Prediction method and device of money laundering behavior, electronic equipment and storage medium

Abstract

The invention provides a money laundering behavior prediction method and device, electronic equipment and a storage medium. The method comprises the following steps: analyzing historical transaction data, terminal operation data and original user information of a user in a historical time period to obtain user attribute information, a transaction behavior sequence and an operation behavior sequence of the user; performing statistical analysis on the transaction behavior sequence and the operation behavior sequence according to anti-money laundering service features, and constructing derivative features of the user; calling a money laundering behavior prediction model obtained by pre-training, and performing local feature and global feature learning on the user attribute information, the transaction behavior sequence, the operation behavior sequence and the derivative feature by adopting a multi-head attention mechanism to obtain a money laundering behavior probability of the user; and based on the money laundering behavior probability and a preset probability threshold, determining whether the user has a money laundering behavior. The method can improve the discrimination capability of the model for high money laundering risk customers.

Description

Technical Field

[0001] The present application relates to the field of financial security technology, and in particular to a method, device, electronic device and storage medium for predicting money laundering behavior. Background Art

[0002] According to the regulations of the People's Bank of China, banks and other financial institutions are obliged to provide suspicious transaction reports to the People's Bank of China. Furthermore, banks and other financial institutions should accurately identify suspicious customers with high money laundering risks based on in-house customer data and report them to the People's Bank of China. As the number of customers and transactions increases, money laundering behavior becomes more complicated. Traditional rule models can no longer meet the increasing requirements for anti-money laundering identification. Money laundering customers often have behavior patterns that are different from normal customers. Using deep sequence models to enable anti-money laundering suspicious customer warnings can effectively improve the efficiency of anti-money laundering work.

[0003] In the prior art, when conducting anti-money laundering suspicious customer warnings, the customer's transaction behavior information and customer attribute information are usually used to predict money laundering behavior, or the money laundering transaction behavior sequence is modeled using a recurrent neural network method. However, this method does not fully consider the customer's operational behavior information (such as mobile banking operational behavior, etc.). At the same time, the modeling method only focuses on the global representation of the behavior sequence, while ignoring its local representation, resulting in the model being unable to accurately capture the customer's money laundering risk in a shorter period of time, resulting in a lower ability to predict money laundering behavior and an increase in the number of false positives of money laundering behavior. Summary of the invention

[0004] The technical problem to be solved by the embodiments of the present application is to provide a method, device, electronic device and storage medium for predicting money laundering behavior, so as to effectively improve the model's ability to distinguish customers with high money laundering risks, reduce false positives of suspicious customers, and more efficiently identify customers' abnormal transaction behaviors and abnormal operation behaviors through differentiated early warning mechanisms.

[0005] In a first aspect, an embodiment of the present application provides a method for predicting money laundering behavior, the method comprising:

[0006] Analyze the historical transaction data, terminal operation data and original user information of the user in the historical period to obtain the user attribute information, transaction behavior sequence and operation behavior sequence of the user;

[0007] Performing statistical analysis on the transaction behavior sequence and the operation behavior sequence according to anti-money laundering business characteristics to construct derived characteristics of the user;

[0008] The pre-trained money laundering behavior prediction model is called to adopt a multi-head attention mechanism to learn local features and global features of the transaction behavior sequence and the operation behavior sequence, and the learned features, the user attribute information and the derived features are processed to obtain the money laundering behavior probability of the user;

[0009] Based on the money laundering behavior probability and a preset probability threshold, it is determined whether the user has engaged in money laundering behavior.

[0010] In a second aspect, an embodiment of the present application provides a device for predicting money laundering behavior, the device comprising:

[0011] A behavior sequence acquisition module is used to parse the historical transaction data, terminal operation data and original user information of the user in the historical period to obtain the user attribute information, transaction behavior sequence and operation behavior sequence of the user;

[0012] A derived feature construction module, used to perform statistical analysis on the transaction behavior sequence and the operation behavior sequence according to anti-money laundering business characteristics, and construct derived features of the user;

[0013] A money laundering behavior probability acquisition module is used to call the pre-trained money laundering behavior prediction model to adopt a multi-head attention mechanism to learn local features and global features of the transaction behavior sequence and the operation behavior sequence, and process the learned features, the user attribute information and the derived features to obtain the money laundering behavior probability of the user;

[0014] The money laundering behavior determination module is used to determine whether the user has engaged in money laundering behavior based on the money laundering behavior probability and a preset probability threshold.

[0015] In a third aspect, an embodiment of the present application provides an electronic device, including:

[0016] A processor, a memory, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the method for predicting money laundering behavior described in any one of the above items is implemented.

[0017] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium. When the instructions in the storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute any of the money laundering behavior prediction methods described above.

[0018] Compared with the prior art, the embodiments of the present application have the following advantages:

[0019] In the embodiment of the present application, the user's user attribute information, transaction behavior sequence and operation behavior sequence are obtained by parsing the user's historical transaction data, terminal operation data and original user information in the historical period. According to the anti-money laundering business characteristics, the transaction behavior sequence and the operation behavior sequence are statistically analyzed to construct the derived features of the user. The pre-trained money laundering behavior prediction model is called to adopt a multi-head attention mechanism to learn local features and global features of the transaction behavior sequence and the operation behavior sequence, and the learned features, user attribute information and derived features are processed to obtain the user's money laundering behavior probability. Based on the money laundering behavior probability and the pre-set probability threshold, it is determined whether the user has money laundering behavior. In addition to using customer attribute information and customer transaction behavior sequence in the suspicious customer warning process, the embodiment of the present application also exploratory introduction of customer operation behavior sequence data, strengthens the model's learning ability for local representation of transaction behavior sequence and operation behavior sequence, and helps to improve the model's ability to identify a small number of abnormal transaction behaviors and abnormal operation behaviors in the transaction behavior sequence and operation behavior sequence, thereby improving the model's ability to distinguish customers with high money laundering risks. At the same time, the connection between customer attribute information and behavior sequence representation is established through the multi-head attention mechanism, and differentiated early warnings are given for the attribute information of different customers. This can not only reduce false alarms of suspicious customers, but also more efficiently identify customers' abnormal transaction behaviors and abnormal operation behaviors through differentiated early warning mechanisms.

[0020] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 A flowchart of a method for predicting money laundering behavior provided in an embodiment of the present application;

[0022] Figure 2 A flowchart of a method for obtaining a derivative feature provided in an embodiment of the present application;

[0023] Figure 3 A flowchart of a method for obtaining the probability of money laundering provided in an embodiment of the present application;

[0024] Figure 4 A flowchart of another method for obtaining the probability of money laundering provided in an embodiment of the present application;

[0025] Figure 5 A schematic diagram of an anti-money laundering suspicious customer early warning process based on a behavior sequence provided in an embodiment of the present application;

[0026] Figure 6 A schematic diagram of a customer money laundering risk prediction process provided in an embodiment of the present application;

[0027] Figure 7 A schematic diagram of the structure of a money laundering prediction device provided in an embodiment of the present application;

[0028] Figure 8 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0029] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, the present application is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0030] The terms used in the embodiments of the present application are only for the purpose of describing specific embodiments, and are not intended to limit the present application. The singular forms "a", "said" and "the" used in the embodiments of the present application and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings.

