Financial transaction detection method and device based on fund network diagram, and electronic equipment

Abstract

The invention discloses a financial transaction detection method and device based on a fund network diagram and electronic equipment, and relates to the field of financial science and technology or other related fields, and the method comprises the steps: extracting feature data of account transaction information, carrying out the clustering processing of the feature data through employing a clustering algorithm, obtaining a first abnormal transaction record, and obtaining a second abnormal transaction record; comparing the obtained abnormal transaction verification set with the first abnormal transaction record to obtain a second abnormal transaction record, constructing a transaction pair and a fund network graph based on the account transaction information, extracting network features from the fund network graph, obtaining account information and transaction behavior features, and sending the account information and the transaction behavior features to a server; and inputting the account information, the transaction behavior characteristics, the second abnormal transaction record and the network characteristics into an abnormal account identification model to obtain an abnormal transaction account with an abnormal fund transfer behavior. According to the invention, the technical problem that the transaction account with the abnormal fund transfer behavior is difficult to accurately recognize due to the single detection rule of the abnormal account recognition model in the related technology is solved.

Description

Technical Field

[0001] The present invention relates to the field of financial technology or other related fields, and in particular, to a financial transaction detection method and device, and electronic equipment based on a capital network diagram. Background Art

[0002] With the rapid development of digital finance and the acceleration of global capital flows, abnormal fund transfer activities have become increasingly complex and difficult to detect. Abnormal fund transfer activities convert funds obtained through abnormal means into seemingly legal assets through a series of complex and covert financial operations to conceal their criminal sources and true ownership. This criminal behavior not only erodes the health of the financial system, but also poses a threat to economic security and social stability.

[0003] In the related technologies, the existing abnormal fund transfer detection schemes have many limitations. For example, the existing abnormal fund transfer detection schemes have a single detection rule, which can be easily circumvented by abnormal fund transferors by changing transaction patterns or exploiting the blind spots of the detection system. It is difficult to detect advanced abnormal fund transfer behaviors, including cross-regional and cross-border abnormal fund transfer behaviors. Furthermore, the existing models for detecting abnormal fund transfer accounts have poor generalization capabilities and are difficult to adapt to the emerging new abnormal fund transfer methods. In particular, when faced with anonymous transactions and abnormal fund transfer behaviors using advanced payment channels, the recognition accuracy of the existing models is greatly reduced. At the same time, the existing models lack a global network perspective and are difficult to identify complex abnormal fund transfer transactions.

[0004] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0005] The embodiments of the present invention provide a financial transaction detection method, device, and electronic device based on a capital network diagram, so as to at least solve the technical problem in the related art that the abnormal account identification model detection rules are single and it is difficult to accurately identify the transaction account where abnormal fund transfer behavior occurs.

[0006] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a financial transaction detection method based on a capital network graph is provided, comprising: extracting feature data of account transaction information, clustering the feature data using a clustering algorithm, and determining the transaction record corresponding to the outlier obtained by clustering as a first abnormal transaction record; obtaining an abnormal transaction verification set, comparing the abnormal transaction verification set with the first abnormal transaction record, and screening out a second abnormal transaction record from the first abnormal transaction record based on the comparison result, wherein the abnormal transaction verification set at least includes: data of abnormal fund transfer behaviors that have occurred in a historical time period; constructing transaction pairs and a capital network graph corresponding to each transaction pair based on the account transaction information, and extracting network features from the capital network graph, wherein the transaction pairs include: transaction accounts and transaction records, the capital network graph includes: nodes indicated by multiple transaction accounts and connection edges corresponding to the transaction records, and the network features include: node features and subgraph features; obtaining account information and transaction behavior features of each account based on the account transaction information, inputting the account information, transaction behavior features, the second abnormal transaction record, and the network features into a pre-constructed abnormal account recognition model to obtain abnormal transaction accounts that have undergone abnormal fund transfer behaviors.

[0007] Optionally, before extracting the characteristic data of the account transaction data, it also includes: obtaining account transaction information, wherein the account transaction information includes: account information, transaction records, payment channel usage records and transaction geographic location information, the account information includes: transaction account number, and the transaction record includes: transaction amount and transaction time; deleting error records in the transaction information, wherein the error records include: transaction records with negative transaction amounts, account information with incorrect account format and repeated account transaction information; standardizing the account transaction information, wherein the standardization includes: converting the values ​​of the same numerical account transaction information to the same size, and encoding the non-numerical account transaction information.

[0008] Optionally, the step of extracting characteristic data of account transaction information includes: based on the transaction records in the account transaction information, calculating the mean, median and variance of the transaction amount of each account, and obtaining transaction time density distribution information, the ratio of the number of accounts for fund transfer in and out, and the average transaction interval time of each account; based on the transaction records in the account transaction information, obtaining the time series fluctuation characteristics of the transaction amount and the number of transactions, wherein the time series fluctuation characteristics are used to reflect the changing trend of the transaction amount and the number of transactions over time; based on the payment channel usage records in the account transaction information, obtaining the payment channel usage frequency and the payment channel type distribution; based on the transaction geographic location information in the account transaction information, obtaining the geographic distribution characteristics and the account usage records of the same IP address and the same terminal, wherein the geographic distribution characteristics include: cross-regional transfer frequency.

[0009] Optionally, the step of constructing a capital network graph includes: determining the transaction accounts in the transaction pair as nodes of the capital network graph, wherein the transaction accounts include: the accounts of the fund transferor and the fund transferee; determining the transaction records in the transaction pair as connecting edges of the capital network graph, wherein the transaction records refer to the transaction flow between the fund transferor and the fund transferee, and the connecting edges are directed edges representing the flow direction of funds.

[0010] Optionally, the step of extracting node features from the capital network graph includes: for each node in the capital network graph, based on the number of times that funds are transferred in and out at the node, calculating the in-degree and out-degree of the node, wherein the in-degree refers to the number of transactions in which funds are transferred in at the node, and the out-degree refers to the number of transactions in which funds are transferred out at the node; based on the number of transaction object nodes when funds are transferred in and out at the node, calculating the in-degree centrality and out-degree centrality of the node, wherein the in-degree centrality is used to evaluate the proportion of transfers from other nodes to the node when the node is a funds transferor, and the out-degree centrality is used to evaluate the proportion of transfers from the node to other nodes when the node is a funds transferor; obtaining the shortest capital flow path for transfers from the node to other nodes, obtaining transit nodes from the shortest capital flow path, obtaining transit nodes of all nodes, and calculating the betweenness centrality of each transit node, wherein the betweenness centrality is used to evaluate the importance of transit nodes in capital flow.

[0011] Optionally, the step of extracting subgraph features from the capital network graph includes: identifying specific subgraphs and frequent subgraphs in the capital network graph, wherein the specific subgraphs include: star structure subgraphs and chain structure subgraphs, and the frequent subgraphs refer to subgraphs that appear frequently and have the same structure; extracting features from the specific subgraphs and frequent subgraphs to obtain subgraph features, wherein the subgraph features include: the number of nodes and the number of edges, node degree distribution features, transaction amount distribution features, and geographical distribution features; obtaining normal subgraphs in the capital network graph, and screening the subgraph features of the specific subgraphs and frequent subgraphs based on the subgraph features of the normal subgraphs, wherein the normal subgraphs refer to the subgraphs of the capital network graph other than the specific subgraphs and the frequent subgraphs.

[0012] Optionally, the step of extracting features from specific subgraphs and frequent subgraphs includes: for each specific subgraph and frequent subgraph, obtaining the number of nodes and the number of edges of the subgraph; obtaining the in-degree and out-degree of each node in the subgraph, and determining the degree distribution characteristics of the subgraph based on preset in-degree thresholds and out-degree thresholds, wherein the degree distribution characteristics are used to reflect the number of nodes whose in-degree is higher than the in-degree threshold and the number of nodes whose out-degree is higher than the out-degree threshold; determining the transaction amount distribution characteristics of the subgraph based on the transaction records in the subgraph, wherein the transaction amount distribution characteristics are used to characterize the total transaction amount of each node and the concentration of the transaction amount; and determining the geographical distribution characteristics of each node in the subgraph based on the transaction geographical location information in the subgraph.

[0013] Optionally, the account information obtained based on the account transaction information includes: real-name authentication information of each account, transaction risk information; the transaction behavior characteristics obtained based on the account transaction information include: the total number of transactions of each account, the average transaction amount, and the proportion of transactions during non-working hours.

[0014] According to another aspect of an embodiment of the present invention, a financial transaction detection device based on a capital network graph is provided, comprising: a clustering unit, for extracting feature data of account transaction information, clustering the feature data using a clustering algorithm, and determining the transaction record corresponding to the outlier obtained by clustering as a first abnormal transaction record; a screening unit, for obtaining an abnormal transaction verification set, comparing the abnormal transaction verification set with the first abnormal transaction record, and screening out a second abnormal transaction record from the first abnormal transaction record based on the comparison result, wherein the abnormal transaction verification set at least includes: data of abnormal fund transfer behaviors that have occurred in a historical time period; a construction unit, for constructing transaction pairs and a capital network graph corresponding to each transaction pair based on the account transaction information, and extracting network features from the capital network graph, wherein the transaction pairs include: transaction accounts and transaction records, the capital network graph includes: nodes indicated by multiple transaction accounts and connection edges corresponding to the transaction records, and the network features include: node features and subgraph features; an identification unit, for obtaining account information and transaction behavior features of each account based on the account transaction information, and inputting the account information, transaction behavior features, the second abnormal transaction record, and the network features into a pre-constructed abnormal account identification model to obtain abnormal transaction accounts that have abnormal fund transfer behaviors.

