Transaction identification method, apparatus, device, medium and program product

Abstract

The present disclosure provides a transaction identification method, which can be applied to the technical field of artificial intelligence. The method comprises: classifying N candidate accounts which have transactions with a suspicious account in a specific time period, and determining M normal accounts; screening a first transaction set between the M normal accounts and the suspicious account; matching the first transaction set with a second transaction set of the suspicious account to obtain a first matching score; matching the first transaction set with a third transaction set of the M normal accounts to obtain a second matching score; and obtaining a transaction category of the first transaction set based on a weighted processing result of the first matching score and the second matching score. The present disclosure also provides a transaction identification device, equipment, storage medium and program product.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the field of artificial intelligence, and more particularly, to a transaction identification method, device, equipment, medium and program product. BACKGROUND

[0002] Unpermitted financial transaction activities (such as illegal and irregular money transfer, payment, exchange, etc.) are a global problem, which not only destroys the financial order, but also threatens social security. In recent years, the situation has become increasingly severe, and the regulatory authorities have increasingly high requirements for the identification of illegal and irregular money transfer, payment, exchange, etc. The traditional illegal and irregular transaction monitoring method relies on rules and manual review.

[0003] In the process of implementing the concept of the present disclosure, the inventors have found that when suspicious transaction activities are screened, measures such as freezing accounts and freezing transaction rights are generally taken quickly, for example, when a label related to suspicious financial transaction activities is applied, the account is considered suspicious, and other accounts found to have transactions with the suspicious account will be quickly frozen. However, other accounts may be normal accounts, and transactions with the suspicious account may also be legal transactions, which will lead to false freezing and poor user experience. SUMMARY

[0004] In view of the above problems, the present disclosure provides a transaction identification method, device, equipment, medium and program product.

[0005] According to a first aspect of the present disclosure, a transaction identification method is provided, comprising: classifying N candidate accounts having transactions with a suspicious account within a specific time period, and determining M normal accounts, N being an integer greater than or equal to 2, and M being less than N; screening a first transaction set between the M normal accounts and the suspicious account, wherein the first transaction set contains at least M transaction records; matching the first transaction set with a second transaction set of the suspicious account to obtain a first matching score, wherein the second transaction set includes suspicious transaction data of the suspicious account within the specific time period except for transaction records in the first transaction set; matching the first transaction set with a third transaction set of the M normal accounts to obtain a second matching score, wherein the third transaction set includes normal transaction data of the M normal accounts within the specific time period except for transaction records in the first transaction set; and obtaining a transaction category of the first transaction set based on a weighted processing result of the first matching score and the second matching score.

[0006] According to an embodiment of the present disclosure, the M normal accounts are determined by classifying N candidate accounts that have transactions with the suspicious account within a certain time period, including: obtaining a feature set of each candidate account in the N candidate accounts, wherein the feature set includes at least two of account attribute features, account behavior features, small-amount transaction features, average transaction amount features, critical transaction amount features, transaction structure features, transaction splitting features, and graph structure features; performing feature encoding fusion on the feature set of each candidate account by using a multi-layer self-attention mechanism to obtain fused features; and inputting the fused features of each candidate account into an account classification model to determine the M normal accounts, wherein the account classification model is obtained according to a machine learning algorithm.

[0007] According to an embodiment of the present disclosure, the first matching score is obtained by matching the first transaction set with a second transaction set of the suspicious account, including: constructing a first transaction graph based on attributes of each transaction record in the first transaction set; constructing a second transaction graph based on attributes of each transaction record in the second transaction set, the attributes including one or more transaction entities; and obtaining the first matching score based on the similarity between the first transaction graph and the second transaction graph.

[0008] According to an embodiment of the present disclosure, the first matching score is obtained based on the similarity between the first transaction graph and the second transaction graph, including: segmenting a plurality of local transaction graphs from the second transaction graph based on the distribution of suspicious transaction entities in the second transaction set; calculating a plurality of similarities between the first transaction graph and the plurality of local transaction graphs respectively; and obtaining the first matching score according to the plurality of similarities.

[0009] According to an embodiment of the present disclosure, the plurality of local transaction graphs are segmented from the second transaction graph based on the distribution of suspicious transaction entities in the second transaction set, including: dividing the second transaction graph into a plurality of grids; obtaining the concentration of suspicious transaction entities in each grid according to the position distribution of each suspicious transaction entity in the second transaction graph; and segmenting a local transaction graph from the second transaction graph in a case where the total concentration of at least one grid in a local area is greater than a preset value.

[0010] According to an embodiment of the present disclosure, before the local transaction graph is segmented from the second transaction graph in the local area, the operation further includes: sequentially traversing the grids of the unsegmented area in the second transaction graph, and accumulating the concentration of the traversed grids one by one; and determining all the traversed grids as a local area to be segmented in a case where the accumulation result is greater than a preset value.

[0011] According to an embodiment of the present disclosure, matching the first transaction set with the third transaction set of the M normal accounts to obtain a second matching score comprises: converting a feature set of the first transaction set into a first signature; converting a feature set of the third transaction set into a second signature; and calculating a similarity of the first signature and the second signature to obtain the second matching score.

