Financial transaction detection method, device, and electronic equipment based on capital network graph

Abstract

This invention discloses a financial transaction detection method, device, and electronic device based on a fund network graph, relating to the fintech field or other related fields. The method includes: extracting feature data from account transaction information; clustering the feature data using a clustering algorithm to obtain a first abnormal transaction record; comparing the obtained abnormal transaction verification set with the first abnormal transaction record to obtain a second abnormal transaction record; constructing transaction pairs and a fund network graph based on the account transaction information; extracting network features from the fund network graph; obtaining account information and transaction behavior features; and inputting the account information, transaction behavior features, the second abnormal transaction record, and network features into an abnormal account identification model to obtain the abnormal transaction account that has engaged in abnormal fund transfer behavior. This invention solves the technical problem in related technologies where the abnormal account identification model has a single detection rule, making it difficult to accurately identify transaction accounts that have engaged in abnormal fund transfer behavior.

Description

Technical Field

[0001] This invention relates to the field of financial technology or other related fields, and more specifically, to a financial transaction detection method, apparatus, and electronic device based on a capital network diagram. Background Technology

[0002] With the rapid development of digital finance and the acceleration of global capital flows, abnormal fund transfer activities have become increasingly complex and difficult to detect. These activities transform funds obtained through illegitimate means into seemingly legitimate assets through a series of complex and covert financial operations, concealing their criminal origin and true ownership. Such criminal activities not only erode the health of the financial system but also pose a threat to economic security and social stability.

[0003] Existing abnormal fund transfer detection schemes have several limitations. For example, their detection rules are simplistic, making them vulnerable to manipulation by perpetrators who alter transaction patterns or exploit system blind spots. They also struggle to detect sophisticated abnormal fund transfer activities, including those spanning geographical and national borders. Furthermore, existing models for detecting abnormal fund transfers have poor generalization capabilities, failing to adapt to emerging and evolving methods. Their accuracy drops significantly, particularly when dealing with anonymous transactions and the use of advanced payment channels. Finally, existing models lack a global network perspective, hindering their ability to identify complex abnormal fund transfer transactions.

[0004] There is currently no effective solution to the above problems. Summary of the Invention

[0005] This invention provides a financial transaction detection method, device, and electronic device based on a fund network diagram, which at least solves the technical problem in related technologies that the abnormal account identification model has a single detection rule and is difficult to accurately identify transaction accounts that have engaged in abnormal fund transfer behavior.

[0006] To achieve the above objectives, according to one aspect of this application, a financial transaction detection method based on a fund network graph is provided, comprising: extracting feature data of account transaction information; performing clustering processing on the feature data using a clustering algorithm; identifying transaction records corresponding to outliers obtained from the clustering as first abnormal transaction records; obtaining an abnormal transaction verification set; comparing the abnormal transaction verification set with the first abnormal transaction records; and selecting second abnormal transaction records from the first abnormal transaction records based on the comparison results, wherein the abnormal transaction verification set includes at least: data on abnormal fund transfer behavior recorded in historical time periods; constructing transaction pairs and fund network graphs corresponding to each transaction pair based on account transaction information; extracting network features from the fund network graphs, wherein the transaction pairs include: transaction accounts and transaction records; the fund network graph includes: nodes indicated by multiple transaction accounts and connecting edges corresponding to transaction records; and the network features include: node features and subgraph features; obtaining account information and transaction behavior features of each account based on account transaction information; inputting the account information, transaction behavior features, second abnormal transaction records, and network features into a pre-constructed abnormal account identification model to obtain abnormal transaction accounts that have experienced abnormal fund transfer behavior.

[0007] Optionally, before extracting the feature data of account transaction data, the method further includes: obtaining account transaction information, which includes: account information, transaction records, payment channel usage records, and transaction geographical location information. The account information includes: transaction account number, and the transaction records include: transaction amount and transaction time; deleting erroneous records in the transaction information, which includes: transaction records with negative transaction amounts, account information with incorrect account format, and duplicate account transaction information; and standardizing the account transaction information, which includes: converting the numerical values ​​of account transaction information of the same type to the same size, and encoding non-numerical account transaction information.

[0008] Optionally, the step of extracting feature data from account transaction information includes: calculating the mean, median, and variance of transaction amounts for each account based on transaction records in the account transaction information, and obtaining transaction time density distribution information, the ratio of accounts transferring funds in and out, and the average transaction interval for each account; obtaining time-series fluctuation characteristics of transaction amount and number of transactions based on transaction records in the account transaction information, wherein the time-series fluctuation characteristics are used to reflect the changing trends of transaction amount and number of transactions over time; obtaining payment channel usage frequency and payment channel type distribution based on payment channel usage records in the account transaction information; and obtaining geographical distribution characteristics and account usage records for the same IP address and the same terminal based on transaction geographical location information in the account transaction information, wherein the geographical distribution characteristics include: cross-regional transfer frequency.

[0009] Optionally, the steps of constructing the funds network graph include: determining the trading accounts in the trading pair as nodes in the funds network graph, wherein the trading accounts include the accounts of the fund transferor and the fund transferee; determining the trading records in the trading pair as connecting edges in the funds network graph, wherein the trading records refer to the transaction flow of the fund transferor and the fund transferee, and the connecting edges are directed edges representing the direction of fund flow.

[0010] Optionally, the step of extracting node features from the fund network graph includes: for each node in the fund network graph, calculating the in-degree and out-degree of the node based on the number of fund inflows and outflows, where in-degree refers to the number of transactions in which the node has fund inflows and out-degree refers to the number of transactions in which the node has fund outflows; calculating the in-degree centrality and out-degree centrality of the node based on the number of transaction partner nodes when the node has fund inflows and outflows, where in-degree centrality is used to evaluate the proportion of other nodes transferring funds to the node when the node is a fund inflow party, and out-degree centrality is used to evaluate the proportion of other nodes transferring funds to the node when the node is a fund outflow party; obtaining the shortest fund flow path from the node to other nodes, obtaining transit nodes from the shortest fund flow path, obtaining transit nodes of all nodes, and calculating the betweenness centrality of each transit node, where betweenness centrality is used to evaluate the importance level of the transit node in the fund flow.

[0011] Optionally, the step of extracting subgraph features from the capital network graph includes: identifying specific subgraphs and frequent subgraphs in the capital network graph, wherein specific subgraphs include star-shaped subgraphs and chain-shaped subgraphs, and frequent subgraphs refer to subgraphs that appear frequently and have the same structure; extracting features from specific subgraphs and frequent subgraphs to obtain subgraph features, wherein subgraph features include: number of nodes and number of edges, node degree distribution features, transaction amount distribution features, and geographical distribution features; obtaining normal subgraphs in the capital network graph, and filtering the subgraph features of specific subgraphs and frequent subgraphs based on the subgraph features of normal subgraphs, wherein normal subgraphs refer to capital network graph subgraphs other than specific subgraphs and frequent subgraphs.

[0012] Optionally, the step of feature extraction for specific subgraphs and frequent subgraphs includes: for each specific subgraph and frequent subgraph, obtaining the number of nodes and edges of the subgraph; obtaining the in-degree and out-degree of each node in the subgraph, and determining the degree distribution feature of the subgraph based on preset in-degree and out-degree thresholds, wherein the degree distribution feature is used to reflect the number of nodes with an in-degree higher than the in-degree threshold and the number of nodes with an out-degree higher than the out-degree threshold; determining the transaction amount distribution feature of the subgraph based on transaction records in the subgraph, wherein the transaction amount distribution feature is used to characterize the total transaction amount of each node and the concentration of transaction amount; and determining the geographical distribution feature of each node in the subgraph based on the transaction geographical location information in the subgraph.

[0013] Optionally, the account information obtained based on account transaction information includes: real-name authentication information and transaction risk information for each account; the transaction behavior characteristics obtained based on account transaction information include: the total number of transactions, average transaction amount, and proportion of transactions during non-working hours for each account.

[0014] According to another aspect of the present invention, a financial transaction detection device based on a fund network graph is also provided, comprising: a clustering unit for extracting feature data of account transaction information, performing clustering processing on the feature data using a clustering algorithm, and determining the transaction records corresponding to outliers obtained by clustering as first abnormal transaction records; a filtering unit for obtaining an abnormal transaction verification set, comparing the abnormal transaction verification set with the first abnormal transaction records, and filtering out second abnormal transaction records from the first abnormal transaction records based on the comparison results, wherein the abnormal transaction verification set includes at least: data of abnormal fund transfer behavior recorded in historical time periods; a construction unit for constructing transaction pairs and fund network graphs corresponding to each transaction pair based on account transaction information, and extracting network features from the fund network graph, wherein the transaction pair includes: transaction account and transaction record, the fund network graph includes: nodes indicated by multiple transaction accounts and connecting edges corresponding to transaction records, and the network features include: node features and subgraph features; and an identification unit for obtaining account information and transaction behavior features of each account based on account transaction information, inputting the account information, transaction behavior features, second abnormal transaction records, and network features into a pre-constructed abnormal account identification model to obtain abnormal transaction accounts that have experienced abnormal fund transfer behavior.

[0015] Optionally, the clustering unit includes: a first acquisition module for acquiring account transaction information, wherein the account transaction information includes: account information, transaction records, payment channel usage records, and transaction geographical location information; the account information includes: transaction account number; and the transaction records include: transaction amount and transaction time; a deletion module for deleting erroneous records in the transaction information, wherein erroneous records include: transaction records with negative transaction amounts, account information with incorrect account format, and duplicate account transaction information; and a standardization module for standardizing the account transaction information, wherein the standardization process includes: converting the values ​​of account transaction information of the same numerical type to the same size, and encoding non-numerical account transaction information.

