Abnormal behavior identification method and device, computer equipment and readable storage medium

Abstract

The invention relates to an abnormal behavior recognition method and device, computer equipment and a readable storage medium, and the method comprises the steps: obtaining multivariate time series data to be recognized, the multivariate time series data being data in financial activities; preprocessing the multivariate time series data and then inputting the preprocessed multivariate time series data into an unsupervised learning model for feature extraction, wherein the unsupervised learning model adopts a clustering algorithm based on deep learning features to perform feature extraction on relationships among variables; calling an unsupervised learning model, and performing clustering analysis on the extracted features by adopting synchronization measurement and elasticity measurement to obtain a clustering analysis result; and calling an unsupervised learning model, evaluating a clustering analysis result by using a contour coefficient and a graph structure clustering algorithm, and obtaining an abnormal financial activity behavior corresponding to the multivariate time sequence data according to an evaluation result. According to the invention, the problem of low efficiency of anti-money laundering discrimination in the prior art is solved.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method and apparatus for identifying abnormal behavior, a computer device and a readable storage medium. Background Art

[0002] With the rapid development of economic globalization, money laundering activities are becoming increasingly rampant around the world, fraud schemes are emerging one after another, and the situation of anti-money laundering financial technology innovation is severe, which seriously threatens the financial systems of countries around the world and has a huge negative impact on social stability and economic development. However, traditional anti-money laundering methods have defects such as serious lag, low efficiency of manual identification, high false alarm rate, insufficient ability to identify complex transaction patterns, and can only obtain a single customer view from a risky perspective. Therefore, the financial industry needs to establish an efficient, intelligent and accurate anti-money laundering intelligent identification device.

[0003] At present, there is no effective solution to the problem of low efficiency in anti-money laundering identification in related technologies. Summary of the invention

[0004] The purpose of this application is to address the deficiencies in the prior art and provide a method, apparatus, computer device and readable storage medium for identifying abnormal behavior, so as to at least solve the problem of low efficiency in anti-money laundering screening in the related art.

[0005] To achieve the above purpose, the technical solution adopted by this application is:

[0006] In a first aspect, an embodiment of the present application provides a method for identifying abnormal behavior, comprising: obtaining multivariate time series data to be identified, wherein the multivariate time series data is data in financial activities; after preprocessing the multivariate time series data, inputting the data into an unsupervised learning model for feature extraction, wherein the unsupervised learning model uses a clustering algorithm based on deep learning features to extract features of the relationship between variables; calling the unsupervised learning model, using synchronous metrics and elastic metrics to perform cluster analysis on the extracted features, and obtaining cluster analysis results; calling the unsupervised learning model, using the silhouette coefficient and graph structure clustering algorithm to evaluate the cluster analysis results, and obtaining the abnormal financial activity behavior corresponding to the multivariate time series data based on the evaluation results.

[0007] In some of the embodiments, after preprocessing the multivariate time series data, the data is input into an unsupervised learning model for feature extraction, including: using an autoencoder as a feature extraction framework to extract relationship features between variables from the multivariate time series data; the autoencoder includes an encoder and a decoder, the encoder is used to select a corresponding type of neural network from multiple neural networks according to the data type and task type to map the input raw data to a hidden representation, the decoder is used to reconstruct the hidden representation back to the original data, each type of neural network structure is used to capture a type of relationship between variables through a deep learning-based clustering algorithm, and the clustering algorithm includes a separable clustering algorithm and an embedded clustering algorithm.

[0008] In some of the embodiments, after preprocessing the multivariate time series data, the data is input into an unsupervised learning model for feature extraction, which also includes: extracting the transaction amount mean, transaction amount standard deviation, transaction amount range and transaction frequency from the multivariate time series data.

[0009] In some of the embodiments, synchronous metrics and elastic metrics are used to perform cluster analysis on the extracted features to obtain cluster analysis results, including: using the covariance sequence-based clustering algorithm CSPCA to preprocess the extracted features, and using a synchronous metric based on point-to-point comparison or Euclidean distance to perform cluster analysis on the preprocessed features to obtain corresponding cluster analysis results, wherein the preprocessing of the extracted features is to process all features to be of equal length and meet the offset requirements; using an elastic metric algorithm to process the features of two multivariate time series data, and using a dynamic time planning algorithm to find the best matching path between the two multivariate time series data, thereby obtaining corresponding cluster analysis results.

[0010] In some of the embodiments, the silhouette coefficient and graph structure clustering algorithm are used to evaluate the clustering analysis results, including: obtaining the silhouette coefficient of each cluster, and using the silhouette coefficient to evaluate the clustering quality of the cluster; using the graph structure clustering algorithm to generate a graph network structure between account entities, detecting abnormal nodes and edges in the graph network structure based on the node degree, centrality and edge weight of the graph network structure, and evaluating the clustering analysis results from the topological domain.

[0011] In some embodiments, obtaining a silhouette coefficient of each cluster and evaluating the clustering quality of the cluster using the silhouette coefficient includes: calculating the silhouette coefficient s(i) of the data point i in the cluster using the following formula:

[0012]

[0013] Where a(i) represents the average distance from data point i to other data points in its cluster, and b(i) represents the average distance from data point i to the nearest cluster in other clusters.

[0014] The silhouette coefficient S of the cluster is calculated using the silhouette coefficients of all data points in the cluster:

[0015]

[0016] Among them, n is the number of data points in the cluster.

[0017] In some of the embodiments, after obtaining abnormal financial activity behaviors corresponding to multivariate time series data based on the evaluation results, it includes: generating a report corresponding to the abnormal financial activities, wherein the report includes basic information of the transaction subject, details of the transaction, and suspicious reasons; submitting the generated report to the target object for further processing by the target object.

[0018] In the second aspect, an embodiment of the present application provides an abnormal behavior identification device, including: an acquisition unit, used to acquire multivariate time series data to be identified, wherein the multivariate time series data is data in financial activities; an extraction unit, used to input the multivariate time series data into an unsupervised learning model for feature extraction after preprocessing the multivariate time series data, wherein the unsupervised learning model uses a clustering algorithm based on deep learning features to extract features of the relationship between variables; a clustering unit, used to call the unsupervised learning model, use synchronization metrics and elasticity metrics to perform cluster analysis on the extracted features, and obtain cluster analysis results; an identification unit, used to call the unsupervised learning model, use the silhouette coefficient and graph structure clustering algorithm to evaluate the cluster analysis results, and obtain the abnormal financial activity behavior corresponding to the multivariate time series data according to the evaluation results.

[0019] In some of the embodiments, the extraction unit is also used to: use an autoencoder as a feature extraction framework to extract relationship features between variables from multivariate time series data; the autoencoder includes an encoder and a decoder, the encoder is used to select a corresponding type of neural network from multiple neural networks according to the data type and task type to map the input raw data to a hidden representation, the decoder is used to reconstruct the hidden representation back to the original data, each type of neural network structure is used to capture a type of relationship between variables through a deep learning-based clustering algorithm, and the clustering algorithm includes a separable clustering algorithm and an embedded clustering algorithm.

[0020] In some of the embodiments, the extraction unit is further used to extract the transaction amount mean, transaction amount standard deviation, transaction amount range and transaction frequency from the multivariate time series data.

[0021] In some of the embodiments, the clustering unit is also used to: use the covariance sequence-based clustering algorithm CSPCA to preprocess the extracted features, and use a synchronous measurement method based on point-to-point comparison or Euclidean distance to perform cluster analysis on the preprocessed features to obtain corresponding cluster analysis results, wherein the preprocessing of the extracted features is to process all features to be of equal length and meet the offset requirements; use an elastic measurement algorithm to process the features of two multivariate time series data, and use a dynamic time planning algorithm to find the best matching path between the two multivariate time series data, thereby obtaining corresponding cluster analysis results.

[0022] In some of the embodiments, the identification unit is also used to: obtain the silhouette coefficient of each cluster, and use the silhouette coefficient to evaluate the clustering quality of the cluster; use a graph structure clustering algorithm to generate a graph network structure between account entities, detect abnormal nodes and edges in the graph network structure based on the node degree, centrality and edge weight of the graph network structure, and evaluate the clustering analysis results from the topological domain.

[0023] In some embodiments, the recognition unit is further used to calculate the silhouette coefficient s(i) of the data point i in the cluster using the following formula:

[0024]

[0025] Where a(i) represents the average distance from data point i to other data points in its cluster, and b(i) represents the average distance from data point i to the nearest cluster in other clusters.

