Suspicious user identification method and related equipment

Abstract

The embodiment of the invention discloses a suspicious user identification method and related equipment, and the method comprises the steps: obtaining target data of a to-be-identified user, the target data comprises account data, transaction data and associated data of the to-be-identified user, and the associated data is used for indicating the operation condition of the to-be-identified user; inputting the target data into a preset rule engine intelligent model, and outputting a first score based on the target data through the rule engine intelligent model; inputting the target data into a preset machine learning model, and outputting a second score based on the target data through the machine learning model; and determining whether the to-be-identified user is a suspicious user based on the first score and the second score. By taking various data as target data, the model can mine features from more dimensions, so that the recognition accuracy of the model is improved; the suspicious user is identified by combining the two models, so that the instability of manual identification can be avoided, and the identification efficiency is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of anti-money laundering, and in particular to a suspicious user identification method and related equipment. Background Art

[0002] In recent years, with the widespread application of new technologies such as mobile payment, big data, and cloud computing in the financial field, it has not only driven the improvement of financial service efficiency and promoted financial inclusion, but also brought about a series of financial security issues such as online fraud and money laundering, among which anti-money laundering is an important area for financial institutions to monitor compliance. Comprehensive use of anti-money laundering regulatory policy tools, implementation of classified supervision, improvement of risk warning and emergency response mechanisms, and practical strengthening of anti-money laundering supervision of high-risk markets, high-risk businesses, and high-risk institutions reflect the trend of stricter supervision. Commercial banks' anti-money laundering systems, processes, and systems urgently need to be updated to meet regulatory requirements.

[0003] At present, major banks and financial institutions identify suspicious users with money laundering risks by first setting a series of monitoring indicators. When the user's transaction data triggers the preset conditions, the anti-money laundering system captures the relevant data and automatically generates suspicious cases. Experienced screening personnel then identify and report the suspicious cases one by one.

[0004] However, the identification process relies heavily on manual screening, and the recognition accuracy is unstable and the efficiency is low. Therefore, how to improve the recognition accuracy and efficiency of suspicious users is an urgent problem to be solved. Summary of the invention

[0005] The embodiment of the present invention provides a suspicious user identification method and related equipment, which can improve the identification accuracy and efficiency of suspicious users.

[0006] A first aspect of an embodiment of the present application provides a suspicious user identification method, the method comprising: obtaining target data of a user to be identified, the target data comprising account data, transaction data and associated data of the user to be identified, wherein the associated data is used to indicate the business status of the user to be identified; inputting the target data into a preset rule engine intelligent model, and outputting a first score based on the target data through the rule engine intelligent model; wherein the rule engine intelligent model is used to calculate the first score based on anti-money laundering identification rules; inputting the target data into a preset machine learning model, and outputting a second score based on the target data through the machine learning model; and determining whether the user to be identified is a suspicious user based on the first score and the second score.

[0007] In the embodiment of the present application, by using multiple data as target data, the model can mine the characteristics of suspicious users from more dimensions, thereby improving the model's accuracy in identifying suspicious users; by combining the rule engine intelligent model and the machine learning model to identify suspicious users, the instability of manual identification can be avoided and the identification efficiency can be improved.

[0008] In a possible implementation, the associated data includes at least one of industrial and commercial data, judicial data, public opinion data, China Securities Depository and Clearing Corporation Limited data, and Dow Jones List Library data.

[0009] In the embodiment of the present application, by using the associated data of the user to be identified in multiple different dimensions as the target data, the data indicators in the intelligent model of the rule engine can be enriched, thereby updating and iterating to obtain more data indicators and anti-money laundering identification rules.

[0010] In one possible implementation, after determining whether the user to be identified is a suspicious user, the method also includes: in the case where it is determined that the user to be identified is a suspicious user, generating case information of the user to be identified, and sending the case information to an expert identification module; receiving an identification result returned by the expert identification module, the identification result including a positive result and a negative result; obtaining data indicators for identifying suspicious users based on the positive result, and updating the anti-money laundering identification rules in the intelligent model of the rule engine based on the suspicious indicator; and training the machine learning model based on the positive result and the negative result.

[0011] In the embodiment of the present application, the recognition accuracy of the model can be further improved by using the results of expert identification as input samples for model training and iteration.

[0012] In one possible implementation, the data indicator for identifying suspicious users is obtained based on the affirmative result, including: generating the data indicator through the intelligent model of the rule engine, based on a combination of algorithms of gradient boosting decision tree (GBDT) and logistic regression (LR), or based on a combination of algorithms of GBDT and factorization machine (FM).

[0013] In the embodiments of the present application, a combination of GBDT and LR algorithms, or a combination of GBDT and FM algorithms is used to generate data indicators, which can effectively process high-dimensional sparse features, learn the interactive information of high-order features, and enhance the fitting ability of the intelligent model of the rule engine.