[0016] Optionally, the clustering unit further includes: a second acquisition module, which calculates the mean, median, and variance of transaction amounts for each account based on transaction records in the account transaction information, and acquires transaction time density distribution information, the proportion of accounts transferring funds in and out, and the average transaction interval time for each account; a third acquisition module, which acquires the time-series fluctuation characteristics of transaction amount and number of transactions based on transaction records in the account transaction information, wherein the time-series fluctuation characteristics are used to reflect the changing trend of transaction amount and number of transactions over time; a fourth acquisition module, which acquires the frequency of payment channel usage and the distribution of payment channel types based on payment channel usage records in the account transaction information; and a fifth acquisition module, which acquires geographical distribution characteristics and account usage records for the same IP address and the same terminal based on transaction geographical location information in the account transaction information, wherein the geographical distribution characteristics include: cross-regional transfer frequency.

[0017] Optionally, the construction unit includes: a first determining module, used to determine the trading accounts in the trading pair as nodes in the capital network graph, wherein the trading accounts include: the accounts of the fund transferor and the fund transferee; and a second determining module, used to determine the trading records in the trading pair as connecting edges in the capital network graph, wherein the trading records refer to the transaction flow of the fund transferor and the fund transferee, and the connecting edges are directed edges representing the direction of fund flow.

[0018] Optionally, the construction unit further includes: for each node in the fund network graph, a first calculation module calculates the in-degree and out-degree of the node based on the number of fund inflows and outflows, where in-degree refers to the number of transactions in which the node has fund inflows and out-degree refers to the number of transactions in which the node has fund outflows; a second calculation module calculates the in-degree centrality and out-degree centrality of the node based on the number of transaction partner nodes when the node has fund inflows and outflows, where in-degree centrality is used to evaluate the proportion of other nodes transferring funds to the node when the node is a fund inflow party, and out-degree centrality is used to evaluate the proportion of other nodes transferring funds to the node when the node is a fund outflow party; a sixth acquisition module is used to acquire the shortest fund flow path from the node to other nodes, acquire transit nodes from the shortest fund flow path, acquire transit nodes of all nodes, and calculate the betweenness centrality of each transit node, where betweenness centrality is used to evaluate the importance level of the transit node in the fund flow.

[0019] Optionally, the construction unit further includes: an identification module for identifying specific subgraphs and frequent subgraphs in the capital network graph, wherein specific subgraphs include star-shaped subgraphs and chain-shaped subgraphs, and frequent subgraphs refer to subgraphs that appear frequently and have the same structure; an extraction module for extracting features from specific subgraphs and frequent subgraphs to obtain subgraph features, wherein subgraph features include: number of nodes and number of edges, node degree distribution features, transaction amount distribution features, and geographical distribution features; and a filtering module for obtaining normal subgraphs in the capital network graph and filtering the subgraph features of specific subgraphs and frequent subgraphs based on the subgraph features of normal subgraphs, wherein normal subgraphs refer to capital network graph subgraphs other than specific subgraphs and frequent subgraphs.

[0020] Optionally, the extraction module includes: for each specific subgraph and frequent subgraph, a first acquisition submodule for acquiring the number of nodes and edges of the subgraph; a second acquisition submodule for acquiring the in-degree and out-degree of each node in the subgraph, and determining the degree distribution characteristics of the subgraph based on preset in-degree and out-degree thresholds, wherein the degree distribution characteristics are used to reflect the number of nodes with an in-degree higher than the in-degree threshold and the number of nodes with an out-degree higher than the out-degree threshold; a first determination submodule for determining the transaction amount distribution characteristics of the subgraph based on transaction records in the subgraph, wherein the transaction amount distribution characteristics are used to characterize the total transaction amount of each node and the concentration of transaction amount; and a second determination submodule for determining the geographical distribution characteristics of each node in the subgraph based on transaction geographical location information in the subgraph.

[0021] Optionally, the account information obtained from the account transaction information in the identification unit includes: real-name authentication information and transaction risk information for each account; the transaction behavior characteristics obtained from the account transaction information include: the total number of transactions, average transaction amount, and proportion of transactions during non-working hours for each account.

[0022] According to another aspect of the present invention, a computer-readable storage medium is also provided, the computer-readable storage medium including a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to execute the financial transaction detection method based on the capital network diagram described above.

[0023] According to another aspect of the present invention, an electronic device is also provided, including one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the financial transaction detection method based on the capital network diagram described above.

[0024] According to another aspect of the present invention, a computer program product is also provided, including a computer program that, when executed by a processor, implements the steps of the financial transaction detection method based on a capital network diagram as described above.

[0025] In this disclosure, feature data of account transaction information is extracted, and clustering algorithm is used to cluster the feature data. The transaction records corresponding to the outliers obtained by clustering are identified as the first abnormal transaction records. Then, an abnormal transaction verification set is obtained and compared with the first abnormal transaction records. Based on the comparison results, the second abnormal transaction records are selected from the first abnormal transaction records. At the same time, a transaction pair and a fund network diagram corresponding to each transaction pair are constructed based on the account transaction information. Network features are extracted from the fund network diagram. Then, the account information and transaction behavior features of each account are obtained based on the account transaction information. The account information, transaction behavior features, second abnormal transaction records, and network features are input into a pre-constructed abnormal account identification model to obtain the abnormal transaction accounts that have experienced abnormal fund transfer behavior.

[0026] Based on the aforementioned disclosure, by constructing a fund network diagram and extracting its network features, and inputting these features into the abnormal account identification model, the global network perspective of the abnormal account identification model is enhanced. By employing clustering algorithms and comparing with historical data, highly suspicious abnormal transaction records are filtered out. The filtered abnormal transaction records, along with account information, transaction behavior characteristics, and network features, are input into the abnormal account identification model. This multi-type feature data improves the accuracy and efficiency of the abnormal account identification model in identifying abnormal transaction accounts that have engaged in abnormal fund transfers. By combining fund network diagram analysis with abnormal account identification model recognition, this disclosure improves the detection capability of abnormal fund transfers, thereby solving the technical problem in related technologies where the detection rules of abnormal account identification models are singular and it is difficult to accurately identify transaction accounts that have engaged in abnormal fund transfers. Attached Figure Description

[0027] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0028] Figure 1 A hardware structure block diagram of a computer terminal (or mobile device) for implementing a financial transaction detection method based on a capital network graph is shown.

[0029] Figure 2 This is a flowchart of an optional financial transaction detection method based on a capital network diagram according to an embodiment of the present invention;

[0030] Figure 3This is a schematic diagram of an optional funding network diagram according to an embodiment of the present invention;

[0031] Figure 4 This is a schematic diagram of an optional financial transaction detection device based on a capital network diagram according to an embodiment of the present invention;

[0032] Figure 5 This is a structural block diagram of an electronic device according to an embodiment of this application. Detailed Implementation

[0033] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0034] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0035] It should be noted that the financial transaction detection method and apparatus based on fund network diagrams in this disclosure can be used in the fintech field to detect financial transactions based on fund network diagrams and identify abnormal transaction accounts with abnormal fund transfer behavior. It can also be used in any field other than the fintech field to detect financial transactions based on fund network diagrams and identify abnormal transaction accounts with abnormal fund transfer behavior. This disclosure does not limit the application field of the financial transaction detection method and apparatus based on fund network diagrams.

[0036] It should be noted that the information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, and displayed data) collected in this public disclosure are information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of related data all comply with the relevant laws, regulations, and standards of the relevant regions, necessary confidentiality measures have been taken, and they do not violate public order and good morals. Corresponding operation entry points are provided for users to choose to authorize or refuse. For example, this system has interfaces with relevant users or organizations. Before obtaining relevant information, a request to obtain the information needs to be sent to the aforementioned user or organization through the interface, and the relevant information is obtained only after receiving consent from the aforementioned user or organization.

[0037] It should be noted that in this disclosure, customer information is collected and analyzed, and users are provided with corresponding operation entry points to choose whether to agree to or reject the automated decision results; if the user chooses to reject, the process will proceed to the expert decision-making process.

[0038] The following embodiments of the present invention can be applied to various systems / applications / devices for financial transaction detection based on fund network diagrams. The present invention constructs a fund network diagram and extracts its network features, then inputs these features into an abnormal account identification model, enhancing the model's global network perspective. By employing clustering algorithms and comparing with historical data, highly suspicious abnormal transaction records are selected. These selected abnormal transaction records, along with account information, transaction behavior characteristics, and network features, are input into the abnormal account identification model. This multi-type feature data improves the accuracy and efficiency of the model in identifying abnormal transaction accounts exhibiting abnormal fund transfer behavior. By combining fund network diagram analysis with abnormal account identification model recognition, the present invention enhances the detection capability for abnormal fund transfer behavior.

[0039] The present invention will now be described in detail with reference to various embodiments.

[0040] Example 1

[0041] According to an embodiment of the present invention, an embodiment of a financial transaction detection method based on a capital network diagram is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0042] The financial transaction detection method based on a capital network graph provided in Embodiment 1 of this application can be executed on a mobile terminal, computer terminal, or similar computing device. Figure 1A hardware block diagram of a computer terminal (or mobile device) for implementing a financial transaction detection method based on a capital network graph is shown. Figure 1 As shown, computer terminal 10 (or mobile device) may include one or more ( Figure 1 The processor 102 (which may include, but is not limited to, a microprocessor MCU (Microcontroller Unit) or a programmable logic device FPGA (Field Programmable Gate Array)) is illustrated using 102a, 102b, ..., 102n. It also includes a memory 104 for storing data and a transmission device 106 for communication functions. In addition, it may include: a display, an input / output interface (I / O interface), a Universal Serial Bus (USB) port (which may be included as one of the ports of a BUS bus), a network interface, a power supply, and / or a camera. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0043] It should be noted that the aforementioned one or more processors 102 and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the computer terminal 10 (or mobile device). As involved in the embodiments of this application, the data processing circuits serve as a processor control mechanism (e.g., selection of a variable resistor termination path connected to an interface).

