Abnormal data recognition model construction method and system and storage medium

Abstract

The invention relates to the technical field of data processing, in particular to an abnormal data recognition model construction method and system and a storage medium, and the method comprises the steps: obtaining financial data related to a maritime non-customs-setting scene; performing index clustering analysis on the financial data to obtain index features of the financial data; determining an abnormal account corresponding to the financial data based on the index characteristics; and based on the abnormal account, generating an abnormal data identification model used for identifying whether the input data belongs to the abnormal account or not. According to the method, the abnormal data identification model is established through the financial data which is already divided into the abnormal accounts, so that the abnormal data identification model can identify the input data according to the fixed field, and therefore, the abnormal data identification model can intelligently identify whether the input data belongs to the abnormal accounts, and the method has relatively high accuracy.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a method, system and storage medium for constructing an abnormal data recognition model in the field of data processing technology. Background Art

[0002] In the relevant technologies, the analysis methods of massive capital transaction data are: first, in the mode of using the specific situation and law of capital flow to carry out clue management and case investigation, the staff mainly use their eyes to identify and analyze with their limited individual ability, which is not only inefficient, but also fails to fully utilize and tap the greater value of capital data. Second, there is a lack of capital transaction anomaly analysis models specifically for unconventional transaction businesses, which generates a large amount of "noise data" that interferes with case handling, resulting in unclear grasp of the evidence status, large discrepancies in personnel research and judgment information, or unclear information in case links, which brings many difficulties to case investigation. Summary of the invention

[0003] The purpose of the present invention is to provide a method, system and storage medium for constructing an abnormal data recognition model. The technical solutions adopted are as follows:

[0004] In a first aspect, an embodiment of the present invention provides a method for constructing an abnormal data recognition model, the method comprising:

[0005] Obtain financial data related to non-customs offshore scenarios;

[0006] Performing indicator cluster analysis on the financial data to obtain indicator characteristics of the financial data;

[0007] Based on the indicator characteristics, determining abnormal accounts corresponding to the financial data;

[0008] Based on the abnormal account, an abnormal data identification model is generated for identifying whether the input data belongs to an abnormal account.

[0009] In a second aspect, a system for constructing an abnormal data recognition model is provided, the system comprising:

[0010] The acquisition module is used to obtain financial data related to non-customs offshore scenarios;

[0011] A clustering module, used to perform index clustering analysis on the financial data to obtain index characteristics of the financial data;

[0012] A determination module, configured to determine an abnormal account corresponding to the financial data based on the indicator feature;

[0013] A generation module is used to generate an abnormal data identification model for identifying whether input data belongs to an abnormal account based on the abnormal account.

[0014] According to a third aspect, a computer program product is provided, comprising: a computer program code, which, when executed on a computer, enables the computer to execute the method in the first aspect or any possible implementation of the first aspect.

[0015] In a fourth aspect, a computer-readable storage medium is provided, which stores a computer program code. When the computer program code runs on a computer, the computer executes the method in the first aspect or any possible implementation manner described in the first aspect.

[0016] The present invention has the following beneficial effects: by acquiring financial data related to non-customs scenarios at sea; and performing index cluster analysis on the financial data based on a plurality of dimension sets, the index characteristics of the financial data are obtained; in this way, by performing index cluster analysis on the financial data, the index characteristics of the financial data in each dimension can be extracted. Afterwards, based on the index characteristics, the abnormal accounts corresponding to the financial data are determined; in this way, by performing automatic abnormal analysis on the index characteristics, the abnormal accounts included in the financial data can be accurately analyzed. Finally, through the abnormal accounts, an abnormal data recognition model is generated for identifying whether the input data belongs to an abnormal account. In this way, by building an abnormal data recognition model through the financial data that has been divided into abnormal accounts, the abnormal data recognition model can identify the input data according to fixed fields, so that the abnormal data recognition model can intelligently identify whether the input data belongs to an abnormal account, and has strong versatility. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions and advantages in the embodiments of the present invention or the prior art, the drawings required for use in the embodiments or the prior art descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0018] Figure 1 It is a schematic diagram of an implementation flow of a method for constructing an abnormal data identification model provided by an embodiment of the present invention;

[0019] Figure 2 It is a schematic diagram of an application scenario of a method for constructing an abnormal data identification model provided by an embodiment of the present invention;

[0020] Figure 3It is another implementation flow diagram of a method for constructing an abnormal data identification model provided by an embodiment of the present invention;

[0021] Figure 4 It is another application scenario schematic diagram of a method for constructing an abnormal data recognition model provided by an embodiment of the present invention;

[0022] Figure 5 It is a schematic diagram of the composition structure of a system for building an abnormal data identification model provided by an embodiment of the present invention;

[0023] Figure 6 It is a structural schematic diagram of a computer device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0024] In order to further explain the technical means and effects adopted by the present invention to achieve the predetermined invention purpose, the following is a detailed description of the construction method of an abnormal data recognition model proposed by the present invention, its specific implementation method, structure, features and effects, in combination with the accompanying drawings and preferred embodiments. In the following description, different "one embodiment" or "another embodiment" does not necessarily refer to the same embodiment. In addition, specific features, structures or characteristics in one or more embodiments may be combined in any suitable form.

