-matched edge is deleted from the matching search tree, and the step of determining the to-be-matched edge from the edges of the data graph is jumped to;

[0025] if the target matching edge corresponds to any edge in the unmatched edge, the earliest matching timestamp corresponding to the auxiliary matching edge is determined; the auxiliary matching edge is an edge in the unmatched edge corresponding to the target matching edge;

[0026] if the timestamp of the to-be-matched edge is earlier than the earliest matching timestamp, the matching information corresponding to the to-be-matched edge is deleted from the matching search tree, and the step of determining the to-be-matched edge from the edges of the data graph is jumped to.

[0027] Optionally, the determination of whether the violation mode conforming to the target violation mode graph is detected based on the determination result includes:

[0028] When the determination result represents that the current to-be-matched edge satisfies the time constraint condition of the target violation pattern graph, and the target matching edge is the edge with the latest timestamp in the target violation pattern graph, it is determined that a violation pattern conforming to the target violation pattern graph is detected, visual display is performed according to the determination result, and a corresponding audit report is generated for the determination result;

[0029] When the determination result represents that the current to-be-matched edge does not satisfy the time constraint condition of the target violation pattern graph, the matching information corresponding to the to-be-matched edge in the matching search tree is deleted.

[0030] Optionally, the transaction behavior auditing method further includes:

[0031] When the time window is slid, the newly added transaction data in the time window is added to the data graph, and the to-be-removed transaction data that is out of the time range corresponding to the time window is removed from the data graph, to obtain an updated data graph;

[0032] The matching information related to the to-be-removed transaction data in the matching search tree is deleted, and a newly added edge corresponding to the newly added transaction data in the updated data graph is determined;

[0033] The newly added edge is determined as the to-be-matched edge, and the step of matching the to-be-matched edge with the target violation pattern graph is jumped to.

[0034] In a second aspect, the present application provides a transaction behavior auditing device, including:

[0035] A search tree determination module is configured to determine a target violation pattern graph to be queried based on a received pattern query instruction, and determine a time window corresponding to the target violation pattern graph and a matching search tree for saving matching information, so as to determine corresponding target transaction data from cached transaction transaction data based on the time window;

[0036] A to-be-matched edge determination module is configured to construct a data graph with transaction participants in the target transaction data as vertices and transaction behaviors in the target transaction data as edges, and determine a to-be-matched edge from a plurality of edges of the data graph; the to-be-matched edge is an un-matched edge randomly selected from the plurality of edges;

[0037] The pruning and updating module is configured to match the to-be-matched edge with the target violation pattern graph, and perform pruning and updating on the matching search tree by using a preset pruning strategy when a matching result obtained by the matching indicates that there is a target matching edge in the target violation pattern graph that matches the to-be-matched edge, so as to determine, according to a time sequence relationship and the matching search tree, whether the to-be-matched edge satisfies a time constraint condition of the target violation pattern graph, and obtain a corresponding determination result.

[0038] The step jumping module is configured to determine, based on the determination result, whether a violation pattern conforming to the target violation pattern graph is detected, and jump to the step of determining the to-be-matched edge from the plurality of edges of the data graph until all the plurality of edges of the data graph are matched.

[0039] In a third aspect, the present application provides an electronic device, comprising:

[0040] a memory configured to save a computer program;

[0041] a processor configured to execute the computer program to implement the transaction behavior auditing method.

[0042] In a fourth aspect, the present application provides a computer readable storage medium configured to save a computer program; wherein the computer program is executed by a processor to implement the transaction behavior auditing method.

[0043] In this embodiment, based on the received mode query instruction, a target violation mode graph to be queried is determined, and a time window corresponding to the target violation mode graph and a matching search tree for saving matching information are determined, so as to determine corresponding target flow data from the cached transaction flow data based on the time window; a data graph is constructed with transaction participants in the target flow data as vertices and transaction behaviors in the target flow data as edges, and a to-be-matched edge is determined from a plurality of edges of the data graph; the to-be-matched edge is an un-matched edge randomly extracted from the plurality of edges; the to-be-matched edge is matched with the target violation mode graph, and after a matching result obtained indicates that there is a target matching edge in the target violation mode graph that matches the to-be-matched edge, a preset pruning strategy is used to prune and update the matching search tree, so as to determine whether the to-be-matched edge currently satisfies a time constraint condition of the target violation mode graph according to a time sequence relationship and the matching search tree, and obtain a corresponding determination result; whether a violation mode conforming to the target violation mode graph is detected is judged based on the determination result, and the step of determining the to-be-matched edge from the plurality of edges of the data graph is jumped to until the plurality of edges of the data graph are all matched. As can be seen from the above, the target violation mode graph to be queried is determined based on the received mode query instruction, and the corresponding time window and the matching search tree are determined, so as to determine the target flow data based on the time window, construct the data graph according to the target flow data, determine the to-be-matched edge from the plurality of edges of the data graph, match the to-be-matched edge with the target violation mode graph, and after a matching result obtained indicates that there is a target matching edge in the target violation mode graph that matches the to-be-matched edge, a preset pruning strategy is used to prune and update the matching search tree, so as to determine whether the to-be-matched edge currently satisfies a time constraint condition of the target violation mode graph, and obtain a corresponding determination result, and whether a violation mode conforming to the target violation mode graph is detected is judged based on the determination result, and the step of determining the to-be-matched edge from the plurality of edges of the data graph is jumped to until the plurality of edges of the data graph are all matched. In this way, through the above process of the present application, when auditing transaction behaviors, in addition to analyzing the topological structure of the graph, the time dependency between transactions is also considered, time constraints are added, and transaction behavior patterns conforming to a specific time sequence can be identified in fund transaction flow data, and the matching search tree is pruned and updated in the matching process, the complexity of transaction pattern recognition is reduced, and thus the problem of low auditing efficiency due to the inability to capture complex time sequence relationships between transactions to identify violation operations with time constraints is solved. BRIEF DESCRIPTION OF DRAWINGS

[0044] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings needed to be used in the embodiments or prior art description will be briefly introduced as follows. Obviously, the drawings in the following description only represent some embodiments of the present application, and for those skilled in the art, other drawings can be obtained without creative labor based on the provided drawings.