[0031] Reference Figure 1 , shows a flowchart of the steps of a method for predicting money laundering behavior provided by an embodiment of the present application, such as Figure 1 As shown, the money laundering behavior prediction method may include: step 101, step 102, step 103 and step 104.

[0032] Step 101: parsing the historical transaction data, terminal operation data and original user information of the user in the historical period, and obtaining the user attribute information, transaction behavior sequence and operation behavior sequence of the user.

[0033] The embodiments of the present application can be applied to the scenario of predicting whether a user has engaged in money laundering behavior by combining user attribute information, transaction behavior sequence, and operation behavior sequence.

[0034] When predicting a user's money laundering behavior, we can obtain the user's historical transaction data, terminal operation data (such as mobile banking terminal operation data, etc.) and original user information (such as original customer information collected by various bank systems, etc.) within the historical period, and parse the user's historical transaction data, terminal operation data and user original information, that is, conduct behavior sequence mining to obtain the user's user attribute information, transaction behavior sequence and operation behavior sequence.

[0035] Behavior sequence mining is an important branch in the field of data mining. It mainly mines meaningful patterns and rules from behavior sequence data. Its goal is to discover repeated behavior patterns in the data. These patterns are usually arranged in chronological order. Behavior sequence mining has a wide range of applications in market analysis, customer behavior analysis, recommendation marketing and other fields.

[0036] Among them, historical transaction data can be data obtained by users on financial data platforms, official transaction websites, etc.

[0037] User attribute information refers to a series of data that can describe or distinguish user characteristics. In this example, user attribute information may include: user basic information, held assets, historical credit information, and other data.

[0038] A transaction behavior sequence refers to a series of transaction decisions and actions arranged in chronological order, including the customer's transaction amount, transaction time, and transaction type. By studying the transaction behavior sequence, it is possible to evaluate and optimize trading strategies, identify potential risk patterns and behaviors, and discover potential patterns and trends. The study of transaction behavior sequences is of great significance to investors, financial institutions, and regulators. In this example, the transaction behavior sequence may include: transaction channels, transaction amounts, counterparties, and other data corresponding to the user's transaction flow.

[0039] An operation behavior sequence is a series of operations and interactions performed by customers in mobile banking applications, arranged in chronological order. These operations are recorded in chronological order, reflecting how users interact with mobile banking applications and complete various financial tasks. By analyzing the customer operation behavior sequence of mobile banking, banks can better understand customer needs, improve service quality, and enhance user experience. At the same time, they can also effectively manage risks and identify potential money laundering risks of customers. In this example, the operation behavior sequence can include: the operation time and operation location corresponding to the user's mobile banking operation.

[0040] After parsing the historical transaction data, terminal operation data and original user information of the user in the historical period to obtain the user attribute information, transaction behavior sequence and operation behavior sequence of the user, step 102 is executed.

[0041] Step 102: Statistically analyze the transaction behavior sequence and the operation behavior sequence according to the anti-money laundering business characteristics to construct derived characteristics of the user.

[0042] Derived characteristics refer to statistics or indicators calculated based on original transaction and operation data that can reflect customer behavior patterns and potential money laundering risks.

[0043] After obtaining the transaction behavior sequence and operation behavior sequence of the user, the transaction behavior sequence and the operation behavior sequence can be statistically analyzed according to the anti-money laundering business characteristics to construct derived characteristics of the obtained user, wherein the derived characteristics may include: average operation interval, average transaction interval and other characteristics.

[0044] The average operation interval refers to the average time between two consecutive operations performed by a user within a certain period of time. This feature can reflect the user's operation frequency and activity. In anti-money laundering business, abnormal operation frequency may indicate the existence of money laundering activities. For example, a user who rarely conducts transactions suddenly conducts a large number of operations in a short period of time, which may indicate that the user is trying to cover up his real money laundering behavior through frequent operations.

[0045] The average transaction interval refers to the average length of time between two consecutive transactions performed by a user within a certain period of time. Similar to the average operation interval, the average transaction interval can also reflect the user's transaction habits and behavior patterns. In the anti-money laundering business, abnormal transaction intervals may indicate that the user is trying to cover up his true money laundering behavior by dispersing transactions.

[0046] In this embodiment, after obtaining the user attribute information, transaction behavior sequence, and operation behavior sequence of the user, these data can be cleaned and preprocessed, and then the derived features can be constructed. Figure 2 This is described in detail as follows.

[0047] Reference Figure 2 , shows a flowchart of the steps of a method for obtaining a derivative feature provided by an embodiment of the present application. Figure 2 As shown, the derived feature acquisition method may include: step 201, step 202 and step 203.

[0048] Step 201: performing data cleansing on the user attribute information, the transaction behavior sequence and the operation behavior sequence to obtain cleansed user attribute information, transaction behavior sequence and operation behavior sequence.

[0049] In this embodiment, after obtaining the user attribute information, transaction behavior sequence and operation behavior sequence of the user, data cleansing can be performed on the user attribute information, transaction behavior sequence and operation behavior sequence to obtain cleansed user attribute information, transaction behavior sequence and operation behavior sequence, that is, to remove duplicate data in the user attribute information, transaction behavior sequence and operation behavior sequence.

[0050] After obtaining the cleansed user attribute information, transaction behavior sequence, and operation behavior sequence, step 202 is executed.

[0051] Step 202: Filling and deleting the cleaned user attribute information, transaction behavior sequence and operation behavior sequence according to the model input requirements to obtain processed user attribute information, transaction behavior sequence and operation behavior sequence.

[0052] After obtaining the cleaned user attribute information, transaction behavior sequence and operation behavior sequence, the cleaned user attribute information, transaction behavior sequence and operation behavior sequence can be filled and eliminated according to the model input requirements to obtain the processed user attribute information, transaction behavior sequence and operation behavior sequence. That is, according to the model requirements, the features are analyzed and screened, and the missing data and inconsistent data in the data are filled and eliminated respectively.

[0053] After obtaining the processed user attribute information, transaction behavior sequence and operation behavior sequence, step 203 is executed.

[0054] Step 203: Statistically analyze the processed user attribute information, transaction behavior sequence, and operation behavior sequence according to the anti-money laundering business characteristics to obtain the derived characteristics of the user.

[0055] After obtaining the processed user attribute information, transaction behavior sequence and operation behavior sequence, statistical analysis can be performed on the processed user attribute information, transaction behavior sequence and operation behavior sequence according to the anti-money laundering business characteristics to obtain the user's derived characteristics.