[0026] The silhouette coefficient S of the cluster is calculated using the silhouette coefficients of all data points in the cluster:

[0027]

[0028] Among them, n is the number of data points in the cluster.

[0029] In some of the embodiments, the identification unit is also used to: generate a report corresponding to the abnormal financial activity, wherein the report includes basic information of the transaction subject, details of the transaction and suspicious reasons; and submit the generated report to the target object for further processing by the target object.

[0030] In a third aspect, an embodiment of the present application provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the method for identifying abnormal behavior as described in the first aspect above is implemented.

[0031] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method for identifying abnormal behavior as described in the first aspect above.

[0032] This application adopts the above technical scheme to obtain multivariate time series data to be identified, wherein the multivariate time series data is data in financial activities; after preprocessing the multivariate time series data, the data is input into the unsupervised learning model for feature extraction, wherein the unsupervised learning model uses a clustering algorithm based on deep learning features to extract features of the relationship between variables; the unsupervised learning model is called, and the extracted features are clustered using synchronization metrics and elasticity metrics to obtain clustering analysis results; the unsupervised learning model is called, and the clustering analysis results are evaluated using the silhouette coefficient and graph structure clustering algorithm, and the abnormal financial activity behavior corresponding to the multivariate time series data is obtained according to the evaluation results. This scheme is based on the multivariate time series clustering algorithm. By strengthening the optimization of the anti-money laundering unsupervised learning model from the perspectives of data feature extraction, optimizing the data analysis process based on the similarity measurement algorithm, and clustering result evaluation, it can quickly locate abnormal financial behaviors and solve the problem of low efficiency in anti-money laundering identification in related technologies.

[0033] Details of one or more embodiments of the present application are set forth in the following drawings and description to make other features, objects, and advantages of the present application more readily apparent. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0035] Figure 1 is a structural block diagram of a mobile terminal according to an embodiment of the present application;

[0036] Figure 2 is a flow chart of a method for identifying abnormal behavior according to an embodiment of the present application;

[0037] Figure 3 It is a flow chart of the logic method of the anti-money laundering optimization scheme according to the preferred embodiment of the present application;

[0038] Figure 4 It is a schematic diagram of the scheme logic according to the preferred embodiment of the present application;

[0039] Figure 5 is a schematic diagram of a clustering solution according to a preferred embodiment of the present application;

[0040] Figure 6 is a schematic diagram of a time series according to a preferred embodiment of the present application;

[0041] Figure 7 is a schematic diagram of a time series according to a preferred embodiment of the present application;

[0042] Figure 8 is a schematic diagram of the clustering result according to the preferred embodiment of the present application;

[0043] Fig. 9 is a structural block diagram of an abnormal behavior identification device according to an embodiment of the present application;

[0044] Fig.10 Schematic diagram of the hardware structure of a computer device according to an embodiment of the present application. DETAILED DESCRIPTION

[0045] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application is described and illustrated below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not intended to limit the present application. Based on the embodiments provided in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application.

[0046] Obviously, the drawings described below are only some examples or embodiments of the present application. For ordinary technicians in this field, the present application can also be applied to other similar scenarios based on these drawings without creative work. In addition, it can also be understood that although the efforts made in this development process may be complicated and lengthy, for ordinary technicians in this field related to the content disclosed in this application, some changes in design, manufacturing or production based on the technical content disclosed in this application are just conventional technical means, and should not be understood as insufficient content disclosed in this application.

[0047] Reference to "embodiments" in this application means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those of ordinary skill in the art that the embodiments described in this application may be combined with other embodiments without conflict.

[0048] Unless otherwise defined, the technical terms or scientific terms involved in this application should be understood by people with ordinary skills in the technical field to which this application belongs. The words "one", "a", "a", "the" and the like involved in this application do not indicate a quantitative limitation, and may represent the singular or plural. The terms "include", "comprise", "have" and any of their variations involved in this application are intended to cover non-exclusive inclusions; for example, a process, method, system, product or device that includes a series of steps or modules (units) is not limited to the listed steps or units, but may also include steps or units that are not listed, or may also include other steps or units inherent to these processes, methods, products or devices. The words "connect", "connected", "coupled" and the like involved in this application are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. The "multiple" involved in this application refers to two or more. "And / or" describes the association relationship of associated objects, indicating that there may be three relationships, for example, "A and / or B" can represent: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the objects before and after are in an "or" relationship. The terms "first", "second", "third", etc. involved in this application are only used to distinguish similar objects and do not represent a specific ordering of the objects.

[0049] This embodiment provides a mobile terminal. Figure 1 is a structural block diagram of a mobile terminal according to an embodiment of the present application. Figure 1 As shown, the mobile terminal includes: a radio frequency (RF) circuit 110, a memory 120, an input unit 130, a display unit 140, a sensor 150, an audio circuit 160, a wireless fidelity (WiFi) module 170, a processor 180, and a power supply 190. Those skilled in the art will understand that Figure 1 The structure of the mobile terminal shown in the figure does not constitute a limitation on the mobile terminal, and may include more or less components than shown in the figure, or combine certain components, or arrange the components differently.

[0050] Combine the following Figure 1 The following is a detailed introduction to the various components of the mobile terminal:

[0051] The RF circuit 110 can be used for receiving and sending signals during the process of sending and receiving information or making calls. In particular, after receiving the downlink information of the base station, it is sent to the processor 180 for processing; in addition, the designed uplink data is sent to the base station. Usually, the RF circuit includes but is not limited to an antenna, at least one amplifier, a transceiver, a coupler, a low noise amplifier (Low Noise Amplifier, referred to as LNA), a duplexer, etc. In addition, the RF circuit 110 can also communicate with the network and other devices through wireless communication. The above-mentioned wireless communication can use any communication standard or protocol, including but not limited to the Global System of Mobile communication (GSM), General Packet Radio Service (GPRS), Code Division Multiple Access (CDMA), Wideband Code Division Multiple Access (WCDMA), Long Term Evolution (LTE), email, Short Messaging Service (SMS), etc.

[0052] The memory 120 can be used to store software programs and modules. The processor 180 executes various functional applications and data processing of the mobile terminal by running the software programs and modules stored in the memory 120. The memory 120 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area may store data created according to the use of the mobile terminal (such as audio data, a phone book, etc.), etc. In addition, the memory 120 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0053] The input unit 130 can be used to receive input digital or character information, and to generate key signal input related to the user settings and function control of the mobile terminal. Specifically, the input unit 130 may include a touch panel 131 and other input devices 132. The touch panel 131, also known as a touch screen, can collect the user's touch operation on or near it (such as the user's operation on the touch panel 131 or near the touch panel 131 using any suitable object or accessory such as a finger, stylus, etc.), and drive the corresponding connection device according to a pre-set program. Optionally, the touch panel 131 may include two parts: a touch detection device and a touch controller. Among them, the touch detection device detects the user's touch orientation, detects the signal brought by the touch operation, and transmits the signal to the touch controller; the touch controller receives the touch information from the touch detection device, converts it into contact coordinates, and then sends it to the processor 180, and can receive and execute commands sent by the processor 180. In addition, the touch panel 131 can be implemented in various types such as resistive, capacitive, infrared, and surface acoustic waves. In addition to the touch panel 131, the input unit 130 may also include other input devices 132. Specifically, other input devices 132 may include but are not limited to one or more of a physical keyboard, function keys (such as volume control keys, switch keys, etc.), a trackball, a mouse, a joystick, etc.

[0054] The display unit 140 can be used to display information input by the user or information provided to the user and various menus of the mobile terminal. The display unit 140 may include a display panel 141. Optionally, the display panel 141 may be configured in the form of a liquid crystal display (LCD), an organic light-emitting diode (OLED), etc. Further, the touch panel 131 may cover the display panel 141. When the touch panel 131 detects a touch operation on or near it, it is transmitted to the processor 180 to determine the type of touch event. Subsequently, the processor 180 provides a corresponding visual output on the display panel 141 according to the type of touch event. Although in Figure 1 In the embodiment, the touch panel 131 and the display panel 141 are used as two independent components to implement the input and output functions of the mobile terminal, but in some embodiments, the touch panel 131 and the display panel 141 can be integrated to implement the input and output functions of the mobile terminal.