[0045] Figure 1 A flow chart of a transaction behavior auditing method disclosed in the present application;

[0046] Figure 2 A schematic diagram of a violation mode graph disclosed in the present application;

[0047] Figure 3 A timing diagram of a transaction behavior auditing method disclosed in the present application;

[0048] Figure 4 A schematic diagram of an auxiliary matching graph disclosed in the present application;

[0049] Figure 5 A schematic diagram of a matching search tree disclosed in the present application;

[0050] Figure 6 A structural schematic diagram of a transaction behavior auditing device disclosed in the present application;

[0051] Figure 7 A structural diagram of an electronic device disclosed in the present application. DETAILED DESCRIPTION

[0052] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments only represent some of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0053] The existing transaction behavior auditing methods mostly rely on topology structure analysis of graphs or simple time window analysis. For such simple transaction behavior auditing methods, when facing large-scale transaction data and complex behavior patterns, the analysis efficiency is low, and it is difficult to accurately identify complex time-sequential violation behaviors, thus failing to meet the auditing requirements.

[0054] In order to overcome the above technical problems, the present application provides a transaction behavior auditing method to solve the problem of low auditing efficiency in identifying time-constrained violation operations due to the failure to capture complex time-sequential relationships between transactions.

[0055] Referring to Figure 1As shown, the embodiment of the application discloses a transaction behavior auditing method, comprising:

[0056] In step S11, the target violation pattern graph to be queried is determined based on the received pattern query instruction, and the time window corresponding to the target violation pattern graph and the matching search tree for saving matching information are determined, so as to determine the corresponding target flow data from the cached transaction flow data based on the time window.

[0057] In this embodiment, the target violation pattern graph to be queried is determined based on the received pattern query instruction, and the time window corresponding to the target violation pattern graph and the matching search tree for saving matching information are determined, so as to determine the corresponding target flow data from the cached transaction flow data based on the time window. The pattern query instruction is an instruction for querying a specified violation pattern initiated by a user from a preset interface according to the query demand of the user; the target violation pattern graph is a graph constructed according to the rules of the existing violation transaction behavior pattern or the rules of the violation transaction behavior pattern summarized by a related expert according to experience; the time window refers to a fixed time period set for statistics or calculation of data in the fixed time period, and has a step attribute as a sliding interval of the time window.

[0058] It should be noted that the target violation pattern graph is determined from a plurality of preset violation pattern graphs, and the time window and the matching search tree are attributes of the violation pattern graph. Each violation pattern graph corresponds to a time window and a matching search tree, and contains the topological structure of the corresponding violation transaction behavior and the time sequence relationship of each edge. Figure 2 As shown in a violation pattern graph provided by the present application, capital letters A, B, C, etc. are used to represent transaction participant types, The vertices of the violation pattern graph are represented, and the subscripts are used to distinguish between the vertices. The time stamp of each transaction behavior is represented by ε, and the time sequence relationship between two time stamps is represented by ≺. The data time range that needs to be counted for identifying the violation pattern corresponding to the target violation pattern graph can be determined through the determined time window, and the processing procedure is as follows: the cached transaction flow data is cleaned and standardized to obtain processed data; the target data corresponding to the time window is determined from the processed data and the target data is taken as the target flow data corresponding to the time window. The transaction flow data is collected from multiple data sources, including but not limited to databases, log systems, APIs (Application Programming Interface), and the like. That is, the cached transaction flow data is cleaned, that is, the problems such as abnormal values and missing values in the data are processed to ensure the quality of the data, and the transaction flow data is standardized to obtain processed data with consistent formats, facilitating matching. Then, the target data corresponding to the time window is determined from the processed data, that is, the target data whose time stamp is within the time range of the time window, and the target data is taken as the target flow data corresponding to the time window. In this way, after receiving the pattern query instruction, the embodiment first determines the target violation pattern graph according to the pattern query instruction, and determines the corresponding time window and the matching search tree according to the target violation pattern graph, so as to facilitate subsequent matching, and determines the target flow data based on the time window. Before this, the data is preprocessed to ensure the quality of the data and unify the format of the data, so as to facilitate the matching of the violation pattern by using the data.

[0059] In step S12, the transaction participants in the target flow data are taken as vertices, the transaction behaviors in the target flow data are taken as edges, a data graph is constructed, and a to-be-matched edge is determined from the edges of the data graph. The to-be-matched edge is an un-matched edge randomly selected from the edges.

[0060] In this embodiment, the transaction participants in the target flow data are taken as vertices, the transaction behaviors in the target flow data are taken as edges, a data graph is constructed, and a to-be-matched edge is randomly selected from the un-matched edges of the data graph. The vertices represent accounts or transaction entities, and the edges represent the flow of funds. Each edge is attached with attributes such as a time stamp and a transaction amount.