[0044] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the financial transaction detection method based on the capital network diagram in this embodiment of the application. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby realizing the aforementioned financial transaction detection method based on the capital network diagram. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0045] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 10. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0046] The display can be, for example, a touchscreen liquid crystal display (LCD), which allows the user to interact with the user interface of the computer terminal 10 (or mobile device).

[0047] Under the aforementioned operating environment, this application provides the following: Figure 2 The financial transaction detection method based on the capital network diagram is shown. Figure 2 This is a flowchart of an optional financial transaction detection method based on a capital network diagram according to an embodiment of the present invention, such as... Figure 2 As shown, the method includes the following steps:

[0048] Step S201: Extract feature data of account transaction information, use clustering algorithm to cluster the feature data, and determine the transaction records corresponding to the outliers obtained by clustering as the first abnormal transaction records.

[0049] In this embodiment of the invention, abnormal fund transfer refers to the act of concealing or obfuscating funds obtained through abnormal means through various channels and methods to make the source and nature of the funds appear legitimate, or to circumvent financial supervision and hide the true source of funds through a series of complex financial operations, so as to be able to freely use these funds and carry out abnormal fund transfer activities that are not traceable.

[0050] Among the vast amounts of financial transaction information, most normal transactions exhibit commonalities and patterns. For example, they often share similar transaction amount ranges, stable transaction frequencies, common transaction time periods, and regular geographical distributions. However, because abnormal fund transfers attempt to evade financial institution oversight and avoid conventional transaction patterns, their information differs significantly from legitimate, normal transactions. For instance, abnormal fund transfers are characterized by concentrated transactions outside of business hours, large and frequent inflows and outflows, complex and variable sources and flows of funds, and unusually wide or highly concentrated geographical distributions. In short, abnormal fund transfers exhibit characteristics that clearly deviate from normal transaction information.

[0051] Based on the distinguishing features between normal and abnormal fund transfer information, a clustering algorithm is used to analyze the feature data of a large amount of historical transaction information. Normal transaction information, after clustering, forms dense clusters. These dense clusters represent normal transaction characteristics, i.e., characteristics not involving abnormal fund transfers. If the feature data of transaction information fluctuates within a reasonable range and can be categorized into a cluster, the transaction information is considered normal. In other words, the feature data of normal transaction information are similar to each other and can form tight clusters. However, the features of abnormal fund transfer information do not form dense clusters with those of normal transaction information. Instead, they deviate significantly from these clusters, appearing as outliers. These outliers may differ significantly from the feature data of normal transaction information in terms of single transaction amount, transaction frequency, transaction object, geographical distribution, or time distribution. These outliers are considered characteristic data of abnormal fund transfer transactions.

[0052] This invention employs a clustering algorithm to identify and locate outliers, thereby obtaining the transaction records corresponding to these outliers. These transaction records are defined as suspicious abnormal fund transfer transaction records. Further screening is then conducted to obtain abnormal fund transfer transaction records with higher suspicion levels, thus providing a data foundation for the abnormal account identification model to identify abnormal transaction accounts that have engaged in abnormal fund transfer behavior.

[0053] To obtain suspicious and abnormal fund transfer transaction records, this embodiment of the invention first extracts feature data from account transaction information. Account transaction information is stored in the internal system of financial institutions. This embodiment of the invention can obtain all account transaction information for the current day or month, extract feature data from this account transaction information, and then use a clustering algorithm to cluster these feature data.

[0054] Clustering algorithms that can be used include DBSCAN (Density-Based Spatial Clustering of Applications with Noise), a density-based clustering algorithm. DBSCAN does not require specifying the number of clusters; it automatically determines the number of clusters in the feature dataset, divides the data into clusters by detecting the surrounding density of feature data points, and automatically treats isolated or sparsely dense feature data points as outliers.

[0055] It should be noted that after the DBSCAN clustering algorithm clusters the feature data, an outlier detection algorithm can be used to identify and locate outliers, thereby improving the accuracy and robustness of outlier identification. Specifically, the outlier detection algorithm can employ the One-Class SVM (One-Class Support Vector Machine) algorithm, which accurately identifies outliers far from the clustered data. After identifying outliers, the transaction records corresponding to them are considered suspicious abnormal fund transfer transaction records. In this embodiment of the invention, the transaction records corresponding to outliers are defined as the first abnormal transaction records. These first abnormal transaction records will undergo further screening to obtain abnormal fund transfer transaction records with higher suspicion levels, providing a data foundation for the abnormal account identification model to identify abnormal transaction accounts exhibiting abnormal fund transfer behavior.

[0056] Step S202: Obtain the abnormal transaction verification set, compare the abnormal transaction verification set with the first abnormal transaction record, and select the second abnormal transaction record from the first abnormal transaction record based on the comparison result. The abnormal transaction verification set includes at least the data of abnormal fund transfer behavior recorded in the historical time period.

[0057] After initially identifying the first abnormal transaction record using a clustering algorithm, in order to further improve the accuracy and credibility of suspicious abnormal transaction records, this embodiment of the invention performs in-depth comparison and analysis between the first abnormal transaction record and the abnormal transaction verification set. The abnormal transaction verification set includes at least data on abnormal fund transfer behaviors recorded in historical time periods. By comparing and analyzing the first abnormal transaction record with the data on abnormal fund transfer behaviors recorded in the abnormal transaction verification set, abnormal transaction records with higher suspicion are screened out.

[0058] First, this embodiment of the invention acquires data on abnormal fund transfers from various channels, including known abnormal transaction records within financial institutions and abnormal transaction records on lists published by regulatory agencies, and aggregates these abnormal transaction records into an abnormal transaction verification set. Before comparing the abnormal transaction verification set with the first abnormal transaction record, the abnormal transaction records in the abnormal transaction verification set are preprocessed to ensure comparability between the two. The preprocessing process includes data cleaning, format standardization, outlier handling, and standardization.

[0059] This invention compares the abnormal transaction verification set with the first abnormal transaction record from multiple dimensions, including: comparing the similarity of the abnormal transaction records in the abnormal transaction verification set with the first abnormal transaction record in terms of features such as amount distribution, transaction frequency, transaction time, and geographical location distribution. Based on the similarity of multiple features between the abnormal transaction records in the abnormal transaction verification set and the first abnormal transaction record, the similarity between each first abnormal transaction record and the abnormal transaction records in the abnormal transaction verification set can be evaluated. Then, the first abnormal transaction record with high similarity is identified as the second abnormal transaction record, that is, the abnormal transaction record with higher suspicion is screened out, thereby providing data with higher credibility and accuracy for the subsequent abnormal account identification model.

[0060] It should be noted that when filtering for second abnormal transaction records from the first abnormal transaction records, an appropriate similarity threshold can be set. This threshold can be set by an experienced team or derived through artificial intelligence training. The similarity threshold determines which first abnormal transaction records will be filtered out as second abnormal transaction records. If the similarity threshold is set too high, the false negative rate will be too high; if it is set too low, the false positive rate will be high. Therefore, it is necessary to combine team experience or artificial intelligence to find a balance between the false positive and false negative rates, and then set an appropriate similarity threshold to filter for second abnormal transaction records from the first abnormal transaction records.

[0061] Step S203: Construct trading pairs and corresponding fund network graphs based on account transaction information, and extract network features from the fund network graph. The trading pairs include: trading accounts and trading records. The fund network graph includes: nodes indicated by multiple trading accounts and connecting edges corresponding to trading records. The network features include: node features and subgraph features.

[0062] In this embodiment of the invention, in addition to using clustering algorithms to identify suspicious abnormal fund transfer transaction records, a fund network diagram is also constructed, network features are extracted from the fund network diagram, and the identified abnormal fund transfer transaction records and network features are input into the abnormal account identification model to identify abnormal transaction accounts that have engaged in abnormal fund transfer behavior.

[0063] A funds network graph is a graph theory model used to describe and analyze the relationships between fund flows. Before constructing the funds network graph, trading pairs are first built based on account transaction information. A trading pair includes trading accounts and trading records; that is, the accounts of the fund transferor and fund transferor are obtained from the account transaction information, along with details of each trading record, including transaction amount and time. Then, based on each trading pair, a funds network graph is constructed. The nodes in the funds network graph represent trading accounts, and the connecting edges represent trading records. Figure 3 This is a schematic diagram of an optional funding network diagram according to an embodiment of the present invention, such as... Figure 3 As shown, A, B, C, and D represent four trading accounts. Figure 3 The transaction involves five pairs of transactions: A transfers 5000 yuan to B, A transfers 200 yuan to C, B transfers 1000 yuan to C, C transfers 2000 yuan to D, and D transfers 500 yuan to A. The directed arrows represent connecting edges and transaction records; for example, A→B represents the transaction record of A transferring money to B. The numerical values ​​next to the connecting edges represent the transfer amounts. It should be noted that... Figure 3 The connecting edges in the diagram represent transaction records, and only the transaction amount is displayed. Other information in the transaction records, including the transaction time, can be stored in the properties of the connecting edges.

[0064] After constructing the funding network graph, network features are extracted from it. These features include node features and subgraph features. Node features include in-degree and out-degree, in-degree centrality, out-degree centrality, and betweenness centrality. Specifically, node in-degree refers to the number of transactions in which a node receives funds, node out-degree refers to the number of transactions in which a node receives funds, in-degree centrality assesses the proportion of funds transferred from other nodes to that node when it is a fund recipient, out-degree centrality assesses the proportion of funds transferred from that node to other nodes when it is a fund sender, and betweenness centrality assesses the importance of intermediary nodes in the fund flow.