[0055] The mobile terminal may also include at least one sensor 150, such as a light sensor, a motion sensor, and other sensors. Specifically, the light sensor may include an ambient light sensor and a proximity sensor, wherein the ambient light sensor may adjust the brightness of the display panel 141 according to the brightness of the ambient light, and the proximity sensor may turn off the display panel 141 and / or the backlight when the mobile terminal is moved to the ear. As a type of motion sensor, the accelerometer sensor can detect the magnitude of acceleration in all directions (generally three axes), and can detect the magnitude and direction of gravity when stationary. It can be used for applications that identify the posture of the mobile terminal (such as horizontal and vertical screen switching, related games, magnetometer posture calibration), vibration recognition related functions (such as pedometer, tapping), etc.; as for other sensors that can be configured in the mobile terminal, such as gyroscopes, barometers, hygrometers, thermometers, infrared sensors, etc., they will not be repeated here.

[0056] The speaker 161 and microphone 162 in the audio circuit 160 can provide an audio interface between the user and the mobile terminal. The audio circuit 160 can transmit the received audio data to the speaker 161 after converting the received audio data into an electrical signal, which is converted into a sound signal for output; on the other hand, the microphone 162 converts the collected sound signal into an electrical signal, which is received by the audio circuit 160 and converted into audio data, and then the audio data is output to the processor 180 for processing, and then sent to another mobile terminal through the RF circuit 110, or the audio data is output to the memory 120 for further processing.

[0057] WiFi is a short-range wireless transmission technology. Mobile terminals can help users send and receive emails, browse web pages, and access streaming media through WiFi module 170. It provides users with wireless broadband Internet access. Figure 1 A WiFi module 170 is shown, but it is understandable that it is not an essential component of the mobile terminal and can be omitted as needed without changing the essence of the invention, or replaced with other short-range wireless transmission modules, such as a Zigbee module or a WAPI module.

[0058] The processor 180 is the control center of the mobile terminal. It uses various interfaces and lines to connect various parts of the entire mobile terminal. It executes various functions of the mobile terminal and processes data by running or executing software programs and / or modules stored in the memory 120, and calling data stored in the memory 120, so as to monitor the mobile terminal as a whole. Optionally, the processor 180 may include one or more processing units; preferably, the processor 180 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface and application programs, etc., and the modem processor mainly processes wireless communications. It is understandable that the above-mentioned modem processor may not be integrated into the processor 180.

[0059] The mobile terminal also includes a power supply 190 (such as a battery) for supplying power to various components. Preferably, the power supply can be logically connected to the processor 180 through a power management system, so that the power management system can manage charging, discharging, power consumption and other functions.

[0060] Although not shown, the mobile terminal may also include a camera, a Bluetooth module, etc., which will not be described in detail here.

[0061] In this embodiment, the processor 180 is configured to: obtain multivariate time series data to be identified, wherein the multivariate time series data is data in financial activities; after preprocessing the multivariate time series data, input the data into an unsupervised learning model for feature extraction, wherein the unsupervised learning model uses a clustering algorithm based on deep learning features to extract features of the relationship between variables; call the unsupervised learning model, use synchronization metrics and elasticity metrics to perform cluster analysis on the extracted features, and obtain cluster analysis results; call the unsupervised learning model, use the silhouette coefficient and graph structure clustering algorithm to evaluate the cluster analysis results, and obtain abnormal financial activity behavior corresponding to the multivariate time series data based on the evaluation results.

[0062] In some of the embodiments, the processor 180 is further configured to: use the covariance sequence-based clustering algorithm CSPCA to preprocess the extracted features, and use a synchronous measurement method based on point-to-point comparison or Euclidean distance to perform cluster analysis on the preprocessed features to obtain corresponding cluster analysis results, wherein the preprocessing of the extracted features is to process all features to be of equal length and meet the offset requirements; use an elastic measurement algorithm to process the features of the two multivariate time series data, and use a dynamic time planning algorithm to find the best matching path between the two multivariate time series data, thereby obtaining corresponding cluster analysis results.

[0063] This embodiment provides a method for identifying abnormal behavior. Figure 2 is a flow chart of a method for identifying abnormal behavior according to an embodiment of the present application, such as Figure 2 As shown, the process includes the following steps:

[0064] Step S201, obtaining multivariate time series data to be identified, where the multivariate time series data is data in financial activities.

[0065] Multivariate time series can be expressed as X = (x1(t), x2(t), …, x m(t)), where t = 1, 2, ..., n. Where n is the size of the time dimension and m is the number of variables. The multivariate time series X can be regarded as a collection of m univariate time series, each of which has a length of n. With the advent of the data age, the explosive growth of data has enabled the multivariate time series data type to have sufficient sample size in various fields to support the multivariate time series clustering algorithm to complete data analysis. The financial field has a large amount of high-quality sample data, so it can be fully applied in artificial intelligence anti-money laundering.

[0066] Step S202, after preprocessing the multivariate time series data, input it into an unsupervised learning model for feature extraction, and the unsupervised learning model uses a clustering algorithm based on deep learning features to extract features of the relationship between variables.

[0067] Step S203, calling the unsupervised learning model, using the synchronization metric and the elastic metric to perform cluster analysis on the extracted features, and obtaining a cluster analysis result.

[0068] Step S204, calling the unsupervised learning model, using the silhouette coefficient and graph structure clustering algorithm to evaluate the clustering analysis results, and obtaining the abnormal financial activity behavior corresponding to the multivariate time series data based on the evaluation results.

[0069] Through the above steps, the multivariate time series data to be identified is obtained, and the multivariate time series data is the data in financial activities; after preprocessing the multivariate time series data, the data is input into the unsupervised learning model for feature extraction, wherein the unsupervised learning model uses a clustering algorithm based on deep learning features to extract features of the relationship between variables; the unsupervised learning model is called, and the extracted features are clustered using synchronous metrics and elastic metrics to obtain clustering analysis results; the unsupervised learning model is called, and the clustering analysis results are evaluated using the silhouette coefficient and graph structure clustering algorithm, and the abnormal financial activity behavior corresponding to the multivariate time series data is obtained according to the evaluation results. This scheme is based on the multivariate time series clustering algorithm. By strengthening the optimization of the anti-money laundering unsupervised learning model from the perspectives of data feature extraction, optimizing the data analysis process based on the similarity measurement algorithm, and clustering result evaluation, it can accurately identify abnormal financial behaviors such as money laundering. This scheme can use artificial intelligence to quickly locate abnormal financial behaviors while ensuring accuracy, solving the problem of low efficiency in anti-money laundering identification in related technologies.

[0070] In some of the embodiments, when extracting features, an autoencoder is used as a framework for feature extraction to extract relationship features between variables from multivariate time series data; the autoencoder includes an encoder and a decoder, the encoder is used to select a corresponding type of neural network from multiple neural networks according to the data type and task type to map the input raw data to a hidden representation, the decoder is used to reconstruct the hidden representation back to the original data, and each type of neural network structure is used to capture a type of relationship between variables through a clustering algorithm based on deep learning, and the clustering algorithm includes a separation clustering algorithm and an embedded clustering algorithm. In addition to this complex feature, this solution also extracts features such as the mean transaction amount, the standard deviation of the transaction amount, the range of the transaction amount, and the transaction frequency.

[0071] General clustering algorithms cannot take into account the extraction of time dimensions and the relationship characteristics between variables, and different models are more effective in specific data scenarios, which makes the transferability of model-based clustering algorithms low. In addition, since the model fitting process consumes a lot of time and space resources, this type of algorithm is not suitable for anti-money laundering work with huge amounts of data. This solution introduces a clustering algorithm based on deep learning features. Deep models such as convolutional neural networks (CNNs) and recurrent neural networks (RNNs) can effectively process high-dimensional data, capture complex relationships between variables, and reduce the dependence of money laundering action recognition process on manual intervention.

[0072] In some of the embodiments, synchronous metrics and elastic metrics are used to perform cluster analysis on the extracted features to obtain cluster analysis results. The covariance sequence-based clustering algorithm CSPCA can be used to preprocess the extracted features, and a synchronous metric based on point-to-point comparison or Euclidean distance is used to perform cluster analysis on the preprocessed features to obtain corresponding cluster analysis results, wherein the preprocessing of the extracted features is to process all features to be of equal length and meet the offset requirements; the elastic metric algorithm is used to process the features of two multivariate time series data, and the dynamic time planning algorithm is used to find the best matching path between the two multivariate time series data, thereby obtaining the corresponding cluster analysis results.