[0061] It can be understood that, since the data graph is a subgraph constructed by the target flow data determined by the set time window, it can reflect the transaction activities in a specific time period, and therefore the data graph can also be a dynamic graph snapshot. In order to store these dynamic graph snapshots, the embodiment can maintain a data structure between vertices and edges in the form of an adjacency list, and each vertex contains an adjacency list for storing transaction edges related to the current vertex. As shown in Figure 3 The timing diagram of a transaction behavior auditing method provided by the present application is shown. The transaction flow containing only basic transaction features is used as input in a streaming processing manner, and the transaction flow is matched with a matching pattern graph, that is, a target violation pattern graph, to output the violation behavior identified by the transaction behavior auditing method provided by the present application. Considering that new transaction flows will continue to appear over time, the dynamic memory graph in the figure represents the dynamic form of the data graph, and the edges in the dynamic memory graph will be increased or decreased accordingly as the time window slides. In this way, after determining the target flow data, the embodiment constructs a data graph according to the target flow data, and determines the un-matched edges to be matched from the data graph, so as to match the edges to be matched with the target violation pattern graph, and determine whether there is a violation pattern corresponding to the target violation pattern graph.

[0062] In step S13, the edges to be matched are matched with the target violation pattern graph, and after the matching result obtained represents that there is a target matching edge in the target violation pattern graph that matches the edges to be matched, the matching search tree is pruned and updated using a preset pruning strategy, to determine whether the edges to be matched satisfy the time constraint condition of the target violation pattern graph according to the time sequence relationship and the matching search tree, and obtain the corresponding determination result.

[0063] In the embodiment, the edges to be matched are matched with the target violation pattern graph, and after the matching result obtained represents that there is a target matching edge in the target violation pattern graph that matches the edges to be matched, the matching search tree is pruned and updated using a preset pruning strategy, to determine whether the edges to be matched satisfy the time constraint condition of the target violation pattern graph according to the time sequence relationship and the matching search tree, and obtain the corresponding determination result. The target matching edge is an edge whose transaction information is completely consistent with the edges to be matched, and the transaction information includes but is not limited to the transaction participant, transaction amount, transaction time and other information in the flow data corresponding to the current edge.

[0064] It should be noted that the specific processing flow of the embodiment is as follows: determining transaction information corresponding to the to-be-matched edge, and matching the to-be-matched edge with edges in the target violation mode graph based on the transaction information to obtain a corresponding matching result; if the matching result represents that there is a target matching edge in the target violation mode graph that matches the to-be-matched edge, then an auxiliary matching graph is constructed based on the target violation mode graph based on a greedy algorithm to determine a plurality of time constraint conditions corresponding to the target violation mode graph; the to-be-matched edge is added to the matching search tree, and the matching search tree is pruned and updated using a preset pruning strategy to associate the to-be-matched edge with historical matching information cached in the matching search tree to obtain a corresponding association result; if the association result represents that there is no matching information associated with the to-be-matched edge in the historical matching information, a determination result is obtained that the to-be-matched edge does not satisfy the time constraint condition of the target violation mode graph; if the association result represents that there is matching information associated with the to-be-matched edge in the historical matching information, the time sequence relationship obtained after association is compared with a target time constraint condition, and the determination result is determined based on the obtained comparison result; the target time constraint condition is a condition related to the time sequence relationship among the plurality of time constraint conditions. That is, for the process of matching the to-be-matched edge with the target violation mode graph, the embodiment first determines the transaction information corresponding to the to-be-matched edge, and matches the to-be-matched edge with the edges in the target violation mode graph according to the transaction information. When there is no edge in the target violation mode graph that matches the transaction information and the to-be-matched edge, it means that there is no possibility of the violation transaction behavior corresponding to the target violation mode graph for the to-be-matched edge, and the to-be-matched edge can be directly excluded, and the step of determining the to-be-matched edge from the plurality of edges of the data graph is directly jumped to. When there is an edge in the target violation mode graph that matches the transaction information and the to-be-matched edge, it is preliminarily determined that the violation transaction behavior corresponding to the target violation mode graph may exist, and needs to be further confirmed. Therefore, the embodiment first constructs an auxiliary matching graph based on the target violation mode graph based on a greedy algorithm to increase the number of time sequence relationship pairs in the auxiliary matching graph, obtain an optimal matching order, determine a plurality of time constraint conditions corresponding to the target violation mode graph, and the pseudo code for constructing the auxiliary matching graph is as follows:

[0065] Input: query graph , root node

[0066] Output: auxiliary query graph , evaluation index

[0067] ;

[0068] for :

[0069] ;

[0070] while :

[0071] ;

[0072] ;

[0073] for each :

[0074] if :

[0075] ;

[0076] else:

[0077] if

[0078] ;

[0079] ;

[0080] ;

[0081] return

[0082] wherein, denotes is defined as, denotes a vertex set of a query graph, denotes a time sequence pair. As Figure 4 shown is a schematic diagram of an auxiliary matching graph provided by the present application. It can be understood that the auxiliary matching graph is a directed acyclic graph, which helps to improve the efficiency of pruning. After determining the plurality of time constraint conditions, the embodiment can add the to-be-matched edge to the matching search tree, and update the matching search tree using a preset pruning strategy to associate the to-be-matched edge with the matching search tree. If there is no matching information associated with the to-be-matched edge in the historical matching information, a determination result is obtained that the to-be-matched edge does not satisfy the time constraint condition of the target violation mode graph; if there is matching information associated with the to-be-matched edge in the historical matching information, the time sequence relationship obtained after association is compared with the target time constraint condition, and the determination result is determined based on the comparison result obtained.