[0015] Optionally, the clustering unit includes: a first acquisition module, used to acquire account transaction information, wherein the account transaction information includes: account information, transaction records, payment channel usage records and transaction geographic location information, the account information includes: transaction account number, and the transaction record includes: transaction amount and transaction time; a deletion module, used to delete error records in the transaction information, wherein error records include: transaction records with negative transaction amounts, account information with incorrect account format and duplicate account transaction information; a standardization module, used to perform standardization processing on the account transaction information, wherein the standardization processing includes: converting the values ​​of the same numerical account transaction information to the same size, and encoding the non-numerical account transaction information.

[0016] Optionally, the clustering unit also includes: a second acquisition module, which calculates the mean, median and variance of the transaction amount of each account based on the transaction records in the account transaction information, and obtains the transaction time density distribution information, the ratio of the number of accounts for fund transfers in and out, and the average transaction interval time of each account; a third acquisition module, which obtains the time series fluctuation characteristics of the transaction amount and the number of transactions based on the transaction records in the account transaction information, wherein the time series fluctuation characteristics are used to reflect the changing trend of the transaction amount and the number of transactions over time; a fourth acquisition module, which obtains the payment channel usage frequency and the payment channel type distribution based on the payment channel usage records in the account transaction information; a fifth acquisition module, which obtains the geographical distribution characteristics and the account usage records of the same IP address and the same terminal based on the transaction geographical location information in the account transaction information, wherein the geographical distribution characteristics include: cross-regional transfer frequency.

[0017] Optionally, the construction unit includes: a first determination module, used to determine the transaction accounts in the transaction pair as nodes of the capital network graph, wherein the transaction accounts include: the accounts of the fund transferor and the fund transferee; a second determination module, used to determine the transaction records in the transaction pair as connecting edges of the capital network graph, wherein the transaction records refer to the transaction flow between the fund transferor and the fund transferee, and the connecting edges are directed edges representing the flow direction of funds.

[0018] Optionally, the construction unit also includes: for each node in the capital network diagram, a first calculation module, based on the number of times that funds are transferred in and out of the node, calculates the in-degree and out-degree of the node, wherein the in-degree refers to the number of transactions in which funds are transferred in, and the out-degree refers to the number of transactions in which funds are transferred out of the node; a second calculation module, based on the number of transaction object nodes when funds are transferred in and out of the node, calculates the in-degree centrality and out-degree centrality of the node, wherein the in-degree centrality is used to evaluate the proportion of transfers from other nodes to the node when the node is a fund transferor, and the out-degree centrality is used to evaluate the proportion of transfers from the node to other nodes when the node is a fund transferor; a sixth acquisition module, used to obtain the shortest capital flow path for the node to transfer funds to other nodes, obtain the transit nodes from the shortest capital flow path, obtain the transit nodes of all nodes, and calculate the betweenness centrality of each transit node, wherein the betweenness centrality is used to evaluate the importance of the transit node in the capital flow.

[0019] Optionally, the construction unit also includes: an identification module, which is used to identify specific subgraphs and frequent subgraphs in the capital network graph, wherein the specific subgraphs include: star structure subgraphs and chain structure subgraphs, and frequent subgraphs refer to frequently appearing subgraphs with the same structure; an extraction module, which is used to extract features from specific subgraphs and frequent subgraphs to obtain subgraph features, wherein the subgraph features include: the number of nodes and the number of edges, node degree distribution features, transaction amount distribution features, and geographical distribution features; a screening module, which is used to obtain normal subgraphs in the capital network graph, and based on the subgraph features of the normal subgraphs, screen the subgraph features of the specific subgraphs and frequent subgraphs, wherein the normal subgraphs refer to subgraphs of the capital network graph other than the specific subgraphs and frequent subgraphs.

[0020] Optionally, the extraction module includes: for each specific subgraph and frequent subgraph, a first acquisition submodule, used to obtain the number of nodes and the number of edges of the subgraph; a second acquisition submodule, used to obtain the in-degree and out-degree of each node in the subgraph, and determine the degree distribution characteristics of the subgraph based on preset in-degree thresholds and out-degree thresholds, wherein the degree distribution characteristics are used to reflect the number of nodes with node in-degree higher than the in-degree threshold and the number of nodes with node out-degree higher than the out-degree threshold; a first determination submodule, based on the transaction records in the subgraph, determines the transaction amount distribution characteristics of the subgraph, wherein the transaction amount distribution characteristics are used to characterize the total transaction amount of each node and the concentration of the transaction amount; a second determination submodule, based on the transaction geographic location information in the subgraph, determines the geographical distribution characteristics of each node in the subgraph.

[0021] Optionally, in the identification unit, the account information obtained based on the account transaction information includes: real-name authentication information and transaction risk information of each account; the transaction behavior characteristics obtained based on the account transaction information include: the total number of transactions of each account, the average transaction amount, and the proportion of transactions during non-working hours.

[0022] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is also provided, wherein the computer-readable storage medium includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute any one of the above-mentioned financial transaction detection methods based on the capital network diagram.

[0023] According to another aspect of an embodiment of the present invention, there is also provided an electronic device, comprising one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement any one of the above-mentioned financial transaction detection methods based on a capital network diagram.

[0024] According to another aspect of an embodiment of the present invention, a computer program product is provided, including a computer program, which, when executed by a processor, implements the steps of any one of the above-mentioned financial transaction detection methods based on a capital network diagram.

[0025] In the present disclosure, feature data of account transaction information is extracted, and clustering processing is performed on the feature data using a clustering algorithm. The transaction record corresponding to the outlier obtained by clustering is determined as the first abnormal transaction record. Then, an abnormal transaction verification set is obtained, and the abnormal transaction verification set is compared with the first abnormal transaction record. Based on the comparison result, a second abnormal transaction record is screened out from the first abnormal transaction record. At the same time, transaction pairs and a capital network graph corresponding to each transaction pair are constructed based on the account transaction information, and network features are extracted from the capital network graph. Then, account information and transaction behavior features of each account are obtained based on the account transaction information. The account information, transaction behavior features, the second abnormal transaction record, and the network features are input into a pre-constructed abnormal account recognition model to obtain an abnormal transaction account number that has undergone abnormal fund transfer behavior.

[0026] Based on the above-mentioned public content, by constructing a capital network graph and extracting the network features of the capital network graph, the network features are input into the abnormal account recognition model, thereby enhancing the global network perspective of the abnormal account recognition model. By adopting a clustering algorithm and comparing with historical data, highly suspicious abnormal transaction records are screened out, and the screened out abnormal transaction records as well as account information, transaction behavior features, and network features are input into the abnormal account recognition model. Multiple types of feature data can improve the accuracy and efficiency of the abnormal account recognition model in identifying abnormal transaction accounts that have undergone abnormal capital transfer behaviors. The present disclosure improves the detection capability of abnormal capital transfer behaviors by combining capital network graph analysis with abnormal account recognition model recognition, thereby solving the technical problem in the related technology that the abnormal account recognition model has a single detection rule and is difficult to accurately identify transaction accounts that have undergone abnormal capital transfer behaviors. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0028] Figure 1 A hardware structure block diagram of a computer terminal (or mobile device) for implementing a financial transaction detection method based on a fund network diagram is shown;

[0029] Figure 2 is a flow chart of an optional financial transaction detection method based on a capital network diagram according to an embodiment of the present invention;

[0030] Figure 3is a schematic diagram of an optional funding network diagram according to an embodiment of the present invention;

[0031] Figure 4 is a schematic diagram of an optional financial transaction detection device based on a capital network diagram according to an embodiment of the present invention;

[0032] Figure 5 It is a structural block diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0033] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0034] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0035] It should be noted that the financial transaction detection method and device based on the capital network diagram in the present disclosure can be used in the field of financial technology, when financial transactions are detected based on the capital network diagram, and abnormal transaction accounts with abnormal fund transfer behaviors are identified. It can also be used in any field other than the field of financial technology, when financial transactions are detected based on the capital network diagram, and abnormal transaction accounts with abnormal fund transfer behaviors are identified. The present disclosure does not limit the application field of the financial transaction detection method and device based on the capital network diagram.

[0036] It should be noted that the information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) collected by this disclosure are information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of relevant data are in compliance with the relevant laws, regulations and standards of the relevant regions, necessary confidentiality measures are taken, and public order and good customs are not violated, and corresponding operation portals are provided for users to choose to authorize or refuse. For example, an interface is set up between this system and relevant users or organizations. Before obtaining relevant information, it is necessary to send an acquisition request to the aforementioned user or organization through the interface, and obtain relevant information after receiving the consent information fed back by the aforementioned user or organization.

[0037] It should be noted that in the present disclosure, when collecting and analyzing customer information, corresponding operation entrances are provided for users to choose to agree or reject the automated decision results; if the user chooses to reject, the expert decision-making process is entered.

[0038] The following embodiments of the present invention can be applied to various systems / applications / devices for financial transaction detection based on capital network graphs. The present invention enhances the global network perspective of the abnormal account recognition model by constructing a capital network graph and extracting network features of the capital network graph, and inputting the network features into the abnormal account recognition model. By adopting a clustering algorithm and comparing with historical data, highly suspicious abnormal transaction records are screened out, and the screened abnormal transaction records, account information, transaction behavior features, and network features are input into the abnormal account recognition model. Multiple types of feature data can improve the accuracy and efficiency of the abnormal account recognition model in identifying abnormal transaction accounts with abnormal capital transfer behaviors. The present invention improves the detection capability of abnormal capital transfer behaviors by combining capital network graph analysis with abnormal account recognition model recognition.

[0039] The present invention is described in detail below in conjunction with various embodiments.

[0040] Embodiment 1

[0041] According to an embodiment of the present invention, an embodiment of a financial transaction detection method based on a capital network diagram is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0042] The financial transaction detection method embodiment based on the capital network diagram provided in the first embodiment of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 1The hardware structure block diagram of a computer terminal (or mobile device) for implementing a financial transaction detection method based on a fund network diagram is shown. Figure 1 As shown, the computer terminal 10 (or mobile device) may include one or more ( Figure 1 The computer system 102 includes a processor 102 (the processor 102 may include but is not limited to a microprocessor MCU (Microcontroller Unit) or a programmable logic device FPGA (Field Programmable Gate Array)), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a Universal Serial Bus (USB) port (which may be included as one of the ports of the BUS bus), a network interface, a power supply and / or a camera. A person skilled in the art can understand that Figure 1 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations are shown.