[0056] The embodiment of the present application can ensure the integrity of the data and improve the accuracy of subsequent money laundering behavior prediction by performing data cleaning, filling and deletion operations on user attribute information, transaction behavior sequences and operation behavior sequences.

[0057] After the transaction behavior sequence and the operation behavior sequence are statistically analyzed and constructed to obtain the derived characteristics of the user according to the anti-money laundering business characteristics, step 103 is executed.

[0058] Step 103: Call the pre-trained money laundering behavior prediction model to adopt a multi-head attention mechanism to learn local features and global features of the transaction behavior sequence and the operation behavior sequence, and process the learned features, the user attribute information and the derived features to obtain the money laundering behavior probability of the user.

[0059] After obtaining user attribute information, transaction behavior sequence, operation behavior sequence and derived features through the above steps, the pre-trained money laundering behavior prediction model can be called to adopt a multi-head attention mechanism to learn local and global features of the transaction behavior sequence and operation behavior sequence. The learned features, user attribute information and derived features are processed to obtain the user's money laundering behavior probability.

[0060] Among them, the multi-head attention mechanism can be widely used in tasks such as processing sequence data and natural language processing. This mechanism extracts information from different subspaces by calculating multiple attention heads in parallel, thereby enhancing the expressiveness and stability of the model. In this embodiment, the multi-head attention mechanism is used to calculate the correlation between customer attribute information and behavior sequence representation.

[0061] In this embodiment, after obtaining the user attribute information, transaction behavior sequence, operation behavior sequence and derived features, the user attribute information, transaction behavior sequence, operation behavior sequence and derived features can be discretized, and then the money laundering behavior prediction model is called to predict the user's money laundering behavior probability. Figure 3 This is described in detail as follows.

[0062] Reference Figure 3 , shows a flowchart of the steps of a method for obtaining the probability of money laundering behavior provided by an embodiment of the present application. Figure 3 As shown, the method for obtaining the probability of money laundering behavior may include: step 301, step 302 and step 303.

[0063] Step 301: Use power bucketing to discretize the numerical features in the transaction behavior sequence and the operation behavior sequence, and use hash bucketing to discretize the non-numerical features in the transaction behavior sequence and the operation behavior sequence, to obtain corresponding discrete transaction behavior sequences and discrete operation behavior sequences.

[0064] In this embodiment, after obtaining the transaction behavior sequence and operation behavior sequence of the user, the power bucketing method can be used to perform bucketing discretization processing on the numerical features in the transaction behavior sequence and the operation behavior sequence. At the same time, the hash bucketing method can be used to perform bucketing discretization processing on the non-numerical features in the transaction behavior sequence and the operation behavior sequence, so as to obtain the corresponding discrete transaction behavior sequence and discrete operation behavior sequence.

[0065] Among them, power bucketing refers to dividing numerical features into different intervals or buckets in a power manner. Specifically, it is to allocate values ​​to different buckets according to their size, and the range of each bucket is several times the range of the previous bucket (such as 10 times or other idempotent constants). For example, the values ​​can be divided into the following buckets: [0-9], [10-99], [100-999], [1000-9999], etc. This division method makes the capacity (or range) of each bucket grow exponentially.

[0066] The processing method of hash bucketing can refer to the description of step 302 below, and this embodiment will not be repeated here.

[0067] Specifically, the transaction behavior sequence and operation behavior sequence are mainly discretized by bucketing for numerical features such as amount and time. Since the frequency of occurrence of numerical features such as amount and time decreases with the increase of the value, such features are discretized by power bucketing, as shown in the following formula (1):

[0068]

[0069] In the above formula (1), B(x) is the discretization result of the xth feature value, x is the feature value, represents the rounding down function, the value range of the mth bucket is [2 m ,2 m+1 ). Due to the differences in the number of customers' transaction behaviors and operation behaviors, it is necessary to perform short-fill-long-cut operations on the transaction behavior sequence and the operation behavior sequence respectively to ensure that the sequence lengths of each customer are consistent.

[0070] Step 302: adopting a hash bucketing method to perform bucket discretization processing on the user attribute information and the derived features respectively, to obtain corresponding discrete user attribute information and discrete derived features.

[0071] After obtaining the user attribute information and derived features, the user attribute information and derived features can be discretized by bucketing using hash bucketing to obtain the corresponding discrete user attribute information and discrete derived features. Hash bucketing is a data distribution method that uses a hash function to distribute data into different buckets.

[0072] User attribute information and derived features are discretized using hash bucketing. The hash bucketing function is shown in the following formula (2):

[0073] H(x)=hash(x)%C (2)

[0074] In the above formula (2), H(x) is the hash processing result of the x-th feature value, hash() is the hash function, x is the feature value, and C represents the number of buckets. All features will be assigned to C buckets.

[0075] Step 303: Call the money laundering behavior prediction model to adopt a multi-head attention mechanism to learn local features and global features of the discrete transaction behavior sequence and the discrete operation behavior sequence, and process the learned features, the discrete user attribute information and the discrete derived features to obtain the money laundering behavior probability of the user.

[0076] After obtaining discrete transaction behavior sequences, discrete operation behavior sequences, discrete user attribute information, and discrete derived features, the money laundering behavior prediction model can be called to use a multi-head attention mechanism to learn local and global features of discrete transaction behavior sequences and discrete operation behavior sequences. Then, the learned features, discrete user attribute information, and discrete derived features can be processed to obtain the user's money laundering behavior probability.

[0077] The embodiment of the present application discretizes transaction behavior sequences, operation behavior sequences, user attribute information and derived features by adopting power bucketing and hash bucketing, which can significantly improve the efficiency and generalization ability of the model and optimize data storage and query performance.

[0078] Next, combine Figure 4 The implementation process of local feature learning and global feature learning is described in detail.

[0079] Reference Figure 4 , shows a flowchart of another method for obtaining the probability of money laundering behavior provided by an embodiment of the present application. Figure 4 As shown, the method for obtaining the probability of money laundering behavior may include: step 401, step 402, step 403, step 404, step 405 and step 406.

[0080] Step 401: Call the vector embedding network to perform vector representation processing on the user attribute information, the transaction behavior sequence, the operation behavior sequence and the derived features to obtain a user attribute vector representation of the user attribute information, a transaction behavior sequence vector representation of the transaction behavior sequence, an operation behavior sequence vector representation of the operation behavior sequence and a derived feature vector representation of the derived features.

[0081] In this embodiment, the money laundering behavior prediction model may include: a vector embedding network, a local representation learning network, a global representation learning network, a feature splicing network and a fully connected neural network.

[0082] After obtaining the user attribute information, transaction behavior sequence, operation behavior sequence and derived features, the user attribute information, transaction behavior sequence, operation behavior sequence and derived features can be input into the money laundering behavior prediction model, and then the vector embedding network can be called to perform vector representation processing on the user attribute information, transaction behavior sequence, operation behavior sequence and derived features to obtain the user attribute vector representation of the user attribute information, the transaction behavior sequence vector representation of the transaction behavior sequence, the operation behavior sequence vector representation of the operation behavior sequence and the derived feature vector representation of the derived features.