[0012] Another aspect of the embodiments of the present disclosure provides a transaction identification device, comprising: an account classification module configured to classify N candidate accounts having transactions with a suspicious account in a specific time period, and determine M normal accounts, N being an integer greater than or equal to 2, and M being less than N; a transaction screening module configured to screen a first transaction set between the M normal accounts and the suspicious account, wherein the first transaction set contains at least M transaction records; a first matching module configured to match the first transaction set with a second transaction set of the suspicious account to obtain a first matching score, wherein the second transaction set comprises suspicious transaction data of the suspicious account in the specific time period except for the transaction records in the first transaction set; a second matching module configured to match the first transaction set with a third transaction set of the M normal accounts to obtain a second matching score, wherein the third transaction set comprises normal transaction data of the M normal accounts in the specific time period except for the transaction records in the first transaction set; and a transaction identification module configured to identify a transaction category of the first transaction set according to a weighted processing result of the first matching score and the second matching score.

[0013] Another aspect of the embodiments of the present disclosure provides an electronic device, comprising: one or more processors; and a memory configured to store one or more programs, wherein the one or more programs, when executed by the one or more processors, cause the one or more processors to perform the method described above.

[0014] Another aspect of the embodiments of the present disclosure provides a computer-readable storage medium having stored thereon a computer program, which, when executed by a processor, causes the processor to perform the method described above.

[0015] Another aspect of the embodiments of the present disclosure provides a computer program product comprising a computer program, which, when executed by a processor, implements the method described above.

[0016] The one or more embodiments have the beneficial effects that the transactions of the suspicious account can be screened in fine granularity and accuracy, the normal account transacted with the suspicious account is determined through the account dimension, the first transaction set between the normal account and the suspicious account is matched with the suspicious transaction data and the normal transaction data respectively through the transaction dimension, and the matching scores are processed by weighting, so that the part of the transactions of the suspicious account can be further classified accurately, the risk of identifying the normal transaction as the suspicious transaction is reduced, the normal account is prevented from being frozen by mistake, and the user experience is effectively improved. BRIEF DESCRIPTION OF DRAWINGS

[0017] The above and other objects, features and advantages of the present disclosure will become more apparent from the following description when taken in conjunction with the accompanying drawings, in which:

[0018] Figure 1 An application scenario diagram of transaction identification according to an embodiment of the present disclosure is schematically shown;

[0019] Figure 2 A flowchart of a transaction identification method according to an embodiment of the present disclosure is schematically shown;

[0020] Figure 3 A flowchart of a method for obtaining a first matching score according to an embodiment of the present disclosure is schematically shown;

[0021] Figure 4 A flowchart of a method for obtaining a first matching score according to another embodiment of the present disclosure is schematically shown;

[0022] Figure 5 A flowchart of a method for obtaining a local transaction graph according to an embodiment of the present disclosure is schematically shown;

[0023] Figure 6 A flowchart of a method for obtaining a second matching score according to an embodiment of the present disclosure is schematically shown;

[0024] Figure 7 A structural block diagram of a transaction identification apparatus according to an embodiment of the present disclosure is schematically shown; and

[0025] Figure 8 A block diagram of an electronic device suitable for implementing the transaction identification method according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0026] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. It should be understood, however, that the description is merely exemplary and is not intended to limit the scope of the present disclosure. In the following detailed description, numerous specific details are set forth in order to provide a thorough understanding of the embodiments of the present disclosure. However, it would be apparent that one or more embodiments can be practiced without these specific details. In addition, in the following description, descriptions of well-known structures and techniques have been omitted to avoid unnecessary obscuring the concept of the present disclosure.

[0027] In the technical solutions of the present disclosure, the user information (including but not limited to user personal information, user image information, user device information such as location information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved are all information and data authorized by the user or authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of related data comply with relevant laws, regulations and standards, necessary security measures are taken, do not violate public order and good customs, and provide corresponding operation portal for user to choose authorization or refusal.

[0028] Figure 1 The application scenario of transaction identification according to the embodiments of the present disclosure is schematically shown. It should be noted that, Figure 1 The shown is only an example that can apply the embodiments of the present disclosure to help those skilled in the art understand the technical content of the present disclosure, but does not mean that the embodiments of the present disclosure cannot be used in other devices, systems, environments or scenarios.

[0029] As Figure 1 The application scenario 100 according to the embodiments can include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104 and a server 105, as shown. The network 104 is a medium for providing a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103 and the server 105. The network 104 can include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0030] The user can use the first terminal device 101, the second terminal device 102, the third terminal device 103 to interact with the server 105 through the network 104 to receive or send payment and the like. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, the third terminal device 103, such as mobile banking applications, shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only as examples).

[0031] The first terminal device 101, the second terminal device 102, and the third terminal device 103 can be various electronic devices with a display screen and supporting web browsing, including but not limited to a smart phone, a tablet computer, a laptop computer, a desktop computer, and the like.

[0032] The server 105 can be a server providing various services, for example, a background management server supporting a website browsed by a user using the first terminal device 101, the second terminal device 102, and the third terminal device 103 (only as an example). The background management server can perform analysis and the like on received user requests and the like, and feed back a processing result (for example, a webpage, information, or data obtained or generated according to a user request, and the like) to a terminal device. For example, the server 105 can be a standalone physical server, or a server cluster or a distributed system composed of multiple physical servers, or a cloud server providing a basic cloud computing service such as cloud service, cloud computing, network service, middleware service, and the like.