[0073] When calculating the distance between time series, synchronous measurement compares each time point point-to-point. Its application in data analysis is reflected in the point-to-point matching of the amount, frequency, and location of transactions under similar conditions during the crime period of the gang involved to determine whether there is a risk of money laundering. Due to the randomness of transaction behavior, the transaction behavior may be similar, but the time series often have differences on the time axis. Therefore, based on the elastic measurement algorithm DTW, a dynamic time planning algorithm is used to find the best matching path between two time series. The DTW distance can be used to measure the similarity of transaction behavior sequences of different customers.

[0074] In some of the embodiments, during the evaluation, the silhouette coefficient of each cluster may be obtained, and the clustering quality of the cluster may be evaluated using the silhouette coefficient:

[0075] The silhouette coefficient s(i) of data point i in the cluster can be calculated using the following formula:

[0076]

[0077] Where a(i) represents the average distance from data point i to other data points in its cluster, and b(i) represents the average distance from data point i to the nearest cluster in other clusters.

[0078] The silhouette coefficient S of the cluster is calculated using the silhouette coefficients of all data points in the cluster:

[0079]

[0080] Among them, n is the number of data points in the cluster.

[0081] The silhouette coefficient value range is between [-1, 1]. The closer it is to 1, the better the clustering effect is. The closer it is to 0, the poorer the clustering effect is. The closer it is to -1, the data point may be misclassified.

[0082] When conducting the evaluation, you can also use the graph structure clustering algorithm to generate a graph network structure between account entities, detect abnormal nodes and edges in the graph network structure based on the node degree, centrality and edge weight of the graph network structure, and evaluate the clustering analysis results from the topological domain.

[0083] Financial transaction data can be constructed into a large graph structure, where nodes represent accounts or transaction entities, and edges represent transaction relationships. Through graph structure clustering algorithms, accounts with close transaction connections can be clustered into one category. For example, frequent large-amount fund transfers between certain accounts will form strongly connected edges in the graph. The algorithm can quickly discover these closely related account groups and help identify possible money laundering gangs. For those accounts that seem to be scattered but actually have hidden connections, they can also be effectively mined through graph structure analysis.

[0084] In some of the embodiments, after obtaining abnormal financial activity behaviors corresponding to multivariate time series data based on the evaluation results, a report corresponding to the abnormal financial activities can be generated, including basic information of the transaction subject, details of the transaction, and suspicious reasons; the generated report is submitted to the target object for further processing by the target object.

[0085] This solution focuses on multivariate time series clustering algorithms, and optimizes the feature extraction, clustering analysis, and anomaly detection stages in the anti-money laundering process. For example, in the feature extraction stage, clustering algorithms based on deep learning features (such as the deep clustering framework using autoencoders AE) and multiple transaction feature calculations are used; the clustering analysis stage is optimized using synchronous metrics (such as the Euclidean distance algorithm) and elastic metrics (such as DTW and its improved algorithms); the clustering result evaluation stage uses silhouette coefficients and graph structure clustering algorithms (such as spectral clustering, Louvain algorithm, etc.).

[0086] This solution proposes a clustering algorithm based on deep learning features, using the autoencoder (AE) framework, including separation and embedded clustering methods. At the same time, the transaction amount mean, standard deviation, range and transaction frequency are calculated to assist in identifying money laundering behavior.

[0087] This scheme adopts clustering algorithms of synchronous measurement (based on Euclidean distance algorithm combined with CSPCA preprocessed data) and elastic measurement (based on DTW and its improved algorithms DTWO and DTWI to calculate time series similarity) in cluster analysis, and measures the similarity of transaction behavior sequences by point-to-point comparison or finding the best matching path to determine the money laundering risk.

[0088] This scheme uses the silhouette coefficient to measure the clustering quality (obtained by calculating the average distance from the data point to the cluster and other clusters). At the same time, the clustering process is converted into a graph partitioning problem. Spectral clustering and other graph structure clustering algorithms are used to detect abnormal nodes and edges based on factors such as node degree, centrality and edge weight, and the clustering effect is evaluated from the topological domain.

[0089] The embodiments of the present application are described and illustrated below through preferred embodiments.

[0090] Figure 3 It is a flow chart of the logic method of the anti-money laundering optimization scheme according to the preferred embodiment of the present application. The anti-money laundering process combined with AI algorithm can include data collection, data preprocessing, feature extraction, cluster analysis, cluster result evaluation, anomaly detection, result processing and decision-making. This invention mainly combines multivariate time series clustering algorithm to optimize the feature extraction stage, cluster analysis stage and anomaly detection stage. Figure 4 ,This scheme is based on multivariate time series clustering algorithm and ,strengthens the optimization of the anti-money laundering unsupervised learning model from the ,angles of data feature extraction, optimization of data analysis ,process based on similarity measurement algorithm, and clustering result evaluation.

[0091] 1) Optimization of data feature extraction method:

[0092] Based on the clustering algorithm of high-dimensional characteristics of data, multivariate time series data has a high degree of recognition in the time dimension. In the application of anti-money laundering, it is reflected in the transaction flow and other data that are strongly related to time. Based on these data, the core features of time series data are extracted through mathematical transformation or model. Commonly used minimum-maximum normalization formula:

[0093] For a variable x in a multivariate time series, the normalized result x new The calculation formula is:

[0094]

[0095] Where max(x) and min(x) are the minimum and maximum values ​​of the variable among all data points, respectively.

[0096] The above clustering algorithms cannot take into account the extraction of time dimension and relationship characteristics between variables, and different models are more effective in specific data scenarios, which makes the model-based clustering algorithm less transferable. In addition, since the model fitting process consumes a lot of time and space resources, this type of algorithm is not suitable for anti-money laundering work with huge data volumes. At this time, it is necessary to introduce a clustering algorithm based on deep learning features. Deep models such as convolutional neural networks (CNNs) and recurrent neural networks (RNNs) can effectively process high-dimensional data, capture complex relationships between variables, and reduce the dependence of money laundering action recognition processes on manual intervention. There are two main methods: separate clustering and embedded clustering. The algorithm structure is as follows: Figure 5 shown.

[0097] The deep clustering based on Auto Encoder (AE) is used as the feature extraction framework. w and decoder g u The encoder is responsible for mapping the input data to a hidden representation (data features), while the decoder reconstructs this representation back to the original data. Depending on the type of data and task being processed, the encoder and decoder parts of the autoencoder can use different types of neural network structures, including fully connected networks, convolutional neural networks (CNNs), and recurrent neural networks (RNNs). By reconstructing the input samples, the sample features z are learned. i =f w (x i ), that is, the loss function is:

[0098]

[0099] Separate clustering directly clusters the feature results of the deep network layer; embedded clustering is the same as f w (x i) together with the clustering loss (such as K-mean) to complete the deep clustering task. AE constrains the feature z i , ensuring the accuracy of money laundering feature extraction.

[0100] In the process of anti-money laundering feature extraction, the transaction amount fluctuation feature is particularly important. Some features are extracted as follows:

[0101] a) Average transaction amount

[0102] Assume that the transaction amount time series is {x1,x2,...,x n}, the mean calculation formula is:

[0103]

[0104] b) Standard deviation of transaction amount:

[0105]

[0106] c) Extremely poor transaction amount:

[0107] Range R = max(x i )-min(x i ), which is the maximum minus the minimum transaction amount in the time series.

[0108] d) Trading frequency

[0109] The transaction frequency can be simply defined as the number of transactions in a specific time period. Let the time period be [t1, t2], and the set of transaction time points be {t i1 ,t i2 ,...,t in}, the transaction frequency f is calculated as:

[0110]

[0111] Where n is the number of transactions that occurred during that time period.

[0112] 2) Optimize the clustering analysis process based on similarity measurement algorithm

[0113] In time series data analysis, similarity measurements in the same or similar time series of sample data are recorded. For example, if customers in the same region have similar behaviors such as account opening, trading, and cash withdrawal in the same time period, these behaviors can be regarded as individual variables, and the similarity distances on each variable can be integrated. Such as the extended DTW algorithm, PCA similarity factor algorithm, etc. According to the characteristics of the similarity measurement method, the synchronous measurement clustering algorithm and the elastic measurement clustering algorithm are used here to optimize the anti-money laundering data analysis process.