[0083] It needs to be further pointed out that the determination result is determined based on the obtained comparison result, and the processing flow is as follows: if the obtained comparison result represents that the timing relationship does not match the target time constraint condition, the determination result that the current to-be-matched edge does not satisfy the time constraint condition of the target violation pattern graph is obtained; if the comparison result represents that the timing relationship matches the target time constraint condition, the determination result that the current to-be-matched edge satisfies the time constraint condition of the target violation pattern graph is obtained. That is, when the obtained comparison result represents that the timing relationship does not match the target time constraint condition, it indicates that the transaction behavior on the current timing relationship does not exist violation behavior, and the determination result that the current to-be-matched edge does not satisfy the time constraint condition of the target violation pattern graph is obtained. When the comparison result represents that the timing relationship matches the target time constraint condition, it indicates that the transaction behavior on the current timing relationship may exist violation behavior, which needs to be reserved for reference when matching the next to-be-matched edge, reducing the repeated auditing process, improving the efficiency, and obtaining the determination result that the current to-be-matched edge satisfies the time constraint condition of the target violation pattern graph.

[0084] It needs to be pointed out that the pruning update of the matching search tree based on the preset pruning strategy is as follows: the unmatched edge in the auxiliary matching graph is determined based on the matching search tree; if the target matching edge does not correspond to any edge in the unmatched edge, the matching information corresponding to the to-be-matched edge is deleted from the matching search tree, and the step of determining the to-be-matched edge from the edges of the data graph is jumped to; if the target matching edge corresponds to any edge in the unmatched edge, the earliest matching timestamp corresponding to the auxiliary matching edge is determined; the auxiliary matching edge is the edge in the unmatched edge corresponding to the target matching edge; if the timestamp of the to-be-matched edge is earlier than the earliest matching timestamp, the matching information corresponding to the to-be-matched edge is deleted from the matching search tree, and the step of determining the to-be-matched edge from the edges of the data graph is jumped to. That is, the unmatched edge in the auxiliary matching graph is first determined according to the matching search tree, and it is judged whether the target matching edge belongs to the unmatched edge. If the target matching edge does not correspond to any edge in the unmatched edge, it indicates that the target matching edge does not belong to the unmatched edge, and further matching is not needed for the to-be-matched edge. The matching information corresponding to the to-be-matched edge is directly deleted from the matching search tree, and the step of determining the to-be-matched edge from the edges of the data graph is jumped to, so as to match the next to-be-matched edge. When the target matching edge corresponds to any edge in the unmatched edge, it indicates that the target matching edge belongs to the unmatched edge, and further judgment needs to be made on the target matching edge. For example Figure 5A matching search tree provided by the present application is shown. The matching search tree belongs to the data structure of search tree, and is used for saving matching information, that is, the data structure of time sequence matching edge, and is used for representing the matching relationship between the edge in the data graph and the edge in the auxiliary matching graph under the time constraint condition. When an edge in the auxiliary matching graph and a certain edge in the data graph meet part of the time constraint under a specific time window or sequence requirement, the edge can be defined as a time sequence matching edge, thereby helping to determine whether the data graph meets the matching mode of the target violation mode graph. Wherein, σ represents the timestamp of the edge, v represents the vertex of the data graph, each node represents the matching of any condition of the plurality of time constraint conditions, and the edge represents the operation of adding the to-be-matched edge to the current matching. The root node of the tree is an empty initial matching, and the leaf node of the tree represents all the matching meeting the time constraint condition.

[0085] It can be understood that since the to-be-matched edge is randomly selected from the plurality of unmatched edges, the timestamp of the to-be-matched edge can be earlier than the timestamp of the previously matched edge. When this situation occurs, it can be determined that the to-be-matched edge cannot meet the violation mode of the target violation mode graph, and therefore further matching of the to-be-matched edge is not required. The present embodiment calculates the minimum timestamp in the time sequence descendant set of each vertex in the target violation mode graph, that is, the earliest timestamp of the edge corresponding to the target matching edge in the unmatched edge, which helps to quickly find and determine the time range of the mode meeting the target violation mode graph in the data graph, and facilitates pruning. Therefore, the present embodiment first determines the earliest matching timestamp corresponding to the auxiliary matching edge, and when the timestamp of the to-be-matched edge is earlier than the earliest matching timestamp, the matching information corresponding to the to-be-matched edge is deleted from the matching search tree, and the step of determining the to-be-matched edge from the plurality of edges of the data graph is jumped to. When the timestamp of the to-be-matched edge is not earlier than the earliest matching timestamp, it cannot be directly determined that the to-be-matched edge cannot meet the violation mode of the target violation mode graph, and therefore the matching information corresponding to the to-be-matched edge is retained for reference when matching a new to-be-matched edge. In this way, the present embodiment removes the matching that does not meet the constraint condition by the way of pruning the matching search tree according to the preset pruning strategy after adding the to-be-matched edge to the matching search tree, reduces the matching burden of the system, improves the matching efficiency, and constructs the auxiliary matching graph, thereby further improving the efficiency of pruning.

[0086] In step S14, it is determined whether the violation mode meeting the target violation mode graph is detected based on the determination result, and the step of determining the to-be-matched edge from the plurality of edges of the data graph is jumped to, until the plurality of edges of the data graph are matched.

[0087] In this embodiment, whether a violation mode conforming to the target violation mode graph is detected is determined according to the determination result, and the step of determining the to-be-matched edge from the edges of the data graph is jumped to until all the edges of the data graph are matched.