[0014] In a possible implementation, the generating of the case information of the user to be identified includes: generating a graph as the case information based on the target information.

[0015] In the embodiment of the present application, by sending case information in the form of a graph to the expert identification module, experts can more efficiently obtain and analyze suspicious clues in the case and identify suspicious users more quickly.

[0016] In a possible implementation, obtaining target data of the user to be identified includes: obtaining a unique identifier of the user to be identified; based on the unique identifier of the user to be identified, obtaining data of the user to be identified in different databases; and converting the data of the user to be identified in different databases into target data in a unified standard format.

[0017] In the embodiment of the present application, the data of the user to be identified in different databases are converted into a unified standard format, which can integrate the multi-dimensional data of the user to be identified and complete the preprocessing before inputting the model, thereby reducing the amount of calculation in the model identification process.

[0018] In a possible implementation, after determining whether the user to be identified is a suspicious user, the method further includes: in the case where it is determined that the user to be identified is a suspicious user, determining similar users and / or associated users of the user to be identified based on the target data; and monitoring transactions of the similar users and / or the associated users.

[0019] In the embodiment of the present application, suspicious users can be predicted based on the similarities and associations between users, and potential suspicious users can be monitored in advance, so that early warnings and processing can be carried out in the first time when suspicious transactions occur.

[0020] A second aspect of an embodiment of the present application provides a suspicious user identification device, which includes: an acquisition module, used to acquire target data of a user to be identified, the target data including account data, transaction data and associated data of the user to be identified, wherein the associated data is used to indicate the business status of the user to be identified; a first scoring module, used to input the target data into a preset rule engine intelligent model, and output a first score based on the target data through the rule engine intelligent model; wherein the rule engine intelligent model is used to calculate the first score based on anti-money laundering identification rules; a second scoring module, used to input the target data into a preset machine learning model, and output a second score based on the target data through the machine learning model; a determination module, used to determine whether the user to be identified is a suspicious user based on the first score and the second score.

[0021] A third aspect of an embodiment of the present application provides a computing device, characterized in that the computing device includes a memory and a processor; the memory and the processor are coupled; the memory is used to store computer program instructions; and the processor is used to call the computer program instructions to execute any method that may be implemented as described in the first aspect.

[0022] A fourth aspect of an embodiment of the present application provides a computer-readable storage medium, characterized in that the computer-readable storage medium stores computer execution instructions; wherein, when the computer execution instructions are executed by a processor, any possible method described in the first aspect is implemented.

[0023] It should be understood that the beneficial effects of the above-mentioned various aspects can be referenced to each other. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0025] Figure 1 A flowchart of a suspicious user identification method provided in an embodiment of the present application;

[0026] Figure 2 A data flow diagram in the process of identifying suspicious users provided by an embodiment of the present application;

[0027] Figure 3 A structural block diagram of a suspicious user identification device provided in an embodiment of the present application;

[0028] Figure 4 A structural block diagram of a computing device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0029] The embodiments of the present application are described below in conjunction with the accompanying drawings. Obviously, the described embodiments are only embodiments of a part of the present application, rather than all embodiments. It is known to those skilled in the art that with the development of technology and the emergence of new scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0030] The terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0031] The embodiment of the present invention provides a suspicious user identification method and related equipment, which can improve the identification accuracy and efficiency of suspicious users.

[0032] See also Figure 1 , Figure 1 A flow chart of a suspicious user identification method provided in an embodiment of the present application is provided, and the method is applied to a computing device, such as Figure 1 As shown, the method includes the following steps 102 to 108.

[0033] It can be understood that the embodiments of the present application involve the field of anti-money laundering and are mainly used in financial institutions such as banks, securities companies and funds; therefore, the computing device in the embodiments of the present application can be understood as a computing device within a financial institution, which is used to support, manage and supervise the transaction behavior of users of the financial institution.

[0034] Step 102: The computing device obtains target data of the user to be identified.

[0035] Among them, anti-money laundering is an important area for financial institutions in terms of monitoring compliance. Financial institutions need to regularly or irregularly identify suspicious users with money laundering risks in their own systems and report them to the regulatory system. During the period when the computing device identifies suspicious users, users who are the target of review but have not started to be identified can be called users to be identified.

[0036] The target data includes the account data, transaction data and associated data of the user to be identified. Specifically, the account data includes the user information entered by the user to be identified when opening an account in a financial institution; the transaction data includes the data corresponding to the transactions of the user to be identified in the financial institution; and the associated data is used to indicate the business status of the user to be identified.

[0037] Optionally, the transaction data may be data corresponding to transaction behaviors of the user to be identified within a certain time window.