[0114] When calculating the distance between time series, synchronous measurement is performed by comparing each time point point to point. The application in data analysis is reflected in the fact that during the crime period, when the gangs involved are involved, under certain similar conditions, the amount, frequency, and location of the transaction are matched point to point to determine whether there is a risk of money laundering. The Euclidean distance algorithm is used for data analysis of multivariate time series feature data. The formula is:

[0115]

[0116] First, the covariance sequence clustering algorithm CSPCA is used to preprocess the sample data based on equal-length feature variables so that the data meets the requirements of equal length and no offset, and the similarity between features is calculated to analyze the correlation between similarity measures.

[0117] Due to the randomness of transaction behavior, the transaction behaviors may be similar, but the time series often have differences on the time axis. At this time, we use the elastic measurement algorithm DTW and the dynamic time planning algorithm to find the best matching path between the two time series.

[0118] Figure 6 The two bold lines in the figure represent two time series, and the line between them represents the characteristic distance between them, which is called the regularized path distance. Figure 7 As shown, suppose the time series to be calculated for similarity are X and Y, with lengths of m and n respectively. The form of the regularized path is W = {w1,w2,...,w k},w k The path W must be in the form of (i, j), where i represents the i-th data point in X and j represents the j-th data point in Y. i =(1,1) to w k =(|X|,|Y|) to ensure that every data point in X and Y appears in W. Based on the DTW algorithm, further optimization is formed to form an algorithm suitable for multivariate time series data DTW O and DTW I Algorithm. If Q and C are two multivariate time series samples, let's assume that they both have two variables x and y. The algorithm formula is as follows:

[0119] DTW D (Q,C)=DTW({Qx,Qy},{Cx,Cy}),

[0120] DTW I (Q,C)=DTW(Qx,Cx)+DTW(Qy,Cy),

[0121] Suppose there are two time series X = [x1, x2, ..., x m] and Y=[y1,y2,...,y m ], where m and n are the lengths of the two sequences respectively. The DTW distance is calculated by constructing a cumulative distance matrix D.

[0122] First, initialize D(1,1)=d(x1,y1), where d(x i ,y i ) is x i and i Some basic distance metric between (e.g. Euclidean distance):

[0123]

[0124] Then, i = 2, ..., m and j = 2, ..., n, calculate:

[0125] D(i, j) = d(x i ,y j )+min{D(i-1, j-1), D(i-1, j), D(i, j-1)}.

[0126] Finally, DTW distance DTW(X,Y) = D(m,n). In anti-money laundering applications, the time series may be a customer's transaction amount series or transaction frequency series, etc. The DTW distance can be used to measure the similarity of different customer transaction behavior series.

[0127] 3) Optimize the clustering result evaluation process based on the clustering partitioning framework

[0128] Clustering is to divide a group of data without prior category knowledge into different clusters according to the data distribution structure and correlation, so that the data objects in the same cluster are as close as possible, and the data objects in different clusters are as far apart as possible, such as Figure 8 shown.

[0129] The algorithms for partitioning and clustering include K-means algorithm, Fuzzy C-Means (FCM) algorithm and K-shape algorithm.

[0130] Probability density function of Gaussian mixture model:

[0131] Assume that the data is a mixture of k Gaussian distributions. For a data point x, the probability density function p(x) is calculated as:

[0132]

[0133] Among them, π j is the mixing coefficient of the th Gaussian distribution, satisfying The mean is μ j, standard deviation is σ j The probability density function of the Gaussian distribution is calculated as follows:

[0134]

[0135] In the clustering process, by estimating the parameters of the model (such as π j , μ j , σ j After clustering is completed, its results need to be objectively evaluated. At this time, we use the silhouette coefficient formula to measure the clustering quality.

[0136] Let a(i) be the average distance from data point i to other data points in its cluster, and b(i) be the average distance from data point i to the nearest cluster in other clusters. The calculation formula of the silhouette coefficient s(i) of data point i is:

[0137]

[0138] The silhouette coefficient S of the entire cluster is the average of the silhouette coefficients of all data points, that is:

[0139]

[0140] The silhouette coefficient value range is between [-1, 1]. The closer it is to 1, the better the clustering effect is. The closer it is to 0, the poorer the clustering effect is. The closer it is to -1, the data point may be misclassified.

[0141] In the clustering process, when the distances between all data samples are obtained, a data relationship similar to a graph structure is actually constructed. In the graph model, each node represents a data sample, and the weight and connection state of the edge represent the similarity between samples. The clustering process is transformed into a graph partitioning problem. The goal is to find the optimal graph partitioning strategy so that the edge weight (i.e., node similarity) within the same cluster is maximized, while the edge weight between different clusters is minimized. For example, spectral clustering community detection algorithm, spectral clustering is a popular clustering method based on graph theory. It uses the similarity between data points to construct a similarity matrix, and then clusters by calculating the eigenvectors of the Laplacian matrix of the graph. Community discovery algorithms are mainly used to discover highly connected node sets in the graph. Common algorithms include: Modularity Maximization, Louvain algorithm, Girvan-Newman algorithm, etc. Based on the similarity measurement method, the time series is converted from the spatiotemporal domain to the topological domain to form a graph network structure.

[0142] Financial transaction data can be constructed into a large graph structure, where nodes represent accounts or transaction entities, and edges represent transaction relationships. Through graph structure clustering algorithms, accounts with close transaction connections can be clustered into one category. For example, frequent large-amount fund transfers between certain accounts will form strongly connected edges in the graph. The algorithm can quickly discover these closely related account groups and help identify possible money laundering gangs. For those accounts that seem to be scattered but actually have hidden connections, they can also be effectively mined through graph structure analysis.

[0143] In the constructed transaction relationship graph, normal transaction behaviors usually form a relatively stable and conventional graph structure pattern. However, abnormal transaction behaviors such as money laundering will cause some abnormal nodes and edges to appear in the graph. The graph structure clustering algorithm can detect abnormal nodes and edges that are significantly different from the normal transaction pattern based on the node's degree, centrality and other characteristics, as well as the edge weight, connection pattern and other factors. These abnormal nodes may represent suspicious accounts, and abnormal edges may represent abnormal transaction relationships, providing important clues for anti-money laundering monitoring.

[0144] 1) Build a transaction relationship network

[0145] Identifying account associations: Financial transaction data can be constructed into a large graph structure, where nodes represent accounts or transaction entities and edges represent transaction relationships. Through graph structure clustering algorithms, accounts with close transaction connections can be clustered into one category. For example, frequent large-scale fund transfers between certain accounts will form strongly connected edges in the graph. The algorithm can quickly discover these closely related account groups and help identify possible money laundering gangs. For those accounts that seem to be scattered but actually have hidden associations, they can also be effectively mined through graph structure analysis.

[0146] Discovering complex transaction patterns: The transaction patterns of money laundering activities are often complex and hidden, not just simple one-to-one transactions. Graph structure clustering algorithms can handle complex transaction structures such as many-to-many and ring-shaped. For example, it is found that some accounts transfer and disperse funds through multiple intermediate accounts, forming a complex fund flow network. By identifying such complex transaction patterns, suspicious transaction behaviors and money laundering suspicions can be more accurately located.

[0147] 2) Identify abnormal nodes

[0148] High transaction frequency nodes: The transaction frequency is determined by analyzing the degree of the node (the number of edges connected to the node). In the anti-money laundering graph network, money laundering accounts usually have a high transaction frequency. For example, a node that trades with a large number of other nodes in a short period of time and whose degree is far higher than the average level of normal accounts may be a suspicious sign. For example, a normal personal savings account may have an average of 10-20 transactions per month, but a suspicious account may have hundreds of transactions.

[0149] Abnormal funds inflow / outflow nodes: Observe the in-degree (number of transaction edges for inflow funds) and out-degree (number of transaction edges for outflow funds) of the nodes. If a node continues to have a large amount of funds flowing in, but the outflow direction is relatively concentrated, or vice versa, this may indicate money laundering. For example, if a corporate account frequently receives small amounts of funds from multiple different personal accounts (high in-degree), and then transfers the funds to an overseas account (relatively concentrated out-degree), it needs to be paid special attention.

[0150] Centrality abnormal nodes: Calculate node centrality indicators such as betweenness centrality (measures how often a node appears on the shortest path between other nodes) and closeness centrality (reflects the average distance from a node to other nodes). In a money laundering network, certain accounts used for fund transfer may have high betweenness centrality because they play a key bridge role in the fund flow path.