[0065] Meanwhile, the network characteristics of a funding network graph also include subgraph features. In a funding network graph, a subgraph refers to a small graph formed by a subset of nodes and their interconnections extracted from the entire network. By analyzing the subgraph structure, micro-level anomalies hidden from the macro-network perspective can be identified. In large-scale funding network graphs, abnormal fund transfer transactions typically involve specific interaction patterns involving a few nodes and a few connecting edges. These patterns exhibit unique or frequently occurring structural features in local areas of the funding network graph. Therefore, by identifying subgraphs with specific structures and frequently occurring subgraphs, these abnormal fund transfer transactions can be captured.

[0066] This invention employs a pre-built subgraph discovery algorithm to identify specific and frequent subgraphs in a capital network graph. Specific subgraphs include star-shaped and chain-shaped subgraphs, while frequent subgraphs refer to subgraphs that appear frequently and have the same structure. After identifying specific and frequent subgraphs, this invention extracts features from these subgraphs to obtain subgraph features. These features include the number of nodes and edges, node degree distribution, transaction amount distribution, and geographical distribution. Then, based on the subgraph features of normal subgraphs (excluding specific and frequent subgraphs), the extracted specific and frequent subgraph features are filtered and incorporated into the network features of the capital network graph. Finally, the network features, including node and subgraph features, are input into an abnormal account identification model to identify abnormal transaction accounts exhibiting abnormal fund transfer behavior.

[0067] Step S204: Based on the account transaction information, obtain the account information and transaction behavior characteristics of each account, and input the account information, transaction behavior characteristics, second abnormal transaction records and network characteristics into the pre-built abnormal account identification model to obtain the abnormal transaction accounts that have experienced abnormal fund transfer behavior.

[0068] After obtaining the second abnormal transaction record and network characteristics, the system retrieves account information and transaction behavior characteristics for each account based on the account transaction information. The account information includes each account's real-name authentication information and transaction risk information. The transaction behavior characteristics include each account's total number of transactions, average transaction amount, and proportion of transactions during non-working hours. It should be noted that the account information includes KYC information, or "Know Your Customer" information. KYC information is a series of relevant customer background information collected and maintained by financial institutions when establishing business relationships with customers. It aims to help financial institutions identify and verify customer identities, understand customers' true business needs, and assess and monitor the risk of abnormal fund transfers.

[0069] Transaction behavior characteristics include the total number of transactions, average transaction amount, and the proportion of transactions outside of working hours for each account. The total number of transactions is a direct indicator of an account's trading activity, reflecting the frequency of transactions within a certain time period. A high number of transactions may indicate frequent fund transfers. The average transaction amount is an important indicator for assessing the scale of an account's transactions, revealing the typical amount of funds involved. The average transaction amount of accounts with abnormal fund transfers may differ significantly from that of normal accounts. For example, accounts with abnormal fund transfers may frequently engage in large transactions or use small, high-frequency transactions to conceal abnormal fund flows. The proportion of transactions outside of working hours is an indicator for assessing an account's trading time pattern, reflecting the proportion of transactions conducted outside of normal working hours and dates (such as nighttime, weekends, or holidays). Abnormal fund transfer activities often involve large or unusual transactions outside of working hours to evade regulation. Therefore, accounts with a high proportion of transactions outside of working hours are at risk of abnormal fund transfers.

[0070] The acquired account information, transaction behavior characteristics, second abnormal transaction records, and network features are input into a pre-built abnormal account identification model to identify potentially abnormal transaction accounts that may be involved in abnormal fund transfers. In this embodiment of the invention, the abnormal account identification model employs the LightGBM model (Light Gradient Boosting Machine model). The LightGBM model is a deep learning model based on gradient boosting decision trees, which can achieve an efficient and highly accurate identification process.

[0071] This invention employs historical account information, transaction behavior characteristics, second abnormal transaction records, network features, and known transaction account labels to train and optimize the LightGBM model. By continuously training and optimizing the model's hyperparameters, including learning rate and tree depth, the LightGBM model is ensured to accurately identify abnormal transaction accounts that have engaged in abnormal fund transfers. After the LightGBM model is trained, the mature LightGBM model is used in real-world scenarios.

[0072] After inputting the acquired account information, transaction behavior characteristics, second abnormal transaction records, and network features into the LightGBM model, the model outputs a binary classification result for the transaction account. For example, it outputs an abnormal transaction account with a label of 1 and a normal transaction account with a label of 0. The abnormal transaction account is the abnormal transaction account that has engaged in abnormal fund transfer behavior.

[0073] It should be noted that, in this embodiment of the invention, the abnormal account identification model is deployed into the monitoring system of financial institutions to continuously detect new transaction records, ensuring timely identification of abnormal transaction accounts exhibiting abnormal fund transfer behavior. As new data increases, the abnormal account identification model is periodically retrained, its parameters are continuously updated, and the model is optimized to address the ever-changing methods of abnormal fund transfer.

[0074] Optionally, before extracting the feature data of account transaction data, the method further includes: obtaining account transaction information, which includes: account information, transaction records, payment channel usage records, and transaction geographical location information. The account information includes: transaction account number, and the transaction records include: transaction amount and transaction time; deleting erroneous records in the transaction information, which includes: transaction records with negative transaction amounts, account information with incorrect account format, and duplicate account transaction information; and standardizing the account transaction information, which includes: converting the numerical values ​​of account transaction information of the same type to the same size, and encoding non-numerical account transaction information.

[0075] In step S201, before extracting the feature data of account transaction data, it is first necessary to obtain comprehensive account transaction information. Account transaction information covers both static account attributes and dynamic transaction characteristics, specifically including account information, transaction records, payment channel usage records, and transaction geographic location information. Specifically, account information includes detailed account information for each transaction, including KYC information, transaction account number, account type, and account status; transaction records include detailed information for each transaction, including transaction amount, transaction time, and transaction type; payment channel usage records include payment information for each transaction, including payment method and communication data; and transaction geographic location information includes the location information at the time of each transaction, including the transaction location, IP address, and terminal number.

[0076] After obtaining comprehensive account transaction information, obviously erroneous data records are deleted, such as transaction records with negative amounts or account information with incorrect account formats. Duplicate account transaction information is also deleted. Furthermore, outliers in the account transaction information are processed. For example, for transaction records with transaction amounts significantly exceeding a reasonable range, the transaction amount of this record can be replaced with the median transaction amount of the account, thereby reducing the impact of outliers on the abnormal account identification model.

[0077] Next, the account transaction information is standardized by converting numerical data of the same type to the same size, for example, by normalizing transaction frequency. Simultaneously, non-numerical account transaction information is encoded, for example, by converting categorized account types into numerical values, so that the abnormal account identification model can process the data.

[0078] Optionally, the step of extracting feature data from account transaction information includes: calculating the mean, median, and variance of transaction amounts for each account based on transaction records in the account transaction information, and obtaining transaction time density distribution information, the ratio of accounts transferring funds in and out, and the average transaction interval for each account; obtaining time-series fluctuation characteristics of transaction amount and number of transactions based on transaction records in the account transaction information, wherein the time-series fluctuation characteristics are used to reflect the changing trends of transaction amount and number of transactions over time; obtaining payment channel usage frequency and payment channel type distribution based on payment channel usage records in the account transaction information; and obtaining geographical distribution characteristics and account usage records for the same IP address and the same terminal based on transaction geographical location information in the account transaction information, wherein the geographical distribution characteristics include: cross-regional transfer frequency.

[0079] In step S201, the extraction of feature data from account transaction information specifically includes:

[0080] Based on transaction records in account transaction information, the mean, median, and variance of transaction amounts for each account are calculated. Transaction time density distribution information, the ratio of accounts receiving and transferring funds in and out, and the average transaction interval for each account are also obtained. For each account, the mean, median, and variance of its transaction amount are calculated. These statistics reflect the basic distribution and fluctuations of the account's transaction amount, helping to identify accounts whose transaction amounts significantly deviate from normal levels. Simultaneously, transaction time is analyzed to obtain the transaction time density distribution, i.e., the distribution of transactions at different times of the day. Special attention is paid to transaction behavior during non-working hours, holidays, or specific periods (such as the last few days of each month). Abnormal fund transfer activities attempt to avoid regular regulatory periods; therefore, abnormal fund transfer transaction records will exhibit abnormal transaction time patterns. Furthermore, the ratio of accounts receiving and transferring funds in and out for each account is calculated. Frequent transfers to a large number of unrelated accounts or receiving transfers from a large number of accounts both pose a risk of abnormal fund transfers. Secondly, the average transaction interval for each account is statistically analyzed to identify accounts with abnormal transaction frequencies. For example, accounts with frequent transactions and abnormal fund transfers may exhibit extremely short average transaction intervals.

[0081] Based on the transaction records in the account transaction information, the temporal fluctuation characteristics of transaction amount and number of transactions are obtained. By analyzing the fluctuation characteristics of transaction amount and number of transactions over time, including daily fluctuations, weekly fluctuations, and monthly fluctuations, transaction records related to abnormal fund transfer activities can be identified. For example, abnormal fluctuations in transaction amount or number of transactions (such as sudden increases or decreases) may be related to abnormal fund transfer activities and require close attention.

[0082] Then, based on the payment channel usage records in the account transaction information, the frequency of payment channel usage and the distribution of payment channel types are obtained. By statistically analyzing the frequency of each account's use of different payment channels and its preference for different payment channel types, such as some accounts preferring to use less regulated payment channels for transactions, accounts attempting to evade regulation are identified.