[0033] It should be noted that the transaction identification method provided by the embodiments of the present disclosure can generally be executed by at least one of a terminal device or a server. Accordingly, the transaction identification apparatus provided by the embodiments of the present disclosure can generally be arranged in at least one of a terminal device or a server.

[0034] It should be understood that Figure 1 The number of terminal devices, networks, and servers in the above-mentioned system is only illustrative. According to the implementation needs, there can be any number of terminal devices, networks, and servers.

[0035] The transaction identification method provided by the embodiments of the present disclosure will be described in detail based on the scenario described above. Figure 1

[0036] Figure 2 An illustrative flowchart of the transaction identification method according to the embodiments of the present disclosure is shown.

[0037] As shown in Figure 2 , this embodiment includes:

[0038] In operation S210, N candidate accounts that have transactions with a suspicious account within a certain time period are classified, and M normal accounts are determined, where N is an integer greater than or equal to 2, and M is less than N;

[0039] ​Exemplarily, the unit of the specific time period can be hour, day, week, month, etc. The time period can be selected flexibly according to requirements. The suspicious account includes an account that exhibits abnormal behavior in a financial transaction, such as frequent large transactions, frequent small transactions with multiple accounts, etc. For example, an account receives large amounts of funds from different sources in a short period of time, and then quickly disperses the funds to multiple accounts, which can be marked as suspicious. If a suspicious account has transaction records with 10 different accounts in the past week, the 10 accounts can be considered as candidate accounts.

[0040] For example, a rule set based on transaction behavior characteristics is predetermined, such as transaction frequency, amount size, and transaction time, etc. The transaction behavior of the candidate account is scored using these rules to determine whether it conforms to the behavior pattern of a normal account. According to the scoring result, the candidate account is classified as a normal account or a suspicious account.

[0041] Alternatively, a baseline model of normal account transaction behavior is established using statistical methods or deep learning techniques. The transaction data of the candidate account is monitored in real time to detect abnormal behavior that deviates significantly from the baseline model.

[0042] In operation S220, a first transaction set between the M normal accounts and the suspicious account is screened, wherein the first transaction set contains at least M transaction records; for example, if 20 normal accounts are determined from 100 candidate accounts, the transaction records between the 20 accounts and the suspicious account constitute the first transaction set.

[0043] In operation S230, the first transaction set is matched with a second transaction set of the suspicious account to obtain a first matching score, wherein the second transaction set includes suspicious transaction data of the suspicious account in a specific time period except for the transaction records in the first transaction set.

[0044] For example, if the suspicious account has 100 transactions in a week, 20 of which constitute the first transaction set with the normal account, the remaining 80 transactions constitute the second transaction set. The first matching score is used to represent the similarity between the first transaction set and the suspicious transaction data.

[0045] For example, the transaction records of the first transaction set and the second transaction set are converted into feature vectors, including transaction amount, frequency, and timestamp attributes, etc. A cosine similarity algorithm is used to measure the similarity between the two transaction sets. Alternatively, a machine learning method, such as a neural network, is used to evaluate the similarity of the first transaction set and the second transaction set.

[0046] In operation S240, the first transaction set is matched with a third transaction set of the M normal accounts to obtain a second matching score, where the third transaction set includes normal transaction data of the M normal accounts except for the transaction records in the first transaction set within a specific time period.

[0047] For example, if one normal account has 50 transactions within a week, and 5 of them constitute the first transaction set with the suspicious account, then the remaining 45 transactions constitute the third transaction set. The second matching score is used to represent the similarity between the first transaction set and the normal transaction data.

[0048] For example, the transaction records of the first transaction set and the third transaction set are converted into feature vectors, including attributes such as transaction amount, frequency, and timestamp. A cosine similarity algorithm is used to measure the similarity between the two transaction sets. Alternatively, a machine learning method such as a neural network is used to evaluate the similarity between the first transaction set and the third transaction set.

[0049] In operation S250, the transaction category of the first transaction set is obtained based on the weighted processing result of the first matching score and the second matching score.

[0050] For example, a linear weighting algorithm is used to weight average the first matching score and the second matching score (both between 0 and 1) according to a preset weight (between -1 and 1) to obtain the final transaction category judgment. For example, the first matching score is given a negative weight, and the second matching score is given a positive weight. When the weighted processing result is negative, the transaction category of the first transaction set is suspicious, and the account to which it belongs is continued to be frozen. Conversely, the transaction category of the first transaction set is normal, and the account to which it belongs is unfrozen.

[0051] By way of example, a transaction may not present sufficient information, but by comparing the granularity of the transaction set, combining statistical thinking from the perspective of big data, matching the first transaction set with the second transaction set representing suspicious data and the third transaction set representing normal data respectively, objective data rules can be found to provide strong support and judgment basis for determining whether each transaction is normal.

[0052] According to embodiments of the present disclosure, the transactions of suspicious accounts can be accurately filtered in a fine granularity, normal accounts that transact with suspicious accounts are determined from the account dimension, and the first transaction set between the normal accounts and the suspicious accounts is matched with suspicious transaction data and normal transaction data respectively from the transaction dimension, and the matching scores are weighted processed, which can accurately further classify part of the transactions of suspicious accounts, reduce the risk of misidentifying normal transactions as suspicious transactions, avoid misfreezing normal accounts, and effectively improve user experience.