[0083] In the specific implementation, the embedding technology in NLP (Natural Language Processing) can be used to embed the discretized features into vectors. The discretized features contained in the user transaction behavior sequence and the user operation behavior sequence are mapped to a vector space of a specific dimension, and a multi-dimensional vector is used to represent the original discretized features. The relevant operations are shown in the following formula (3):

[0084] T,E,S,U=Emdedding(SEQ t ,SEQ e ,Stat,User) (3)

[0085] In the above formula (3), T represents the vector representation of the transaction behavior sequence, E represents the vector representation of the behavior sequence, S represents the vector representation of the derived features, and U represents the vector representation of the customer attribute features. t Represents the original transaction behavior sequence, SEQ e Represents the original operation behavior sequence, Stat and User represent the original derived features and original customer attribute features respectively.

[0086] After obtaining the user attribute vector representation of the user attribute information, the transaction behavior sequence vector representation of the transaction behavior sequence, the operation behavior sequence vector representation of the operation behavior sequence, and the derived feature vector representation of the derived feature, step 402 is executed.

[0087] Step 402: Call the local representation learning network to perform feature extraction on the transaction behavior sequence vector representation and the operation behavior sequence vector representation respectively to obtain the transaction behavior sequence local representation corresponding to the transaction behavior sequence vector representation and the operation behavior sequence local representation corresponding to the operation behavior sequence vector representation.

[0088] After obtaining the transaction behavior sequence vector representation of the transaction behavior sequence and the operation behavior sequence vector representation of the operation behavior sequence, the local representation learning network can be called to extract features from the transaction behavior sequence vector representation of the transaction behavior sequence and the operation behavior sequence vector representation of the operation behavior sequence to obtain the transaction behavior sequence local representation corresponding to the transaction behavior sequence vector representation and the operation behavior sequence local representation corresponding to the operation behavior sequence vector representation. The local representation learning network focuses on extracting features from local areas of the data, which are essential for understanding and analyzing the data. In the network, local features are encoded and represented through specific algorithms or models for subsequent classification, recognition or other tasks.

[0089] In a specific implementation, an average pooling operation can be used to compress the vector representation of each transaction in the transaction behavior sequence vector representation into a one-dimensional vector, and obtain a first pooled sequence vector representation corresponding to the transaction behavior sequence vector representation. Using an average pooling operation, the vector representation of each operation in the operation behavior sequence vector representation is compressed into a one-dimensional vector, and a second pooled sequence vector representation corresponding to the operation behavior sequence vector representation is obtained. Then, the first pooled sequence vector representation and the second pooled sequence representation are transformed and processed respectively to obtain the corresponding first transformed sequence vector representation and the second transformed sequence vector representation. The local feature learning network is called to extract local features from the first transformed sequence vector representation and the second transformed sequence vector representation respectively, and the corresponding transaction behavior sequence local representation and operation behavior sequence local representation are obtained. The processing process of the pooled sequence vector representation can be: calling the local feature learning network to use the bidirectional GRU model to process the first transformed sequence vector representation and the second transformed sequence vector representation respectively, and obtain the corresponding first model hidden state output and second model hidden state output. The first model hidden state output is concatenated with the first transformed sequence vector representation to obtain a first concatenated vector, and the second model hidden state output is concatenated with the second transformed sequence vector representation to obtain a second concatenated vector. The first concatenated vector is subjected to sliding maximum pooling to obtain a local representation of the transaction behavior sequence, and the second concatenated vector is subjected to sliding maximum pooling to obtain a local representation of the operation behavior sequence.

[0090] In this embodiment, in the Embedding vector T of the transaction behavior sequence, each transaction contains N features, where the one-dimensional representation vector corresponding to the nth feature is fea n To improve the model inference prediction efficiency, an average pooling operation is used to compress the N features of the kth transaction into a one-dimensional vector T k , the average pooling operation is shown in the following formula (4):

[0091]

[0092] After the average pooling operation, the transaction behavior sequence is converted to T', and the representation learning network is used to extract local representations of the above sequence. First, the transaction behavior sequence T' is input into the bidirectional GRU model to obtain the model hidden state output vector, and then the model hidden state output vector is concatenated with the original sequence T'. Finally, the concatenated vector is subjected to the sliding maximum pooling operation to construct the local representation of the transaction behavior.

[0093] For the operation behavior sequence, the above method can be used to use the representation learning network to extract the local representation of the Embedding vector E of the operation behavior sequence.

[0094] Step 403: Perform multi-head attention mechanism calculation on the user attribute vector representation, the transaction behavior sequence local representation and the operation behavior sequence local representation, respectively, to obtain the transaction feature weight corresponding to the transaction behavior sequence local representation and the operation feature weight corresponding to the operation behavior sequence local representation.

[0095] After obtaining the local representation of the transaction behavior sequence and the local representation of the operation behavior sequence, the user attribute vector representation can be calculated with the local representation of the transaction behavior sequence and the local representation of the operation behavior sequence by a multi-head attention mechanism to obtain the transaction feature weight corresponding to the local representation of the transaction behavior sequence and the operation feature weight corresponding to the local representation of the operation behavior sequence. Specifically, the user attribute information can be first mapped into a low-dimensional vector Q through a linear layer user , and then perform multi-head attention mechanism calculation with the local representations of the transaction behavior sequence and the operation behavior sequence to obtain the corresponding weights. The relevant calculation methods are shown in the following formulas (5) and (6):

[0096]

[0097] In the above formula, K T represents the local representation of the transaction behavior sequence, K E Both represent the local representation of the operation behavior sequence, and Softmax() is the softmax function, which is used to constrain the weight range to the interval between 0 and 1. trans and w event They represent the weight of the local representation of the transaction behavior sequence and the weight of the local representation of the operation behavior sequence respectively. k Represents the representation of the multi-head attention mechanism (the specified value, represented by the dimension of the input vector).

[0098] Step 404: Call the global representation learning network to process the local representation of the transaction behavior sequence based on the transaction feature weight to obtain the global feature of the transaction behavior sequence corresponding to the local representation of the transaction behavior sequence; and process the local representation of the operation behavior sequence based on the operation feature weight to obtain the global feature of the operation behavior sequence corresponding to the local representation of the operation behavior sequence.

[0099] After obtaining the transaction feature weights and operation feature weights, the global representation learning network can be called to process the local representation of the transaction behavior sequence based on the transaction feature weights to obtain the global features of the transaction behavior sequence corresponding to the local representation of the transaction behavior sequence. And the local representation of the operation behavior sequence is processed based on the operation feature weights to obtain the global features of the operation behavior sequence corresponding to the local representation of the operation behavior sequence. Specifically, the local representation of the behavior sequence and the corresponding weights w can be used to trans and w event, the global representations of customer transaction behavior sequences and customer operation behavior sequences are calculated using the following formulas:

[0100] Z trans =w trans ·V T (7)

[0101] Z event =w event ·V E (8)

[0102] In the above formula, V T Represents the local representation of the transaction behavior sequence, V E Represents the local representation of the operation behavior sequence, Z trans and Z event They represent the global representation of customer transaction behavior sequence and customer operation behavior sequence respectively.