[0043] It should be noted that the one or more processors 102 and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the computer terminal 10 (or mobile device). As described in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0044] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the financial transaction detection method based on the capital network diagram in the embodiment of the present application. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, that is, the above-mentioned financial transaction detection method based on the capital network diagram is realized. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the computer terminal 10 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0045] The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the computer terminal 10. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0046] The display may be, for example, a touch screen liquid crystal display (LCD), which enables a user to interact with a user interface of the computer terminal 10 (or mobile device).

[0047] Under the above operating environment, this application provides Figure 2 The financial transaction detection method based on the capital network graph is shown. Figure 2 is a flow chart of an optional financial transaction detection method based on a fund network diagram according to an embodiment of the present invention, such as Figure 2 As shown, the method comprises the following steps:

[0048] Step S201, extracting feature data of account transaction information, clustering the feature data using a clustering algorithm, and determining the transaction record corresponding to the outlier obtained by clustering as the first abnormal transaction record.

[0049] In the embodiments of the present invention, abnormal fund transfer refers to the act of disguising and confusing funds obtained through abnormal means through various channels and means to make the source and nature of the funds appear to be legitimate, or through a series of complex financial operations aimed at circumventing financial supervision and hiding the true source of funds, so that these funds can be used freely to carry out abnormal fund transfer activities that cannot be traced.

[0050] Among the vast amount of financial transaction information, most normal transaction information will show commonality and regularity. For example, they will have similar transaction amount ranges, stable transaction frequencies, common transaction time periods, and regular geographical distributions. Since abnormal fund transfer transactions will try to avoid the supervision of financial institutions and try not to adopt regular transaction patterns, the transaction information of abnormal fund transfers is significantly different from the legitimate normal transaction information. For example, the transaction information of abnormal fund transfers has the characteristics of concentrated transactions during non-working hours, large-scale frequent in and out transactions, complex and changeable sources and flows of funds, and abnormally wide or highly concentrated geographical distribution. In other words, the transaction information of abnormal fund transfers will show characteristics that are significantly deviated from normal transaction information.

[0051] Based on the characteristic difference between normal transaction information and transaction information of abnormal fund transfer, by using clustering algorithm to analyze the characteristic data of a large amount of historical transaction information, the characteristic data of normal transaction information will form a dense cluster structure after clustering. These dense clusters symbolize normal transaction characteristics, that is, transaction characteristics that do not involve abnormal fund transfer behavior. As long as the characteristic data of transaction information fluctuates within a reasonable range and can be summarized into clusters, the transaction information is considered normal. In other words, the characteristic data of normal transaction information are similar to each other and can form tight clusters. The characteristics of transaction information of abnormal fund transfer will not form a dense cluster structure with the characteristics of normal transaction information, but will be far away from these dense cluster structures, and then appear as outliers that are obviously far away from the clusters. Outliers may have obvious differences from the characteristic data of normal transaction information in terms of single transaction amount, transaction frequency, transaction object, geographical distribution or time distribution. These outliers are regarded as characteristic data of transaction information of abnormal fund transfer.

[0052] The embodiment of the present invention adopts a clustering algorithm to identify and locate these outliers, and then obtains the transaction records corresponding to these outliers, defines these transaction records as suspicious abnormal funds transfer transaction records, and obtains abnormal funds transfer transaction records with higher suspicion through subsequent further screening, thereby providing a data basis for the abnormal account recognition model to identify abnormal transaction accounts that have abnormal funds transfer behavior.

[0053] In order to obtain suspicious abnormal fund transfer transaction records, the embodiment of the present invention first extracts feature data from account transaction information. Account transaction information is stored in the internal system of a financial institution. The embodiment of the present invention can obtain all account transaction information of the day or month, extract feature data from these account transaction information, and then use a clustering algorithm to cluster these feature data.

[0054] The clustering algorithm may be the DBSCAN (Density-Based Spatial Clustering of Applications with Noise) clustering algorithm, which is a density-based clustering algorithm. The DBSCAN clustering algorithm does not require the number of clusters to be specified, and can automatically determine the number of clusters of the feature data set, divide the clusters by detecting the surrounding density of the feature data points, and automatically regard the single and sparse feature data points as outliers.

[0055] It should be noted that after the DBSCAN clustering algorithm clusters the feature data, an outlier detection algorithm can be used to identify and locate outliers to improve the accuracy and robustness of outlier identification. Among them, the outlier detection algorithm can adopt the OneClass SVM (One-Class Support Vector Machine) algorithm, that is, the one-class support vector machine algorithm, which accurately identifies outliers that are far away from the clustered clusters by adopting the one-class support vector machine algorithm. After the outliers are identified, the transaction records corresponding to the outliers are regarded as suspicious abnormal funds transfer transaction records. The embodiment of the present invention defines the transaction records corresponding to the outliers as the first abnormal transaction records. The first abnormal transaction record will be further screened in the future to obtain a more suspicious abnormal funds transfer transaction record, which provides a data basis for the abnormal account recognition model to identify abnormal transaction accounts with abnormal funds transfer behavior.

[0056] Step S202, obtaining an abnormal transaction verification set, comparing the abnormal transaction verification set with the first abnormal transaction record, and selecting a second abnormal transaction record from the first abnormal transaction record based on the comparison result, wherein the abnormal transaction verification set at least includes: data on abnormal fund transfer behaviors that have occurred in a historical time period.

[0057] After preliminarily determining the first abnormal transaction record by using a clustering algorithm, in order to further improve the accuracy and credibility of the suspicious abnormal transaction records, an embodiment of the present invention deeply compares and analyzes the first abnormal transaction record with an abnormal transaction verification set, where the abnormal transaction verification set at least includes data on abnormal fund transfer behaviors that have occurred in a historical time period. By comparing and analyzing the first abnormal transaction record with the data on abnormal fund transfer behaviors that have occurred recorded in the abnormal transaction verification set, abnormal transaction records with higher suspicion are screened out.

[0058] First, the embodiment of the present invention obtains data on abnormal fund transfers that have occurred from different channels, including known abnormal transaction records within financial institutions, abnormal transaction records in lists published by regulatory agencies, etc., and collects these abnormal transaction records into an abnormal transaction verification set. Before comparing the abnormal transaction verification set with the first abnormal transaction record, the abnormal transaction records in the abnormal transaction verification set are preprocessed to ensure comparability between the two. The preprocessing process includes data cleaning, format unification, abnormal value processing, and standardization processing.

[0059] The embodiment of the present invention compares the abnormal transaction verification set with the first abnormal transaction record from multiple dimensions, including: comparing the similarity of the amount distribution characteristics, transaction frequency, transaction time, geographical location distribution and other characteristics of the abnormal transaction records in the abnormal transaction verification set and the first abnormal transaction records; based on the similarity of multiple characteristics between the abnormal transaction records in the abnormal transaction verification set and the first abnormal transaction records, the similarity between each first abnormal transaction record and the abnormal transaction record in the abnormal transaction verification set can be evaluated, and then the first abnormal transaction record with high similarity is determined as the second abnormal transaction record, that is, the abnormal transaction records with higher suspicion are screened out, thereby providing data with higher credibility and accuracy for the subsequent abnormal account recognition model.

[0060] It should be noted that when screening the second abnormal transaction record from the first abnormal transaction record, a suitable similarity threshold can be set. The similarity threshold can be set by an experienced team or trained by artificial intelligence. The similarity threshold determines which first abnormal transaction records will be screened as second abnormal transaction records. If the similarity threshold is set too high, the false alarm rate will be too high. If the similarity threshold is set too low, the false alarm rate will increase. Therefore, it is necessary to combine team experience or artificial intelligence to find a balance between the false alarm rate and the false alarm rate, and then set a suitable similarity threshold, and use the similarity threshold to screen out the second abnormal transaction record from the first abnormal transaction record.

[0061] Step S203, constructing transaction pairs and a capital network graph corresponding to each transaction pair based on the account transaction information, and extracting network features from the capital network graph, wherein the transaction pairs include: transaction accounts and transaction records, the capital network graph includes: nodes indicated by multiple transaction accounts and connection edges corresponding to the transaction records, and the network features include: node features and subgraph features.

[0062] In an embodiment of the present invention, in addition to using a clustering algorithm to identify suspicious abnormal funds transfer transaction records, a funds network diagram is also constructed, network features are extracted from the funds network diagram, and the identified abnormal funds transfer transaction records and network features are jointly input into an abnormal account identification model to further identify abnormal transaction accounts where abnormal funds transfer behavior occurs.

[0063] The capital network diagram is a graph theory model used to describe and analyze the relationship between capital flows. Before constructing the capital network diagram, first construct a transaction pair based on the account transaction information. The transaction pair includes the transaction account number and transaction record, that is, obtain the account number of the fund transferor and the fund transferor from the account transaction information, as well as the detailed information of each transaction record, including the transaction amount, transaction time, etc. Then, construct the capital network diagram based on each transaction pair. The nodes of the capital network diagram represent the transaction accounts, and the connecting edges of the capital network diagram represent the transaction records. Figure 3 is a schematic diagram of an optional fund network diagram according to an embodiment of the present invention, such as Figure 3 As shown, A, B, C, and D represent four trading accounts. Figure 3 There are 5 transaction pairs, namely A transfers 5,000 yuan to B, A transfers 200 yuan to C, B transfers 1,000 yuan to C, C transfers 2,000 yuan to D, and D transfers 500 yuan to A. The directed arrows are connecting edges, representing transaction records. For example, A→B represents the transaction record of A transferring to B, and the value marked next to the connecting edge represents the transfer amount. It should be noted that Figure 3 The connecting edges in are transaction records, which only show the transaction amounts in the transaction records. Other information in the transaction records, including the transaction time, can be stored in the attributes of the connecting edges.