[0025] Among them, in the description of the embodiments of the present invention, unless otherwise specified, " / " means or, for example, A / B can mean A or B: "and / or" in the text is only a way to describe the association relationship of associated objects, indicating that there can be three relationships, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the description of the embodiments of the present invention, "multiple" refers to two or more than two.

[0026] In the following, the terms "first" and "second" are used for descriptive purposes only and are not to be understood as suggesting or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features.

[0027] Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs.

[0028] The following is a detailed description of a method for constructing an abnormal data recognition model provided by the present invention in conjunction with the accompanying drawings. Figure 1 , which shows a schematic diagram of an implementation flow of a method for constructing an abnormal data recognition model provided by an embodiment of the present invention, the method comprising:

[0029] 101, obtain financial data related to non-customs scenarios at sea.

[0030] Here, the non-customs setting scene at sea may be a non-customs setting place at sea. The financial data related to the non-customs setting scene at sea may be massive capital transaction data.

[0031] 102. Perform indicator cluster analysis on the financial data to obtain indicator features of the financial data.

[0032] Here, the multiple dimension sets include different dimensions, such as transaction amount, number of transactions, transaction time, transaction balance, consumption channel, transaction pattern, account transfer amount, counterparty account, etc.

[0033] In some possible implementations, the above step 102 may be implemented by the following steps 121 to 123 (not shown):

[0034] 121, determine the account type of the financial data.

[0035] Among them, the account types of financial data include: standard account, demo account, margin account, China-Pakistan account, foreign ship account and cargo owner account, etc.

[0036] 122. Filter the target account type among the account types.

[0037] The target account types include: China-Pakistan account, foreign ship account and cargo owner account. The account types are screened to determine whether the target account type is included in the account types of the financial data. If the target account type is included in the account types of the financial data, the financial data to which the target account type belongs is further screened.

[0038] 123. Based on the target account type, extract features of the financial data to which the target account type belongs to obtain indicator features of the financial data.

[0039] Here, the target account type is used to analyze the fund flow of the financial data to which the target account type belongs; and the parameter dimension set applicable to the target account type is analyzed through the fund flow, so that the financial data to which the target account type belongs can be extracted according to the parameter dimension set to obtain the indicator features of the financial data.

[0040] In some possible implementations, the above step 123 can be performed by Figure 3 The steps shown achieve:

[0041] 301. Determine a corresponding parameter dimension set based on the target account type.

[0042] Here, the parameter dimension set includes: the parameter dimensions included in the financial data corresponding to the target account type, such as transaction amount, number of transactions, transaction time, transaction balance, account transfer channel, counterparty account, etc. Different target account types have different corresponding parameter dimension sets. Since the target account types include China-Pakistan accounts, foreign ship accounts and cargo owner accounts, the parameter dimensions included in different target account types are different. Therefore, by analyzing the capital flow of the target account type, the parameter dimension set corresponding to the target account type can be accurately analyzed.

[0043] In some possible implementations, the above step 301 may be implemented by the following steps 321 and 322 (not shown in the figure):

[0044] 321. Based on the target account type, determine the fund flow of the financial data to which the target account type belongs.

[0045] Among them, the capital flow direction includes: capital inflow direction and capital outflow direction. If the target account type is the cargo owner account, then the capital flow direction of the financial data belonging to the cargo owner account is capital inflow; if the target account type is a foreign ship account or a China-Pakistan account, then the capital flow direction includes: capital inflow and capital outflow.

[0046] 322. Determine the parameter dimension set based on the capital flow.

[0047] In some possible implementations, if the capital flow direction is capital inflow, the transaction amount, number of transactions, transaction time, transaction balance, and account transfer channel corresponding to the financial data to which the target account type belongs are determined to obtain a parameter dimension set corresponding to the capital inflow;

[0048] Or, if the fund flow direction is fund outflow, determine the transaction amount, number of transactions, transaction time, transaction balance, account transfer channel, and counterparty account corresponding to the financial data to which the target account type belongs, and obtain the parameter dimension set corresponding to the fund outflow. In this way, the parameter dimension set included in the financial data can be accurately analyzed through the fund flow direction of the financial data.

[0049] 302 , extracting features of the financial data to which the target account type belongs based on the parameter dimension set to obtain indicator features corresponding to the parameter dimension set.