[0038] It is understandable that the computing device can associate the business conditions and transaction behaviors of the user to be identified through associative data, and explore the deep connection between the two, so as to better judge the money laundering risk of the user to be identified.

[0039] It is understandable that when the user to be identified is an individual, the associated data may include relevant information indicating the investment behavior disclosed by the individual.

[0040] Among them, the account data and transaction data of the user to be identified are data managed internally by the financial institution, and therefore can be collectively referred to as internal data; the associated data indicating the business status of the user to be identified requires the computing device to obtain it from a database outside the financial institution, and therefore the associated data can be collectively referred to as external data.

[0041] Among them, the computing device can combine the risk information reflected by external data to check the transaction behavior of the user to be identified, and realize the effective connection of internal and external money laundering risk-related data.

[0042] In a possible implementation, the associated data includes at least one of industrial and commercial data, judicial data, public opinion data, China Securities Depository and Clearing Corporation Limited data, and Dow Jones List Library data.

[0043] Exemplarily, the computing device can obtain the share structure and shareholding status of the user to be identified through industrial and commercial data, thereby mining associated users who are closely related to the user to be identified; and then analyze the transaction data of these users to identify whether there is gang money laundering behavior, thereby determining whether there are multiple suspicious users engaged in gang money laundering.

[0044] Exemplarily, the computing device may also determine through industrial and commercial data whether the user to be identified is involved in a high-risk area for money laundering.

[0045] Exemplarily, the computing device may analyze the recent operating conditions of the user to be identified through the data in the China Securities Depository and Clearing Corporation Limited (CSDC) system or the Dow Jones List Library system, and identify whether there is any unreasonable or suspicious transaction behavior in combination with the recent transaction data of the user to be identified.

[0046] The computing device can generate the data indicators required for the calculation of the rule engine intelligent model based on external data, such as calculating shareholder equity penetration based on shareholding information in industrial and commercial data.

[0047] In a possible implementation, the associated data also includes associated users and / or similar users.

[0048] Among them, the computing device can determine the associated users of the user to be identified based on the capital relationship in the industrial and commercial data; and can determine the similar users of the user to be identified based on the similarity of the transaction behaviors reflected in the transaction data.

[0049] After determining the associated users and / or similar users of the user to be identified, the computing device may save the relevant data of the associated users and / or similar users as the associated data of the user to be identified.

[0050] In an embodiment of the present application, the computing device can be user-centric and obtain the user's financial accounts, trading accounts, position records, judicial data, public opinion data and other data, and then connect with other users through information such as associated accounts, joint positions, and joint holdings to establish a multi-dimensional, interconnected anti-money laundering database.

[0051] In one possible implementation, the computing device may first obtain the corresponding unique identifier from the account data of the user to be identified, and then based on the unique identifier, obtain the data of the user to be identified in different databases; and convert the data of the user to be identified in different databases into the target data in a unified standard format.

[0052] Among them, the computing device can obtain the account data and transaction data of the user to be identified from the internal database, and then obtain related data from the external database based on the unique identifier; and then convert these data into target data.

[0053] Exemplarily, the unique identifier may be the ID number or unified social credit code of the user to be identified.

[0054] After obtaining the data of the user to be identified from different databases, the computing device can detect whether there are suspicious abnormal data values ​​in these data according to the terms of the management methods and implementation rules issued by the competent authority; in the case of abnormal data values, the data can be corrected through multi-party data verification and manual due diligence; then, combined with the common data standards in the industry, the corrected multi-dimensional data from different sources can be converted into target data with unified standards.

[0055] Among them, the computing device can detect different fields according to the corresponding rules based on the formats of different data items, official terms and conditions or common industry standards to determine whether there are abnormal data values.

[0056] Optionally, the computing device may convert the data in the above-mentioned different databases into target data with the unique identifier as the primary key and other contents as attribute items; and then uniformly store the target data of each user to be identified in the anti-money laundering database.

[0057] Optionally, the target data includes first target data and second target data; the computing device can extract corresponding data values ​​from the above-mentioned different database data as the first target data in a first standard format through a preset anti-money laundering identification rule; then extract features of the above-mentioned different database data as the second target data in a second standard format through a feature extraction algorithm; then input the first target data into a preset rule engine intelligent model, and execute step 104; input the second target data into a preset machine learning model, and execute step 106.

[0058] In a possible implementation, the computing device may use a data warehouse hive to store the target data. The computing device may periodically obtain the latest target data of the user, and then store or update the target data in the data warehouse; if step 102 needs to be performed, the computing device obtains the target data corresponding to the user to be identified from the data warehouse.