[0053] In some embodiments, the M normal accounts are further determined by obtaining a feature set of each of the N candidate accounts, wherein the feature set comprises at least two of an account attribute feature, an account behavior feature, a small-amount transaction feature, an average transaction amount feature, a critical transaction amount feature, a transaction structure feature, a transaction splitting feature, and a graph structure feature; performing feature encoding and fusion on the feature set of each of the N candidate accounts by using a multi-layer self-attention mechanism to obtain a fused feature; and inputting the fused feature of each of the N candidate accounts into an account classification model to determine the M normal accounts, wherein the account classification model is obtained according to a machine learning algorithm.

[0054] Exemplarily, the account classification model can be constructed by using a Transformer structure. The account classification model can further comprise a feature extraction layer constructed by using a multi-layer self-attention mechanism.

[0055] First, data preprocessing. Under the authorization, collect multi-source data such as customer basic information, business registration information, due diligence application and result information, historical transaction information, transaction behavior pattern, market dynamics, and perform cleaning and standardization processing to construct a training set, a validation set and a test set.

[0056] Then, key features are extracted from the original data by using feature selection and feature extraction techniques, including but not limited to transaction frequency, transaction amount, transaction type, customer occupation information, opposite account, opposite account name, etc. The original data can be converted into a new set of features by using principal component analysis and non-matrix decomposition algorithm, which are usually combinations or transformations of the original features, for revealing the internal structure and relationship of the data. The dimension of the feature space can be reduced by using a filtering method first, and then a wrapping method and an embedding method are used for further feature selection during model training.

[0057] Filter methods are used to evaluate the correlation of each feature by statistical tests, such as correlation coefficient, chi-square test, etc., to select features with high correlation with the target variable. Wrapper methods are used to evaluate the performance of feature subsets by training models, such as recursive feature elimination (RFE), etc., to select feature subsets that can improve the performance of the model. Embedded methods are used to select features during model training, such as LASSO, decision tree, etc., which perform feature selection while training.

[0058] Then, feature construction. In addition to extracting and selecting features from raw data, new features can also be constructed by combining existing features. For example, features can be constructed from a customer's transaction behavior and personal information, such as the customer's transaction habits, money flow patterns, social network relationships, etc. (i.e. account attribute features). Account behavior features can include the time after the first transaction. The time interval after the user completes the first transaction, this feature can help identify the user's transaction activity and loyalty. Small transaction features include the number of small transactions within 24 hours. The average transaction amount feature includes a rolling calculation of the average value of the transaction data within a time window, which can capture the trends and patterns of transaction behavior. Critical transaction amount features include transaction information with transaction amounts close to certain preset thresholds, which may indicate that the user is circumventing certain regulatory restrictions. Transaction splitting features include behavior information that splits large transactions into multiple small transactions to avoid regulation. By analyzing transaction patterns, this behavior can be identified. Transaction structured features include behavior information that disperses large amounts of cash into bank accounts to avoid reporting requirements. By analyzing deposit patterns, this behavior can be identified. Graph structure features include degree centrality, local clustering coefficient, ego network size, etc.

[0059] Through layer-by-layer iteration, the multi-layer self-attention mechanism model not only deeply integrates feature context information, but also automatically adjusts attention weights based on training tasks, allowing the model to focus on features that are critical to suspicious transaction detection and ignore irrelevant features.

[0060] Then, model construction. The Transformer model can be used to build an account classification model. The Transformer model can capture long-distance dependencies in data through self-attention mechanisms, making it suitable for processing sequential financial data.

[0061] 1) Model architecture:

[0062] The core of the Transformer model is the self-attention mechanism, which allows the model to consider not only the information at the current position when processing sequential data, but also the dependency between any two positions in the sequence. This mechanism is very suitable for processing financial data, as financial events are often influenced by historical transaction records and market dynamics.

[0063] 2) Data serialization processing:

[0064] Before inputting financial data into the Transformer model, it needs to be converted into a sequence form. This may involve sorting timestamps, ordering transaction records, etc. The serialized data can be better understood by the Transformer model.

[0065] 3) Model Input Preparation:

[0066] According to the requirements of the Transformer model, the serialized data is converted into an input format that the model can accept. This usually includes the setting of embedding layers, which map elements in the sequence (such as transaction types, account IDs, etc.) to vectors in a high-dimensional space.

[0067] 4) Self-Attention Layer Design:

[0068] The self-attention layer is a core component of the Transformer model. In the illegal and irregular transaction monitoring risk identification model, multiple self-attention layers can be stacked to increase the depth of the model, thereby capturing more complex data dependencies. Each self-attention layer contains the calculation of query (Query), key (Key) and value (Value), through which the model can assign different importance to each element in the sequence.

[0069] 5) Position Encoding Addition:

[0070] Since the Transformer model does not have a recursive structure, position encoding needs to be added to maintain the order information of elements in the sequence. Position encoding can be fixed or learned, and they are added to the input embedding vectors to ensure that the model can identify the position of elements in the sequence.

[0071] 6) Model Output and Risk Assessment:

[0072] The output of the Transformer model can be generated through one or more fully connected layers to generate the final risk score or classification result. According to the output of the model, each customer or transaction can be assigned a suspicious transaction risk level.