[0088] It should be noted that the process flow of determining whether a violation mode conforming to the target violation mode graph is detected based on the determination result is as follows: when the determination result represents that the to-be-matched edge currently meets the time constraint condition of the target violation mode graph, and the target matching edge is the edge with the latest timestamp in the target violation mode graph, it is determined that a violation mode conforming to the target violation mode graph is detected, visual display is performed according to the determination result, and an audit report corresponding to the determination result is generated; when the determination result represents that the to-be-matched edge currently does not meet the time constraint condition of the target violation mode graph, the matching information corresponding to the to-be-matched edge in the matching search tree is deleted. The content of the visual display includes but is not limited to transaction behavior trend, suspicious activity distribution, etc., and the form includes but is not limited to chart, dashboard, etc.; the audit report includes transaction details, detected abnormal behavior, risk assessment result and improvement suggestion. That is, after the determination result represents that the to-be-matched edge currently meets the time constraint condition of the target violation mode graph, it is determined whether the target matching edge is the edge with the latest timestamp in the target violation mode graph. If yes, it means that the edge matched this time is the last edge that needs to be matched in the target violation mode graph, and the current time sequence completely conforms to the mode of the target violation mode graph, so it is determined that a violation mode conforming to the target violation mode graph is detected, visual display is performed according to the determination result, and an audit report corresponding to the determination result is generated, which can support auditors to make decisions quickly and accurately, and improve the efficiency and accuracy of risk control. When the determination result represents that the to-be-matched edge currently does not meet the time constraint condition of the target violation mode graph, it means that the current matching does not conform to the mode of the target violation mode graph, and the matching information corresponding to the to-be-matched edge in the matching search tree can be directly deleted for exclusion.

[0089] It should be noted that, since the time window will be correspondingly slid according to its step attribute as time elapses, new stream data and expired stream data can occur, which need to be processed correspondingly, and the processing procedure is as follows: when the time window is slid, the new stream data in the time window is added to the data graph, and the stream data to be removed beyond the time range corresponding to the time window is removed from the data graph, so as to obtain an updated data graph; the matching information related to the stream data to be removed in the matching search tree is deleted, and the new edge corresponding to the new stream data in the updated data graph is determined; the new edge is determined as the to-be-matched edge, and the step of matching the to-be-matched edge with the target violation mode graph is jumped to. That is, when the time window is slid, the data graph can be updated based on the principle of incremental update, specifically, the new stream data in the time window is added to the data graph, and the stream data to be removed beyond the time range corresponding to the time window is removed from the data graph, so as to obtain an updated data graph, which not only improves the memory use efficiency, but also ensures the real-time and accuracy of the matching method. Then, the matching search tree needs to be pruned and updated according to the change of the data graph, specifically, the matching information related to the stream data to be removed in the matching search tree is deleted, and the new edge corresponding to the new stream data in the updated data graph is determined, the new edge is determined as the to-be-matched edge, and the step of matching the to-be-matched edge with the target violation mode graph is jumped to, so as to update the matching search tree according to the matching of the new edge. It can be understood that, due to the change of the data graph, the changed part also needs to be updated due to the change of the edge, such as the earliest timestamp, and the update formula can be as follows:

[0090] ;

[0091] wherein, represents the earliest timestamp, represents the edge of the target violation mode graph, represents a function of obtaining other vertices connected with the vertex. In this way, after the violation mode conforming to the target violation mode graph is detected, the related results are visualized and displayed, and an audit report is generated, which can support the auditors to make decisions quickly and accurately, improve the efficiency and accuracy of risk control, and at the same time, when the time window is slid, the data graph is updated based on the principle of incremental update, which not only improves the memory use efficiency, but also ensures the real-time and accuracy of the matching method, and improves the efficiency of transaction behavior audit.

[0092] As can be seen, the embodiment of the present application first determines a target violation pattern graph to be queried based on the received mode query instruction, and determines a corresponding time window and a matching search tree, to determine target flow data based on the time window, construct a data graph according to the target flow data, determine a to-be-matched edge from a plurality of edges of the data graph, match the to-be-matched edge with the target violation pattern graph, and after obtaining a matching result representing that there is a target matching edge in the target violation pattern graph that matches the to-be-matched edge, prune and update the matching search tree using a preset pruning strategy to determine whether the to-be-matched edge satisfies a time constraint condition of the target violation pattern graph, obtain a corresponding determination result, and determine whether a violation pattern conforming to the target violation pattern graph is detected based on the determination result, and jump to the step of determining the to-be-matched edge from the plurality of edges of the data graph until the plurality of edges of the data graph are all matched. In this way, through the above process of the embodiment of the present application, when auditing a transaction behavior, on the one hand, in addition to analyzing the topological structure of a graph, the time dependency between transactions is also considered, and a time constraint is added, so that a transaction behavior pattern conforming to a specific time sequence can be identified in fund transaction flow data; on the one hand, the matching search tree is pruned and updated in the matching process, reducing the complexity of transaction pattern identification; on the one hand, the data is preprocessed before the target flow data is determined based on the time window, to ensure the quality of the data and unify the format of the data, facilitating the matching of a violation pattern using the data; on the other hand, after the to-be-matched edge is added to the matching search tree, the matching search tree is pruned according to the preset pruning strategy, to remove matching that does not conform to the constraint condition, reduce the matching burden of the system, improve the matching efficiency, construct an auxiliary matching graph, further improve the pruning efficiency, and thus solve the problem of low auditing efficiency caused by the inability to capture complex time sequence relationships between transactions to identify violation operations with time constraints.

[0093] Correspondingly, referring to Figure 6 The embodiment of the present application also provides a transaction behavior auditing device, which comprises:

[0094] A search tree determination module 11 is configured to determine a target violation pattern graph to be queried based on a received mode query instruction, and determine a time window corresponding to the target violation pattern graph and a matching search tree for saving matching information, to determine corresponding target flow data from cached transaction flow data based on the time window.

[0095] A to-be-matched edge determination module 12 is configured to construct a data graph with transaction participants in the target flow data as vertices and transaction behaviors in the target flow data as edges, and determine a to-be-matched edge from a plurality of edges of the data graph; the to-be-matched edge is an un-matched edge randomly extracted from the plurality of edges.