[0151] 3) Discover abnormal edges (transaction relationships)

[0152] Frequent transaction edge: The weight of the analysis edge (which can be determined comprehensively based on the transaction amount, transaction frequency, etc.). If the transaction relationship represented by an edge frequently has large transactions and does not conform to the normal transaction pattern of the account, this may be abnormal. For example, if high amounts of funds are transferred between two personal accounts every day, and there is no obvious economic connection between the holders of the two accounts (such as kinship, business partnership, etc.) to explain such frequent large transactions, there may be a risk of money laundering.

[0153] Edges with abnormal time patterns: Consider the transaction time factor and observe whether the transactions represented by the edge are conducted during non-working hours or at times that do not conform to the normal transaction cycle. For example, a large number of fund transfers occur late at night or on holidays, which is inconsistent with normal business transaction hours and may be a sign of money laundering activities trying to evade supervision.

[0154] Edges with abnormal fund flows: Trace the path of fund flows and observe the direction of the edges. If funds are found to flow between multiple accounts in a complex but regular manner, such as forming a circular flow or concentrated flow to accounts of a specific type (such as overseas accounts, high-risk industry accounts), this may be a fund flow pattern for money laundering.

[0155] 4) Detecting abnormal subgraphs (suspected money laundering gangs)

[0156] Tightly connected subgraph: A tightly connected subgraph structure is discovered through clustering algorithms. In money laundering activities, the accounts between gang members usually form relatively tight connections, and funds frequently flow between these accounts. For example, a money laundering gang may use multiple accounts to conceal the source and destination of funds through layer-by-layer transfers, splits, and mergers. These accounts form a tightly connected subgraph in the graph network.

[0157] Isolated subgraphs or subgraphs isolated from normal communities: Some money laundering networks may try to hide themselves, forming relatively isolated subgraphs with less contact with normal transaction communities. If such subgraphs are found and the transaction behaviors in them are abnormal (such as transaction amounts, frequencies, etc. that do not conform to normal patterns), they also need to be paid special attention.

[0158] Internal transaction pattern consistency of the subgraph: Analyze whether the transaction pattern within the subgraph is consistent, such as the distribution of transaction amounts, the regularity of transaction time, etc. The transaction pattern of a money laundering gang may show certain regularity, such as transactions of the same amount or proportional amounts at fixed time intervals. This consistency may be a feature of money laundering activities.

[0159] 5) Compare normal trading patterns with abnormal patterns

[0160] Establish a normal transaction graph: Use historical data and known normal transaction behaviors to build a graph network model of normal transactions, including normal connection relationships between accounts, distribution of transaction amounts and frequencies, etc. By comparing the currently detected graph network structure with the normal transaction graph, it is easier to find differences.

[0161] Set thresholds and rules: According to the statistical characteristics of normal transaction graphs, set reasonable thresholds for indicators such as node degree, edge weight, centrality, and some rules for transaction patterns. When the detected transaction behavior exceeds these thresholds or violates the rules, an anti-money laundering alarm is triggered. For example, if the median transaction amount between normal accounts is 1,000 yuan, then a threshold can be set. For example, transactions exceeding 100,000 yuan require further review, and other indicators can be combined to determine whether there is a money laundering risk.

[0162] 6) Dynamic monitoring and updating

[0163] Real-time update of graph network: As new transaction data is continuously generated, the anti-money laundering graph network structure is updated in real time to promptly capture new abnormal transaction patterns and money laundering behaviors. For example, the transaction system of a financial institution can integrate new transaction data into the graph network for re-analysis at regular intervals (such as a few minutes or hours).

[0164] Adapt to changes in money laundering methods: Money launderers may constantly change their money laundering methods, so the anti-money laundering detection system needs to continuously adjust the graph network analysis methods and detection rules according to the emerging money laundering patterns and transaction behaviors. This may include updating the parameters of the clustering algorithm, adjusting the threshold, adding new feature indicators, etc. to improve the accuracy of detection.

[0165] With the continuous development of financial technology, new money laundering methods continue to emerge. Multivariate time series clustering algorithms can adapt to new money laundering methods and transaction patterns by continuously learning and updating models, maintaining sensitivity and monitoring capabilities for money laundering activities.

[0166] If it is determined that there is a high suspicion of money laundering, take appropriate measures, such as freezing accounts, conducting in-depth investigations, etc.; if it is determined that there is no suspicion or the suspicion is low, archive the data for subsequent reference; if it is uncertain, continue to monitor the relevant transaction data.

[0167] 1) Suspicious transaction report

[0168] Report generation: After a suspicious transaction is identified through various anti-money laundering monitoring methods (such as graph-based clustering algorithms, transaction rule monitoring, etc.), a detailed suspicious transaction report needs to be generated. The report content includes the basic information of the transaction subject (such as account name, account number, customer identity information, etc.), the details of the transaction (transaction time, amount, transaction type, capital flow, etc.) and the reasons for suspicion (such as the transaction model does not conform to normal business logic, involving high-risk areas or industries, etc.).

[0169] For example, when an account is found to frequently receive small amounts of funds from multiple different accounts within a short period of time, and then transfers the funds to overseas accounts, the report should clearly record these transaction details and an analysis of whether this transaction pattern is suspected of money laundering.

[0170] Report submission object: Financial institutions are usually required to submit suspicious transaction reports to their internal anti-money laundering departments for further review. At the same time, according to regulatory requirements, they must also submit reports to financial regulatory agencies (such as the Anti-Money Laundering Monitoring and Analysis Center of the People's Bank of China in China). These reports are an important source of clues for regulatory agencies to conduct anti-money laundering investigations and help to grasp the dynamics of money laundering activities from a macro level.

[0171] 2) Customer risk rating adjustment

[0172] Risk reassessment: Reassess the risk level of customers based on the results of anti-money laundering monitoring. For customers involved in suspicious transactions, their risk level will be raised. Risk rating can take into account multiple factors, such as the customer's identity background, transaction behavior characteristics, industry risks, etc.

[0173] For example, an individual customer who was originally rated as low risk may have his risk level adjusted to high risk after being found to have frequent transactions with multiple high-risk accounts.

[0174] Differentiated management measures: Different management measures are adopted for customers with different risk levels. For high-risk customers, the monitoring frequency of their transactions may be strengthened, more identity verification information may be required, and even certain high-risk transaction types may be restricted. For low-risk customers, a relatively loose monitoring method can be adopted to balance the effectiveness of anti-money laundering work and business efficiency.

[0175] 3) Transaction restrictions and blocking

[0176] Temporary transaction restrictions: When a high risk of money laundering is initially determined, temporary restrictions may be imposed on suspicious accounts or related transactions. For example, non-counter transactions (such as online bank transfers, mobile bank payments, etc.) of suspicious accounts may be suspended, or specific transactions involving suspicious fund flows may be intercepted pending further investigation and verification.

[0177] This restriction can prevent the rapid transfer of suspicious funds and buy time for anti-money laundering investigations. However, when implementing transaction restrictions, certain procedures and regulations need to be followed to avoid unnecessary damage to the legitimate rights and interests of normal customers.

[0178] Long-term transaction blocking (after money laundering is confirmed): If, after in-depth investigation, it is determined that an account is involved in money laundering activities, the financial institution shall, in accordance with the requirements of laws and regulations, permanently block the relevant transactions and cooperate with law enforcement agencies to freeze and confiscate the funds in the account.

[0179] 4) Investigation and law enforcement cooperation

[0180] Internal investigation: After receiving a suspicious transaction report, the anti-money laundering department of a financial institution will conduct an internal investigation. This includes further verification of the customer's identity (such as by contacting the customer, verifying the business background provided by the customer, etc.), and in-depth tracking of the source and destination of transaction funds (using the bank's internal transaction records, collaborating with other financial institutions, etc.).

[0181] For example, by reviewing the business information provided by the customer when opening an account, investigate whether the transaction purpose stated by the customer is consistent with the actual transaction behavior.

[0182] External law enforcement cooperation: Financial institutions should work closely with external law enforcement agencies (such as public security organs, procuratorates, etc.). They should promptly hand over clues of suspected money laundering crimes found during the investigation to law enforcement agencies, and provide necessary technical support and financial expertise to law enforcement agencies. For example, they should help law enforcement agencies interpret complex financial transaction records, track the flow of funds, and provide strong evidence for solving cases.