[0064] After constructing the capital network graph, network features are extracted from the capital network graph. Network features include node features and subgraph features. Node features include the node's in-degree and out-degree, in-degree centrality and out-degree centrality, and betweenness centrality. Among them, the node in-degree refers to the number of transactions where funds are transferred into the node, and the node out-degree refers to the number of transactions where funds are transferred out of the node. The node's in-degree centrality is used to evaluate the proportion of transfers from other nodes to the node when the node is the fund transferor. The node's out-degree centrality is used to evaluate the proportion of transfers from the node to other nodes when the node is the fund transferor. The node's betweenness centrality is used to evaluate the importance of the transfer node in the fund flow.

[0065] At the same time, the network characteristics of the capital network graph also include subgraph characteristics. In the capital network graph, a subgraph refers to a small graph formed by a part of the nodes extracted from the entire capital network graph and their interconnected relationships. By analyzing the subgraph structure, it is possible to identify microscopic abnormal patterns hidden in the macro network perspective. In a large-scale capital network graph, abnormal fund transfer transaction records are usually specific interaction patterns involving a few nodes and a few connecting edges. These patterns will reflect unique structural features or frequently occurring structural features in local areas of the capital network graph. Therefore, by identifying subgraphs of specific structures and frequently occurring subgraphs, this part of abnormal abnormal fund transfer transaction records can be captured.

[0066] The embodiment of the present invention adopts a pre-built subgraph discovery algorithm to identify specific subgraphs and frequent subgraphs in a capital network graph. Specific subgraphs include star-structured subgraphs and chain-structured subgraphs, and frequent subgraphs refer to subgraphs with the same structure that appear frequently. After identifying specific subgraphs and frequent subgraphs, the embodiment of the present invention extracts features from these subgraphs to obtain subgraph features, wherein the subgraph features include the number of nodes and edges of the subgraphs, node degree distribution features, transaction amount distribution features, and geographic distribution features. Based on the subgraph features of normal subgraphs other than specific subgraphs and frequent subgraphs, the extracted subgraph features of specific subgraphs and frequent subgraphs are screened, and the screened subgraph features are classified into the network features of the capital network graph. Finally, the network features including node features and subgraph features are input into the abnormal account recognition model, thereby identifying abnormal transaction accounts with abnormal fund transfer behaviors.

[0067] Step S204, based on the account transaction information, the account information and transaction behavior characteristics of each account are obtained, and the account information, transaction behavior characteristics, the second abnormal transaction record and the network characteristics are input into a pre-built abnormal account identification model to obtain the abnormal transaction account number where the abnormal fund transfer behavior occurs.

[0068] After obtaining the second abnormal transaction record and network characteristics, the account information and transaction behavior characteristics of each account are obtained based on the account transaction information, where the account information includes the real-name authentication information and transaction risk information of each account, and the transaction behavior characteristics include the total number of transactions, average transaction amount, and non-working hours transaction ratio of each account. It should be noted that the account information includes KYC information, namely "Know Your Customer" information. KYC information is a series of relevant customer background information collected and maintained by financial institutions when establishing business relationships with customers, which is intended to help financial institutions identify and verify customer identities, understand customers' real business needs, and evaluate and monitor customers' abnormal fund transfer risks.

[0069] The transaction behavior characteristics include the total number of transactions, average transaction amount, and non-working period transaction ratio of each account. The total number of transactions is a direct indicator of the account's transaction activity, reflecting the frequency of the account's transactions within a certain period of time. A high number of transactions may indicate that the account is involved in frequent fund flows. The average transaction amount is an important indicator for evaluating the transaction scale of an account, which reveals the amount of funds that the account usually involves in transactions. The average transaction amount of an abnormal fund transfer account may be significantly different from that of a normal account. For example, an abnormal fund transfer account may frequently involve large transactions, or conceal the flow of abnormal funds through small and high-frequency transactions. The non-working period transaction ratio is an indicator for evaluating the transaction time pattern of an account. It reflects the proportion of transactions conducted by an account during non-normal working hours and dates (such as night, weekends, or holidays). In order to evade supervision, abnormal fund transfer activities often conduct large or abnormal transactions during non-working hours. Therefore, accounts with a high proportion of non-working period transactions are at risk of abnormal fund transfer.

[0070] The acquired account information, transaction behavior characteristics, second abnormal transaction records and network characteristics are input into a pre-built abnormal account identification model to identify abnormal transaction accounts with potential abnormal fund transfer behaviors. In the embodiment of the present invention, the abnormal account identification model adopts the LightGBM model (Light Gradient Boosting Machine model), which is a deep learning model based on a gradient boosting decision tree, and can achieve an efficient and high-accuracy identification process.

[0071] The embodiment of the present invention uses historical account information, transaction behavior characteristics, second abnormal transaction records, network characteristics and known transaction account labels to train and optimize the LightGBM model. By continuously training and optimizing the hyperparameters of the model, including learning rate, tree depth, etc., it ensures that the LightGBM model can accurately identify abnormal transaction accounts with abnormal fund transfer behavior. After the LightGBM model training is completed, the mature LightGBM model is used in actual scenarios.

[0072] After the acquired account information, transaction behavior characteristics, second abnormal transaction records and network characteristics are input into the LightGBM model, the binary classification results of the transaction account are output, for example, abnormal transaction accounts with a label of 1 and normal transaction accounts with a label of 0 are output, where the abnormal transaction account is an abnormal transaction account in which abnormal fund transfer behavior occurs.

[0073] It should be noted that the embodiment of the present invention deploys the abnormal account identification model into the monitoring system of the financial institution, continuously detects new transaction records, and ensures that abnormal transaction accounts with abnormal fund transfer behaviors can be identified in a timely manner. As new data increases, the abnormal account identification model is regularly retrained, the model parameters are continuously updated, and the abnormal account identification model is optimized to cope with the ever-changing abnormal fund transfer methods.

[0074] Optionally, before extracting the characteristic data of the account transaction data, it also includes: obtaining account transaction information, wherein the account transaction information includes: account information, transaction records, payment channel usage records and transaction geographic location information, the account information includes: transaction account number, and the transaction record includes: transaction amount and transaction time; deleting error records in the transaction information, wherein the error records include: transaction records with negative transaction amounts, account information with incorrect account format and repeated account transaction information; standardizing the account transaction information, wherein the standardization includes: converting the values ​​of the same numerical account transaction information to the same size, and encoding the non-numerical account transaction information.

[0075] In step S201, before extracting the characteristic data of the account transaction data, it is first necessary to obtain comprehensive account transaction information. Account transaction information covers the static attributes and dynamic transaction characteristics of the account, specifically including account information, transaction records, payment channel usage records and transaction geographic location information. Among them, account information includes detailed information of the account involved in each transaction, including KYC information, transaction account number, account type, account status, etc., transaction records include detailed information of each transaction, including transaction amount, transaction time, transaction type, etc., payment channel usage records include payment information of each transaction, including payment method, communication data, etc., transaction geographic location information includes location information when each transaction occurs, including the place where the transaction occurs, IP address and terminal number, etc.

[0076] After obtaining comprehensive account transaction information, delete data records with obvious errors, such as transaction records with negative transaction amounts, account information with incorrect account formats, and duplicate account transaction information. At the same time, process outliers in account transaction information. For example, for transaction records with transaction amounts that obviously exceed a reasonable range, the transaction amount of this transaction record can be replaced with the median of the account transaction amount, thereby reducing the impact of outliers on account identification by the abnormal account identification model.

[0077] Next, the account transaction information is standardized, and the values ​​of the same numerical account transaction information are converted to the same size, for example, the transaction frequency is normalized. At the same time, the non-numerical account transaction information is encoded, for example, the classified account type is converted into a numerical value, so that the abnormal account recognition model can process the data.

[0078] Optionally, the step of extracting characteristic data of account transaction information includes: based on the transaction records in the account transaction information, calculating the mean, median and variance of the transaction amount of each account, and obtaining transaction time density distribution information, the ratio of the number of accounts for fund transfer in and out, and the average transaction interval time of each account; based on the transaction records in the account transaction information, obtaining the time series fluctuation characteristics of the transaction amount and the number of transactions, wherein the time series fluctuation characteristics are used to reflect the changing trend of the transaction amount and the number of transactions over time; based on the payment channel usage records in the account transaction information, obtaining the payment channel usage frequency and the payment channel type distribution; based on the transaction geographic location information in the account transaction information, obtaining the geographic distribution characteristics and the account usage records of the same IP address and the same terminal, wherein the geographic distribution characteristics include: cross-regional transfer frequency.

[0079] In step S201, when extracting the characteristic data of the account transaction information, it specifically includes:

[0080] Based on the transaction records in the account transaction information, the mean, median and variance of the transaction amount of each account are calculated, and the transaction time density distribution information, the ratio of the number of accounts with funds transferred in and out, and the average transaction interval of each account are obtained. For each account, the mean, median and variance of its transaction amount are calculated. These statistics can reflect the basic distribution and fluctuation of the account transaction amount, and help identify those accounts whose transaction amounts deviate significantly from the normal level. At the same time, the transaction time is analyzed to obtain the transaction time density distribution, that is, the distribution of transactions in different time periods of the day, with special attention paid to transaction behaviors during non-working hours, holidays or specific cycles (such as the last few days of each month). Abnormal fund transfer activities will try to avoid regular regulatory periods, so abnormal fund transfer transaction records will show abnormal transaction time patterns. In addition, the ratio of the number of accounts with funds transferred in and out of each account is calculated. Frequent transfers to a large number of unrelated accounts or acceptance of transfers from a large number of accounts are all at risk of abnormal fund transfers. Secondly, the average transaction interval of each account is counted to identify accounts with abnormal transaction frequencies. For example, abnormal fund transfer accounts with frequent transactions may show extremely short average transaction intervals.