[0083] Finally, based on the geographical location information of account transactions, we obtain geographical distribution characteristics and account usage records for the same IP address and the same terminal. By collecting geographical location information of transactions, including the transaction location, IP address, and transaction terminal number, we analyze the frequency and distribution of cross-regional transfers to identify accounts that frequently conduct cross-regional transactions, especially those involving high-risk areas. The number of accounts using the same IP address or the same transaction terminal may indicate that multiple accounts are operating from the same location, posing a risk of abnormal fund transfers.

[0084] Optionally, the steps of constructing the funds network graph include: determining the trading accounts in the trading pair as nodes in the funds network graph, wherein the trading accounts include the accounts of the fund transferor and the fund transferee; determining the trading records in the trading pair as connecting edges in the funds network graph, wherein the trading records refer to the transaction flow of the fund transferor and the fund transferee, and the connecting edges are directed edges representing the direction of fund flow.

[0085] In step S203, when constructing the capital network graph, the trading accounts in the trading pair are determined as nodes of the capital network graph, and the trading records in the trading pair are determined as connecting edges of the capital network graph. For example... Figure 3 As shown, A, B, C, and D represent four trading accounts. The arrows from A to B, B to C, C to D, D to A, and A to C are all connecting edges. These edges represent the transaction records between the fund transferor and the fund transferee, i.e., the transaction flow between them. They are directed edges representing the direction of fund flow. For example, A→B represents the transaction flow of funds from A to B. The numerical value next to the connecting edge represents the transfer amount. The value of the A→B connecting edge is 5000. If there are multiple transactions between two nodes, the transaction amounts can be summed, or the average or maximum value can be calculated as attributes of the connecting edge.

[0086] It should be noted that complex funding network diagrams may have hundreds, thousands, or even millions of nodes and connecting edges. In such cases, visualization tools can be used to lay out the funding network diagram for better analysis.

[0087] Optionally, the step of extracting node features from the fund network graph includes: for each node in the fund network graph, calculating the in-degree and out-degree of the node based on the number of fund inflows and outflows, where in-degree refers to the number of transactions in which the node has fund inflows and out-degree refers to the number of transactions in which the node has fund outflows; calculating the in-degree centrality and out-degree centrality of the node based on the number of transaction partner nodes when the node has fund inflows and outflows, where in-degree centrality is used to evaluate the proportion of other nodes transferring funds to the node when the node is a fund inflow party, and out-degree centrality is used to evaluate the proportion of other nodes transferring funds to the node when the node is a fund outflow party; obtaining the shortest fund flow path from the node to other nodes, obtaining transit nodes from the shortest fund flow path, obtaining transit nodes of all nodes, and calculating the betweenness centrality of each transit node, where betweenness centrality is used to evaluate the importance level of the transit node in the fund flow.

[0088] In step S203, extracting node features from the funding network diagram specifically includes:

[0089] For each node (i.e., a trading account) in the fund network graph, calculate the in-degree and out-degree of that node based on the number of fund inflows and outflows. In-degree refers to the number of transactions in which a node has fund inflows, and out-degree refers to the number of transactions in which a node has fund outflows. For example... Figure 3 In the scenario, node A transfers funds to nodes B and C, meaning node A has two outward connections, thus its out-degree is 2. Simultaneously, only node D transfers funds to node A, meaning node A has one inward connection, thus its in-degree is 1. Calculating in-degree and out-degree reveals account activity and transaction direction, crucial for identifying abnormal transaction behavior. For example, an account with an extremely high in-degree and relatively low out-degree indicates a suspicious account involved in abnormal fund transfers, while an account with an extremely high out-degree and low in-degree suggests it may be the source account for such abnormal fund transfers.

[0090] For each node in the funding network graph, the in-degree centrality and out-degree centrality of the node are further calculated based on the number of transaction partners when funds are transferred in and out. In-degree centrality assesses the proportion of funds transferred from other nodes to the node when it is a fund inflow, while out-degree centrality assesses the proportion of funds transferred from the node to other nodes when it is a fund outflow. The formulas for calculating in-degree centrality and out-degree centrality are typically the number of edges directly connected to the node divided by the total number of edges in the funding network graph. Figure 3 As shown, the funding network diagram has 5 connecting edges. For node A, there are 2 outward connecting edges with an out-degree centrality of 2 / 5 = 40%, and node A has 1 inward connecting edge with an in-degree centrality of 1 / 5 = 20%.

[0091] For each node in the fund flow graph, obtain the shortest fund flow path from that node to other nodes. In complex fund flow graphs, the shortest fund flow path between two nodes reveals the most direct and frequent flow of funds from one account to another. The transit nodes identified from the shortest fund flow path, i.e., the "bridge" accounts through which funds pass, are key points in fund flow analysis. Calculate the betweenness centrality of each transit node. Betweenness centrality indicates the importance of a node in acting as a "bridge" connecting other nodes in the fund flow, revealing accounts that frequently appear in fund flows and play a pivotal role; these accounts are at risk of abnormal fund transfers.

[0092] It should be noted that when extracting node features from a funding network graph, PageRank features and clustering coefficients can also be extracted. PageRank is a metric used to measure the importance of nodes in a network, while the clustering coefficient is a metric used to measure the tightness of connections between nodes in a network.

[0093] Optionally, the step of extracting subgraph features from the capital network graph includes: identifying specific subgraphs and frequent subgraphs in the capital network graph, wherein specific subgraphs include star-shaped subgraphs and chain-shaped subgraphs, and frequent subgraphs refer to subgraphs that appear frequently and have the same structure; extracting features from specific subgraphs and frequent subgraphs to obtain subgraph features, wherein subgraph features include: number of nodes and number of edges, node degree distribution features, transaction amount distribution features, and geographical distribution features; obtaining normal subgraphs in the capital network graph, and filtering the subgraph features of specific subgraphs and frequent subgraphs based on the subgraph features of normal subgraphs, wherein normal subgraphs refer to capital network graph subgraphs other than specific subgraphs and frequent subgraphs.

[0094] In step S203, when extracting subgraph features from the fund network graph, specific and frequent subgraphs within the fund network graph are first identified. Subgraphs with specific structures are searched within the fund network graph, including star-shaped and chain-shaped subgraphs. Star-shaped subgraphs typically refer to structures where one or a few central nodes transact with a large number of surrounding nodes, indicating that the central node may be a hub for abnormal fund transfer activities. Chain-shaped subgraphs are characterized by funds being continuously transferred along a series of nodes, such as a straight line transfer from A to B, B to C, and C to D. This pattern may be used to conceal the original source or final destination of funds and is a typical method of abnormal fund transfer. In addition to star-shaped and chain-shaped subgraphs, highly clustered closed-loop subgraphs can also be identified. Highly clustered closed-loop subgraphs refer to structures where funds frequently circulate between a few accounts, indicating "transactional" behavior among these accounts and a risk of abnormal fund transfers.

[0095] Subgraphs with the same or similar structures that frequently appear in the fund network diagram, as identified by algorithms, may represent common operating patterns of abnormal fund transfers or reflect certain regular characteristics of abnormal fund transfer behavior, and thus also carry the risk of abnormal fund transfers.

[0096] After identifying specific and frequent subgraphs, feature extraction is performed to obtain subgraph features. These features include the number of nodes and edges, node degree distribution, transaction amount distribution, and geographical distribution. Then, by acquiring normal subgraphs from the capital network graph (excluding specific and frequent subgraphs), the features of specific and frequent subgraphs are filtered based on these normal features. The transaction amount distribution and frequency of specific and frequent subgraphs are compared with common features of normal subgraphs. If the features of specific or frequent subgraphs significantly deviate from those of normal subgraphs—for example, if the average transaction amount is extremely high or transactions are concentrated outside normal business hours—it indicates an anomaly. It should be noted that when determining whether a subgraph feature significantly deviates from normal features, a relevant threshold can be pre-set to filter out anomalous subgraph features that significantly deviate from normal features. Finally, the subgraph features of the selected specific subgraphs and frequent subgraphs are used as network features of the funding network graph and input into the abnormal account identification model.

[0097] Optionally, the step of feature extraction for specific subgraphs and frequent subgraphs includes: for each specific subgraph and frequent subgraph, obtaining the number of nodes and edges of the subgraph; obtaining the in-degree and out-degree of each node in the subgraph, and determining the degree distribution feature of the subgraph based on preset in-degree and out-degree thresholds, wherein the degree distribution feature is used to reflect the number of nodes with an in-degree higher than the in-degree threshold and the number of nodes with an out-degree higher than the out-degree threshold; determining the transaction amount distribution feature of the subgraph based on transaction records in the subgraph, wherein the transaction amount distribution feature is used to characterize the total transaction amount of each node and the concentration of transaction amount; and determining the geographical distribution feature of each node in the subgraph based on the transaction geographical location information in the subgraph.

[0098] Feature extraction for specific and frequent subgraphs specifically includes:

[0099] For each specific subgraph and frequent subgraph, obtain the number of nodes and edges. The number of nodes reflects the range of accounts covered by the subgraph, while the number of edges shows the density of transactions between accounts. This data provides basic information about the size of the subgraph and reflects the scope of fund flows.

[0100] For each specific subgraph and frequent subgraph, the in-degree and out-degree of each node in the subgraph are obtained. Based on preset in-degree and out-degree thresholds, the degree distribution characteristics of the subgraph are determined. These degree distribution characteristics reflect the number of nodes with in-degrees higher than the in-degree threshold and the number of nodes with out-degrees higher than the out-degree threshold. Inputting these degree distribution characteristics into the abnormal account identification model helps the model identify abnormal accounts.