[0096] The pruning updating module 13 is configured to match the to-be-matched edge with the target violation pattern graph, and after a matching result obtained indicates that there is a target matching edge in the target violation pattern graph that matches the to-be-matched edge, prune and update the matching search tree by using a preset pruning strategy, to determine whether the to-be-matched edge currently meets a time constraint condition of the target violation pattern graph according to a time sequence relationship and the matching search tree, and obtain a corresponding determination result.

[0097] The step jumping module 14 is configured to determine whether a violation pattern conforming to the target violation pattern graph is detected based on the determination result, and jump to the step of determining the to-be-matched edge from the plurality of edges of the data graph until all the plurality of edges of the data graph are matched.

[0098] As can be seen from the above, the embodiment of the present application first determines a target violation pattern graph to be queried based on the received pattern query instruction, and determines a corresponding time window and a matching search tree, to determine target flow data based on the time window, construct a data graph according to the target flow data, determine a to-be-matched edge from a plurality of edges of the data graph, match the to-be-matched edge with the target violation pattern graph, and after a matching result obtained indicates that there is a target matching edge in the target violation pattern graph that matches the to-be-matched edge, prune and update the matching search tree by using a preset pruning strategy, to determine whether the to-be-matched edge currently meets a time constraint condition of the target violation pattern graph, and obtain a corresponding determination result, and determine whether a violation pattern conforming to the target violation pattern graph is detected based on the determination result, and jump to the step of determining the to-be-matched edge from the plurality of edges of the data graph until all the plurality of edges of the data graph are matched. In this way, through the above process of the embodiment of the present application, when auditing transaction behaviors, the time dependency between transactions is considered in addition to the analysis of the topological structure of the graph, time constraints are added, and the transaction behavior pattern conforming to a specific time sequence can be identified in the fund transaction flow data, and the matching search tree is pruned and updated in the matching process, the complexity of transaction pattern identification is reduced, and thus the problem of low auditing efficiency caused by the inability to capture the complex time sequence relationship between transactions to identify violation operations with time constraints is solved.

[0099] In some specific embodiments, the search tree determining module 11 can specifically include:

[0100] The data processing unit is configured to clean and standardize the buffered transaction flow data to obtain processed data.

[0101] The data determination unit is configured to determine target data corresponding to the time window from the processed data according to the timestamp, and take the target data as target flow data corresponding to the time window.

[0102] In some embodiments, the pruning update module 13 can specifically include:

[0103] The edge matching unit is configured to determine transaction information corresponding to the to-be-matched edge, and match the to-be-matched edge with edges in the target violation pattern graph based on the transaction information to obtain a corresponding matching result.

[0104] The matching graph construction unit is configured to, if the matching result indicates that there is a target matching edge in the target violation pattern graph that matches the to-be-matched edge, construct an auxiliary matching graph based on the target violation pattern graph according to a greedy algorithm to determine a plurality of time constraint conditions corresponding to the target violation pattern graph.

[0105] The pruning update sub-module is configured to add the to-be-matched edge to the matching lookup tree, and perform pruning update on the matching lookup tree according to a preset pruning strategy to associate the to-be-matched edge with historical matching information cached in the matching lookup tree to obtain a corresponding association result.

[0106] The first result determination unit is configured to, if the association result indicates that there is no matching information associated with the to-be-matched edge in the historical matching information, obtain a determination result that the to-be-matched edge does not satisfy the time constraint condition of the target violation pattern graph.

[0107] The result determination sub-module is configured to, if the association result indicates that there is matching information associated with the to-be-matched edge in the historical matching information, compare a time sequence relationship obtained after the association with a target time constraint condition, and determine the determination result based on a comparison result obtained.

[0108] In some embodiments, the result determination sub-module can specifically include:

[0109] The second result determination unit is configured to, if the comparison result indicates that the time sequence relationship does not match the target time constraint condition, obtain a determination result that the to-be-matched edge does not satisfy the time constraint condition of the target violation pattern graph.

[0110] The third result determination unit is configured to, if the comparison result indicates that the time sequence relationship matches the target time constraint condition, obtain a determination result that the to-be-matched edge satisfies the time constraint condition of the target violation pattern graph.

[0111] In some embodiments, the pruning update submodule can specifically include:

[0112] An unmatched edge determination unit is configured to determine unmatched edges in the auxiliary matching graph based on the matching search tree;

[0113] A first step jump unit is configured to, if none of the target matching edge and the unmatched edges correspond to each other, delete the matching information corresponding to the to-be-matched edge from the matching search tree, and jump to the step of determining the to-be-matched edge from the plurality of edges of the data graph;

[0114] A timestamp determination unit is configured to, if the target matching edge corresponds to any of the unmatched edges, determine the earliest matching timestamp corresponding to the auxiliary matching edge; the auxiliary matching edge is an edge in the unmatched edges corresponding to the target matching edge;

[0115] A second step jump unit is configured to, if the timestamp of the to-be-matched edge is earlier than the earliest matching timestamp, delete the matching information corresponding to the to-be-matched edge from the matching search tree, and jump to the step of determining the to-be-matched edge from the plurality of edges of the data graph.

[0116] In some embodiments, the step jump module 14 can specifically include:

[0117] A report generation unit is configured to, when the determination result represents that the to-be-matched edge currently satisfies the time constraint condition of the target violation pattern graph, and the target matching edge is the edge with the latest timestamp in the target violation pattern graph, determine that a violation pattern conforming to the target violation pattern graph is detected, visually display according to the determination result, and generate a corresponding audit report for the determination result;

[0118] An information deletion unit is configured to, when the determination result represents that the to-be-matched edge currently does not satisfy the time constraint condition of the target violation pattern graph, delete the matching information corresponding to the to-be-matched edge in the matching search tree.