[0081] Based on the transaction records in the account transaction information, the time series fluctuation characteristics of the transaction amount and the number of transactions are obtained. By analyzing the fluctuation characteristics of the transaction amount and the number of transactions over time, including daily fluctuations, weekly fluctuations, monthly fluctuations, etc., transaction records related to abnormal fund transfer activities can be identified. For example, abnormal fluctuations in the transaction amount or number of transactions (such as sudden increases or decreases) may be related to abnormal fund transfer activities and require special attention.

[0082] Then, based on the payment channel usage records in the account transaction information, the payment channel usage frequency and payment channel type distribution are obtained. By counting the usage frequency of different payment channels for each account and the preference for different payment channel types, such as some accounts prefer to use payment channels with looser supervision for transactions, trading accounts that attempt to evade supervision can be marked.

[0083] Finally, based on the transaction geographic location information in the account transaction information, the geographical distribution characteristics and the account usage records of the same IP address and the same terminal are obtained. By collecting the geographical location information of the transaction, including the place where the transaction occurred, the IP address, the transaction terminal number, etc., the frequency and distribution of cross-regional transfers are analyzed to identify those accounts that frequently conduct cross-regional transactions, especially those involving high-risk areas. The number of accounts that use the same IP address or the same transaction terminal for transactions may indicate that multiple accounts are operating in the same location, which may pose a risk of abnormal fund transfers.

[0084] Optionally, the step of constructing a capital network graph includes: determining the transaction accounts in the transaction pair as nodes of the capital network graph, wherein the transaction accounts include: the accounts of the fund transferor and the fund transferee; determining the transaction records in the transaction pair as connecting edges of the capital network graph, wherein the transaction records refer to the transaction flow between the fund transferor and the fund transferee, and the connecting edges are directed edges representing the flow direction of funds.

[0085] In step S203, when constructing the capital network graph, the transaction accounts in the transaction pairs are determined as nodes of the capital network graph, and the transaction records in the transaction pairs are determined as connecting edges of the capital network graph. Figure 3 As shown in the figure, A, B, C, and D represent four transaction accounts. The arrows from A to B, B to C, C to D, D to A, and A to C are all connecting edges. The connecting edge is the transaction record between the fund transferor and the fund transferee, that is, the transaction flow between the fund transferor and the fund transferee, and is a directed edge that represents the flow of funds. For example, A→B represents the transaction flow of A to B, which represents the flow of funds from A to B. The value marked next to the connecting edge represents the transfer amount, such as 5000 for the A to B connecting edge. If there are multiple transactions between the two nodes, the transaction amounts can be summed, or the average value or maximum value can be calculated as the attribute of the connecting edge.

[0086] It should be noted that for a complex capital network diagram, there will be hundreds, thousands or even millions of nodes and connecting edges. At this time, visualization tools can be used to layout the capital network diagram for better analysis.

[0087] Optionally, the step of extracting node features from the capital network graph includes: for each node in the capital network graph, based on the number of times that funds are transferred in and out at the node, calculating the in-degree and out-degree of the node, wherein the in-degree refers to the number of transactions in which funds are transferred in at the node, and the out-degree refers to the number of transactions in which funds are transferred out at the node; based on the number of transaction object nodes when funds are transferred in and out at the node, calculating the in-degree centrality and out-degree centrality of the node, wherein the in-degree centrality is used to evaluate the proportion of transfers from other nodes to the node when the node is a funds transferor, and the out-degree centrality is used to evaluate the proportion of transfers from the node to other nodes when the node is a funds transferor; obtaining the shortest capital flow path for transfers from the node to other nodes, obtaining transit nodes from the shortest capital flow path, obtaining transit nodes of all nodes, and calculating the betweenness centrality of each transit node, wherein the betweenness centrality is used to evaluate the importance of transit nodes in capital flow.

[0088] In step S203, when extracting node features from the capital network graph, it specifically includes:

[0089] For each node (i.e., transaction account) in the capital network graph, the in-degree and out-degree of the node are calculated based on the number of times the node has funds transferred in and out. The in-degree refers to the number of transactions where the node has funds transferred in, and the out-degree refers to the number of transactions where the node has funds transferred out. Figure 3 In the example, node A transfers money to nodes B and C, that is, node A has 2 outgoing edges, so the out-degree of node A is 2; at the same time, only node D transfers money to node A, that is, the inward edge of node A is 1, so the in-degree of node A is 1. The calculation of in-degree and out-degree can reveal the activity level and transaction direction of an account, which is crucial for identifying abnormal transaction behavior. For example, if an account has a very high in-degree and a relatively low out-degree, it indicates that the account is a suspicious account for abnormal fund transfers, while an account with a very high out-degree and a low in-degree indicates that the account may be the source account of abnormal fund transfers.

[0090] For each node in the capital network graph, the in-degree centrality and out-degree centrality of the node are further calculated based on the number of transaction object nodes when the node has capital transfers in and out. The in-degree centrality is used to evaluate the proportion of transfers from other nodes to the node when the node is the capital transferor, and the out-degree centrality is used to evaluate the proportion of transfers from the node to other nodes when the node is the capital transferor. The calculation formula for in-degree centrality and out-degree centrality is usually the number of edges directly connected to the node divided by the number of all connected edges in the capital network graph. Figure 3 As shown, the capital network graph has 5 connecting edges. For node A, there are 2 outward connecting edges, and its out-degree centrality is 2 / 5=40%. Node A has 1 inward connecting edge, and its in-degree centrality is 1 / 5=20%.

[0091] For each node in the capital network diagram, obtain the shortest capital flow path for transferring funds from the node to other nodes. In a complex capital network diagram, the shortest capital flow path between two nodes can reveal the most direct and frequent flow path of funds from one account to another. The transit nodes identified from the shortest capital flow path, that is, the "bridge" accounts through which funds pass, are key points in capital network analysis. Calculate the betweenness centrality of each transit node. The betweenness centrality indicates the importance of the node as a "bridge" connecting other nodes in the capital network. It can reveal accounts that frequently appear in capital flows and play a hub role. These accounts are at risk of abnormal capital transfers.

[0092] It should be noted that when extracting node features of the capital network graph, PageRank features and clustering coefficients can also be extracted. The PageRank feature is an indicator used to measure the importance of nodes in the network, while the clustering coefficient is an indicator used to measure the degree of interconnection between nodes in the network.

[0093] Optionally, the step of extracting subgraph features from the capital network graph includes: identifying specific subgraphs and frequent subgraphs in the capital network graph, wherein the specific subgraphs include: star structure subgraphs and chain structure subgraphs, and the frequent subgraphs refer to subgraphs that appear frequently and have the same structure; extracting features from the specific subgraphs and frequent subgraphs to obtain subgraph features, wherein the subgraph features include: the number of nodes and the number of edges, node degree distribution features, transaction amount distribution features, and geographical distribution features; obtaining normal subgraphs in the capital network graph, and screening the subgraph features of the specific subgraphs and frequent subgraphs based on the subgraph features of the normal subgraphs, wherein the normal subgraphs refer to the subgraphs of the capital network graph other than the specific subgraphs and the frequent subgraphs.

[0094] In step S203, when extracting subgraph features from the capital network graph, first identify specific subgraphs and frequent subgraphs in the capital network graph. Search for subgraphs with specific structures in the capital network graph, including star-shaped structure subgraphs and chain-shaped structure subgraphs. Among them, the star-shaped structure subgraph usually refers to a structure in which one or several central nodes conduct transactions with a large number of surrounding nodes, which indicates that the central node may be the hub of abnormal fund transfer activities. The chain-shaped structure subgraph is reflected in the continuous transfer of funds along a series of nodes, such as A to B, B to C, and C to D for straight-line transfer. This mode may be used to hide the original source or final destination of funds, and is a typical means of abnormal fund transfer. At the same time, in addition to the star-shaped structure subgraph and the chain-shaped structure subgraph, a highly clustered closed-loop subgraph can also be identified. The highly clustered closed-loop subgraph refers to a structure in which funds are frequently circulated between a few accounts, indicating that there is a "transfer" behavior between these accounts and there is a risk of abnormal fund transfer.

[0095] The subgraphs with the same or similar structures that frequently appear in the capital network diagram and are identified by the algorithm may represent common operating modes of abnormal fund transfers, or reflect certain regular characteristics of abnormal fund transfer behaviors, and also pose the risk of abnormal fund transfers.

[0096] After identifying the specific subgraph and the frequent subgraph, feature extraction is performed on them to obtain subgraph features. Among them, the subgraph features include the number of nodes and edges of the subgraph, the node degree distribution features, the transaction amount distribution features, and the geographical distribution features. Then, by obtaining the normal subgraph in the capital network graph, that is, obtaining the subgraph of the capital network graph other than the specific subgraph and the frequent subgraph, the subgraph features of the specific subgraph and the frequent subgraph are screened based on the subgraph features of the normal subgraph. The transaction amount distribution features, transaction frequency, etc. of the specific subgraph and the frequent subgraph are compared with the common transaction amount distribution features, transaction frequency, and other subgraph features of the normal subgraph. If the subgraph features of the specific subgraph and the frequent subgraph significantly deviate from the subgraph features of the normal subgraph, for example, the average transaction amount of the specific subgraph or the frequent subgraph is extremely high, and the transaction time is concentrated in the non-normal business hours, etc., it indicates that the subgraph features are abnormal. It should be noted that when judging whether the subgraph features significantly deviate from the normal subgraph features, the relevant threshold can be set in advance, and the abnormal subgraph features that significantly deviate from the normal subgraph features can be screened by the set threshold. Finally, the subgraph features of the screened specific subgraph and frequent subgraph are used as network features of the capital network graph and input into the abnormal account recognition model.