[0073] Through the above steps, the account classification model not only can handle complex serialized financial data, but also can effectively capture long-distance dependencies in transaction data, thereby improving the accuracy and efficiency of transaction risk identification.

[0074] Then, the model is trained. A loss function can be defined, such as Cross-Entropy Loss and Mean Squared Error (MSE). The combination of Backpropagation and Stochastic Gradient Descent (SGD) is adopted. Backpropagation is responsible for efficiently computing gradients, while gradient descent updates parameters according to these gradients. Through multiple iterations, the parameters of the model are gradually adjusted to minimize the value of the loss function, thereby improving the prediction performance of the model. During the training process, the model calculates the prediction result through forward propagation, then calculates the gradient through the backpropagation algorithm, and finally updates the model parameters using the optimization algorithm. This process is usually organized into multiple training cycles (Epochs), each cycle containing multiple batches (Batches) of data. Hyperparameter tuning, regularization, and anti-overfitting techniques can also be introduced.

[0075] Then, the model is evaluated, and after passing the evaluation, it can be deployed for use, such as distinguishing high-risk, medium-risk, and low-risk accounts. Low-risk accounts are considered normal accounts. The model can also be iteratively updated later.

[0076] According to embodiments of the present disclosure, feature encoding fusion not only captures complex data relationships, but also improves the accuracy of account risk identification. Moreover, the account classification model significantly improves the efficiency of account risk identification.

[0077] Figure 3 A flowchart of a method for obtaining a first matching score according to an embodiment of the present disclosure is schematically shown.

[0078] As Figure 3 shown, this embodiment is one of the embodiments of operation S230, which includes:

[0079] In operation S310, a first transaction graph is constructed based on the attributes of each transaction record in the first transaction set;

[0080] In operation S320, a second transaction graph is constructed based on the attributes of each transaction record in the second transaction set;

[0081] The transaction graph refers to visual graph structure data constructed based on attributes of transaction records, wherein a node represents a transaction entity abstracted from attribute information, and an edge represents a transaction relationship between entities. The transaction entity includes at least one of a transaction object (such as an account node, a user node), a transaction target (such as tobacco, alcohol, sugar, tea, hotel accommodation, financial products, or other products or services), a transaction time, and a transaction amount. For example, the transaction target can also be mapped to a node, which can provide more rich graph information and facilitate obtaining more accurate similarity calculation results. The transaction target node can represent a specific product or service. For example, a mobile phone (node) as a transaction target node is connected to different user nodes that purchase it.

[0082] In operation S330, a first matching score is obtained based on the similarity between the first transaction graph and the second transaction graph.

[0083] The graph similarity algorithm can be used to compare the structure and attributes of the two graphs to calculate the first matching score. For example, the similarity between the graphs is evaluated by comparing the local structure in the graph.

[0084] According to an embodiment of the present disclosure, by comparing the similarity of the transaction graphs, the similarity of the first transaction set to the suspicious transaction data can be more accurately identified. Through accurate graph comparison, the situation of misjudging normal transactions as suspicious transactions can be reduced, and the false positive rate can be reduced.

[0085] Figure 4 A flowchart for obtaining a first matching score according to another embodiment of the present disclosure is schematically shown.

[0086] As Figure 4 shown, this embodiment is one of the embodiments of operation S330, which includes:

[0087] In operation S410, based on the distribution of suspicious transaction entities in the second transaction set, a plurality of local transaction graphs are segmented from the second transaction graph;

[0088] For example, the suspicious transaction entity includes a transaction entity (such as a user, an account, a transaction target, etc.) that exhibits abnormal or suspicious behavior (transaction mode, frequency, amount, or other characteristics that are different from normal transaction behavior). The suspicious transaction entity distribution includes at least one of the position distribution of the corresponding node in the second transaction graph and the entity category distribution. If several suspicious transaction entities (such as different accounts) are found to be clustered together in the graph, it may indicate that there is a close financial flow relationship between these accounts.

[0089] In operation S420, a plurality of similarities of the first transaction graph and the plurality of local transaction graphs are respectively calculated; for example, the number and frequency of the same transaction paths in the two graphs can be compared to obtain the similarity.

[0090] At operation S430, a first matching score is obtained according to the plurality of similarities.

[0091] A weighted average score can be calculated according to the similarities of all local graphs as the first matching score. For example, the similarity of the first transaction graph to each local graph can be multiplied by its transaction volume weight in the second transaction graph, and then summed to obtain the first matching score.

[0092] According to an embodiment of the present disclosure, by integrating the similarities of a plurality of local graphs, noise in matching the second transaction graph as a whole can be reduced.

[0093] Figure 5 A flowchart for obtaining a local transaction graph according to an embodiment of the present disclosure is schematically shown.

[0094] As Figure 5 shown, this embodiment is one of the embodiments of operation S410, which includes:

[0095] At operation S510, the second transaction graph is divided into a plurality of grids;

[0096] A grid refers to a region unit divided in the second transaction graph, used for spatially dividing transaction entities.

[0097] At operation S520, a concentration of suspicious transaction entities in each grid is obtained according to the location distribution of each suspicious transaction entity in the second transaction graph.