[0103] After obtaining the global features of the transaction behavior sequence and the global features of the operation behavior sequence, step 405 is executed.

[0104] Step 405: calling the feature concatenation network to concatenate the transaction behavior sequence global features, the operation behavior sequence global features, the derived feature vector representation and the user attribute vector representation to obtain a concatenated feature vector representation.

[0105] After obtaining the global features of the transaction behavior sequence and the global features of the operation behavior sequence, the feature concatenation network can be called to concatenate the global features of the transaction behavior sequence, the global features of the operation behavior sequence, the derived feature vector representation and the user attribute vector representation to obtain the concatenated feature vector representation.

[0106] Step 406: calling the fully connected neural network to process the concatenated feature vector representation to obtain the money laundering behavior probability of the user.

[0107] Finally, the fully connected neural network can be called to process the concatenated feature vector representation to obtain the user's money laundering behavior probability. Specifically, the concatenated feature vector can be input into a two-layer fully connected neural network to obtain the customer's money laundering risk probability. Figure 6 As shown in the figure, the global representation of transaction behavior sequence, the global representation of operation behavior sequence, customer attribute information (vector representation), and derived features (vector representation) are concatenated to obtain the concatenated vector representation. After passing through the ReLU activation function layer and the Sigmoid activation function layer, the customer's money laundering risk probability, that is, the money laundering behavior probability, can be output.

[0108] After calling the fully connected neural network to process the concatenated feature vector representation to obtain the user's money laundering behavior probability, step 104 is executed.

[0109] Step 104: Based on the money laundering behavior probability and a preset probability threshold, determine whether the user has engaged in money laundering behavior.

[0110] After the fully connected neural network is called to process the concatenated feature vector representation to obtain the user's money laundering behavior probability, it can be determined whether the user has engaged in money laundering based on the money laundering behavior probability and the pre-set probability threshold. Specifically, when the money laundering behavior probability is greater than the probability threshold, it can be determined that the user has engaged in money laundering. When the money laundering behavior probability is less than or equal to the probability threshold, it is determined that the user has not engaged in money laundering.

[0111] Once it is determined that a user has engaged in money laundering, an early warning will be triggered and the user's information will be handed over to anti-money laundering staff for further analysis and investigation.

[0112] The embodiment of the present application expands the information dimension used in the early warning of suspicious customers for anti-money laundering. In addition to using customer attribute information and customer transaction behavior sequence in the early warning process of suspicious customers, it also explores the introduction of customer operation behavior sequence data. Customer operation behavior sequence data can provide a new modeling and analysis perspective for early warning of suspicious customers for anti-money laundering. On the one hand, abnormal operation behaviors in customer operation behavior sequences can facilitate the model to identify suspicious customers with high money laundering risks and enhance the accuracy of early warnings; on the other hand, the identified abnormal operation behaviors can also be used as risk points for future identification of anti-money laundering employees.

[0113] This embodiment also strengthens the model's learning ability for local representation of transaction behavior sequences and operation behavior sequences, which helps to improve the model's ability to identify a small number of abnormal transaction behaviors and abnormal operation behaviors in transaction behavior sequences and operation behavior sequences, thereby improving the model's ability to identify customers with high money laundering risks.

[0114] Through the multi-head attention mechanism, the connection between customer attribute information and behavior sequence representation is established, and differentiated warnings are given based on the attribute information of different customers. This can not only reduce false alarms of suspicious customers, but also more efficiently identify customers' abnormal transaction behaviors and abnormal operation behaviors through differentiated warning mechanisms, providing an effective and adaptive solution for banks and other financial institutions.

[0115] Next, combine Figure 5 The anti-money laundering suspicious customer early warning process is described in detail as follows.

[0116] like Figure 5As shown, the anti-money laundering suspicious customer warning model based on behavior sequence proposed in the embodiment of the present application mainly includes the following three modules: M1 data collection and preprocessing module, M2 behavior sequence representation learning module, M3 suspicious customer identification module, and the overall process may include:

[0117] The M1 data collection and preprocessing module mainly completes the collection and preprocessing of data required for anti-money laundering suspicious customer warning. This module includes the following four steps: (1) Data collection: Collect relevant customer data according to the preset identification and retrospective period range, including customer attribute information (such as customer basic information, assets held, historical credit data, etc.), customer transaction behavior sequence (such as transaction channel, transaction amount, counterparty, etc. corresponding to customer transaction flow), customer operation behavior sequence (such as operation time, operation point, etc. corresponding to customer mobile banking operation). (2) Data cleaning: Clean the acquired customer attribute information, customer transaction behavior sequence and customer operation behavior sequence. (3) Derivative feature construction: Combined with the characteristics of anti-money laundering suspicious customer warning business, construct sequence derivative features based on the customer transaction behavior sequence and customer operation behavior sequence processed in step (2), such as transaction frequency, total transaction amount, operation frequency, etc. (4) Feature discretization: The customer attribute information, customer transaction behavior, customer operation behavior, and sequence derivative features obtained in steps (2) and (3) are bucketed and discretized to obtain discrete features.

[0118] The M2 behavior sequence representation learning module mainly completes the sequence representation extraction of customer transaction behavior sequences and customer operation behavior sequences. This module mainly includes the following four steps: (1) Vector embedding: Map the discrete features contained in the customer transaction behavior sequence and customer operation behavior sequence to a vector space of a specific dimension, and use multi-dimensional vectors to represent the original discrete features. (2) Local representation learning: Use the representation learning network to extract the sequence representation of the customer transaction behavior sequence and customer operation behavior sequence after the transformation in step (1), and replace the global maximum pooling in the representation learning network with sliding maximum pooling to extract the local representation of the customer transaction behavior sequence and customer operation behavior sequence. (3) Weight calculation: Use the multi-head attention mechanism to build the connection between customer attribute information and sequence local representation to obtain the weight of the local representation of the customer transaction behavior sequence and the weight of the local representation of the customer operation behavior sequence. (4) Global representation learning: Based on the sequence local representation and its weight obtained in steps (2) and (3), the weighted summation method is used to calculate the global representation of the customer transaction behavior sequence and the customer operation behavior sequence respectively.