[0097] Optionally, the step of extracting features from specific subgraphs and frequent subgraphs includes: for each specific subgraph and frequent subgraph, obtaining the number of nodes and the number of edges of the subgraph; obtaining the in-degree and out-degree of each node in the subgraph, and determining the degree distribution characteristics of the subgraph based on preset in-degree thresholds and out-degree thresholds, wherein the degree distribution characteristics are used to reflect the number of nodes whose in-degree is higher than the in-degree threshold and the number of nodes whose out-degree is higher than the out-degree threshold; determining the transaction amount distribution characteristics of the subgraph based on the transaction records in the subgraph, wherein the transaction amount distribution characteristics are used to characterize the total transaction amount of each node and the concentration of the transaction amount; and determining the geographical distribution characteristics of each node in the subgraph based on the transaction geographical location information in the subgraph.

[0098] When extracting features from specific subgraphs and frequent subgraphs, it specifically includes:

[0099] For each specific subgraph and frequent subgraph, obtain the number of nodes and edges of the subgraph. The number of nodes reflects the range of accounts covered by the subgraph, and the number of edges shows the density of transactions between accounts. These data can provide basic information about the size of the subgraph and reflect the scope of capital flow.

[0100] For each specific subgraph and frequent subgraph, the in-degree and out-degree of each node in the subgraph are obtained, and the degree distribution characteristics of the subgraph are determined based on the preset in-degree threshold and out-degree threshold. The degree distribution characteristics reflect the number of nodes with in-degree higher than the in-degree threshold and the number of nodes with out-degree higher than the out-degree threshold. By inputting the degree distribution characteristics into the abnormal account recognition model, it helps the abnormal account recognition model to identify abnormal accounts.

[0101] For each specific subgraph and frequent subgraph, the transaction amount distribution characteristics of the subgraph are determined based on the transaction records in the subgraph, wherein the transaction amount distribution characteristics are used to characterize the total transaction amount of each node and the concentration of the transaction amount. The embodiment of the present invention calculates the total transaction amount of each node based on the transaction records in the specific subgraph and the frequent subgraph, including all transaction amounts of the node as the transferor and transferor of funds. In addition, the concentration of the transaction amount is also analyzed, such as calculating the mean, median, standard deviation, maximum and minimum values ​​of the amount. These statistics can reveal the mean level, volatility and extreme value of the capital flow.

[0102] For each specific subgraph and frequent subgraph, the geographical distribution characteristics of each node in the subgraph are determined based on the transaction geographical location information in the subgraph. The geographical distribution characteristics can reveal the regional pattern of capital flow, such as whether there are cross-regional or cross-border transactions, and whether the transactions are concentrated in a specific geographical area.

[0103] The steps provided by the above-mentioned financial transaction detection method based on the capital network graph can be performed by extracting feature data of account transaction information, clustering the feature data using a clustering algorithm, determining the transaction record corresponding to the outlier obtained by clustering as the first abnormal transaction record, and then obtaining an abnormal transaction verification set, comparing the abnormal transaction verification set with the first abnormal transaction record, and screening out the second abnormal transaction record from the first abnormal transaction record based on the comparison result. At the same time, transaction pairs and capital network graphs corresponding to each transaction pair are constructed based on the account transaction information, network features are extracted from the capital network graph, and then account information and transaction behavior features of each account are obtained based on the account transaction information, and the account information, transaction behavior features, the second abnormal transaction record and network features are input into a pre-constructed abnormal account recognition model to obtain abnormal transaction accounts where abnormal funds transfer behavior occurs.

[0104] The embodiment of the present invention constructs a capital network graph and extracts network features of the capital network graph, and inputs the network features into an abnormal account identification model, thereby enhancing the global network perspective of the abnormal account identification model. By adopting a clustering algorithm and comparing with historical data, highly suspicious abnormal transaction records are screened out, and the screened abnormal transaction records as well as account information, transaction behavior features, and network features are input into the abnormal account identification model. Multiple types of feature data can improve the accuracy and efficiency of the abnormal account identification model in identifying abnormal transaction accounts that have abnormal fund transfer behaviors.

[0105] At the same time, the embodiment of the present invention periodically retrains the abnormal account recognition model, continuously updates the model parameters, and optimizes the abnormal account recognition model, thereby improving the generalization ability of the abnormal account recognition model and ensuring that the abnormal account recognition model can cope with the ever-changing abnormal fund transfer methods.

[0106] The embodiments of the present invention improve the ability to detect abnormal fund transfer behavior by combining fund network graph analysis and abnormal account identification model recognition, thereby solving the technical problem in the related art that the abnormal account identification model detection rules are single and it is difficult to accurately identify the transaction account that has abnormal fund transfer behavior.

[0107] The following is a detailed description in conjunction with another embodiment.

[0108] Embodiment 2

[0109] A financial transaction detection device based on a capital network diagram provided in this embodiment includes multiple implementation units, each of which corresponds to each implementation step in the above-mentioned embodiment 1.

[0110] Figure 4 is a schematic diagram of an optional financial transaction detection device based on a fund network diagram according to an embodiment of the present invention, such as Figure 4As shown, the financial transaction detection device based on the capital network diagram may include: a clustering unit 41, a screening unit 42, a construction unit 43, and an identification unit 44.

[0111] The clustering unit 41 is used to extract feature data of account transaction information, perform clustering processing on the feature data using a clustering algorithm, and determine the transaction record corresponding to the outlier point obtained by clustering as the first abnormal transaction record.

[0112] The screening unit 42 is used to obtain an abnormal transaction verification set, compare the abnormal transaction verification set with the first abnormal transaction record, and screen out a second abnormal transaction record from the first abnormal transaction record based on the comparison result, wherein the abnormal transaction verification set at least includes: data on abnormal fund transfer behaviors that have occurred in a historical time period.

[0113] The construction unit 43 constructs transaction pairs and a capital network graph corresponding to each transaction pair based on the account transaction information, and extracts network features from the capital network graph, wherein the transaction pairs include: transaction accounts and transaction records, the capital network graph includes: nodes indicated by multiple transaction accounts and connection edges corresponding to the transaction records, and the network features include: node features and subgraph features.

[0114] The identification unit 44 obtains the account information and transaction behavior characteristics of each account based on the account transaction information, inputs the account information, transaction behavior characteristics, the second abnormal transaction record and the network characteristics into a pre-built abnormal account identification model, and obtains the abnormal transaction account number where the abnormal fund transfer behavior occurs.

[0115] The above-mentioned financial transaction detection device based on the capital network diagram can extract the characteristic data of the account transaction information through the clustering unit 41, cluster the characteristic data using a clustering algorithm, determine the transaction record corresponding to the outlier obtained by clustering as the first abnormal transaction record, and then obtain the abnormal transaction verification set through the screening unit 42, compare the abnormal transaction verification set with the first abnormal transaction record, and screen out the second abnormal transaction record from the first abnormal transaction record based on the comparison result. At the same time, the construction unit 43 constructs transaction pairs and the capital network diagram corresponding to each transaction pair based on the account transaction information, extracts network features from the capital network diagram, and then obtains the account information and transaction behavior characteristics of each account based on the account transaction information through the identification unit 44, inputs the account information, transaction behavior characteristics, the second abnormal transaction record and the network characteristics into a pre-constructed abnormal account identification model to obtain the abnormal transaction account number where abnormal capital transfer behavior occurs.

[0116] The embodiment of the present invention constructs a capital network graph and extracts network features of the capital network graph, inputs the network features into an abnormal account identification model, thereby enhancing the global network perspective of the abnormal account identification model, and screens out highly suspicious abnormal transaction records by adopting a clustering algorithm and comparing with historical data, and inputs the screened abnormal transaction records as well as account information, transaction behavior features, and network features into the abnormal account identification model. Multiple types of feature data can improve the accuracy and efficiency of the abnormal account identification model in identifying abnormal transaction accounts that have undergone abnormal capital transfer behaviors. The embodiment of the present invention improves the detection capability of abnormal capital transfer behaviors by combining capital network graph analysis with abnormal account identification model recognition, thereby solving the technical problem in the related art that the abnormal account identification model has a single detection rule and is difficult to accurately identify transaction accounts that have undergone abnormal capital transfer behaviors.

[0117] Optionally, the clustering unit 41 includes: a first acquisition module, used to acquire account transaction information, wherein the account transaction information includes: account information, transaction records, payment channel usage records and transaction geographic location information, the account information includes: transaction account number, and the transaction record includes: transaction amount and transaction time; a deletion module, used to delete error records in the transaction information, wherein error records include: transaction records with negative transaction amounts, account information with incorrect account format and repeated account transaction information; a standardization module, used to perform standardization processing on the account transaction information, wherein the standardization processing includes: converting the values ​​of the same numerical account transaction information to the same size, and encoding the non-numerical account transaction information.

[0118] Optionally, the clustering unit 41 also includes: a second acquisition module, which calculates the mean, median and variance of the transaction amount of each account based on the transaction records in the account transaction information, and obtains the transaction time density distribution information, the ratio of the number of accounts for fund transfer in and out, and the average transaction interval time of each account; a third acquisition module, which obtains the time series fluctuation characteristics of the transaction amount and the number of transactions based on the transaction records in the account transaction information, wherein the time series fluctuation characteristics are used to reflect the changing trend of the transaction amount and the number of transactions over time; a fourth acquisition module, which obtains the payment channel usage frequency and the payment channel type distribution based on the payment channel usage records in the account transaction information; a fifth acquisition module, which obtains the geographical distribution characteristics and the account usage records of the same IP address and the same terminal based on the transaction geographical location information in the account transaction information, wherein the geographical distribution characteristics include: cross-regional transfer frequency.

[0119] Optionally, the construction unit 43 includes: a first determination module, used to determine the transaction accounts in the transaction pair as nodes of the capital network graph, wherein the transaction accounts include: the accounts of the fund transferor and the fund transferee; a second determination module, used to determine the transaction records in the transaction pair as connecting edges of the capital network graph, wherein the transaction records refer to the transaction flow between the fund transferor and the fund transferee, and the connecting edges are directed edges representing the flow direction of funds.