[0098] For example, the concentration can be defined as the proportion of the number of suspicious transaction entities in a grid to the total number of transaction entities in the grid. If there are 100 transaction entities in a grid, of which 10 are labeled as suspicious, the concentration of the grid is 10%.

[0099] At operation S530, if the total concentration of at least one grid in a local region is greater than a preset value, the local region is segmented from the second transaction graph to obtain a local transaction graph.

[0100] A local region includes a region divided in the graph according to a specific condition, which can include one or more grids. The total concentration refers to the sum of the concentrations of all grids in the same local region. The preset value can be set to 15% (only as an example). If the concentration of a local region exceeds 15%, it can be segmented.

[0101] According to an embodiment of the present disclosure, by grid management and concentration calculation, specific risk regions in the second transaction graph are accurately identified, and thus the similarity to the first transaction graph better reflects the suspicious degree.

[0102] In some embodiments, before the local transaction graph is obtained by segmenting the local region from the second transaction graph, the following operation is further performed: sequentially traversing the grids in the unsegmented region of the second transaction graph, and accumulating the concentration of the traversed grids one by one; when the accumulation result is greater than a preset value, determining all the traversed grids as the local region to be segmented.

[0103] First, the entire second transaction graph is regarded as an unsegmented region, and then segmentation is performed according to specific conditions (such as concentration). Then the unsegmented region is traversed again. Sequential traversal can start from the first traversed grid and sequentially traverse each grid in the order of rows or columns. Different local regions can have different areas, and the total concentration can also be different.

[0104] According to embodiments of the present disclosure, by sequentially traversing and accumulating the concentration, it can be more accurate to identify which regions have concentrated suspicious transaction activities. The segmentation result of the local region can be dynamically adapted to the changes of the transaction graph and updated in real time.

[0105] It should be noted that the present disclosure is not limited to sequential traversal, but can also use random traversal or traversal in a preset order.

[0106] Figure 6 A flowchart for obtaining the second matching score according to an embodiment of the present disclosure is schematically shown.

[0107] As shown in Figure 6 , this embodiment is one of the embodiments of operation S230, which includes:

[0108] In operation S610, the feature set of the first transaction set is converted into a first signature;

[0109] In operation S620, the feature set of the third transaction set is converted into a second signature;

[0110] In operation S630, the similarity between the first signature and the second signature is calculated to obtain the second matching score.

[0111] For example, features (such as account attribute features, account behavior features, small transaction features, average transaction amount features, critical transaction amount features, transaction structured features, transaction splitting features, and graph structure features) are extracted from all transaction records in the transaction set (the first transaction set or the third transaction set), wherein features of the same category are combined, and features of different categories are retained. Each type of feature can be converted using a hash algorithm to obtain a signature unit. All types of features in the feature set obtain a signature, such as the first signature and the second signature. Complex transaction data can be converted into signature units that are easy to compare and analyze, so that similarity analysis can be performed between different transaction sets. The similarity between the first signature and the second signature can be the number of the same signature units.

[0112] According to the embodiments of the present disclosure, converting the feature set into a signature can simplify the process and complexity of similarity calculation. The similarity of two transaction sets can be accurately calculated in the form of a signature unit.

[0113] After obtaining the transaction category of the first transaction set in operation S240, if the category is normal, the M normal accounts are marked as normal, and if the M normal accounts are frozen, the unfreezing process is performed. If the category is suspicious, the M normal accounts can be marked as suspicious accounts. Then, a suspicious report can be further output.

[0114] The suspicious report automatic generation project refers to analyzing abnormal transaction customer basic information, account transaction information, and monitoring indicators and model conditions triggering illegal and irregular transactions, and then inserting the above information and analysis results into a set report template to generate a single customer suspicious transaction report. The following processes are included:

[0115] (1) Obtain customer basic information, account transaction data, and transaction information data such as triggering model indicators from illegal and irregular transaction monitoring systems, data lakes, and other system platforms.

[0116] (2) Execute one or more embodiments of the above transaction identification method to generate suspicious point analysis and preliminary conclusions by the illegal and irregular transaction monitoring large model.

[0117] (3) Integrate the basic situation table, the fund flow direction table, and the detailed analysis report to generate a suspicious transaction report for each suspicious account.

[0118] (4) The illegal and irregular transaction monitoring personnel review, fine-tune, and supplement the generated report to form the final suspicious transaction report for reporting.

[0119] (5) The illegal and irregular transaction monitoring personnel score the suspicious transaction report generated by the illegal and irregular transaction monitoring large model, and the system stores the preliminary report, the score, and the modified report together.

[0120] (6) Train the illegal and irregular transaction monitoring large model using incremental data to enhance its robustness. The large model includes a generative natural language model, which can include hundreds of millions of large-scale parameters.

[0121] In the suspicious transaction report, the fund transaction and customer behavior situation can include the basic situation table and the fund flow direction table, and the suspicious point analysis and preliminary conclusion chapter can be generated by the large model, which can be manually modified and scored and evaluated.

[0122] It should be noted that some steps of the above method can be executed alone or in combination, and can be executed in parallel or sequentially, and are not limited to the specific operation sequence shown in the figure.

[0123] Based on the above transaction identification method, the disclosure also provides a transaction identification device. The following will be described in detail in combination with Figure 7 The device is described in detail.