[0059] In an embodiment of the present application, the computing device can integrate the target data of each user in the financial institution through the data warehouse hive technology to establish a comprehensive, multi-dimensional anti-money laundering database.

[0060] Exemplarily, the data of the user to be identified in different databases can be converted and stored in a unified standard format including three dimensions: account data, transaction data, and behavior data. Specifically, account data can include account holder information, such as name, gender, nationality, occupation, address, contact information, and age; transaction data can include transaction type, transaction amount, and transaction time; and behavior data can include large-amount transfer permission, etc.

[0061] Exemplarily, the computing device may be connected to two systems, namely, the securities margin trading system and the centralized trading system, and the data of the user to be identified in the two systems may be put into a table for unified summary.

[0062] In traditional methods, using transaction data from a single, fragmented transaction scenario can only partially discover a type of abnormal suspicious points of suspicious users, and it is impossible to comprehensively combine multi-dimensional information to comprehensively portray suspicious users, making it difficult to accurately identify suspicious transactions and suspicious users; this not only easily leads to redundant warnings, but also to problems such as false warnings and missed warnings. The embodiments of the present application use multiple data as target data, so that the model can mine the characteristics of suspicious users from more dimensions, thereby improving the model's accuracy in identifying suspicious users.

[0063] After acquiring the target data, the computing device may execute step 104 and step 106. It is understandable that the computing device may execute step 104 first, or step 106 first, or both steps simultaneously, which is not specifically limited in the present embodiment.

[0064] Step 104: The computing device inputs the target data into a preset rule engine intelligent model, and outputs a first score based on the target data through the rule engine intelligent model.

[0065] The rule engine intelligent model is used to calculate the first score based on the anti-money laundering identification rule. Specifically, the anti-money laundering identification rule specifies a plurality of data indicators, and the computing device can calculate the first score based on the matching between the values ​​corresponding to these data indicators in the target data and the requirements of the anti-money laundering identification rule.

[0066] Exemplarily, the computing device may calculate the first score of the user to be identified based on the ratio of the number of data indicator matching items corresponding to the target data of the user to be identified to the total number of data indicators.

[0067] Exemplarily, the computing device may perform weighted calculation based on the matching of preset weights of various data indicators and the target data of the user to be identified to obtain the first score.

[0068] Among them, the computing device can preset the initial anti-money laundering identification rules based on relevant official regulations or reports, and the monitoring indicators indicated by the industry's general standards; then, the computing device can obtain data indicators based on the determined suspicious user cases to add or update the anti-money laundering identification rules.

[0069] In one possible implementation, industry experts convert suspicious features involved in suspicious user cases or money laundering user cases into a single abnormal logic, and then further break down the abnormal logic into data indicators that can indicate suspicious users; the computing device can receive manually input data indicators, and then add or update the anti-money laundering identification rules based on the data indicators.

[0070] For example, in suspicious user cases, there are characteristics such as: the user is a retiree, or has no fixed job, or is unwilling to disclose the original work unit; the income is not high, and it is inconsistent with the asset scale and transaction scale.

[0071] These features can be broken down into:

[0072] Data indicator 1-Customer occupation = freelancer, retired, unemployed, other;

[0073] Data indicator 2-Customer is unwilling to disclose the original work unit = yes;

[0074] Data indicator 3-customer asset size (stock market value + fund balance) >=5 million yuan;

[0075] Data indicator 4-In 5 consecutive trading days, the number of stocks traded is 500,000 shares or the amount is more than 5 million yuan.

[0076] After the values ​​of data indicators 3 and 4 are confirmed through manual due diligence, the computing device can receive these data indicators and add or update the anti-money laundering identification rules in the intelligent model of the rule engine based on these data indicators.

[0077] For example, in a suspicious user case, the user transfers a large amount of money but does not conduct transactions; the characteristics can be broken down into: data indicator 1-a large amount of transfers greater than 500,000; data indicator 2-no transactions or small transactions; data indicator 3-transfers back and forth through multiple custodian banks to skip the bank's monitoring system. Similarly, the computing device can add or update anti-money laundering identification rules based on these data indicators.

[0078] In the embodiment of the present application, by receiving data indicators broken down by experts, the computing device can fully consider the actual business scenarios of the crime types and past cases, summarize the suspicious features of the cases from multiple aspects, establish multi-indicator comprehensive identification rules based on business scenarios, and realize model iteration in the manner of "case characterization, feature indicatorization, and indicator modeling."

[0079] In another possible implementation, the intelligent model of the rule engine uses a combination of gradient boosting decision tree (GBDT) and logistic regression (LR) algorithms, or a combination of GBDT and factorization machine (FM) algorithms to perform calculations.