[0120] Optionally, the construction unit 43 also includes: for each node in the capital network diagram, a first calculation module, based on the number of times that funds are transferred in and out of the node, calculates the in-degree and out-degree of the node, wherein the in-degree refers to the number of transactions in which funds are transferred in at the node, and the out-degree refers to the number of transactions in which funds are transferred out at the node; a second calculation module, based on the number of transaction object nodes when funds are transferred in and out of the node, calculates the in-degree centrality and out-degree centrality of the node, wherein the in-degree centrality is used to evaluate the proportion of transfers from other nodes to the node when the node is a fund transferor, and the out-degree centrality is used to evaluate the proportion of transfers from the node to other nodes when the node is a fund transferor; a sixth acquisition module, used to obtain the shortest capital flow path for the node to transfer funds to other nodes, obtain the transit nodes from the shortest capital flow path, obtain the transit nodes of all nodes, and calculate the betweenness centrality of each transit node, wherein the betweenness centrality is used to evaluate the importance of the transit node in the capital flow.

[0121] Optionally, the construction unit 43 also includes: an identification module, which is used to identify specific subgraphs and frequent subgraphs in the capital network graph, wherein the specific subgraphs include: star structure subgraphs and chain structure subgraphs, and frequent subgraphs refer to frequently appearing subgraphs with the same structure; an extraction module, which is used to extract features from specific subgraphs and frequent subgraphs to obtain subgraph features, wherein the subgraph features include: the number of nodes and the number of edges, node degree distribution features, transaction amount distribution features, and geographical distribution features; a screening module, which is used to obtain normal subgraphs in the capital network graph, and based on the subgraph features of the normal subgraphs, screen the subgraph features of the specific subgraphs and frequent subgraphs, wherein the normal subgraphs refer to the subgraphs of the capital network graph other than the specific subgraphs and the frequent subgraphs.

[0122] Optionally, the extraction module includes: for each specific subgraph and frequent subgraph, a first acquisition submodule, used to obtain the number of nodes and the number of edges of the subgraph; a second acquisition submodule, used to obtain the in-degree and out-degree of each node in the subgraph, and determine the degree distribution characteristics of the subgraph based on preset in-degree thresholds and out-degree thresholds, wherein the degree distribution characteristics are used to reflect the number of nodes with node in-degree higher than the in-degree threshold and the number of nodes with node out-degree higher than the out-degree threshold; a first determination submodule, based on the transaction records in the subgraph, determines the transaction amount distribution characteristics of the subgraph, wherein the transaction amount distribution characteristics are used to characterize the total transaction amount of each node and the concentration of the transaction amount; a second determination submodule, based on the transaction geographic location information in the subgraph, determines the geographical distribution characteristics of each node in the subgraph.

[0123] Optionally, in the identification unit 44, the account information obtained based on the account transaction information includes: real-name authentication information and transaction risk information of each account; the transaction behavior characteristics obtained based on the account transaction information include: the total number of transactions of each account, the average transaction amount, and the proportion of transactions during non-working hours.

[0124] The above-mentioned financial transaction detection device based on the capital network diagram may also include a processor and a memory. The above-mentioned clustering unit 41, screening unit 42, construction unit 43, identification unit 44, etc. are all stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to realize the corresponding functions.

[0125] The processor includes a kernel, which retrieves the corresponding program unit from the memory. One or more kernels can be set, and the kernel parameters can be adjusted to detect financial transactions based on the capital network diagram and identify abnormal transaction accounts with abnormal capital transfer behaviors.

[0126] The above-mentioned memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one storage chip.

[0127] Embodiment 3

[0128] An embodiment of the present application may provide an electronic device, Figure 5 is a structural block diagram of an electronic device according to an embodiment of the present application. Figure 5 As shown, the electronic device may include: one or more ( Figure 5 (only one is shown) processor 502, memory 504, storage controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.

[0129] Among them, the memory can be used to store software programs and modules, such as program instructions / modules corresponding to the methods and devices in the embodiments of the present application, and the processor executes various functional applications and data processing by running the software programs and modules stored in the memory, that is, realizing the above-mentioned method. The memory may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include a memory remotely arranged relative to the processor, and these remote memories may be connected to the terminal via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0130] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: extract the feature data of the account transaction information, cluster the feature data using a clustering algorithm, and determine the transaction record corresponding to the outlier obtained by clustering as the first abnormal transaction record; obtain an abnormal transaction verification set, compare the abnormal transaction verification set with the first abnormal transaction record, and screen out the second abnormal transaction record from the first abnormal transaction record based on the comparison result, wherein the abnormal transaction verification set at least includes: data recorded in the historical time period that the abnormal fund transfer behavior has occurred; construct a transaction pair and a fund network graph corresponding to each transaction pair based on the account transaction information, and extract network features from the fund network graph, wherein the transaction pair includes: a transaction account number and a transaction record, the fund network graph includes: nodes indicated by multiple transaction accounts and connection edges corresponding to the transaction records, and the network features include: node features and subgraph features; obtain the account information and transaction behavior features of each account based on the account transaction information, input the account information, transaction behavior features, the second abnormal transaction record and the network features into a pre-constructed abnormal account recognition model to obtain the abnormal transaction account number that has undergone abnormal fund transfer behavior.

[0131] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: obtain account transaction information, wherein the account transaction information includes: account information, transaction records, payment channel usage records and transaction geographic location information, the account information includes: transaction account number, and the transaction record includes: transaction amount and transaction time; delete error records in the transaction information, wherein the error records include: transaction records with negative transaction amounts, account information with incorrect account format and repeated account transaction information; standardize the account transaction information, wherein the standardization includes: converting the values ​​of the same numerical account transaction information to the same size, and encoding the non-numerical account transaction information.

[0132] The processor can also call the information and application programs stored in the memory through the transmission device to perform the following steps: based on the transaction records in the account transaction information, calculate the mean, median and variance of the transaction amount of each account, and obtain the transaction time density distribution information, the ratio of the number of accounts for fund transfer in and out, and the average transaction interval time of each account; based on the transaction records in the account transaction information, obtain the time series fluctuation characteristics of the transaction amount and the number of transactions, wherein the time series fluctuation characteristics are used to reflect the changing trend of the transaction amount and the number of transactions over time; based on the payment channel usage records in the account transaction information, obtain the payment channel usage frequency and the payment channel type distribution; based on the transaction geographic location information in the account transaction information, obtain the geographic distribution characteristics and the account usage records of the same IP address and the same terminal, wherein the geographic distribution characteristics include: cross-regional transfer frequency.

[0133] The processor can also call the information and application programs stored in the memory through the transmission device to perform the following steps: determine the transaction accounts in the transaction pair as nodes of the capital network diagram, wherein the transaction accounts include: the accounts of the fund transferor and the fund transferee; determine the transaction records in the transaction pair as connecting edges of the capital network diagram, wherein the transaction records refer to the transaction flow between the fund transferor and the fund transferee, and the connecting edges are directed edges representing the flow of funds.

[0134] The processor can also call the information and application programs stored in the memory through the transmission device to perform the following steps: for each node in the capital network diagram, based on the number of times that funds are transferred in and out of the node, calculate the in-degree and out-degree of the node, wherein the in-degree refers to the number of transactions in which funds are transferred in at the node, and the out-degree refers to the number of transactions in which funds are transferred out at the node; based on the number of transaction object nodes when funds are transferred in and out of the node, calculate the in-degree centrality and out-degree centrality of the node, wherein the in-degree centrality is used to evaluate the proportion of transfers from other nodes to the node when the node is a fund transferor, and the out-degree centrality is used to evaluate the proportion of transfers from the node to other nodes when the node is a fund transferor; obtain the shortest capital flow path for the node to transfer to other nodes, obtain the transit nodes from the shortest capital flow path, obtain the transit nodes of all nodes, and calculate the betweenness centrality of each transit node, wherein the betweenness centrality is used to evaluate the importance of the transit node in the capital flow.

[0135] The processor can also call the information and application programs stored in the memory through the transmission device to perform the following steps: identify specific subgraphs and frequent subgraphs in the capital network graph, wherein the specific subgraphs include: star structure subgraphs and chain structure subgraphs, and frequent subgraphs refer to subgraphs that appear frequently and have the same structure; extract features from the specific subgraphs and frequent subgraphs to obtain subgraph features, wherein the subgraph features include: the number of nodes and the number of edges, node degree distribution features, transaction amount distribution features, and geographical distribution features; obtain normal subgraphs in the capital network graph, and based on the subgraph features of the normal subgraphs, screen the subgraph features of the specific subgraphs and frequent subgraphs, wherein the normal subgraphs refer to subgraphs of the capital network graph other than the specific subgraphs and frequent subgraphs.

[0136] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: for each specific subgraph and frequent subgraph, obtain the number of nodes and the number of edges of the subgraph; obtain the in-degree and out-degree of each node in the subgraph, and determine the degree distribution characteristics of the subgraph based on the preset in-degree threshold and out-degree threshold, wherein the degree distribution characteristics are used to reflect the number of nodes with node in-degree higher than the in-degree threshold and the number of nodes with node out-degree higher than the out-degree threshold; based on the transaction records in the subgraph, determine the transaction amount distribution characteristics of the subgraph, wherein the transaction amount distribution characteristics are used to characterize the total transaction amount of each node and the concentration of the transaction amount; based on the transaction geographic location information in the subgraph, determine the geographical distribution characteristics of each node in the subgraph.

[0137] The processor can also call the information and applications stored in the memory through the transmission device to perform the following steps: the account information obtained based on the account transaction information includes: the real-name authentication information of each account, and transaction risk information; the transaction behavior characteristics obtained based on the account transaction information include: the total number of transactions of each account, the average transaction amount, and the proportion of transactions during non-working hours.