[0050] Here, if the parameter dimension set includes: transaction amount, number of transactions, transaction time, transaction balance, and consumption channel, then according to multiple parameter dimensions such as transaction amount, number of transactions, transaction time, transaction balance, and consumption channel, feature extraction is performed on the financial data belonging to the target account type to obtain the transaction amount, number of transactions, transaction time, transaction balance, and consumption channel of the financial data; the transaction amount, number of transactions, transaction time, transaction balance, and consumption channel of the financial data are determined as indicator features.

[0051] If the parameter dimension set includes at least: transaction rules, transaction amount, number of transactions, transaction time, account transfer amount, etc., then the financial data is feature extracted according to the transaction rules, transaction amount, number of transactions, transaction time, account transfer amount, etc. to obtain the indicator features of the financial data such as transaction rules, transaction amount, number of transactions, transaction time, account transfer amount, etc. The transaction rules are used to characterize the number of transactions, transfer-in amount, and transfer-out amount of the instant in and out transactions.

[0052] If the parameter dimension set includes at least: transaction amount, number of transactions, transaction time, and counterparty account, then feature extraction is performed on the financial data according to the transaction amount, number of transactions, transaction time, and counterparty account to obtain indicator features such as the transaction amount, number of transactions, transaction time, and counterparty account of the financial data. In this way, by extracting features from financial data in different dimensions, a richer indicator feature can be obtained, which facilitates abnormal identification of the rich indicator features and builds an abnormal data identification model with better performance. Moreover, by extracting features from financial data according to the parameter dimension set, the extracted indicator features can facilitate accurate judgment of abnormal accounts in the financial data.

[0053] 103. Determine the abnormal account corresponding to the financial data based on the indicator characteristics.

[0054] Here, abnormal accounts include: abnormal foreign ship accounts, abnormal China-Pakistan accounts and abnormal cargo owner accounts. In the massive financial data, there are multiple foreign ship accounts, multiple China-Pakistan accounts and multiple cargo owner accounts (for example, Figure 2 The multiple foreign ship accounts may also be China-Pakistan accounts, foreign ship accounts or cargo owner accounts. The corresponding relationship between the multiple foreign ship accounts and China-Pakistan accounts, foreign ship accounts and cargo owner accounts is as follows: Figure 2 As shown, a foreign ship account can be a China-Pakistan account or a cargo owner account. At the same time, a foreign ship account can correspond to multiple China-Pakistan accounts, or multiple cargo owner accounts.

[0055] In some possible implementations, the above step 103 may be implemented by the following process:

[0056] The first step is to determine the capital characteristics of the financial data to which the target account type belongs based on the target account type.

[0057] Here, since the target account types include: foreign ship accounts, China-Pakistan accounts and cargo owner accounts, the capital characteristics of the financial data belonging to foreign ship accounts include: large total daily transaction amount, certain regularity of transaction amount, concentrated transaction time, capital sedimentation period, IP location and certain activity of accounts. The capital characteristics of the financial data belonging to China-Pakistan accounts include: accounts have the characteristics of immediate in and out and appear multiple times, large total daily transaction amount, accounts have test transaction characteristics, account use is periodic, the balance after each transaction is zero and the ratio of capital in and out is close to the exchange rate of the day. The capital characteristics of the financial data belonging to cargo owner accounts include: the number of transactions has certain characteristics, the transaction amount is relatively large and there are many counterparties.

[0058] The second step is to generate indicator rules that match the characteristics of the funds.

[0059] Here, the indicator rules that match the capital characteristics of the foreign account are:

[0060] If the financial data belongs to a personal account, and the transaction amount in the indicator feature is greater than a first threshold;

[0061] If the financial data belongs to a personal account for cross-border transactions, and the accumulated transaction amount within a first preset time period is greater than a second threshold; here, the first preset time period may be the same day, for example, within 24 hours.

[0062] The number of transactions in the indicator feature of the financial data is greater than a third threshold, or the number of transactions transferred within the first preset time period is greater than a fourth threshold;

[0063] The transaction time in the indicator feature is within a preset time period; here, the preset time period can be any time period set by user.

[0064] The transaction balance in the indicator feature within the second preset time period is greater than a fifth threshold;

[0065] The transaction channel in the indicator feature includes preset keywords.

[0066] Here, the first threshold, the second threshold, the third threshold, the fourth threshold and the fifth threshold have different corresponding values ​​and may be user-defined.

[0067] According to the indicator rules, a large amount of financial data is classified through cluster analysis and rule classification analysis of financial data to obtain abnormal foreign accounts. The abnormal data identification model is mainly based on the fund transaction details of suspicious accounts, and extracts features from multiple dimensions such as transaction amount, number of transactions, transaction time, transaction balance, consumption channel, etc., so as to determine abnormal foreign accounts.

[0068] Through cluster analysis of financial data, a large number of indicator features are classified to obtain abnormal foreign accounts.