[0101] For each specific subgraph and frequent subgraph, the transaction amount distribution characteristics of that subgraph are determined based on the transaction records within that subgraph. These characteristics characterize the total transaction amount of each node and the concentration of transaction amounts. In this embodiment of the invention, based on the transaction records in specific and frequent subgraphs, the total transaction amount of each node is calculated, including all transaction amounts where the node acts as both a fund inflow and outflow party. Furthermore, the concentration of transaction amounts is analyzed, for example, by calculating the average, median, standard deviation, maximum, and minimum values. These statistics reveal the mean level, volatility, and extreme values ​​of fund flows.

[0102] For each specific subgraph and frequent subgraph, the geographical distribution characteristics of each node in the subgraph are determined based on the geographical location information of transactions within that subgraph. These geographical distribution characteristics can reveal regional patterns in capital flows, such as whether cross-regional or cross-border transactions exist, and whether transactions are concentrated in specific geographical areas.

[0103] The steps provided by the above-mentioned financial transaction detection method based on fund network graphs can be as follows: First, extract feature data from account transaction information, perform clustering processing on the feature data using a clustering algorithm, identify the transaction records corresponding to outliers obtained from the clustering as the first abnormal transaction records, obtain an abnormal transaction verification set, compare the abnormal transaction verification set with the first abnormal transaction records, and filter out the second abnormal transaction records from the first abnormal transaction records based on the comparison results. Simultaneously, construct transaction pairs and fund network graphs corresponding to each transaction pair based on account transaction information, extract network features from the fund network graphs, and obtain account information and transaction behavior features for each account based on account transaction information. Finally, input the account information, transaction behavior features, the second abnormal transaction records, and network features into a pre-constructed abnormal account identification model to obtain the abnormal transaction accounts that have exhibited abnormal fund transfer behavior.

[0104] This invention constructs a fund network diagram and extracts its network features. These features are then input into an abnormal account identification model, enhancing the model's global network perspective. By employing clustering algorithms and comparing data with historical data, highly suspicious abnormal transaction records are selected. These selected abnormal transaction records, along with account information, transaction behavior characteristics, and network features, are then input into the abnormal account identification model. This multi-type feature data improves the accuracy and efficiency of the model in identifying abnormal transaction accounts exhibiting abnormal fund transfer behavior.

[0105] Meanwhile, the embodiments of the present invention improve the generalization ability of the abnormal account identification model by periodically retraining the abnormal account identification model, continuously updating the model parameters, and optimizing the abnormal account identification model, thereby ensuring that the abnormal account identification model can cope with the ever-changing abnormal fund transfer methods.

[0106] This invention improves the detection capability of abnormal fund transfer behavior by combining fund network diagram analysis and abnormal account identification model, thereby solving the technical problem that the abnormal account identification model in related technologies has a single detection rule and is difficult to accurately identify the transaction account that has abnormal fund transfer behavior.

[0107] The following is a detailed description with reference to another embodiment.

[0108] Example 2

[0109] The financial transaction detection device based on a capital network diagram provided in this embodiment includes multiple implementation units, each of which corresponds to a specific implementation step in Embodiment 1 above.

[0110] Figure 4 This is a schematic diagram of an optional financial transaction detection device based on a capital network diagram according to an embodiment of the present invention, such as... Figure 4As shown, the financial transaction detection device based on the capital network diagram may include: a clustering unit 41, a screening unit 42, a construction unit 43, and an identification unit 44.

[0111] Among them, clustering unit 41 is used to extract feature data of account transaction information, and to perform clustering processing on the feature data using a clustering algorithm, and to determine the transaction record corresponding to the outlier obtained by clustering as the first abnormal transaction record.

[0112] The filtering unit 42 is used to obtain an abnormal transaction verification set, compare the abnormal transaction verification set with the first abnormal transaction record, and filter out the second abnormal transaction record from the first abnormal transaction record based on the comparison result. The abnormal transaction verification set includes at least the data of abnormal fund transfer behavior recorded in the historical time period.

[0113] Construction unit 43 constructs trading pairs and corresponding capital network graphs based on account transaction information, and extracts network features from the capital network graph. The trading pairs include: trading accounts and trading records. The capital network graph includes: nodes indicated by multiple trading accounts and connecting edges corresponding to trading records. The network features include: node features and subgraph features.

[0114] The identification unit 44 obtains the account information and transaction behavior characteristics of each account based on the account transaction information, and inputs the account information, transaction behavior characteristics, second abnormal transaction records and network characteristics into the pre-built abnormal account identification model to obtain the abnormal transaction account that has experienced abnormal fund transfer behavior.

[0115] The aforementioned financial transaction detection device based on a fund network graph can extract feature data of account transaction information through clustering unit 41, perform clustering processing on the feature data using a clustering algorithm, identify the transaction records corresponding to outliers obtained from the clustering as the first abnormal transaction records, obtain an abnormal transaction verification set through filtering unit 42, compare the abnormal transaction verification set with the first abnormal transaction records, and filter out the second abnormal transaction records from the first abnormal transaction records based on the comparison results. At the same time, constructing unit 43 constructs transaction pairs and fund network graphs corresponding to each transaction pair based on account transaction information, extracts network features from the fund network graph, and obtains account information and transaction behavior features of each account through identification unit 44 based on account transaction information. The account information, transaction behavior features, second abnormal transaction records, and network features are input into a pre-constructed abnormal account identification model to obtain the abnormal transaction accounts that have experienced abnormal fund transfer behavior.

[0116] This invention constructs a fund network diagram and extracts its network features. These features are then input into an abnormal account identification model, enhancing the model's global network perspective. By employing clustering algorithms and comparing with historical data, highly suspicious abnormal transaction records are selected. These selected abnormal transaction records, along with account information, transaction behavior characteristics, and network features, are input into the abnormal account identification model. This multi-type feature data improves the accuracy and efficiency of the model in identifying abnormal transaction accounts exhibiting abnormal fund transfer behavior. By combining fund network diagram analysis with abnormal account identification model recognition, this invention enhances the detection capability for abnormal fund transfer behavior, thereby solving the technical problem in related technologies where abnormal account identification models have limited detection rules and struggle to accurately identify transaction accounts exhibiting abnormal fund transfer behavior.

[0117] Optionally, clustering unit 41 includes: a first acquisition module for acquiring account transaction information, wherein the account transaction information includes: account information, transaction records, payment channel usage records, and transaction geographical location information, the account information includes: transaction account number, and the transaction records include: transaction amount and transaction time; a deletion module for deleting erroneous records in the transaction information, wherein erroneous records include: transaction records with negative transaction amounts, account information with incorrect account format, and duplicate account transaction information; and a standardization module for standardizing the account transaction information, wherein the standardization process includes: converting the values ​​of account transaction information of the same numerical type to the same size, and encoding non-numerical account transaction information.

[0118] Optionally, clustering unit 41 further includes: a second acquisition module, which calculates the mean, median, and variance of transaction amounts for each account based on transaction records in the account transaction information, and acquires transaction time density distribution information, the proportion of accounts transferring funds in and out, and the average transaction interval time for each account; a third acquisition module, which acquires the time-series fluctuation characteristics of transaction amount and number of transactions based on transaction records in the account transaction information, wherein the time-series fluctuation characteristics are used to reflect the changing trend of transaction amount and number of transactions over time; a fourth acquisition module, which acquires the frequency of payment channel usage and the distribution of payment channel types based on payment channel usage records in the account transaction information; and a fifth acquisition module, which acquires geographical distribution characteristics and account usage records for the same IP address and the same terminal based on transaction geographical location information in the account transaction information, wherein the geographical distribution characteristics include: cross-regional transfer frequency.

[0119] Optionally, the construction unit 43 includes: a first determining module, used to determine the trading accounts in the trading pair as nodes in the capital network graph, wherein the trading accounts include: the accounts of the fund transferor and the fund transferee; and a second determining module, used to determine the trading records in the trading pair as connecting edges in the capital network graph, wherein the trading records refer to the transaction flow of the fund transferor and the fund transferee, and the connecting edges are directed edges representing the direction of fund flow.

[0120] Optionally, the construction unit 43 further includes: for each node in the fund network graph, a first calculation module, which calculates the in-degree and out-degree of the node based on the number of fund inflows and outflows of the node, wherein the in-degree refers to the number of transactions in which the node has fund inflows and the out-degree refers to the number of transactions in which the node has fund outflows; a second calculation module, which calculates the in-degree centrality and out-degree centrality of the node based on the number of transaction partner nodes when the node has fund inflows and outflows, wherein the in-degree centrality is used to evaluate the proportion of other nodes transferring funds to the node when the node is a fund inflow party, and the out-degree centrality is used to evaluate the proportion of other nodes transferring funds to the node when the node is a fund outflow party; and a sixth acquisition module, which is used to acquire the shortest fund flow path from the node to other nodes, acquire the transit nodes from the shortest fund flow path, acquire the transit nodes of all nodes, and calculate the betweenness centrality of each transit node, wherein the betweenness centrality is used to evaluate the importance level of the transit node in the fund flow.

[0121] Optionally, the construction unit 43 further includes: an identification module for identifying specific subgraphs and frequent subgraphs in the capital network graph, wherein specific subgraphs include star-shaped subgraphs and chain-shaped subgraphs, and frequent subgraphs refer to subgraphs that appear frequently and have the same structure; an extraction module for extracting features from specific subgraphs and frequent subgraphs to obtain subgraph features, wherein subgraph features include: number of nodes and number of edges, node degree distribution features, transaction amount distribution features, and geographical distribution features; and a filtering module for obtaining normal subgraphs in the capital network graph and filtering the subgraph features of specific subgraphs and frequent subgraphs based on the subgraph features of normal subgraphs, wherein normal subgraphs refer to capital network graph subgraphs other than specific subgraphs and frequent subgraphs.