[0119] The M3 suspicious customer identification module mainly calculates the customer money laundering risk probability based on the customer attribute information, sequence-derived features and sequence global representation obtained by the above modules to mine suspicious customers with high money laundering risks. This module mainly includes the following three steps: (1) Feature splicing: The customer attribute information and sequence-derived features obtained by the M1 data acquisition and preprocessing module, the customer transaction behavior sequence global representation obtained by the M2 behavior sequence representation learning module, and the customer operation behavior sequence global representation are spliced ​​to form a new feature vector. (2) Customer money laundering risk prediction: The feature vector constructed in step (1) is passed into the fully connected neural network to obtain the customer money laundering risk probability. (3) Suspicious customer warning: According to the pre-set threshold, customers with money laundering risk probability higher than the threshold are screened to trigger warnings. The above customers will be handed over to anti-money laundering staff for further analysis and reconnaissance.

[0120] The prediction method of money laundering provided in the embodiment of the present application obtains the user attribute information, transaction behavior sequence and operation behavior sequence of the user by parsing the historical transaction data, terminal operation data and original user information of the user in the historical period. According to the anti-money laundering business characteristics, the transaction behavior sequence and the operation behavior sequence are statistically analyzed to construct the derived features of the user. The pre-trained money laundering behavior prediction model is called to adopt a multi-head attention mechanism to learn the local features and global features of the transaction behavior sequence and the operation behavior sequence, and the learned features, user attribute information and derived features are processed to obtain the user's money laundering behavior probability. Based on the money laundering behavior probability and the pre-set probability threshold, it is determined whether the user has money laundering behavior. In addition to using customer attribute information and customer transaction behavior sequence in the suspicious customer warning process, the embodiment of the present application also exploratory introduction of customer operation behavior sequence data, strengthens the model's learning ability for the local representation of transaction behavior sequence and operation behavior sequence, and helps to improve the model's ability to identify a small number of abnormal transaction behaviors and abnormal operation behaviors in the transaction behavior sequence and operation behavior sequence, thereby improving the model's ability to distinguish customers with high money laundering risks. At the same time, the connection between customer attribute information and behavior sequence representation is established through the multi-head attention mechanism, and differentiated early warnings are given for the attribute information of different customers. This can not only reduce false alarms of suspicious customers, but also more efficiently identify customers' abnormal transaction behaviors and abnormal operation behaviors through differentiated early warning mechanisms.

[0121] Reference Figure 7 , shows a schematic diagram of the structure of a money laundering prediction device provided in an embodiment of the present application, such as Figure 7 As shown, the money laundering behavior prediction device 700 may include the following modules:

[0122] The behavior sequence acquisition module 710 is used to parse the historical transaction data, terminal operation data and original user information of the user in the historical period to obtain the user attribute information, transaction behavior sequence and operation behavior sequence of the user;

[0123] A derived feature construction module 720 is used to perform statistical analysis on the transaction behavior sequence and the operation behavior sequence according to the anti-money laundering business characteristics to construct a derived feature of the user;

[0124] The money laundering behavior probability acquisition module 730 is used to call the pre-trained money laundering behavior prediction model to adopt a multi-head attention mechanism to learn local features and global features of the transaction behavior sequence and the operation behavior sequence, and process the learned features, the user attribute information and the derived features to obtain the money laundering behavior probability of the user;

[0125] The money laundering behavior determination module 740 is used to determine whether the user has engaged in money laundering behavior based on the money laundering behavior probability and a preset probability threshold.

[0126] Optionally, the derived feature construction module includes:

[0127] a cleansing data acquisition unit, used to clean the user attribute information, the transaction behavior sequence and the operation behavior sequence to obtain cleansed user attribute information, transaction behavior sequence and operation behavior sequence;

[0128] A processing sequence acquisition unit, used to fill and remove the cleaned user attribute information, transaction behavior sequence and operation behavior sequence according to the model input requirements, to obtain processed user attribute information, transaction behavior sequence and operation behavior sequence;

[0129] The derived feature acquisition unit is used to perform statistical analysis on the processed user attribute information, transaction behavior sequence and operation behavior sequence according to the anti-money laundering business characteristics to obtain the derived features of the user.

[0130] Optionally, the money laundering behavior probability acquisition module includes:

[0131] A discrete behavior sequence acquisition unit is used to perform bucket discretization processing on the numerical features in the transaction behavior sequence and the operation behavior sequence respectively by using a power bucketing method, and to perform bucket discretization processing on the non-numerical features in the transaction behavior sequence and the operation behavior sequence respectively by using a hash bucketing method, so as to obtain corresponding discrete transaction behavior sequences and discrete operation behavior sequences;

[0132] A discrete feature acquisition unit, configured to perform bucket discretization processing on the user attribute information and the derived features respectively by adopting a hash bucketing method, so as to obtain corresponding discrete user attribute information and discrete derived features;

[0133] The money laundering behavior probability acquisition unit is used to call the money laundering behavior prediction model to adopt a multi-head attention mechanism to learn local features and global features of the discrete transaction behavior sequence and the discrete operation behavior sequence, and process the learned features, the discrete user attribute information and the discrete derived features to obtain the money laundering behavior probability of the user.

[0134] Optionally, the money laundering behavior prediction model includes: a vector embedding network, a local representation learning network, a global representation learning network, a feature splicing network and a fully connected neural network.

[0135] The money laundering behavior probability acquisition module includes:

[0136] a vector representation acquisition unit, configured to call the vector embedding network to perform vector representation processing on the user attribute information, the transaction behavior sequence, the operation behavior sequence, and the derived features, to obtain a user attribute vector representation of the user attribute information, a transaction behavior sequence vector representation of the transaction behavior sequence, an operation behavior sequence vector representation of the operation behavior sequence, and a derived feature vector representation of the derived features;

[0137] A local representation acquisition unit, used to call the local representation learning network to perform feature extraction on the transaction behavior sequence vector representation and the operation behavior sequence vector representation, respectively, to obtain a transaction behavior sequence local representation corresponding to the transaction behavior sequence vector representation, and an operation behavior sequence local representation corresponding to the operation behavior sequence vector representation;

[0138] A feature weight acquisition unit, used to perform multi-head attention mechanism calculation on the user attribute vector representation, the transaction behavior sequence local representation and the operation behavior sequence local representation, respectively, to obtain the transaction feature weight corresponding to the transaction behavior sequence local representation and the operation feature weight corresponding to the operation behavior sequence local representation;

[0139] A global feature acquisition unit is used to call the global representation learning network to process the local representation of the transaction behavior sequence based on the transaction feature weight to obtain the global feature of the transaction behavior sequence corresponding to the local representation of the transaction behavior sequence; and to process the local representation of the operation behavior sequence based on the operation feature weight to obtain the global feature of the operation behavior sequence corresponding to the local representation of the operation behavior sequence;

[0140] a splicing vector representation acquisition unit, configured to call the feature splicing network to splice the transaction behavior sequence global feature, the operation behavior sequence global feature, the derived feature vector representation and the user attribute vector representation to obtain a splicing feature vector representation;

[0141] The money laundering probability acquisition unit is used to call the fully connected neural network to process the concatenated feature vector representation to obtain the money laundering behavior probability of the user.