[0124] Figure 7 The structure block diagram of the transaction identification device according to the embodiment of the disclosure is schematically shown.

[0125] As Figure 7 The transaction identification device 700 of the embodiment includes an account classification module 710, a transaction screening module 720, a first matching module 730, a second matching module 740, and a transaction identification module 750.

[0126] The account classification module 710 can perform operation S210 for classifying N candidate accounts having transactions with a suspicious account within a specific time period, and determining M normal accounts, N being an integer greater than or equal to 2, and M being less than N.

[0127] The transaction screening module 720 can perform operation S220 for screening a first transaction set between the M normal accounts and the suspicious account, wherein the first transaction set contains at least M transaction records.

[0128] The first matching module 730 can perform operation S230 for matching the first transaction set with a second transaction set of the suspicious account to obtain a first matching score, wherein the second transaction set includes suspicious transaction data of the suspicious account within the specific time period except for the transaction records in the first transaction set.

[0129] The second matching module 740 can perform operation S240 for matching the first transaction set with a third transaction set of the M normal accounts to obtain a second matching score, wherein the third transaction set includes normal transaction data of the M normal accounts within the specific time period except for the transaction records in the first transaction set.

[0130] The transaction identification module 750 can perform operation S250 for identifying the transaction category of the first transaction set according to the weighted processing result of the first matching score and the second matching score.

[0131] In some embodiments, the account classification module 710 is further configured to obtain a feature set of each candidate account in the N candidate accounts; perform feature encoding fusion on the feature set of each candidate account by using a multi-layer self-attention mechanism to obtain fused features; and input the fused features of each candidate account into an account classification model to determine the M normal accounts.

[0132] In some embodiments, the first matching module 730 is further configured to perform operations S310-S330, operations S410-S430, operations S510-S530, which will not be repeated here.

[0133] In some embodiments, the second matching module 740 is further configured to perform operations S610-S630, which will not be repeated here.

[0134] For the parts not mentioned in the device part, it can be understood with reference to the various embodiments of the above method. That is, the device part includes modules respectively configured to perform the various steps of any one of the method embodiments described above. And the implementation of each module / unit / subunit, etc. in the device part embodiment, the technical problems solved, the functions implemented, and the technical effects achieved are the same as or similar to the implementation of each corresponding step in the method part embodiment, the technical problems solved, the functions implemented, and the technical effects achieved, which will not be repeated here.

[0135] According to embodiments of the present disclosure, any multiple of the account classification module 710, the transaction screening module 720, the first matching module 730, the second matching module 740, and the transaction identification module 750 can be combined in one module for implementation, or any one of them can be split into multiple modules. Or, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module.

[0136] According to embodiments of the present disclosure, at least one of the account classification module 710, the transaction screening module 720, the first matching module 730, the second matching module 740, and the transaction identification module 750 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on chip, a system on substrate, a system on package, an application specific integrated circuit (ASIC), or any other reasonable manner that can be integrated or packaged by a circuit, etc. hardware or firmware, or any one of software, hardware, and firmware or any appropriate combination of several of them. Or, at least one of the account classification module 710, the transaction screening module 720, the first matching module 730, the second matching module 740, and the transaction identification module 750 can be at least partially implemented as a computer program module that can perform corresponding functions when the computer program module is run.

[0137] Figure 8 The block diagram of an electronic device suitable for implementing the transaction identification method according to embodiments of the present disclosure is schematically shown.

[0138] As Figure 8As shown, the electronic device 800 according to an embodiment of the present disclosure includes a processor 801 which can perform various appropriate actions and processes according to a program stored in a read only memory (ROM) 802 or a program loaded from a storage section 808 into a random access memory (RAM) 803. The processor 801 can include, for example, a general purpose microprocessor (e.g., a CPU), an instruction set processor, and / or a related chipset, and / or a special purpose microprocessor (e.g., an application specific integrated circuit (ASIC)), and so on. The processor 801 can also include an on-board memory for cache use. The processor 801 can include a single processing unit or multiple processing units for executing different actions of the method processes according to embodiments of the present disclosure.

[0139] In the RAM 803, various programs and data required for the operation of the electronic device 800 are stored. The processor 801, the ROM 802, and the RAM 803 are connected to each other via a bus 804. The processor 801 performs various operations of the method processes according to embodiments of the present disclosure by executing the programs in the ROM 802 and / or the RAM 803. Note that the programs can also be stored in one or more memories other than the ROM 802 and the RAM 803. The processor 801 can also perform various operations of the method processes according to embodiments of the present disclosure by executing the programs stored in the one or more memories.

[0140] According to an embodiment of the present disclosure, the electronic device 800 can further include an input / output (I / O) interface 805 which is also connected to the bus 804. The electronic device 800 can further include one or more of the following components connected to the input / output (I / O) interface 805: an input section 806 including a keyboard, a mouse, etc.; an output section 807 including a display such as a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 808 including a hard disk, etc.; and a communication section 809 including a network interface card such as a LAN card, a modem, etc. The communication section 809 performs communication processing via a network such as the Internet. A drive 810 is also connected to the input / output (I / O) interface 805 as necessary. A removable medium 811 such as a magnetic disk, a magneto-optical disk, a semiconductor memory, etc. is attached to the drive 810 as necessary, so that a computer program read out therefrom is installed in the storage section 808 as necessary.