[0080] Among them, the algorithm combination of GBDT and LR, as well as the algorithm combination of GBDT and FM, can effectively process high-dimensional sparse features. At the same time, GBDT can learn the interactive information of high-order features and enhance the fitting ability of the intelligent model of the rule engine. In addition, GBDT can generate new data indicators based on old data indicators.

[0081] In the embodiments of the present application, the rule engine intelligent model performs calculations by using a combination of GBDT and LR algorithms, or a combination of GBDT and FM algorithms. The rule engine intelligent model can better distinguish between suspicious users and normal users, thereby improving the accuracy of identifying suspicious users. In addition, the combination of these two algorithms can select, divide, combine and analyze the importance of original feature indicators in suspicious user cases or money laundering user cases, realize relationship mining of high-order feature indicator combinations, reduce the degree of dependence of the rule engine intelligent model on traditional anti-money laundering identification rules, and construct a more three-dimensional rule engine intelligent model.

[0082] In one possible implementation, the computing device can use Python big data computing technology to perform logical operations on the target data according to the indicator formula corresponding to the anti-money laundering identification rule to obtain the data required for the input of the rule engine intelligent model; then input the data into the rule engine intelligent model to obtain a first score.

[0083] In addition, target data from more data sources can bring more data indicators, so that the intelligent model of the rule engine can mine the characteristics of suspicious users from more dimensions and improve the recognition accuracy.

[0084] Step 106: The computing device inputs the target data into a preset machine learning model, and outputs a second score based on the target data through the machine learning model.

[0085] Among them, the machine learning model can be a similarity model, a machine learning unsupervised model, a deep learning supervised algorithm model or a model fusion solution.

[0086] Exemplarily, the machine learning unsupervised model can adopt any one of the isolation forest algorithm, support vector machine algorithm, logistic regression algorithm, k-means algorithm, adaboost iterative algorithm and GBDT algorithm.

[0087] Exemplarily, the deep learning supervision algorithm model can adopt a deep factorization machine algorithm or a deep cross algorithm.

[0088] Exemplarily, the model fusion solution may be a stacking integration model or a blending model.

[0089] Before executing step 102, the computing device may train the machine learning model using the target data of suspicious users as negative samples and the target data of normal users as positive samples.

[0090] In the embodiment of the present application, the machine learning model can learn the differences and connections between normal users and suspicious users, so that suspicious users can be accurately identified.

[0091] Step 108: The computing device determines whether the user to be identified is a suspicious user based on the first score and the second score.

[0092] Optionally, the computing device may be preset with a first threshold and a second threshold; when the first score is higher than the first threshold and the second score is higher than the second threshold, the computing device may determine that the user to be identified is a suspicious user.

[0093] Optionally, the computing device may be preset with a third threshold; the computing device may perform weighted calculation based on the first preset weight, the first score and the second score to obtain a comprehensive score of the user to be identified; when the comprehensive score is higher than the third threshold, the computing device may determine that the user to be identified is a suspicious user.

[0094] Optionally, there are multiple users to be identified; the computing device can sort the multiple users to be identified based on the first score and the second score to obtain a first ranking and a second ranking; then perform weighted calculation based on the second preset weight, the first ranking and the second ranking to obtain a comprehensive ranking; finally, the top N users to be identified in the comprehensive ranking are determined as suspicious users.

[0095] In addition to the above optional implementations, the computing device can also determine the suspiciousness of the user to be identified based on the first score, the second score and other methods, thereby determining the suspicious user. It is understandable that embodiments derived from simple changes or derivatives based on the above implementation ideas are also within the protection scope of this application.

[0096] In a possible implementation, when the computing device determines that the user to be identified is a suspicious user, it may determine similar users and / or associated users of the user to be identified based on the target data, and then monitor transactions of the similar users and / or associated users.

[0097] Among them, computing devices can predict suspicious transactions of customers based on the correlation between users, and combine the multi-dimensional data in the target data to build a comprehensive, multi-dimensional and penetrating compliance supervision framework.

[0098] In the embodiment of the present application, by taking multiple data as part of the target data, the model can mine the characteristics of suspicious users from more dimensions, thereby improving the model's accuracy in identifying suspicious users; by combining the rule engine intelligent model and the machine learning model to identify suspicious users, the instability of manual identification can be avoided and the identification efficiency can be improved.

[0099] See also Figure 2 , Figure 2 A data flow diagram of a suspicious user identification process provided in an embodiment of the present application is shown below. Figure 2 The method provided in the embodiments of the present application is further described.

[0100] like Figure 2 As shown, the computing device within the financial institution system can obtain the internal data of the user to be identified from the internal database, and then obtain the external data from the external database based on the unique identifier in the account data of the user to be identified.

[0101] The computing device for acquiring internal data and the computing device for deploying the internal database may be the same computing device or different computing devices within the financial institution system.