[0069] In some possible implementations, the index rules that match the capital characteristics of the foreign-invested account include: transaction index rules, total transaction number index rules, transaction time index rules, transaction balance index rules, transaction summary index rules, etc.; among which:

[0070] (1) Transaction amount indicator rules

[0071] If the financial data is a personal account, the account with a total accumulated transaction amount greater than or equal to N1 (i.e., the first threshold);

[0072] If the financial data is a personal account, the cross-border transaction account whose cumulative transaction amount on that day is greater than or equal to N2 (the second threshold).

[0073] (2) Total transaction count indicator rules

[0074] The total number of transactions in the indicator feature is counted to obtain accounts with a number of transactions greater than or equal to N4 (ie, the third threshold).

[0075] There are traces of test transactions, and the accounts have transferred more than N5 transactions per day and less than N5 transactions per day.

[0076] (3) Trading time indicator rules

[0077] The transaction time in the indicator feature is relatively concentrated, and the daily transactions are concentrated in a certain time period N7 (ie, the preset time period) for a number of days, and the accounts have a certain regularity.

[0078] (4) Trading balance indicator rules

[0079] The transaction balance in the indicator feature has a certain sedimentation period. For three consecutive days (the second preset period), the balance in the account is huge, accounting for N9 (the fifth threshold) of the total transaction amount.

[0080] (5) Trading summary indicator rules

[0081] The transaction channel in the indicator feature represents the account with consumption records in the personal account, which is obtained from the transaction name or transaction summary of the counterparty, and contains keywords such as "supermarket". In this way, the different indicators in the indicator feature are analyzed according to the indicator rules, so that abnormal external accounts can be accurately analyzed from financial data.

[0082] For the case where the target account type is a CMB account: if the transaction pattern, transaction amount, number of transactions, transaction time, and account transfer amount in the indicator characteristics meet at least one of the following indicator rules, it is determined that the account corresponding to the financial data is the abnormal CMB account; wherein the indicator rules that match the fund characteristics of the CMB account include:

[0083] The transaction regularity in the indicator feature indicates that the number of transactions of simultaneous entry and exit reaches a sixth threshold, the ratio between the amount transferred in and the amount transferred out is within a preset range, and the transaction amount is greater than a seventh threshold; here, the preset range can be a custom-set amount range.

[0084] If the financial data belongs to a personal account, and the transaction amount in the indicator feature is greater than a first threshold;

[0085] If the financial data belongs to a personal account for cross-border transactions, and the accumulated transaction amount within the first preset time period is greater than the second threshold;

[0086] If the financial data belongs to a business account and the transaction amount is greater than an eighth threshold;

[0087] The number of transactions in the indicator feature is greater than the third threshold, or there is a test transaction in the number of transactions, the number of transactions per unit time is greater than the ninth threshold, the transaction amount is less than the tenth threshold, and the amount transferred out within the third preset time period is greater than the eleventh threshold;

[0088] The transaction time in the indicator feature is regular, and after the current transaction, the transaction balance is less than the twelfth threshold;

[0089] The account transfer amount in the indicator feature is greater than a thirteenth threshold, and the difference between the account transfer amount and the transaction exchange rate is less than a fourteenth threshold.

[0090] In a specific example, the indicator rules that match the capital characteristics of the China-Pakistan account include: transaction regularity indicator rules, transaction amount indicator rules, total number of transactions indicator rules, transaction time indicator rules, and transaction exchange rate indicator rules; among which:

[0091] (1) Trading rules and indicators

[0092] The transaction rules in the indicator characteristics have the characteristics of 5 immediate in-and-out transactions (i.e. the sixth threshold), the account is transferred out within N11 hours after the deposit, the ratio of the amount transferred in to the amount transferred out is between N12 and N13 (i.e. the preset range), and the transaction amount is greater than or equal to N14 yuan (i.e. the seventh threshold).

[0093] (2) Transaction amount indicator rules

[0094] If the financial data is a personal account, the account with a total accumulated transaction amount greater than or equal to N1 (i.e., the first threshold);

[0095] If the financial data is a personal account, the cross-border transaction account whose cumulative transaction amount on that day is greater than or equal to N2 (the second threshold).

[0096] If the financial data is a corporate account, the account with a total accumulated transaction amount greater than or equal to N3 (ie, the eighth threshold); by merging the results, the account with a huge transaction amount is obtained.

[0097] (3) Total transaction count indicator rules

[0098] The total number of transactions in the indicator feature is counted to obtain accounts with N4 transactions or more (i.e., the third threshold);

[0099] There are traces of test transactions in the number of transactions, with more than N5 transactions transferred out in a single day (i.e. the number of transactions per unit time is greater than the ninth threshold) and the amount is within N6 yuan (i.e. the transaction amount is less than the tenth threshold), and N8 yuan is transferred out within N7 hours (i.e. the transfer amount within the third preset time period is greater than the eleventh threshold).

[0100] (4) Trading time indicator rules

[0101] The transaction time in the indicator characteristics is periodic. The account transaction active days are less than or equal to N9 days, and the account silent period is greater than or equal to N10 transaction balance indicator rules.