[0142] Optionally, the local representation acquisition unit includes:

[0143] A first pooled representation acquisition subunit is used to compress the vector representation of each transaction in the transaction behavior sequence vector representation into a one-dimensional vector by using an average pooling operation to obtain a first pooled sequence vector representation corresponding to the transaction behavior sequence vector representation;

[0144] A second pooled representation acquisition subunit is used to compress the vector representation of each operation in the operation behavior sequence vector representation into a one-dimensional vector using an average pooling operation to obtain a second pooled sequence vector representation corresponding to the operation behavior sequence vector representation;

[0145] a conversion vector representation acquisition subunit, used to perform conversion processing on the first pooled sequence vector representation and the second pooled sequence representation respectively to obtain a corresponding first conversion sequence vector representation and a second conversion sequence vector representation;

[0146] The local representation acquisition subunit is used to call the local feature learning network to extract local features from the first conversion sequence vector representation and the second conversion sequence vector representation respectively, to obtain the corresponding transaction behavior sequence local representation and the operation behavior sequence local representation.

[0147] Optionally, the local representation acquisition subunit includes:

[0148] A hidden state output acquisition subunit is used to call the local feature learning network to use the bidirectional GRU model to process the first transformation sequence vector representation and the second transformation sequence vector representation respectively, and obtain the corresponding first model hidden state output and second model hidden state output;

[0149] A concatenated vector acquisition subunit, configured to concatenate the first model hidden state output with the first transformed sequence vector representation to obtain a first concatenated vector; and to concatenate the second model hidden state output with the second transformed sequence vector representation to obtain a second concatenated vector;

[0150] The sequence local representation acquisition subunit is used to perform a sliding maximum pooling process on the first splicing vector to obtain the local representation of the transaction behavior sequence; and perform a sliding maximum pooling process on the second splicing vector to obtain the local representation of the operation behavior sequence.

[0151] Optionally, the money laundering behavior determination module includes:

[0152] A first money laundering behavior determination unit, configured to determine that the user has engaged in money laundering behavior when the money laundering behavior probability is greater than the probability threshold;

[0153] The second money laundering behavior determination unit is configured to determine that the user does not have any money laundering behavior when the probability of the money laundering behavior is less than or equal to the probability threshold.

[0154] The prediction device for money laundering provided in the embodiment of the present application obtains the user attribute information, transaction behavior sequence and operation behavior sequence of the user by parsing the historical transaction data, terminal operation data and original user information of the user in the historical period. The transaction behavior sequence and the operation behavior sequence are statistically analyzed according to the anti-money laundering business characteristics to construct the derived features of the user. The pre-trained money laundering behavior prediction model is called to adopt a multi-head attention mechanism to learn the local features and global features of the transaction behavior sequence and the operation behavior sequence, and the learned features, user attribute information and derived features are processed to obtain the user's money laundering behavior probability. Based on the money laundering behavior probability and the pre-set probability threshold, it is determined whether the user has money laundering behavior. In addition to using customer attribute information and customer transaction behavior sequence in the suspicious customer warning process, the embodiment of the present application also exploratory introduction of customer operation behavior sequence data, strengthens the model's learning ability for the local representation of transaction behavior sequence and operation behavior sequence, helps to improve the model's recognition ability for a small number of abnormal transaction behaviors and abnormal operation behaviors in the transaction behavior sequence and operation behavior sequence, and thus improves the model's ability to distinguish customers with high money laundering risks. At the same time, the connection between customer attribute information and behavior sequence representation is established through the multi-head attention mechanism, and differentiated early warnings are given for the attribute information of different customers. This can not only reduce false alarms of suspicious customers, but also more efficiently identify customers' abnormal transaction behaviors and abnormal operation behaviors through differentiated early warning mechanisms.

[0155] An embodiment of the present application also provides an electronic device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program implements the above-mentioned money laundering behavior prediction method when executed by the processor.

[0156] Figure 8 FIG. 8 is a schematic diagram showing the structure of an electronic device 800 according to an embodiment of the present invention. Figure 8As shown, the electronic device 800 includes a central processing unit (CPU) 801, which can perform various appropriate actions and processes according to computer program instructions stored in a read-only memory (ROM) 802 or computer program instructions loaded from a storage unit 808 into a random access memory (RAM) 803. In the RAM 803, various programs and data required for the operation of the electronic device 800 can also be stored. The CPU 801, the ROM 802, and the RAM 803 are connected to each other via a bus 804. An input / output (I / O) interface 805 is also connected to the bus 804.

[0157] Multiple components in the electronic device 800 are connected to the I / O interface 805, including: an input unit 806, such as a keyboard, a mouse, a microphone, etc.; an output unit 807, such as various types of displays, speakers, etc.; a storage unit 808, such as a disk, an optical disk, etc.; and a communication unit 809, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 809 allows the electronic device 800 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0158] The various processes and processing described above may be performed by the processing unit 801. For example, the method of any of the above embodiments may be implemented as a computer software program, which is tangibly contained in a computer-readable medium, such as the storage unit 808. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 800 via the ROM 802 and / or the communication unit 809. When the computer program is loaded into the RAM 803 and executed by the CPU 801, one or more actions in the method described above may be performed.

[0159] In addition, an embodiment of the present application further provides a computer-readable storage medium having a computer program stored thereon, which implements the above-mentioned method for predicting money laundering behavior when executed by a processor.

[0160] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0161] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, devices, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0162] The embodiments of the present application are described with reference to the flowcharts and / or block diagrams of the methods, terminals (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0163] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing terminal to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0164] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal so that a series of operating steps are executed on the computer or other programmable terminal to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable terminal. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0165] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present application.

[0166] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal. In the absence of further restrictions, the elements defined by the statement "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or terminal including the elements.

[0167] The above is a detailed introduction to a money laundering prediction method, a money laundering prediction device, an electronic device and a computer-readable storage medium provided by the present application. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea; at the same time, for a person skilled in the art, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A method for predicting money laundering behavior, characterized in that: The method comprises: Analyze the historical transaction data, terminal operation data and original user information of the user in the historical period to obtain the user attribute information, transaction behavior sequence and operation behavior sequence of the user; Performing statistical analysis on the transaction behavior sequence and the operation behavior sequence according to anti-money laundering business characteristics to construct derived characteristics of the user; The pre-trained money laundering behavior prediction model is called to adopt a multi-head attention mechanism to learn local features and global features of the transaction behavior sequence and the operation behavior sequence, and the learned features, the user attribute information and the derived features are processed to obtain the money laundering behavior probability of the user; Based on the money laundering behavior probability and a preset probability threshold, it is determined whether the user has engaged in money laundering behavior.