[0102] exist Figure 2 In a specific example, the computing device can obtain the account data, transaction data, manual due diligence data and basic operation data of the user to be identified from the internal database; obtain the business data of the user to be identified from the external China Securities Depository and Clearing Corporation Limited database and the Dow Jones List Database; and obtain the public opinion data, judicial data and industrial and commercial data of the user to be identified from the official database and the third-party database.

[0103] After acquiring the above data, the computing device can convert the data into target data in a unified standard format.

[0104] Afterwards, the computing device can directly input the target data into the rule engine intelligent model and the machine learning model, and the machine learning model can extract features from the target data, or the rule engine intelligent model can obtain the running results based on the data indicator formula calculation, and then perform model calculation; in addition, the computing device can also first obtain the features and the above-mentioned calculation results based on the target data, and then input the features into the machine learning model, and input the calculation results into the rule engine intelligent model.

[0105] Among them, the computing device or machine learning model can perform derivative calculations from the existing feature pool to obtain new features. For example, the computing device can process the buy feature and sell feature in the transaction data to obtain the new feature of profit ratio ((sell-buy) / buy); for another example, the transaction amount of the last 5 days and the transaction amount of the last 15 days can be processed based on the transaction amount feature of each transaction. The processed new features are closer to the business scenario and can better reflect the user's portrait information in the anti-money laundering scenario, which is helpful for machine model learning and prediction.

[0106] Similarly, computing devices or intelligent models of rule engines can be processed based on existing data indicators and business logic to obtain new data indicators. For example, in the scenario where a suspicious user is identified by the characteristics of frequent transfers but no transactions or a small number of transactions, a new data indicator of the number of transactions in the past 10 trading days can be obtained based on the user's transaction time and the entrusted transaction time.

[0107] Optionally, the computing device can generate data indicators through the intelligent model of the rule engine, based on an algorithm combination of a gradient boosting decision tree GBDT and LR, or based on an algorithm combination of GBDT and FM.

[0108] After the two models output the first score and the second score respectively, the computing device can perform weighted calculation based on preset weights to obtain a comprehensive score for each user to be identified; and then determine the user to be identified whose comprehensive score is greater than a preset threshold as a suspicious user.

[0109] Then, the computing device may generate case information of the suspicious user and send the case information to the expert identification module, wherein the expert identification module may be deployed on the computing device or on the working terminal of the expert.

[0110] In one possible implementation, the computing device may generate a graph as case information of the suspicious user based on the target data of the suspicious user.

[0111] In the embodiment of the present application, by generating a graph to draw a user portrait, the target data can be more intuitively visualized, which can help experts to discover suspicious transaction clues in the target data and better identify suspicious transaction nodes and core transaction nodes; by combining the graphs of multiple suspicious users, experts can also better identify abnormal transaction gangs.

[0112] When the expert identification module determines that the suspicious user has a high money laundering risk, the expert identification module can generate a suspicious transaction report based on the corresponding case information and analysis results, and upload the suspicious transaction report to the regulatory agency system.

[0113] In one possible implementation, the expert identification module can automatically generate a suspicious transaction report based on the corresponding case information and analysis results through a machine learning model and a preset template.

[0114] In the embodiment of the present application, suspicious transaction reports are automatically generated through a machine learning model, which can improve the reporting efficiency of suspicious transactions.

[0115] After the expert identification is completed, the expert identification module may return the identification result to the computing device; the computing device may receive the identification result returned by the expert identification module, and the identification result includes a positive result and a negative result.

[0116] Then, based on the affirmative result, the computing device can decompose the case information into indicators to obtain data indicators for identifying the suspicious user, and update the anti-money laundering identification rules in the intelligent model of the rule engine based on the data indicators.

[0117] In other possible implementations, the computing device may also directly receive data indicators obtained by experts after decomposing the case information corresponding to the affirmative result.

[0118] As industry experience continues to accumulate and anti-money laundering services continue to improve, the data indicators and corresponding thresholds in the anti-money laundering identification rules can be continuously adjusted and changed, thereby modulating the latest and most experienced rule engine intelligent model. For example, as the number of judicial cases involving money laundering users increases, the user's judicial data indicators can be added to the anti-money laundering identification rules, adding or increasing the impact of the judicial data dimension on the first score.

[0119] The computing device may also train the machine learning model based on the positive result and the negative result. Optionally, the computing device may periodically obtain the latest suspicious user cases and normal user cases, and train the machine learning model using the suspicious user cases as negative samples and the normal user cases as positive samples.

[0120] The suspicious user identification method in the embodiment of the present application is described above. The suspicious user identification device in the embodiment of the present application is described below.