[0119] In some embodiments, the transaction behavior auditing apparatus can further include:

[0120] A data removal unit is configured to, when the time window slides, add the newly added flow data in the time window to the data graph, remove the to-be-removed flow data beyond the time range corresponding to the time window from the data graph, and obtain an updated data graph;

[0121] The new edge determination unit is configured to delete the matching information related to the to-be-removed flow data in the matching search tree, and determine a new edge corresponding to the new flow data in the updated data graph;

[0122] The third step jump unit is configured to determine the new edge as the to-be-matched edge, and jump to the step of matching the to-be-matched edge with the target violation mode graph.

[0123] Further, the embodiment of the present application further discloses an electronic device, Figure 7 is an electronic device 20 structure diagram shown according to an exemplary embodiment, the contents in the figure cannot be considered as any limitation on the use range of the present application. The electronic device 20, specifically can include: at least one processor 21, at least one memory 22, power supply 23, communication interface 24, input output interface 25 and communication bus 26. Wherein, the memory 22 is used for storing computer programs, the computer programs are loaded and executed by the processor 21, to realize the related steps in the transaction behavior audit method disclosed in any preceding embodiment. In addition, the electronic device 20 in the embodiment specifically can be an electronic computer.

[0124] In the embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device, and the communication protocol followed is any communication protocol applicable to the technical solution of the present application, which is not specifically limited here; the input output interface 25 is used to obtain external input data or output data to the outside world, and the specific interface type can be selected according to the specific application needs, which is not specifically limited here.

[0125] In addition, the memory 22 as the carrier of resource storage can be read-only memory, random access memory, magnetic disk or optical disk, etc., and the resources stored thereon can include operating system 221, computer program 222, etc., and the storage mode can be temporary storage or permanent storage.

[0126] Wherein, the operating system 221 is used to manage and control each hardware device on the electronic device 20 and the computer program 222, which can be Windows Server, Netware, Unix, Linux, etc. In addition to the computer program capable of completing the transaction behavior audit method executed by the electronic device 20 disclosed in any preceding embodiment, the computer program 222 can further include computer programs capable of completing other specific work.

[0127] Further, the application also discloses a computer readable storage medium for storing a computer program, wherein the computer program is executed by a processor to realize the transaction behavior auditing method disclosed above. For the specific steps of the method, refer to the corresponding content disclosed in the foregoing embodiments, which will not be repeated here.

[0128] The various embodiments are described in the specification by progressive stages, and each embodiment focuses on the difference from other embodiments. For the device disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple, and the relevant parts refer to the method part.

[0129] The skilled person can further realize that the units and algorithm steps of the examples described in combination with the embodiments disclosed herein can be realized by electronic hardware, computer software or a combination of both. In order to clearly illustrate the interchangeability of hardware and software, the components and steps of the examples have been described in the above description in general terms. Whether the functions are realized in hardware or software depends on the specific application and design constraints of the technical solution. The skilled person can use different methods to realize the described functions for each specific application, but such implementation should not be considered beyond the scope of the application.

[0130] The steps of the method or algorithm described in combination with the embodiments disclosed herein can be directly implemented by hardware, a software module executed by a processor, or a combination of both. The software module can be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0131] Finally, it should be noted that, in this document, relational terms such as first and second, and the like, are used solely to distinguish one entity or action from another entity or action, without necessarily requiring or implying any such actual relationship or order between such entities or actions. Moreover, the terms "comprises", "comprising", or any other variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements, but can also include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without more limitations, an element defined by the phrase "comprising a" does not exclude the existence of additional identical elements in the process, method, article, or apparatus that includes the element.

[0132] The technical solutions provided by the present application are described in detail above, and the principles and implementation manners of the present application are described by using specific examples. The above description of the examples is only used to help understand the method of the present application and its core idea; meanwhile, for those skilled in the art, according to the idea of the present application, the specific implementation manners and application ranges will be changed, and the above description of the content of the specification should not be understood as a limitation on the present application.

Claims

1. A method of auditing transactional behavior, the method comprising: The method comprises the following steps: determining a target violation pattern graph to be queried based on the received pattern query instruction, and determining a time window corresponding to the target violation pattern graph and a matching search tree for saving matching information, so as to determine corresponding target transaction flow data from the cached transaction flow data based on the time window; constructing a data graph with transaction participants in the target transaction flow data as vertices and transaction behaviors in the target transaction flow data as edges, and determining a to-be-matched edge from a plurality of edges of the data graph; the to-be-matched edge is an un-matched edge randomly selected from the plurality of edges; matching the to-be-matched edge with the target violation pattern graph, and pruning and updating the matching search tree based on a preset pruning strategy when a matching result obtained from the matching indicates that there is a target matching edge in the target violation pattern graph that matches the to-be-matched edge, so as to determine whether the to-be-matched edge meets a time constraint condition of the target violation pattern graph according to a time sequence relationship and the matching search tree, and obtain a corresponding determination result; determining whether a violation pattern conforming to the target violation pattern graph is detected based on the determination result, and jumping to the step of determining the to-be-matched edge from the plurality of edges of the data graph until all the plurality of edges of the data graph are matched.

2. The method of claim 1, wherein, The step of determining the corresponding target transaction flow data from the cached transaction flow data based on the time window comprises the following steps: cleaning and standardizing the cached transaction flow data to obtain processed data; determining target data corresponding to the time window from the processed data, and taking the target data as the target transaction flow data corresponding to the time window.