[0183] 5) Feedback and Optimization

[0184] Feedback to the anti-money laundering system: Feedback the processing results of the anti-money laundering process to the anti-money laundering monitoring system. For example, if it is found that certain transaction patterns can always successfully evade the detection of the monitoring system, or a large number of false positives occur, it is necessary to optimize and adjust the monitoring system (such as clustering algorithm parameters, transaction rules, etc.). At the same time, according to the actual investigation results, update the parameters and characteristic factors of the risk assessment model so that the risk rating can more accurately reflect the customer's money laundering risk.

[0185] Feedback on employee training and system construction: Update the employee training content within financial institutions based on the problems encountered in anti-money laundering work. For example, if employees are deficient in identifying suspicious transactions, relevant training needs to be strengthened to improve employees' anti-money laundering awareness and business capabilities. Improve anti-money laundering systems and processes, such as refining the suspicious transaction reporting system and optimizing customer risk assessment methods, to improve the overall level of anti-money laundering work.

[0186] It should be further explained that the purpose of cluster analysis is to divide data objects into different groups or clusters (i.e., aggregation) so that objects within the same cluster have high similarity, while objects between different clusters have high differences. For example, in the graph network clustering of anti-money laundering, accounts are clustered into different clusters based on characteristics such as transaction behavior, which may result in clusters of suspected money laundering accounts and normal accounts. The evaluation of cluster analysis results is to determine the effectiveness and reliability of clustering. Since clustering algorithms may be affected by multiple factors such as data quality, algorithm parameters, and data distribution, their results may not always meet expectations. Through evaluation, it can be determined whether the clustering results can truly discover meaningful information, such as whether money laundering accounts and normal accounts are accurately separated in anti-money laundering applications.

[0187] 1) One manifestation of correlation: evaluation indicators are used to guide and improve the cluster analysis process

[0188] Internal evaluation indicators: Internal evaluation indicators such as the Silhouette Coefficient can measure the closeness of each data point to other points in its cluster and the degree of separation from data points in other clusters. If the Silhouette Coefficient is low, it means that the clustering result may not be ideal, the data points in the same cluster are not close enough or the boundaries between different clusters are not clear enough. In anti-money laundering applications, if the Silhouette Coefficient is low, it may mean that the account clustering is chaotic and normal accounts and suspicious accounts are not well separated. At this time, the parameters of the clustering algorithm can be adjusted according to this evaluation result, such as changing the number of clusters, adjusting the distance measurement method, etc., to improve the clustering quality.

[0189] External evaluation indicators: When there are known category labels (such as in a labeled anti-money laundering test data set, it is known which accounts are money laundering accounts and which are normal accounts), external evaluation indicators such as the Rand Index can be used. The Rand Index measures the consistency between the clustering results and the known true classification. If the Rand Index is low, it means that the clustering results deviate greatly from the actual situation, and it is necessary to re-examine the applicability of the clustering algorithm or further pre-process the data, such as re-selecting features or standardizing the data.

[0190] 2) The second manifestation of correlation: cluster analysis provides objects for evaluation, and the evaluation results react to the application of cluster analysis

[0191] Providing evaluation objects: Cluster analysis first produces clustering results, which include the number of clusters, members of each cluster, characteristics of the clusters, etc. These contents are the objects of evaluation. For example, after clustering the anti-money laundering graph network, several account clusters were obtained, each with different transaction behavior characteristics, such as average transaction amount, transaction frequency, etc. The division and characteristics of these clusters are the focus of subsequent evaluation, and the quality of clustering is judged by evaluating whether these clusters are reasonable.

[0192] Evaluation results affect application decisions: Cluster analysis with good evaluation results can be more effectively applied to actual scenarios. In anti-money laundering, if cluster analysis can accurately divide suspicious account clusters after evaluation, then these clusters can be used as key investigation targets to help anti-money laundering agencies quickly locate potential money laundering behaviors. On the contrary, if the evaluation results show that the clustering effect is not good, then caution is needed when using the clustering results for anti-money laundering decisions, or the cluster analysis should be improved before application.

[0193] By implementing the multivariate time series clustering algorithm in the money laundering process, the width and breadth of feature extraction can be improved, and the characteristics of potential money laundering behavior can be discovered. For example, the transaction amount of certain accounts frequently fluctuates sharply in a short period of time, or a large number of transactions are concentrated in a specific time period. These abnormal patterns may indicate potential money laundering behavior. Adapting to complex money laundering scenarios, in real financial transactions, transaction behaviors are complex and diverse. The multivariate time series clustering algorithm can comprehensively consider the time change trends of multiple factors and better adapt to complex transaction scenarios. Compared with the single-dimensional analysis method, it can more comprehensively and accurately identify abnormal transactions and reduce the possibility of misjudgment and omission.

[0194] It should be noted that the steps shown in the above process or the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0195] This embodiment provides an abnormal behavior identification device, which is used to implement the above-mentioned embodiments and preferred implementation modes, and will not be repeated hereafter. As used below, the terms "module", "unit", "subunit", etc. can implement a combination of software and / or hardware of a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0196] Fig. 9 is a structural block diagram of an abnormal behavior identification device according to an embodiment of the present application, such as Fig. 9 As shown, the device comprises:

[0197] An acquisition unit 91 is used to acquire multivariate time series data to be identified, wherein the multivariate time series data is data in financial activities;

[0198] An extraction unit 92, configured to input the multivariate time series data into an unsupervised learning model for feature extraction after preprocessing the multivariate time series data, wherein the unsupervised learning model uses a clustering algorithm based on deep learning features to extract features of the relationship between variables;

[0199] A clustering unit 93 is used to call the unsupervised learning model, use synchronization metrics and elastic metrics to perform cluster analysis on the extracted features, and obtain cluster analysis results;

[0200] The identification unit 94 is used to call the unsupervised learning model, use the silhouette coefficient and graph structure clustering algorithm to evaluate the clustering analysis results, and obtain the abnormal financial activity behavior corresponding to the multivariate time series data according to the evaluation results.

[0201] In some of the embodiments, the extraction unit is also used to: use an autoencoder as a feature extraction framework to extract relationship features between variables from the multivariate time series data; the autoencoder includes an encoder and a decoder, the encoder is used to select a corresponding type of neural network from multiple neural networks according to the data type and task type to map the input raw data to a hidden representation, the decoder is used to reconstruct the hidden representation back to the original data, each type of neural network structure is used to capture a type of relationship between variables through a deep learning-based clustering algorithm, and the clustering algorithm includes a separable clustering algorithm and an embedded clustering algorithm.

[0202] In some of the embodiments, the extraction unit is further used to extract the transaction amount mean, transaction amount standard deviation, transaction amount range and transaction frequency from the multivariate time series data.

[0203] In some of the embodiments, the clustering unit is also used to: use the covariance sequence-based clustering algorithm CSPCA to preprocess the extracted features, and use a synchronous measurement method based on point-to-point comparison or Euclidean distance to perform cluster analysis on the preprocessed features to obtain corresponding cluster analysis results, wherein the preprocessing of the extracted features is to process all features to be of equal length and meet the offset requirements; use an elastic measurement algorithm to process the features of the two multivariate time series data, and use a dynamic time planning algorithm to find the best matching path between the two multivariate time series data, thereby obtaining corresponding cluster analysis results.

[0204] In some of the embodiments, the identification unit is also used to: obtain a silhouette coefficient for each cluster, and use the silhouette coefficient to evaluate the clustering quality of the cluster; use a graph structure clustering algorithm to generate a graph network structure between account entities, detect abnormal nodes and edges in the graph network structure based on the node degree, centrality and edge weight of the graph network structure, and evaluate the clustering analysis results from a topological domain.

[0205] In some embodiments, the recognition unit is further used to calculate the silhouette coefficient s(i) of the data point i in the cluster using the following formula:

[0206]

[0207] Where a(i) represents the average distance from data point i to other data points in its cluster, and b(i) represents the average distance from data point i to the nearest cluster in other clusters.

[0208] The silhouette coefficient S of the cluster is calculated using the silhouette coefficients of all data points in the cluster:

[0209]

[0210] Among them, n is the number of data points in the cluster.