[0121] In the embodiment of the present application, the suspicious user identification device may be a server or a client device, and specifically, the client device may be any one of a smart phone, a tablet electronic device, a network set-top box, a portable computer, a desktop computer, a personal digital assistant (PDA), a vehicle-mounted device, and a smart wearable device. Among them, the smart wearable device may include smart glasses, smart watches, and smart bracelets.

[0122] In practical applications, the part of anti-money laundering identification can be performed on the server side as described above, or all operations can be completed in the client device. The specific selection can be based on the processing capacity of the client device and the limitations of the user's usage scenario. This application does not limit this. If all operations are completed in the client device, a processor can also be deployed in the client device.

[0123] The client device may have a communication module (i.e., a communication unit) that can communicate with a remote server to achieve data transmission with the server. The server may include a server on the task scheduling center side, and other implementation scenarios may also include a server on an intermediate platform, such as a server on a third-party server platform that has a communication link with the task scheduling center server. The server may include a single computer device, or a server cluster consisting of multiple servers, or a server structure of a distributed device.

[0124] See also Figure 3 An embodiment of the suspicious user identification device 300 in the embodiment of the present application includes:

[0125] The acquisition module 301 is used to acquire target data of the user to be identified, wherein the target data includes account data, transaction data and associated data of the user to be identified, wherein the associated data is used to indicate the business status of the user to be identified;

[0126] A first scoring module 302, configured to input the target data into a preset rule engine intelligent model, and output a first score based on the target data through the rule engine intelligent model; wherein the rule engine intelligent model is configured to calculate the first score based on anti-money laundering identification rules;

[0127] A second scoring module 303, configured to input the target data into a preset machine learning model, and output a second score based on the target data through the machine learning model;

[0128] The determination module 304 is used to determine whether the user to be identified is a suspicious user based on the first score and the second score.

[0129] In the embodiment of the present application, by taking multiple data as part of the target data, the model can mine the characteristics of suspicious users from more dimensions, thereby improving the model's accuracy in identifying suspicious users; by combining the rule engine intelligent model and the machine learning model to identify suspicious users, the instability of manual identification can be avoided and the identification efficiency can be improved.

[0130] In a possible implementation, the associated data includes at least one of industrial and commercial data, judicial data, public opinion data, China Securities Depository and Clearing Corporation Limited data, and Dow Jones List Library data.

[0131] In a possible implementation, the suspicious user identification device 300 also includes: a generation module 305, which is used to generate case information of the user to be identified when it is determined that the user to be identified is a suspicious user; a sending module 306, which is used to send the case information to the expert identification module; a receiving module 307, which is used to receive the identification result returned by the expert identification module, and the identification result includes a positive result and a negative result; the acquisition module 301 is also used to obtain data indicators for identifying the suspicious user based on the positive result; an update module 308, which is used to update the anti-money laundering identification rules in the intelligent model of the rule engine based on the data indicator; a training module 309, which is used to train the machine learning model based on the positive result and the negative result.

[0132] In a possible implementation, the acquisition module 301 is specifically used to generate the data indicator through the intelligent model of the rule engine, based on the algorithm combination of GBDT and LR, or based on the algorithm combination of GBDT and FM.

[0133] In a possible implementation, the generation module 305 is specifically used to generate a graph as the case information based on the target data.

[0134] In a possible implementation, the acquisition module 301 is specifically used to acquire the data of the user to be identified in different databases based on the unique identifier of the user to be identified; and convert the data of the user to be identified in different databases into the target data in a unified standard format.

[0135] In one possible implementation, the determination module 304 is also used to determine similar users and / or associated users of the user to be identified based on the target data when it is determined that the user to be identified is a suspicious user; the suspicious user identification device 300 also includes: a monitoring module 310, which is used to monitor the transactions of the similar users and / or the associated users.

[0136] The suspicious user identification device 300 provided in the embodiment of the present application can be understood by referring to the corresponding contents of the aforementioned suspicious user identification method embodiment part, and will not be repeated here.

[0137] In some other possible embodiments, the present application also provides a computing device, which can be specifically referred to in Figure 4 , Figure 4 This is a schematic diagram of the structure of a computing device provided in an embodiment of the present application. Figure 4 As shown, the computing device 400 provided in the embodiment of the present application includes a processor 410 and a memory 420 .

[0138] Among them, the processor 410 may include one or more processing cores. The processor 410 uses various interfaces and lines to connect various parts within the computing device 400, and executes the methods provided by any one or more of the above embodiments by running or executing instructions, programs, code sets or instruction sets stored in the memory 420, and calling data stored in the memory 420. Optionally, the processor 410 can be implemented in at least one hardware form of digital signal processing (digital signal processing, DSP), field-programmable gate array (field-programmable gate array, FPGA), and programmable logic array (programmable logic array, PLA). The processor 410 can integrate one or a combination of several of a CPU, a graphics processing unit (graphics processing unit, GPU) and a modem. It is understandable that the above-mentioned modem may not be integrated into the processor 410, but may be implemented separately through a communication chip.