3. The method of claim 1, wherein, The step of matching the to-be-matched edge with the target violation pattern graph, and pruning and updating the matching search tree based on a preset pruning strategy when a matching result obtained from the matching indicates that there is a target matching edge in the target violation pattern graph that matches the to-be-matched edge, so as to determine whether the to-be-matched edge meets a time constraint condition of the target violation pattern graph according to a time sequence relationship and the matching search tree, and obtain a corresponding determination result, comprises the following steps: determining transaction information corresponding to the to-be-matched edge, and matching the to-be-matched edge with edges in the target violation pattern graph based on the transaction information to obtain a corresponding matching result; if the matching result indicates that there is a target matching edge in the target violation pattern graph that matches the to-be-matched edge, constructing an auxiliary matching graph based on the target violation pattern graph based on a greedy algorithm to determine a plurality of time constraint conditions corresponding to the target violation pattern graph; adding the to-be-matched edge to the matching search tree, and pruning and updating the matching search tree based on a preset pruning strategy to associate the to-be-matched edge with historical matching information cached in the matching search tree to obtain a corresponding association result; if the association result indicates that there is no matching information associated with the to-be-matched edge in the historical matching information, a determination result that the to-be-matched edge does not meet the time constraint condition of the target violation pattern graph is obtained. If the association result represents that there is matching information associated with the to-be-matched edge in the historical matching information, the obtained time sequence relationship after association is compared with a target time constraint condition, and the determination result is determined based on the obtained comparison result; the target time constraint condition is a condition related to the time sequence relationship in the time constraint conditions.

4. The method of claim 3, wherein, The determination result is determined based on the obtained comparison result, including: If the obtained comparison result represents that the time sequence relationship does not match the target time constraint condition, a determination result that the to-be-matched edge currently does not satisfy the time constraint condition of the target violation mode graph is obtained; If the comparison result represents that the time sequence relationship matches the target time constraint condition, a determination result that the to-be-matched edge currently satisfies the time constraint condition of the target violation mode graph is obtained.

5. The method of claim 4, wherein, The pruning update of the matching search tree by using a preset pruning strategy includes: Based on the matching search tree, an unmatched edge in the auxiliary matching graph is determined; If the target matching edge does not correspond to any edge in the unmatched edge, the matching information corresponding to the to-be-matched edge is deleted from the matching search tree, and the step of determining the to-be-matched edge from the edges of the data graph is jumped to; If the target matching edge corresponds to any edge in the unmatched edge, the earliest matching timestamp corresponding to the auxiliary matching edge is determined; the auxiliary matching edge is an edge in the unmatched edge corresponding to the target matching edge; If the timestamp of the to-be-matched edge is earlier than the earliest matching timestamp, the matching information corresponding to the to-be-matched edge is deleted from the matching search tree, and the step of determining the to-be-matched edge from the edges of the data graph is jumped to.

6. The method of claim 1, wherein, The determination of whether a violation mode conforming to the target violation mode graph is detected based on the determination result includes: When the determination result represents that the to-be-matched edge currently satisfies the time constraint condition of the target violation mode graph, and the target matching edge is the edge with the latest timestamp in the target violation mode graph, it is determined that a violation mode conforming to the target violation mode graph is detected, a visual display is performed according to the determination result, and an audit report corresponding to the determination result is generated; When the determination result represents that the to-be-matched edge currently does not satisfy the time constraint condition of the target violation mode graph, the matching information corresponding to the to-be-matched edge in the matching search tree is deleted.

7. The method of claim 1 to 6, wherein, Further including: When the time window slides, the newly added flow data in the time window is added to the data graph, and the to-be-removed flow data exceeding the time range corresponding to the time window is removed from the data graph to obtain an updated data graph; The matching information related to the to-be-removed flow data in the matching search tree is deleted, and a newly added edge corresponding to the newly added flow data in the updated data graph is determined; The newly added edge is determined as the to-be-matched edge, and the step of matching the to-be-matched edge with the target violation mode graph is jumped to.

8. A transaction behavior auditing apparatus, characterized by comprising: Including: The lookup tree determination module is configured to determine a target violation pattern graph to be queried based on the received pattern query instruction, and determine a time window corresponding to the target violation pattern graph and a matching lookup tree for saving matching information, so as to determine corresponding target transaction flow data from cached transaction flow data based on the time window. The edge to be matched determination module is configured to construct a data graph with transaction participants in the target transaction flow data as vertices and transaction behaviors in the target transaction flow data as edges, and determine edges to be matched from a plurality of edges of the data graph; the edges to be matched are un-matched edges randomly selected from the plurality of edges. The pruning update module is configured to match the edges to be matched with the target violation pattern graph, and perform pruning update on the matching lookup tree by using a preset pruning strategy when a matching result obtained by the matching indicates that there is a target matching edge in the target violation pattern graph that matches the edges to be matched, so as to determine whether the edges to be matched satisfy a time constraint condition of the target violation pattern graph according to a time sequence relationship and the matching lookup tree, and obtain a corresponding determination result. The step jump module is configured to determine whether a violation pattern conforming to the target violation pattern graph is detected based on the determination result, and jump to a step of determining the edges to be matched from the plurality of edges of the data graph until the plurality of edges of the data graph are all matched.

9. An electronic device, comprising: The memory is configured to save a computer program. The processor is configured to execute the computer program to implement the transaction behavior audit method according to any one of claims 1 to 7. The memory is configured to save a computer program.

10. A computer-readable storage medium, characterized in that, The computer program is executed by the processor to implement the transaction behavior audit method according to any one of claims 1 to 7.

Images