[0122] Optionally, the extraction module includes: for each specific subgraph and frequent subgraph, a first acquisition submodule for acquiring the number of nodes and edges of the subgraph; a second acquisition submodule for acquiring the in-degree and out-degree of each node in the subgraph, and determining the degree distribution characteristics of the subgraph based on preset in-degree and out-degree thresholds, wherein the degree distribution characteristics are used to reflect the number of nodes with an in-degree higher than the in-degree threshold and the number of nodes with an out-degree higher than the out-degree threshold; a first determination submodule for determining the transaction amount distribution characteristics of the subgraph based on transaction records in the subgraph, wherein the transaction amount distribution characteristics are used to characterize the total transaction amount of each node and the concentration of transaction amount; and a second determination submodule for determining the geographical distribution characteristics of each node in the subgraph based on transaction geographical location information in the subgraph.

[0123] Optionally, in the identification unit 44, the account information obtained based on the account transaction information includes: real-name authentication information and transaction risk information for each account; the transaction behavior characteristics obtained based on the account transaction information include: the total number of transactions for each account, the average transaction amount, and the proportion of transactions during non-working hours.

[0124] The aforementioned financial transaction detection device based on the capital network diagram may also include a processor and a memory. The clustering unit 41, the filtering unit 42, the construction unit 43, the identification unit 44, etc., are all stored in the memory as program units, and the processor executes the aforementioned program units stored in the memory to realize the corresponding functions.

[0125] The aforementioned processor contains a kernel, which retrieves the corresponding program units from memory. One or more kernels can be configured, and by adjusting kernel parameters, financial transactions can be detected based on a fund network diagram, identifying abnormal trading accounts exhibiting unusual fund transfer behavior.

[0126] The aforementioned memory may include non-permanent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0127] Example 3

[0128] Embodiments of this application may provide an electronic device. Figure 5 This is a structural block diagram of an electronic device according to an embodiment of this application. Figure 5 As shown, the electronic device may include: one or more ( Figure 5 Only one of the components is shown: processor 502, memory 504, memory controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module, and display.

[0129] The memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the methods and apparatus in the embodiments of this application. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, thereby implementing the above-described methods. The memory may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include memory remotely located relative to the processor, and these remote memories can be connected to the terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0130] The processor can access information and applications stored in the memory via a transmission device to execute the following steps: extract feature data from account transaction information, perform clustering processing on the feature data using a clustering algorithm, and identify the transaction records corresponding to outliers obtained from the clustering as the first abnormal transaction records; obtain an abnormal transaction verification set, compare the abnormal transaction verification set with the first abnormal transaction records, and filter out the second abnormal transaction records from the first abnormal transaction records based on the comparison results, wherein the abnormal transaction verification set includes at least: data on abnormal fund transfer behavior recorded in historical time periods; construct transaction pairs and fund network graphs corresponding to each transaction pair based on account transaction information, and extract network features from the fund network graph, wherein the transaction pairs include: transaction accounts and transaction records, the fund network graph includes: nodes indicated by multiple transaction accounts and connecting edges corresponding to transaction records, and the network features include: node features and subgraph features; obtain account information and transaction behavior features of each account based on account transaction information, and input the account information, transaction behavior features, second abnormal transaction records, and network features into a pre-constructed abnormal account identification model to obtain the abnormal transaction accounts that have experienced abnormal fund transfer behavior.

[0131] The processor can also access information and applications stored in the memory via a transmission device to perform the following steps: acquiring account transaction information, including account information, transaction records, payment channel usage records, and transaction geographic location information; the account information includes the transaction account number, and the transaction records include the transaction amount and transaction time; deleting erroneous records from the transaction information, including transaction records with negative transaction amounts, account information with incorrect account formats, and duplicate account transaction information; and standardizing the account transaction information, including converting the values ​​of account transaction information of the same numerical type to the same size and encoding non-numerical account transaction information.

[0132] The processor can also access information and applications stored in the memory via a transmission device to perform the following steps: Based on transaction records in the account transaction information, calculate the mean, median, and variance of transaction amounts for each account, and obtain transaction time density distribution information, the ratio of accounts transferring funds in and out, and the average transaction interval for each account; Based on transaction records in the account transaction information, obtain the time-series fluctuation characteristics of transaction amount and number of transactions, where the time-series fluctuation characteristics reflect the changing trends of transaction amount and number of transactions over time; Based on payment channel usage records in the account transaction information, obtain the frequency of payment channel usage and the distribution of payment channel types; Based on transaction geographic location information in the account transaction information, obtain geographic distribution characteristics and account usage records for the same IP address and the same terminal, where the geographic distribution characteristics include: cross-regional transfer frequency.

[0133] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: determining the trading accounts in the trading pair as nodes in the capital network graph, wherein the trading accounts include: the accounts of the fund transferor and the fund transferee; determining the trading records in the trading pair as connecting edges in the capital network graph, wherein the trading records refer to the transaction flow of the fund transferor and the fund transferee, and the connecting edges are directed edges representing the direction of capital flow.

[0134] The processor can also invoke information and applications stored in the memory via the transmission device to perform the following steps: For each node in the fund network graph, calculate the in-degree and out-degree of the node based on the number of fund inflows and outflows, where in-degree refers to the number of fund inflows and outflows; calculate the in-degree centrality and out-degree centrality of the node based on the number of transaction nodes when the node makes fund inflows and outflows, where in-degree centrality is used to evaluate the proportion of other nodes transferring funds to the node when the node is a fund inflow, and out-degree centrality is used to evaluate the proportion of other nodes transferring funds to the node when the node is a fund outflow; obtain the shortest fund flow path from the node to other nodes, obtain the transit nodes from the shortest fund flow path, obtain the transit nodes of all nodes, and calculate the betweenness centrality of each transit node, where betweenness centrality is used to evaluate the importance level of the transit node in the fund flow.

[0135] The processor can also access information and applications stored in the memory via a transmission device to perform the following steps: identifying specific and frequent subgraphs in the capital network graph, wherein specific subgraphs include star-shaped and chain-shaped subgraphs, and frequent subgraphs refer to subgraphs that appear frequently and have the same structure; extracting features from specific and frequent subgraphs to obtain subgraph features, wherein subgraph features include: number of nodes and edges, node degree distribution features, transaction amount distribution features, and geographical distribution features; obtaining normal subgraphs in the capital network graph, and filtering the subgraph features of specific and frequent subgraphs based on the subgraph features of normal subgraphs, wherein normal subgraphs refer to capital network graph subgraphs other than specific and frequent subgraphs.

[0136] The processor can also invoke information and applications stored in the memory via the transmission device to perform the following steps: For each specific subgraph and frequent subgraph, obtain the number of nodes and edges of the subgraph; obtain the in-degree and out-degree of each node in the subgraph, and determine the degree distribution characteristics of the subgraph based on preset in-degree and out-degree thresholds, wherein the degree distribution characteristics are used to reflect the number of nodes with an in-degree higher than the in-degree threshold and the number of nodes with an out-degree higher than the out-degree threshold; determine the transaction amount distribution characteristics of the subgraph based on the transaction records in the subgraph, wherein the transaction amount distribution characteristics are used to characterize the total transaction amount of each node and the concentration of transaction amount; determine the geographical distribution characteristics of each node in the subgraph based on the transaction geographical location information in the subgraph.

[0137] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: the account information obtained based on the account transaction information includes: the real-name authentication information and transaction risk information of each account; the transaction behavior characteristics obtained based on the account transaction information include: the total number of transactions, the average transaction amount, and the proportion of transactions during non-working hours for each account.

[0138] This application provides a scheme for a financial transaction detection method based on a fund network graph. By extracting feature data from account transaction information, a clustering algorithm is used to cluster the feature data. Transaction records corresponding to outliers obtained from the clustering are identified as first abnormal transaction records. An abnormal transaction verification set is then obtained and compared with the first abnormal transaction records. Based on the comparison results, second abnormal transaction records are selected from the first abnormal transaction records. Simultaneously, transaction pairs and corresponding fund network graphs are constructed based on account transaction information. Network features are extracted from the fund network graphs. Account information and transaction behavior features of each account are then obtained based on the account transaction information. The account information, transaction behavior features, second abnormal transaction records, and network features are input into a pre-constructed abnormal account identification model to obtain abnormal transaction accounts that have engaged in abnormal fund transfers. This enhances the global network perspective of the abnormal account identification model and improves its ability to detect abnormal fund transfers. It also solves the technical problem in related technologies where abnormal account identification models have single detection rules and are difficult to accurately identify transaction accounts that have engaged in abnormal fund transfers.

[0139] Those skilled in the art will understand that Figure 5 The structure shown is for illustrative purposes only. Electronic devices can also be smartphones, tablets, handheld computers, mobile internet devices (MIDs), PADs, and other terminal devices. Figure 5 This does not limit the structure of the aforementioned electronic device. For example, electronic devices may also include components that are more... Figure 5 The more or fewer components shown (such as network interfaces, display devices, etc.), or having the same Figure 5 Different configurations shown.

[0140] Those skilled in the art will understand that all or part of the steps in the various financial transaction detection methods based on fund network diagrams in the above embodiments can be implemented by a program instructing the hardware of the terminal device. The program can be stored in a computer-readable storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0141] Example 4

[0142] Embodiments of this application also provide a storage medium. Optionally, in this embodiment, the storage medium can be used to store the program code executed by the financial transaction detection method based on a capital network diagram provided in Embodiment 1.