[0102] After the transaction, the balance of the account is less than or equal to N15 yuan (i.e. the twelfth threshold);

[0103] (5) Trading exchange rate index rules

[0104] The account transfer amount in the indicator feature has a single transaction amount greater than or equal to N16 yuan (the 13th threshold), and is close to an integer multiple of the exchange rate (mainly the US dollar exchange rate), the error is less than N17 and greater than N18, and the minimum transaction time is N19 (that is, the difference between the account transfer amount and the transaction exchange rate is less than the 14th threshold). In this way, according to the indicator rules, the different indicators in the indicator feature are compared and analyzed, so that abnormal Chinese and Pakistani accounts can be accurately analyzed from financial data.

[0105] For the case where the target account type is a China-Pakistan account: if the transaction amount, number of transactions, transaction time, and counterparty account in the indicator characteristics meet at least one of the following indicator rules, it is determined that the account corresponding to the financial data is the abnormal consignor account; wherein the indicator rules that match the financial data to which the China-Pakistan account belongs include:

[0106] If the financial data belongs to a personal account, and the transaction amount in the indicator feature is greater than a first threshold;

[0107] If the financial data belongs to a corporate account and the transaction amount in the indicator feature is greater than a second threshold;

[0108] The single transaction amount in the indicator feature is greater than the eighth threshold;

[0109] The number of transactions in the indicator feature is greater than a third threshold;

[0110] The transaction time in the indicator feature is periodic and the corresponding account silence duration is greater than the ninth threshold;

[0111] The number of counterparty accounts in the indicator feature is greater than the tenth threshold.

[0112] In a specific example, according to the indicator rules, a large amount of financial data is classified through cluster analysis and rule classification analysis of financial data to obtain abnormal consignor accounts. The abnormal consignor accounts show the characteristics of extremely small total number of transactions. Further feature extraction is performed on dimensions such as transaction amount, transaction time, and counterparty to determine suspicious consignor accounts. Based on this, the indicator rules that match the financial data belonging to the China-Pakistan account include: transaction amount indicator rules, total number of transactions indicator rules, total number of transactions indicator rules, transaction time indicator rules, and counterparty indicator rules; among which:

[0113] (1) Transaction amount indicator rules

[0114] If the financial data is a personal account, the account with a total accumulated transaction amount greater than or equal to N1 (i.e., the first threshold);

[0115] If the financial data is a corporate account, the account with a total accumulated transaction amount greater than or equal to N2 (i.e., the second threshold);

[0116] Among all accounts, accounts with a single transaction amount greater than or equal to N3 (i.e., the eighth threshold); merge the results to obtain accounts with huge transaction amounts.

[0117] (2) Total transaction count indicator rules

[0118] The total number of transactions in the indicator feature is counted to obtain accounts with less than or equal to N4 transactions (ie, the third threshold).

[0119] (4) Trading time indicator rules

[0120] The transaction time in the indicator characteristics is periodic, and the account silence period is greater than or equal to N5 days (i.e. the ninth threshold).

[0121] (5) Counterparty Indicator Rules

[0122] The number of counterparty accounts in the indicator feature, accounts that have financial transactions with transition accounts above N6 (i.e. the tenth threshold).

[0123] In the embodiment of the present invention, the financial data is classified by using different indicator features and corresponding indicator rules in the indicator features, so that abnormal consignor accounts in the financial data can be analyzed more accurately.

[0124] The third step is to compare the indicator feature with the indicator rule to obtain a comparison result.

[0125] The fourth step is to determine the abnormal account corresponding to the financial data based on the comparison result.

[0126] Among them, if the comparison result represents that the indicator characteristics are different from the indicator rules, it means that there are abnormal accounts corresponding to the target account type in the financial data. Abnormal accounts include: abnormal foreign ship accounts, abnormal China-Pakistan accounts and abnormal cargo owner accounts. In this way, the financial data is classified through different indicator characteristics and corresponding indicator rules, so that the abnormal foreign ship accounts, abnormal China-Pakistan accounts and abnormal cargo owner accounts in the financial data can be analyzed more accurately.

[0127] 104. Based on the abnormal account, generate an abnormal data identification model for identifying whether the input data belongs to an abnormal account.

[0128] Here, the abnormal data recognition model can be composed of multiple functional modules. In some possible implementations, first, the abnormal account and the corresponding indicator rules are embedded in the functional module to obtain multiple functional modules; then, based on the multiple functional modules, the abnormal data recognition model is built. For example, the functional module is automatically generated according to the indicator rules, and the financial data and the corresponding indicator rules are imported into the functional module, and the identified multiple abnormal accounts are embedded at the same time to form the abnormal data recognition model; thus, the abnormal data recognition model can identify the different specifications of funds from different banks according to fixed fields to form a standard unified funds database. In this way, not only does the algorithm reflect the characteristics of simplicity and clarity, but the operators are flexibly combined, which greatly improves the robustness of the abnormal data recognition model; and the abnormal data recognition model is not limited to a certain scenario, and can intelligently identify and learn intelligently, and has strong versatility.