[0139] The memory 420 may include a random access memory (RAM) or a read-only memory (ROM). Optionally, the memory 420 includes a non-transitory computer-readable storage medium. The memory 420 may be used to store instructions, programs, codes, code sets, or instruction sets. The memory 420 may include a program storage area. The program storage area may store instructions for implementing an operating system, instructions for implementing at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the method of the embodiment of the present application, etc.

[0140] The processor 410 and the memory 420 are connected to each other through a bus in the computing device 400, which may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 4 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0141] In another embodiment of the present application, a computer-readable storage medium is provided, in which computer-executable instructions are stored. When at least one processor of a device executes the computer-executable instructions, the device executes the method flow described in the above embodiment.

[0142] In another embodiment of the present application, a computer program product is also provided, which includes computer execution instructions, which are stored in a computer-readable storage medium; at least one processor of the device can read the computer execution instructions from the computer-readable storage medium, and at least one processor executes the computer execution instructions so that the device executes the method flow described in the above embodiment.

[0143] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the embodiments of the present application.

[0144] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0145] In the several embodiments provided in the embodiments of the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0146] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0147] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0148] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), disk or optical disk and other media that can store program codes.

Claims

1. A suspicious user identification method, characterized in that: The method comprises: Acquire target data of the user to be identified, the target data including account data, transaction data and associated data of the user to be identified, wherein the associated data is used to indicate the business status of the user to be identified; Inputting the target data into a preset rule engine intelligent model, and outputting a first score based on the target data through the rule engine intelligent model; wherein the rule engine intelligent model is used to calculate the first score based on anti-money laundering identification rules; Inputting the target data into a preset machine learning model, and outputting a second score based on the target data through the machine learning model; Based on the first score and the second score, it is determined whether the user to be identified is a suspicious user.

2. The method according to claim 1, characterized in that The associated data includes at least one of industrial and commercial data, judicial data, public opinion data, China Securities Depository and Clearing Corporation Limited data and Dow Jones List Database data.

3. The method according to claim 1 or 2, characterized in that: After determining whether the user to be identified is a suspicious user, the method further includes: In the case where it is determined that the user to be identified is a suspicious user, generating case information of the user to be identified, and sending the case information to the expert identification module; Receiving the identification result returned by the expert identification module, wherein the identification result includes a positive result and a negative result; Acquire data indicators for identifying the suspicious user based on the positive result, and update anti-money laundering identification rules in the rule engine intelligent model based on the data indicators; Based on the positive result and the negative result, the machine learning model is trained.

4. The method according to claim 3, characterized in that: The acquiring of data indicators for identifying the suspicious user based on the positive result includes: The data indicators are generated through the intelligent model of the rule engine based on an algorithm combination of a gradient boosted decision tree GBDT and a logistic regression LR, or an algorithm combination of a GBDT and a factorization machine FM.

5. The method according to claim 3, characterized in that: The generating the case information of the user to be identified includes: Based on the target data, a graph is generated as the case information.

6. The method according to claim 1 or 2, characterized in that: The step of obtaining target data of the user to be identified includes: Obtaining a unique identifier of the user to be identified; Based on the unique identifier, obtaining data of the user to be identified in different databases; The data of the user to be identified in different databases are converted into the target data in a unified standard format.

7. The method according to claim 1 or 2, characterized in that: After determining whether the user to be identified is a suspicious user, the method further includes: In the case where it is determined that the user to be identified is a suspicious user, determining similar users and / or associated users of the user to be identified based on the target data; The transactions of the similar users and / or the associated users are monitored.

8. A suspicious user identification device, characterized in that: The device comprises: An acquisition module, used to acquire target data of the user to be identified, wherein the target data includes account data, transaction data and associated data of the user to be identified, wherein the associated data is used to indicate the business status of the user to be identified; A first scoring module, used for inputting the target data into a preset rule engine intelligent model, and outputting a first score based on the target data through the rule engine intelligent model; wherein the rule engine intelligent model is used for calculating the first score based on anti-money laundering identification rules; A second scoring module, used for inputting the target data into a preset machine learning model, and outputting a second score based on the target data through the machine learning model; A determination module is used to determine whether the user to be identified is a suspicious user based on the first score and the second score.

9. A computing device, characterized in that The computing device includes a memory and a processor; The memory is coupled to the processor; The memory is used to store computer program instructions; The processor is configured to call the computer program instructions to execute the method according to any one of claims 1-7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions; wherein, when the computer-executable instructions are executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images