[0211] In some of the embodiments, the identification unit is also used to: generate a report corresponding to the abnormal financial activity, wherein the report includes basic information of the transaction subject, details of the transaction and suspicious reasons; submit the generated report to the target object for further processing by the target object.

[0212] It should be noted that the above modules can be functional modules or program modules, and can be implemented by software or hardware. For modules implemented by hardware, the above modules can be located in the same processor; or the above modules can be located in different processors in any combination.

[0213] The embodiment provides a computer device. The abnormal behavior identification method in accordance with the embodiment of the present application can be implemented by the computer device. Fig.10 Schematic diagram of the hardware structure of a computer device according to an embodiment of the present application.

[0214] The computer device may include a processor 51 and a memory 52 storing computer program instructions.

[0215] Specifically, the processor 51 may include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present application.

[0216] Among them, the memory 52 may include a large capacity memory for data or instructions. By way of example and not limitation, the memory 52 may include a hard disk drive (HDD), a floppy disk drive, a solid state drive (SSD), a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a universal serial bus (USB) drive, or a combination of two or more of these. Where appropriate, the memory 52 may include a removable or non-removable (or fixed) medium. Where appropriate, the memory 52 may be inside or outside the data processing device. In a specific embodiment, the memory 52 is a non-volatile memory. In a specific embodiment, the memory 52 includes a read-only memory (ROM) and a random access memory (RAM). Where appropriate, the ROM may be a mask-programmed ROM, a programmable ROM (Programmable Read-Only Memory, PROM for short), an erasable PROM (Erasable ProgrammableRead-Only Memory, EPROM for short), an electrically erasable PROM (Electrically Erasable ProgrammableRead-Only Memory, EEPROM for short), an electrically alterable ROM (Electrically Alterable Read-Only Memory, EAROM for short) or a flash memory (FLASH) or a combination of two or more of these. Under appropriate circumstances, the RAM can be a static random access memory (SRAM) or a dynamic random access memory (DRAM), wherein the DRAM can be a fast page mode dynamic random access memory (FPMDRAM), an extended data output dynamic random access memory (EDODRAM), a synchronous dynamic random access memory (SDRAM), etc.

[0217] The memory 52 may be used to store or cache various data files required for processing and / or communication, as well as possible computer program instructions executed by the processor 51 .

[0218] The processor 51 implements any one of the abnormal behavior identification methods in the above embodiments by reading and executing computer program instructions stored in the memory 52 .

[0219] In some of the embodiments, the computer device may further include a communication interface 53 and a bus 50. Fig.10 As shown, the processor 51, the memory 52, and the communication interface 53 are connected via a bus 50 and communicate with each other.

[0220] The communication interface 53 is used to implement communication between the modules, devices, units and / or equipment in the embodiment of the present application. The communication interface 53 can also implement data communication with other components such as: external devices, image / data acquisition equipment, databases, external storage, and image / data processing workstations.

[0221] The bus 50 includes hardware, software or both, and couples the components of the computer device to each other. The bus 50 includes but is not limited to at least one of the following: a data bus, an address bus, a control bus, an expansion bus, and a local bus. By way of example and not limitation, bus 50 may include an Accelerated Graphics Port (AGP) or other graphics bus, an Extended Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), a Hyper Transport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an InfiniBand interconnect, a Low Pin Count (LPC) bus, a memory bus, a Micro Channel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local Bus (VLB) bus, or other suitable buses or a combination of two or more of these. Where appropriate, bus 50 may include one or more buses. Although embodiments of the present application describe and illustrate a particular bus, the present application contemplates any suitable bus or interconnect.

[0222] In addition, in combination with the abnormal behavior identification method in the above embodiment, the embodiment of the present application can provide a computer-readable storage medium for implementation. The computer-readable storage medium stores computer program instructions; when the computer program instructions are executed by the processor, any abnormal behavior identification method in the above embodiment is implemented.

[0223] The technical features of the above-described embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above-described embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0224] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.

Claims

1. A method for identifying abnormal behavior, characterized in that: include: Acquire multivariate time series data to be identified, wherein the multivariate time series data is data in financial activities; After preprocessing the multivariate time series data, the data is input into an unsupervised learning model for feature extraction, wherein the unsupervised learning model uses a clustering algorithm based on deep learning features to extract features of the relationship between variables; The unsupervised learning model is called, and a synchronous metric and an elastic metric are used to perform cluster analysis on the extracted features to obtain a cluster analysis result; The unsupervised learning model is called, the silhouette coefficient and graph structure clustering algorithm are used to evaluate the clustering analysis results, and the abnormal financial activity behavior corresponding to the multivariate time series data is obtained according to the evaluation results.

2. The identification method according to claim 1, characterized in that: After preprocessing the multivariate time series data, the data is input into an unsupervised learning model for feature extraction, including: An autoencoder is used as a feature extraction framework to extract relational features between variables from the multivariate time series data; the autoencoder includes an encoder and a decoder, the encoder is used to select a corresponding type of neural network from multiple neural networks according to the data type and the task type to map the input raw data to a hidden representation, the decoder is used to reconstruct the hidden representation back to the original data, each type of neural network structure is used to capture a type of relationship between variables through a clustering algorithm based on deep learning, and the clustering algorithm includes a separable clustering algorithm and an embedded clustering algorithm.

3. The identification method according to claim 2, characterized in that: After preprocessing the multivariate time series data, inputting the data into an unsupervised learning model for feature extraction also includes: The transaction amount mean, transaction amount standard deviation, transaction amount range and transaction frequency are extracted from the multivariate time series data.

4. The identification method according to claim 1, characterized in that: The extracted features are clustered using synchronous metrics and elastic metrics to obtain cluster analysis results, including: The extracted features are preprocessed using the covariance sequence-based clustering algorithm CSPCA, and the preprocessed features are clustered using a synchronous measurement method based on point-to-point comparison or Euclidean distance to obtain corresponding clustering analysis results, wherein the preprocessing of the extracted features is to process all features to be of equal length and meet the offset requirements; The elastic metric algorithm is used to process the features of the two multivariate time series data, and the best matching path between the two multivariate time series data is found through a dynamic time planning algorithm, so as to obtain the corresponding cluster analysis result.

5. The identification method according to claim 1, characterized in that: The cluster analysis results are evaluated using the silhouette coefficient and graph structure clustering algorithm, including: Obtaining a silhouette coefficient of each cluster, and using the silhouette coefficient to evaluate the clustering quality of the cluster; A graph structure clustering algorithm is used to generate a graph network structure between account entities. Abnormal nodes and edges in the graph network structure are detected based on the node degree, centrality and edge weight of the graph network structure, and the clustering analysis results are evaluated from the topological domain.

6. The identification method according to claim 5, characterized in that: Obtaining a silhouette coefficient of each cluster, and using the silhouette coefficient to evaluate the clustering quality of the cluster, including: The silhouette coefficient s(i) of the data point i in the cluster is calculated using the following formula: Where a(i) represents the average distance from data point i to other data points in its cluster, and b(i) represents the average distance from data point i to the nearest cluster in other clusters. The silhouette coefficient S of the cluster is calculated using the silhouette coefficients of all data points in the cluster: Among them, n is the number of data points in the cluster.

7. The identification method according to any one of claims 1 to 6, characterized in that: After obtaining the abnormal financial activity behavior corresponding to the multivariate time series data according to the evaluation results, it includes: Generate a report corresponding to the abnormal financial activity, wherein the report includes basic information of the transaction subject, details of the transaction and the suspicious reason; The generated report is submitted to the target object for further processing by the target object.

8. A device for identifying abnormal behavior, characterized in that: include: An acquisition unit, used for acquiring multivariate time series data to be identified, wherein the multivariate time series data is data in financial activities; An extraction unit, used for inputting the multivariate time series data into an unsupervised learning model for feature extraction after preprocessing the multivariate time series data, wherein the unsupervised learning model uses a clustering algorithm based on deep learning features to extract features of the relationship between variables; A clustering unit, used to call the unsupervised learning model, use synchronization metrics and elastic metrics to perform cluster analysis on the extracted features, and obtain cluster analysis results; The identification unit is used to call the unsupervised learning model, use the silhouette coefficient and graph structure clustering algorithm to evaluate the clustering analysis results, and obtain the abnormal financial activity behavior corresponding to the multivariate time series data according to the evaluation results.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the abnormal behavior identification method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the abnormal behavior identification method according to any one of claims 1 to 7 is implemented.

Images