[0129] In some embodiments, after building an abnormal data recognition model, for the input data, the abnormal data recognition model can be used to identify abnormal financial data of the input data to obtain candidate indicator features corresponding to the input data; that is, the indicator features in the input data are extracted by the abnormal data recognition model to obtain candidate indicator features. Afterwards, based on the candidate indicator features, an account transaction map of the input data is generated; wherein the account transaction map is used to characterize a comprehensive flow diagram of relevant account financial data. Finally, through the account transaction map, it is determined whether the input data belongs to the abnormal account. Here, through the association method of the transaction amount indicator rule, transaction time indicator rule, total transaction indicator rule, transaction balance indicator rule, counterparty name indicator rule, and transaction summary indicator rule in the abnormal data recognition model, the maps of each link and team of the owners of unconventional transactions in non-customs areas at sea, China-Pakistan and foreign ships are excavated, the business machinery of clues is actively excavated, clues are actively captured, and rapid strikes are achieved through further exploration and implementation. Figure 4 As shown in FIG. 1 , each indicator rule in the abnormal data identification model is used to identify the abnormal financial data of the maritime non-customs area in region A, and the behavioral characteristics of the financial data are obtained. For example, the behavioral characteristics of account 41 are: large-amount transactions and many counterparties, and the possibility of the account being an abnormal consignor account and an abnormal China-Pakistan account is output, such as Figure 4 As shown, the possibility that this account is an abnormal cargo owner account is 80%, and the possibility that this account is an abnormal China-Pakistan account is 30%. The behavior characteristics of account 42 are: large transactions and account name in English, and the possibility that this account is an abnormal cargo owner account and an abnormal foreign ship account is output, such as Figure 4 As shown, the possibility that this account is an abnormal shipper account is 50%, and the possibility that this account is an abnormal foreign ship account is 40%. The behavior characteristics of account 43 are: transaction periodicity and immediate in and out, and the possibility that this account is an abnormal China-Pakistan account and an abnormal shipper account is output, as shown in Figure 4 As shown, the probability that the account is an abnormal CMB account is 85%, and the probability that the account is an abnormal consignor account is 35%. The behavior characteristics of account 44 are: large transactions and many counterparties, and the probability that the account is an abnormal consignor account and an abnormal CMB account is output, as shown in Figure 4 As shown, the probability that the account is an abnormal consignor account is 80%, and the probability that the account is an abnormal China-Pakistan account is 30%. The behavior characteristics of account 45 are: large transactions and many counterparties, and the probability that the account is an abnormal consignor account and an abnormal China-Pakistan account is output, such as Figure 4 As shown, the possibility that the account is an abnormal consignor account is 80%, and the possibility that the account is an abnormal China-Pakistan account is 30%.

[0130] In this way, the embodiments of the present invention gradually build a huge and effective analysis data base by accumulating active account fund flow data. The fund flow patterns of non-customs cases are obvious. Even if the categories of unconventional transaction goods are different, the fund flow shows a high degree of commonality. The unique fund flow patterns of each link are combined to form a comprehensive picture of the fund flow of non-customs crimes, which will be widely used in related research and judgment fields.

[0131] In an embodiment of the present invention, after obtaining financial data related to non-customs-based scenarios at sea, the financial data is subjected to index cluster analysis through multiple dimension sets, so that the index features of the financial data in each dimension can be extracted. By automatically performing abnormal analysis on the index features, the abnormal accounts included in the financial data can be accurately analyzed. By building an abnormal data recognition model based on the financial data that has been classified as abnormal accounts, the abnormal data recognition model can recognize the input data according to fixed fields, so that the abnormal data recognition model can intelligently recognize whether the input data belongs to an abnormal account, and has strong versatility.

[0132] The present invention provides a system for constructing an abnormal data recognition model. Figure 4 , which shows a schematic diagram of the composition structure of a system for building an abnormal data identification model provided by an embodiment of the present invention, the system 500 includes:

[0133] An acquisition module 501 is used to acquire financial data related to offshore non-customs scenarios;

[0134] A clustering module 502, configured to perform an indicator clustering analysis on the financial data based on a plurality of dimension sets to obtain indicator features of the financial data;

[0135] A determination module 503, configured to determine an abnormal account corresponding to the financial data based on the indicator feature;

[0136] The generating module 504 is used to generate an abnormal data identification model for identifying whether the input data belongs to an abnormal account based on the abnormal account.

[0137] In some possible implementations, the clustering module 502 is further used to determine the account type of the financial data; among the account types, screen a target account type; and based on the target account type, perform feature extraction on the financial data to which the target account type belongs to obtain indicator features of the financial data.