2. The method according to claim 1, characterized in that The statistical analysis of the transaction behavior sequence and the operation behavior sequence according to the anti-money laundering business characteristics to construct the derived characteristics of the user includes: Performing data cleaning on the user attribute information, the transaction behavior sequence, and the operation behavior sequence to obtain cleaned user attribute information, transaction behavior sequence, and operation behavior sequence; Filling and removing the cleaned user attribute information, transaction behavior sequence and operation behavior sequence according to the model input requirements to obtain processed user attribute information, transaction behavior sequence and operation behavior sequence; According to the anti-money laundering business characteristics, statistical analysis is performed on the processed user attribute information, transaction behavior sequence and operation behavior sequence to obtain the derived characteristics of the user.

3. The method according to claim 1, characterized in that The money laundering behavior prediction model obtained by calling the pre-training adopts a multi-head attention mechanism to learn local features and global features of the transaction behavior sequence and the operation behavior sequence, and processes the learned features, the user attribute information and the derived features to obtain the money laundering behavior probability of the user, including: The numerical features in the transaction behavior sequence and the operation behavior sequence are respectively discretized by bucketing using a power bucketing method, and the non-numerical features in the transaction behavior sequence and the operation behavior sequence are respectively discretized by bucketing using a hash bucketing method, so as to obtain corresponding discrete transaction behavior sequences and discrete operation behavior sequences; The user attribute information and the derived features are respectively discretized by bucketing using a hash bucketing method to obtain corresponding discrete user attribute information and discrete derived features; The money laundering behavior prediction model is called to adopt a multi-head attention mechanism to learn local features and global features of the discrete transaction behavior sequence and the discrete operation behavior sequence, and the learned features, the discrete user attribute information and the discrete derived features are processed to obtain the money laundering behavior probability of the user.

4. The method according to claim 1, characterized in that: The money laundering behavior prediction model includes: a vector embedding network, a local representation learning network, a global representation learning network, a feature splicing network and a fully connected neural network. The money laundering behavior prediction model obtained by calling the pre-training adopts a multi-head attention mechanism to learn local features and global features of the transaction behavior sequence and the operation behavior sequence, and processes the learned features, the user attribute information and the derived features to obtain the money laundering behavior probability of the user, including: Calling the vector embedding network to perform vector representation processing on the user attribute information, the transaction behavior sequence, the operation behavior sequence and the derived features to obtain a user attribute vector representation of the user attribute information, a transaction behavior sequence vector representation of the transaction behavior sequence, an operation behavior sequence vector representation of the operation behavior sequence and a derived feature vector representation of the derived features; Calling the local representation learning network to perform feature extraction on the transaction behavior sequence vector representation and the operation behavior sequence vector representation respectively, to obtain a transaction behavior sequence local representation corresponding to the transaction behavior sequence vector representation, and an operation behavior sequence local representation corresponding to the operation behavior sequence vector representation; The user attribute vector representation is respectively calculated with the transaction behavior sequence local representation and the operation behavior sequence local representation by a multi-head attention mechanism to obtain the transaction feature weight corresponding to the transaction behavior sequence local representation and the operation feature weight corresponding to the operation behavior sequence local representation; The global representation learning network is called to process the local representation of the transaction behavior sequence based on the transaction feature weight to obtain the global feature of the transaction behavior sequence corresponding to the local representation of the transaction behavior sequence; and the local representation of the operation behavior sequence is processed based on the operation feature weight to obtain the global feature of the operation behavior sequence corresponding to the local representation of the operation behavior sequence; Calling the feature concatenation network to concatenate the transaction behavior sequence global feature, the operation behavior sequence global feature, the derived feature vector representation, and the user attribute vector representation to obtain a concatenated feature vector representation; The fully connected neural network is called to process the concatenated feature vector representation to obtain the money laundering behavior probability of the user.

5. The method according to claim 4, characterized in that The calling of the local representation learning network to perform feature extraction on the transaction behavior sequence vector representation and the operation behavior sequence vector representation respectively to obtain a transaction behavior sequence local representation corresponding to the transaction behavior sequence vector representation and an operation behavior sequence local representation corresponding to the operation behavior sequence vector representation, including: Using an average pooling operation, compressing the vector representation of each transaction in the transaction behavior sequence vector representation into a one-dimensional vector, to obtain a first pooled sequence vector representation corresponding to the transaction behavior sequence vector representation; Using an average pooling operation, compressing the vector representation of each operation in the operation behavior sequence vector representation into a one-dimensional vector, to obtain a second pooled sequence vector representation corresponding to the operation behavior sequence vector representation; Respectively transforming the first pooled sequence vector representation and the second pooled sequence representation to obtain corresponding first transformed sequence vector representation and second transformed sequence vector representation; The local feature learning network is called to extract local features from the first conversion sequence vector representation and the second conversion sequence vector representation respectively, to obtain the corresponding local representation of the transaction behavior sequence and the local representation of the operation behavior sequence.

6. The method according to claim 5, characterized in that The calling of the local feature learning network to extract local features from the first conversion sequence vector representation and the second conversion sequence vector representation to obtain the corresponding transaction behavior sequence local representation and the operation behavior sequence local representation includes: Calling the local feature learning network to use the bidirectional GRU model to process the first transformation sequence vector representation and the second transformation sequence vector representation respectively to obtain corresponding first model hidden state output and second model hidden state output; The first model hidden state output is concatenated with the first transformed sequence vector representation to obtain a first concatenated vector; and the second model hidden state output is concatenated with the second transformed sequence vector representation to obtain a second concatenated vector; The first splicing vector is subjected to sliding maximum pooling processing to obtain a local representation of the transaction behavior sequence; and the second splicing vector is subjected to sliding maximum pooling processing to obtain a local representation of the operation behavior sequence.

7. The method according to claim 1, characterized in that The determining whether the user has engaged in money laundering based on the money laundering probability and a preset probability threshold comprises: When the money laundering behavior probability is greater than the probability threshold, determining that the user has engaged in money laundering behavior; When the probability of money laundering behavior is less than or equal to the probability threshold, it is determined that the user does not have any money laundering behavior.

8. A money laundering prediction device, characterized in that: The device comprises: A behavior sequence acquisition module is used to parse the historical transaction data, terminal operation data and original user information of the user in the historical period to obtain the user attribute information, transaction behavior sequence and operation behavior sequence of the user; A derived feature construction module, used to perform statistical analysis on the transaction behavior sequence and the operation behavior sequence according to anti-money laundering business characteristics, and construct derived features of the user; A money laundering behavior probability acquisition module is used to call the pre-trained money laundering behavior prediction model to adopt a multi-head attention mechanism to learn local features and global features of the transaction behavior sequence and the operation behavior sequence, and process the learned features, the user attribute information and the derived features to obtain the money laundering behavior probability of the user; The money laundering behavior determination module is used to determine whether the user has engaged in money laundering behavior based on the money laundering behavior probability and a preset probability threshold.

9. An electronic device, characterized in that: include: A processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method for predicting money laundering behavior according to any one of claims 1 to 7 when executing the program.

10. A computer-readable storage medium, characterized in that: When the instructions in the storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute the method for predicting money laundering behavior according to any one of claims 1 to 7.

Images