[0143] According to another aspect of the present invention, a computer-readable storage medium is also provided, the computer-readable storage medium including a stored computer program, wherein, when the computer program is running, it controls the device where the computer-readable storage medium is located to execute any of the above-described financial transaction detection methods based on a capital network diagram.

[0144] Optionally, in this embodiment, the storage medium may be located in any computer terminal in a group of computer terminals in a computer network, or in any mobile terminal in a group of mobile terminals.

[0145] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the financial transaction detection method based on a capital network graph as described in various embodiments of this application.

[0146] This application also provides a computer program product, including a non-volatile computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the financial transaction detection method based on a capital network diagram as described in various embodiments of this application.

[0147] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0148] In the above embodiments of the present invention, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0149] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For instance, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0150] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0151] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0152] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0153] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A financial transaction detection method based on a capital network graph, characterized in that, include: Extract feature data from account transaction information, perform clustering processing on the feature data using a clustering algorithm, and identify the transaction records corresponding to the outliers obtained from the clustering as the first abnormal transaction records; Obtain an abnormal transaction verification set, compare the abnormal transaction verification set with the first abnormal transaction record, and filter out a second abnormal transaction record from the first abnormal transaction record based on the comparison result. The abnormal transaction verification set includes at least: data on abnormal fund transfer behavior recorded in historical time periods. Based on the account transaction information, a trading pair and a capital network graph corresponding to each trading pair are constructed. Network features are extracted from the capital network graph. The trading pair includes: trading account and trading record. The capital network graph includes: nodes indicated by multiple trading accounts and connecting edges corresponding to trading records. The network features include: node features and subgraph features. Based on the account transaction information, the account information and transaction behavior characteristics of each account are obtained. The account information, the transaction behavior characteristics, the second abnormal transaction record, and the network characteristics are input into a pre-built abnormal account identification model to obtain the abnormal transaction account that has experienced abnormal fund transfer behavior. The abnormal account identification model adopts the LightGBM model. The steps for extracting node features from the fund network graph include: for each node in the fund network graph, calculating the in-degree and out-degree of the node based on the number of fund inflows and outflows, wherein the in-degree refers to the number of fund inflow transactions and the out-degree refers to the number of fund outflow transactions; calculating the in-degree centrality and out-degree centrality of the node based on the number of transaction partner nodes when the node has fund inflows and outflows, wherein the in-degree centrality is used to evaluate the proportion of other nodes transferring funds to the node when the node is a fund inflow party and the out-degree centrality is used to evaluate the proportion of other nodes transferring funds to the node when the node is a fund outflow party; obtaining the shortest fund flow path from the node to other nodes, obtaining transit nodes from the shortest fund flow path, obtaining transit nodes of all nodes, and calculating the betweenness centrality of each transit node, wherein the betweenness centrality is used to evaluate the importance level of the transit node in the fund flow; The step of extracting the subgraph features from the capital network graph includes: identifying specific subgraphs and frequent subgraphs in the capital network graph, wherein the specific subgraphs include star-shaped subgraphs and chain-shaped subgraphs, and the frequent subgraphs refer to subgraphs that appear frequently and have the same structure; performing feature extraction on the specific subgraphs and the frequent subgraphs to obtain the subgraph features, wherein the subgraph features include: the number of nodes and edges, node degree distribution features, transaction amount distribution features, and geographical distribution features; obtaining normal subgraphs in the capital network graph, and filtering the subgraph features of the specific subgraphs and the frequent subgraphs based on the subgraph features of the normal subgraphs, wherein the normal subgraphs refer to capital network graph subgraphs other than the specific subgraphs and the frequent subgraphs.

2. The financial transaction detection method according to claim 1, characterized in that, Before extracting the feature data of the account transaction data, the process also includes: Obtain the account transaction information, wherein the account transaction information includes: account information, transaction records, payment channel usage records, and transaction geographical location information, the account information includes: transaction account number, and the transaction records include: transaction amount and transaction time; Delete erroneous records from the transaction information, wherein the erroneous records include: transaction records with negative transaction amounts, account information with incorrect account format, and duplicate account transaction information; The account transaction information is standardized, wherein the standardization process includes: converting the numerical values ​​of the account transaction information of the same type to the same size, and encoding the non-numerical account transaction information.

3. The financial transaction detection method according to claim 1, characterized in that, The steps for extracting feature data from the account transaction information include: Based on the transaction records in the account transaction information, calculate the mean, median and variance of the transaction amount for each account, and obtain the transaction time density distribution information, the ratio of the number of accounts transferring funds in and out, and the average transaction interval time for each account. Based on the transaction records in the account transaction information, the temporal fluctuation characteristics of transaction amount and number of transactions are obtained, wherein the temporal fluctuation characteristics are used to reflect the changing trend of transaction amount and number of transactions over time. Based on the payment channel usage records in the account transaction information, obtain the payment channel usage frequency and the distribution of payment channel types; Based on the transaction geographic location information in the account transaction information, the geographic distribution characteristics and account usage records of the same IP address and the same terminal are obtained. The geographic distribution characteristics include: cross-regional transfer frequency.

4. The financial transaction detection method according to claim 1, characterized in that, The steps for constructing the funding network diagram include: The trading accounts in the trading pair are identified as nodes in the fund network diagram, wherein the trading accounts include the accounts of the fund transferor and the fund transferee; The transaction records in the transaction pair are determined as the connecting edges of the fund network graph, wherein the transaction record refers to the transaction flow between the fund transferor and the fund transferee, and the connecting edge is a directed edge representing the direction of fund flow.

5. The financial transaction detection method according to claim 1, characterized in that, The step of feature extraction for the specific subgraph and the frequent subgraph includes: for each specific subgraph and the frequent subgraph, Get the number of nodes and edges of the subgraph; Obtain the in-degree and out-degree of each node in the subgraph. Based on preset in-degree and out-degree thresholds, determine the degree distribution characteristics of the subgraph. The degree distribution characteristics are used to reflect the number of nodes with an in-degree higher than the in-degree threshold and the number of nodes with an out-degree higher than the out-degree threshold. Based on the transaction records in the subgraph, the transaction amount distribution characteristics of the subgraph are determined, wherein the transaction amount distribution characteristics are used to characterize the total transaction amount of each node and the concentration of transaction amount. Based on the geographical location information of the transactions in this subgraph, the geographical distribution characteristics of each node in the subgraph are determined.

6. The financial transaction detection method according to claim 1, characterized in that, include: The account information obtained based on the account transaction information includes: real-name authentication information and transaction risk information for each account; The transaction behavior characteristics obtained based on the account transaction information include: the total number of transactions for each account, the average transaction amount, and the proportion of transactions during non-working hours.

7. A financial transaction detection device based on a capital network diagram, characterized in that, include: The clustering unit is used to extract feature data of account transaction information, and the clustering algorithm is used to cluster the feature data. The transaction records corresponding to the outliers obtained by clustering are identified as the first abnormal transaction records. A filtering unit is used to obtain an abnormal transaction verification set, compare the abnormal transaction verification set with the first abnormal transaction record, and filter out a second abnormal transaction record from the first abnormal transaction record based on the comparison result. The abnormal transaction verification set includes at least: data on abnormal fund transfer behavior recorded in historical time periods. The construction unit constructs trading pairs and corresponding fund network graphs based on the account transaction information, and extracts network features from the fund network graph. The trading pair includes: trading account and trading record. The fund network graph includes: nodes indicated by multiple trading accounts and connecting edges corresponding to trading records. The network features include: node features and subgraph features. The identification unit obtains account information and transaction behavior characteristics of each account based on the account transaction information, and inputs the account information, the transaction behavior characteristics, the second abnormal transaction record, and the network characteristics into a pre-built abnormal account identification model to obtain abnormal transaction accounts that have experienced abnormal fund transfer behavior; the abnormal account identification model adopts the LightGBM model. The construction unit also includes: for each node in the fund network graph, a first calculation module calculates the in-degree and out-degree of the node based on the number of fund inflows and outflows, where in-degree refers to the number of transactions in which the node has fund inflows and out-degree refers to the number of transactions in which the node has fund outflows; a second calculation module calculates the in-degree centrality and out-degree centrality of the node based on the number of transaction partner nodes when the node has fund inflows and outflows, where in-degree centrality is used to evaluate the proportion of other nodes transferring funds to the node when the node is a fund inflow party, and out-degree centrality is used to evaluate the proportion of other nodes transferring funds to the node when the node is a fund outflow party; a sixth acquisition module is used to acquire the shortest fund flow path from the node to other nodes, acquire transit nodes from the shortest fund flow path, acquire transit nodes of all nodes, and calculate the betweenness centrality of each transit node, where betweenness centrality is used to evaluate the importance level of the transit node in the fund flow; The construction unit also includes: an identification module for identifying specific subgraphs and frequent subgraphs in the capital network graph, wherein specific subgraphs include star-shaped subgraphs and chain-shaped subgraphs, and frequent subgraphs refer to subgraphs that appear frequently and have the same structure; an extraction module for extracting features from specific subgraphs and frequent subgraphs to obtain subgraph features, wherein subgraph features include: number of nodes and edges, node degree distribution features, transaction amount distribution features, and geographical distribution features; and a filtering module for obtaining normal subgraphs in the capital network graph and filtering the subgraph features of specific subgraphs and frequent subgraphs based on the subgraph features of normal subgraphs, wherein normal subgraphs refer to capital network graph subgraphs other than specific subgraphs and frequent subgraphs.

8. An electronic device, characterized in that, It includes one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the financial transaction detection method based on the capital network diagram as described in any one of claims 1 to 6.

Images