[0138] In some possible implementations, the clustering module 502 is further used to determine a corresponding parameter dimension set based on the target account type; perform feature extraction on the financial data belonging to the target account type based on the parameter dimension set to obtain indicator features corresponding to the parameter dimension set.

[0139] In some possible implementations, the clustering module 502 is further used to determine, based on the target account type, the fund flow of the financial data to which the target account type belongs; and to determine the parameter dimension set based on the fund flow.

[0140] In some possible implementations, the clustering module 502 is also used to determine the transaction amount, number of transactions, transaction time, transaction balance, and account transfer channel corresponding to the financial data to which the target account type belongs if the fund flow direction is fund inflow, and obtain the parameter dimension set corresponding to the fund inflow; or, if the fund flow direction is fund outflow, determine the transaction amount, number of transactions, transaction time, transaction balance, account transfer channel, and counterparty account corresponding to the financial data to which the target account type belongs, and obtain the parameter dimension set corresponding to the fund outflow.

[0141] In some possible implementations, the determination module 503 is further used to determine, based on the target account type, the capital characteristics of the financial data to which the target account type belongs; generate indicator rules that match the capital characteristics; compare the indicator characteristics with the indicator rules to obtain a comparison result; and determine, based on the comparison result, an abnormal account corresponding to the financial data.

[0142] In some possible implementations, the generating module 504 is further used to embed the abnormal accounts and corresponding indicator rules into a functional module to obtain a plurality of functional modules; and to build the abnormal data recognition model based on the plurality of functional modules.

[0143] In some possible implementations, the generation module 504 is also used to use the abnormal data identification model to perform abnormal financial data identification on the input data to obtain candidate indicator features corresponding to the input data; based on the candidate indicator features, generate an account transaction map of the input data; based on the account transaction map, determine whether the input data belongs to the abnormal account.

[0144] Optionally, the transmission medium can be a wired link (for example, but not limited to, coaxial cable, optical fiber and digital subscriber line (DSL), etc.) or a wireless link (for example, but not limited to, wireless Fidelity (WIFI), Bluetooth and mobile device network, etc.). It should be noted that: the system provided in the above embodiment is only illustrated by the division of the above functional modules. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the computer device is divided into different functional modules to complete all or part of the functions described above. In addition, the method embodiments provided in the above embodiments belong to the same concept. The specific implementation process is detailed in the method embodiments, which will not be repeated here.

[0145] Figure 6 is a schematic diagram of the structure of a computer device provided by an embodiment of the present invention. Figure 6 As shown, the computer device 600 includes: a memory 601, a processor 602, and a computer program 603 stored in the memory 601 and running on the processor 602, wherein when the processor 602 executes the computer program 603, the computer device can execute any one of the above-mentioned methods for constructing an abnormal data recognition model.

[0146] In addition, the embodiment of the present invention also protects a system, which may include a memory and a processor, wherein an executable program code is stored in the memory, and the processor is used to call and execute the executable program code to perform a method for constructing an abnormal data identification model provided by the embodiment of the present invention. This embodiment can divide the functional modules of the system according to the above method example. For example, it can correspond to each functional module, or two or more functions can be integrated into a processing module, and the above integrated module can be implemented in the form of hardware. It should be noted that the division of modules in this embodiment is schematic, which is only a logical function division, and there may be other division methods in actual implementation. It should be noted that all relevant contents of each step involved in the above method embodiment can be cited to the functional description of the corresponding functional module, which will not be repeated here.

[0147] It should be understood that the system provided in this embodiment is used to execute the above-mentioned method for constructing an abnormal data identification model, so the same effect as the above-mentioned implementation method can be achieved. In the case of an integrated unit, the system may include a processing module and a storage module. Wherein, when the system is applied to a device, the processing module may be used to control and manage the actions of the device. The storage module may be used to support the device to execute mutual program codes, etc. Wherein, the processing module may be a processor or a controller, which may implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the disclosure of the present invention. The processor may also be a combination that implements a computing function, such as a combination of one or more microprocessors, a combination of digital signal processing (DSP) and a microprocessor, and the like, and the storage module may be a memory.

[0148] In addition, the system provided by the embodiment of the present invention may be specifically a chip, a component or a module, and the chip may include a connected processor and a memory; wherein the memory is used to store instructions, and when the processor calls and executes the instructions, the chip can execute a method for constructing an abnormal data identification model provided in the above embodiment. This embodiment also provides a computer-readable storage medium, in which a computer program code is stored, and when the computer program code is run on a computer, the computer executes the above-mentioned related method steps to implement a method for constructing an abnormal data identification model provided in the above embodiment.