[0138] By adopting the embodiment of the present application, a scheme of a financial transaction detection method based on a capital network graph is provided. By extracting feature data of account transaction information, clustering the feature data using a clustering algorithm, determining the transaction record corresponding to the outlier obtained by clustering as the first abnormal transaction record, and then obtaining an abnormal transaction verification set, comparing the abnormal transaction verification set with the first abnormal transaction record, and filtering out the second abnormal transaction record from the first abnormal transaction record based on the comparison result, at the same time, constructing transaction pairs and a capital network graph corresponding to each transaction pair based on the account transaction information, extracting network features from the capital network graph, and then obtaining the account information and transaction behavior features of each account based on the account transaction information, inputting the account information, transaction behavior features, the second abnormal transaction record and the network features into a pre-constructed abnormal account identification model, and obtaining an abnormal transaction account number with abnormal fund transfer behavior, thereby achieving the purpose of enhancing the global network perspective of the abnormal account identification model and improving the detection capability of abnormal fund transfer behavior, thereby solving the technical problem that the abnormal account identification model detection rule is single in the related technology and it is difficult to accurately identify the transaction account number with abnormal fund transfer behavior.

[0139] It can be understood by those skilled in the art that Figure 5 The structure shown is for illustration only, and the electronic device may also be a smart phone, a tablet computer, a PDA, a mobile Internet device (MID), a PAD, or other terminal devices. Figure 5 The structure of the electronic device is not limited. Figure 5 More or fewer components (such as network interfaces, display devices, etc.) shown in, or having Figure 5 Different configurations shown.

[0140] A person of ordinary skill in the art can understand that all or part of the steps in the various financial transaction detection methods based on the capital network diagram in the above-mentioned embodiments can be completed by instructing the hardware related to the terminal device through a program, and the program can be stored in a computer-readable storage medium, and the storage medium may include: a flash drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0141] Embodiment 4

[0142] The embodiment of the present application further provides a storage medium. Optionally, in this embodiment, the storage medium can be used to store the program code executed by the financial transaction detection method based on the capital network diagram provided in the first embodiment.

[0143] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is also provided, the computer-readable storage medium including a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute any one of the financial transaction detection methods based on the capital network diagram in the above-mentioned embodiment 1.

[0144] Optionally, in this embodiment, the above storage medium may be located in any computer terminal in a computer terminal group in a computer network, or in any mobile terminal in a mobile terminal group.

[0145] The present application also provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of the financial transaction detection method based on the capital network diagram described in each embodiment of the present application.

[0146] The present application also provides a computer program product, including a non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the financial transaction detection method based on the capital network diagram described in each embodiment of the present application are implemented.

[0147] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0148] In the above embodiments of the present invention, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0149] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0150] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0151] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0152] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and other media that can store program codes.

[0153] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A financial transaction detection method based on a capital network diagram, characterized in that: include: Extracting feature data of account transaction information, performing clustering processing on the feature data using a clustering algorithm, and determining a transaction record corresponding to an outlier point obtained by clustering as a first abnormal transaction record; Acquire an abnormal transaction verification set, compare the abnormal transaction verification set with the first abnormal transaction record, and select a second abnormal transaction record from the first abnormal transaction record based on the comparison result, wherein the abnormal transaction verification set at least includes: data of abnormal fund transfer behaviors that have occurred in a historical time period; Constructing transaction pairs and a capital network graph corresponding to each transaction pair based on the account transaction information, and extracting network features from the capital network graph, wherein the transaction pairs include: transaction accounts and transaction records, the capital network graph includes: nodes indicated by multiple transaction accounts and connection edges corresponding to transaction records, and the network features include: node features and subgraph features; Based on the account transaction information, the account information and transaction behavior characteristics of each account are obtained, and the account information, the transaction behavior characteristics, the second abnormal transaction record and the network characteristics are input into a pre-built abnormal account identification model to obtain the abnormal transaction account number where abnormal fund transfer behavior occurs.

2. The financial transaction detection method according to claim 1, characterized in that: Before extracting the characteristic data of the account transaction data, the method further includes: Acquire the account transaction information, wherein the account transaction information includes: account information, the transaction record, payment channel usage record and transaction geographic location information, the account information includes: transaction account number, and the transaction record includes: transaction amount and transaction time; Deleting the error records in the transaction information, wherein the error records include: the transaction records with negative transaction amounts, the account information with incorrect account format, and repeated account transaction information; The account transaction information is standardized, wherein the standardization includes: converting the numerical values ​​of the account transaction information of the same numerical type into the same size, and encoding the non-numerical account transaction information.

3. The financial transaction detection method according to claim 1, characterized in that: The step of extracting characteristic data of the account transaction information comprises: Based on the transaction records in the account transaction information, calculate the mean, median and variance of the transaction amount of each account, and obtain the transaction time density distribution information, the ratio of the number of accounts with funds transferred in and out, and the average transaction interval time of each account; Based on the transaction records in the account transaction information, obtaining the time series fluctuation characteristics of the transaction amount and the number of transactions, wherein the time series fluctuation characteristics are used to reflect the changing trend of the transaction amount and the number of transactions over time; Based on the payment channel usage records in the account transaction information, obtaining the payment channel usage frequency and payment channel type distribution; Based on the transaction geographic location information in the account transaction information, the geographic distribution characteristics and the account usage records of the same IP address and the same terminal are obtained, wherein the geographic distribution characteristics include: cross-regional transfer frequency.

4. The financial transaction detection method according to claim 1, characterized in that: The steps of constructing the capital network diagram include: Determine the transaction accounts in the transaction pair as nodes of the capital network graph, wherein the transaction accounts include: accounts of the fund transferor and the fund transferee; The transaction records in the transaction pair are determined as the connection edges of the capital network graph, wherein the transaction records refer to the transaction flow between the capital transferor and the capital transferee, and the connection edges are directed edges representing the flow direction of the capital.

5. The financial transaction detection method according to claim 1, characterized in that: The step of extracting the node features from the capital network graph comprises: for each node in the capital network graph, Based on the number of fund transfers in and out of the node, calculate the in-degree and out-degree of the node, where the in-degree refers to the number of transactions in which the node transfers in, and the out-degree refers to the number of transactions in which the node transfers out; Based on the number of transaction object nodes when funds are transferred in and out of the node, the in-degree centrality and out-degree centrality of the node are calculated, wherein the in-degree centrality is used to evaluate the proportion of other nodes other than the node transferring funds to the node when the node is the fund transferor, and the out-degree centrality is used to evaluate the proportion of the node transferring funds to the other nodes when the node is the fund transferor; Obtain the shortest capital flow path for transferring money from the node to the other nodes, obtain the transfer nodes from the shortest capital flow path, obtain the transfer nodes of all nodes, and calculate the betweenness centrality of each transfer node, wherein the betweenness centrality is used to evaluate the importance level of the transfer node in the capital flow.

6. The financial transaction detection method according to claim 1, characterized in that: The step of extracting the subgraph features from the capital network graph comprises: Identify specific subgraphs and frequent subgraphs in the capital network graph, wherein the specific subgraphs include: star-structured subgraphs and chain-structured subgraphs, and the frequent subgraphs refer to subgraphs that appear frequently and have the same structure; Extracting features from the specific subgraph and the frequent subgraph to obtain the subgraph features, wherein the subgraph features include: the number of nodes and the number of edges, node degree distribution features, transaction amount distribution features, and geographic distribution features; A normal subgraph in the capital network graph is obtained, and based on the subgraph features of the normal subgraph, the subgraph features of the specific subgraph and the frequent subgraph are screened, wherein the normal subgraph refers to a subgraph of the capital network graph other than the specific subgraph and the frequent subgraph.

7. The financial transaction detection method according to claim 6, characterized in that: The step of extracting features from the specific subgraph and the frequent subgraph includes: for each of the specific subgraph and the frequent subgraph, obtaining the number of nodes and the number of edges of the subgraph; Obtain the in-degree and out-degree of each node in the subgraph, and determine the degree distribution characteristics of the subgraph based on a preset in-degree threshold and an out-degree threshold, wherein the degree distribution characteristics are used to reflect the number of nodes whose in-degree is higher than the in-degree threshold and the number of nodes whose out-degree is higher than the out-degree threshold; Based on the transaction records in the subgraph, determining the transaction amount distribution characteristics of the subgraph, wherein the transaction amount distribution characteristics are used to characterize the total transaction amount of each node and the concentration of the transaction amount; Based on the transaction geographic location information in the subgraph, the geographic distribution characteristics of each node in the subgraph are determined.

8. The financial transaction detection method according to claim 1, characterized in that: include: The account information obtained based on the account transaction information includes: real-name authentication information of each account and transaction risk information; The transaction behavior characteristics obtained based on the account transaction information include: the total number of transactions of each account, the average transaction amount, and the proportion of transactions during non-working hours.

9. A financial transaction detection device based on a capital network diagram, characterized in that: include: A clustering unit, used to extract feature data of account transaction information, perform clustering processing on the feature data using a clustering algorithm, and determine a transaction record corresponding to an outlier point obtained by clustering as a first abnormal transaction record; a screening unit, configured to obtain an abnormal transaction verification set, compare the abnormal transaction verification set with the first abnormal transaction record, and screen out a second abnormal transaction record from the first abnormal transaction record based on the comparison result, wherein the abnormal transaction verification set at least includes: data of abnormal fund transfer behaviors that have occurred in a historical time period; A construction unit is configured to construct a transaction pair and a capital network graph corresponding to each transaction pair based on the account transaction information, and extract network features from the capital network graph, wherein the transaction pair includes: a transaction account number and a transaction record, the capital network graph includes: nodes indicated by multiple transaction accounts and connection edges corresponding to the transaction records, and the network features include: node features and subgraph features; The identification unit obtains the account information and transaction behavior characteristics of each account based on the account transaction information, inputs the account information, the transaction behavior characteristics, the second abnormal transaction record and the network characteristics into a pre-built abnormal account identification model, and obtains the abnormal transaction account number where the abnormal fund transfer behavior occurs.

10. An electronic device, characterized in that: It includes one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the financial transaction detection method based on the capital network diagram as described in any one of claims 1 to 7.

Images