[0149] The present embodiment also provides a computer program product, when the computer program product is run on a computer, the computer executes the above-mentioned related steps to implement a method for constructing an abnormal data identification model provided by the above embodiment. Among them, the system, computer-readable storage medium, computer program product or chip provided in the present embodiment are all used to execute the corresponding method provided above, so the beneficial effects that can be achieved can refer to the beneficial effects in the corresponding method provided above, and will not be repeated here. Through the description of the above implementation mode, the technicians in the relevant field can understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In practical applications, the above-mentioned function allocation can be completed by different functional modules as needed, that is, the internal structure of the system is divided into different functional modules to complete all or part of the functions described above. In the embodiments provided by the present invention, it should be understood that the disclosed system and method can be implemented in other ways. For example, the system embodiment described above is only schematic, for example, the division of modules or units is only a logical function division, and there can be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, system or unit, which may be electrical, mechanical or other forms.

[0150] It should be noted that the sequence of the above-mentioned embodiments of the present invention is only for description and does not represent the advantages and disadvantages of the embodiments. The process depicted in the accompanying drawings does not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multi-task processing and parallel processing are also possible or may be advantageous. The various embodiments in this specification are described in a progressive manner, and the same and similar parts between the various embodiments can be referenced to each other, and each embodiment focuses on the differences from other embodiments. The above content is only a specific implementation method of the present invention, but the protection scope of the present invention is not limited to this. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be covered within the protection scope of the present invention.

Claims

1. A method for constructing an abnormal data recognition model, characterized in that: The method for constructing the abnormal data recognition model includes: Obtain financial data related to non-customs offshore scenarios; Performing indicator cluster analysis on the financial data to obtain indicator characteristics of the financial data; Based on the indicator characteristics, determining abnormal accounts corresponding to the financial data; Based on the abnormal account, an abnormal data identification model is generated for identifying whether the input data belongs to an abnormal account.

2. The method for constructing an abnormal data recognition model according to claim 1, characterized in that: The performing of index cluster analysis on the financial data to obtain index characteristics of the financial data includes: determining an account type of the financial data; Among the account types, filter the target account type; Based on the target account type, feature extraction is performed on the financial data to which the target account type belongs to obtain indicator features of the financial data.

3. The method for constructing an abnormal data recognition model according to claim 2, characterized in that: The step of extracting features of the financial data to which the target account type belongs based on the target account type to obtain indicator features of the financial data includes: Based on the target account type, determining a corresponding parameter dimension set; Based on the parameter dimension set, feature extraction is performed on the financial data belonging to the target account type to obtain indicator features corresponding to the parameter dimension set.

4. The method for constructing an abnormal data recognition model according to claim 3, characterized in that: The determining a corresponding parameter dimension set based on the target account type includes: Based on the target account type, determining the fund flow direction of the financial data to which the target account type belongs; Based on the capital flow, the parameter dimension set is determined.

5. The method for constructing an abnormal data recognition model according to claim 4, characterized in that: The step of determining the parameter dimension set based on the capital flow direction includes: If the capital flow direction is capital inflow, determine the transaction amount, number of transactions, transaction time, transaction balance, and account transfer channel corresponding to the financial data to which the target account type belongs, and obtain a parameter dimension set corresponding to the capital inflow; Or, if the fund flow direction is fund outflow, determine the transaction amount, number of transactions, transaction time, transaction balance, account transfer channel, and counterparty account corresponding to the financial data belonging to the target account type, and obtain the parameter dimension set corresponding to the fund outflow.

6. The method for constructing an abnormal data recognition model according to claim 3, characterized in that: Before determining the abnormal account corresponding to the financial data based on the indicator feature, the method further includes: Based on the target account type, determining a fund characteristic of the financial data to which the target account type belongs; generating indicator rules matching the characteristics of the funds; Comparing the indicator feature with the indicator rule to obtain a comparison result; Based on the comparison result, an abnormal account corresponding to the financial data is determined.

7. The method for constructing an abnormal data recognition model according to claim 1, characterized in that: The generating, based on the abnormal account, an abnormal data identification model for identifying whether the input data belongs to an abnormal account comprises: Embedding the abnormal accounts and corresponding indicator rules into a functional module to obtain multiple functional modules; Based on the multiple functional modules, the abnormal data identification model is constructed.

8. The method for constructing an abnormal data recognition model according to claim 1, characterized in that: The method further comprises: Using the abnormal data identification model to identify abnormal financial data on the input data, and obtaining candidate indicator features corresponding to the input data; Based on the candidate indicator features, generating an account transaction graph of the input data; Based on the account transaction graph, determine whether the input data belongs to the abnormal account.

9. A system for constructing an abnormal data recognition model, characterized in that: The system comprises: The acquisition module is used to obtain financial data related to non-customs offshore scenarios; A clustering module, used to perform index clustering analysis on the financial data to obtain index characteristics of the financial data; A determination module, configured to determine an abnormal account corresponding to the financial data based on the indicator feature; A generation module is used to generate an abnormal data identification model for identifying whether input data belongs to an abnormal account based on the abnormal account.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program code, and when the computer program code is executed on a computer, the computer executes the method for constructing an abnormal data identification model according to any one of claims 1 to 8.

Images