[0141] The present disclosure also provides a computer readable storage medium, which can be included in the device / apparatus / system described in the above embodiments, or exist separately without being assembled into the device / apparatus / system. The above computer readable storage medium carries one or more programs, which, when executed, implement the method according to the embodiments of the present disclosure.

[0142] According to an embodiment of the present disclosure, the computer readable storage medium can be a non-volatile computer readable storage medium, which can include, but is not limited to, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any appropriate combination thereof. In the present disclosure, the computer readable storage medium can be any tangible medium that contains or stores a program, which can be used by or in connection with an instruction execution system, apparatus, or device. For example, according to an embodiment of the present disclosure, the computer readable storage medium can include one or more of the ROM 802 and / or the RAM 803 described above, and / or one or more memories other than the ROM 802 and the RAM 803.

[0143] The embodiments of the present disclosure also include a computer program product, which includes a computer program containing program codes for executing the methods shown in the flowcharts. When the computer program product is run in a computer system, the program codes are used to make the computer system implement the methods provided by the embodiments of the present disclosure.

[0144] The above functions defined in the system / apparatus of the embodiments of the present disclosure are performed when the computer program is executed by the processor 801. According to an embodiment of the present disclosure, the system, apparatus, module, unit, etc. described above can be implemented by computer program modules.

[0145] In one embodiment, the computer program can rely on a tangible storage medium such as an optical storage medium, a magnetic storage medium, etc. In another embodiment, the computer program can also be transmitted, distributed, and downloaded in the form of a signal via a network medium, and be downloaded and installed through the communication part 809 and / or installed from the detachable medium 811. The program codes contained in the computer program can be transmitted via any appropriate network medium, including but not limited to wireless, wired, etc., or any appropriate combination thereof.

[0146] In such embodiments, the computer program can be downloaded and installed from the network via the communication section 809, and / or installed from the removable media 811. When the computer program is executed by the processor 801, the above-described functions defined in the system of the embodiments of the present disclosure are executed. According to the embodiments of the present disclosure, the system, device, apparatus, module, unit, and the like described above can be implemented by the computer program modules.

[0147] According to the embodiments of the present disclosure, the program code for executing the computer program provided by the embodiments of the present disclosure can be written in any combination of one or more programming languages, and specifically, these computer programs can be implemented using high-level procedural and / or object-oriented programming language, and / or assembly / machine language. The programming language includes, but is not limited to, such as Java, C++, python, “C” language or similar programming language. The program code can be executed entirely on the user computing device, partially on the user device, partially on a remote computing device, or entirely on a remote computing device or server. In the case involving a remote computing device, the remote computing device can be connected to the user computing device through any kind of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, connected to the Internet through an Internet service provider).

[0148] The flowcharts and the block diagrams in the drawings illustrate the possible architectures, functions, and operations of systems, methods, and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowcharts or block diagrams can represent a module, a segment, or a portion of code, which contains one or more executable instructions for implementing the specified logical functions. It should also be noted that in some alternative implementations, the functions noted in the blocks can occur out of the order noted in the drawings. For example, two blocks noted in succession can in fact be executed substantially concurrently or in the reverse order, depending on the functionality involved. It will also be noted that each block in the block diagrams or flowcharts, and combinations of blocks in the block diagrams or flowcharts, can be implemented by dedicated hardware-based systems that perform the specified functions or operations, or can be implemented by a combination of dedicated hardware and computer instructions.

[0149] Those skilled in the art can understand that the features described in various embodiments of the present disclosure can be combined and / or integrated in various combinations and / or integrations, even if such combinations or integrations are not explicitly described in the present disclosure. In particular, the features described in various embodiments of the present disclosure can be combined and / or integrated in various combinations and / or integrations without departing from the spirit and teachings of the present disclosure. All such combinations and / or integrations fall within the scope of the present disclosure.

[0150] The above describes embodiments of the present disclosure. However, these embodiments are merely for illustrative purposes, and are not intended to limit the scope of the present disclosure. Although each embodiment is described above separately, this does not mean that the measures in each embodiment cannot be used advantageously in combination. The scope of the present disclosure is defined by the appended claims and their equivalents. Those skilled in the art can make various substitutions and modifications without departing from the scope of the present disclosure, and these substitutions and modifications should all fall within the scope of the present disclosure.

Claims

1. A transaction identification method, comprising: classifying N candidate accounts that have transactions with a suspicious account in a specific time period to determine M normal accounts, N being an integer greater than or equal to 2, and M being less than N; screening a first transaction set between the M normal accounts and the suspicious account, wherein the first transaction set contains at least M transaction records; matching the first transaction set with a second transaction set of the suspicious account to obtain a first matching score, wherein the second transaction set includes suspicious transaction data of the suspicious account in the specific time period except for the transaction records in the first transaction set; matching the first transaction set with a third transaction set of the M normal accounts to obtain a second matching score, wherein the third transaction set includes normal transaction data of the M normal accounts in the specific time period except for the transaction records in the first transaction set; obtaining a transaction category of the first transaction set based on a weighted processing result of the first matching score and the second matching score.

2. The method of claim 1, wherein, The classifying N candidate accounts that have transactions with a suspicious account in a specific time period to determine M normal accounts comprises: obtaining a feature set of each candidate account in the N candidate accounts, wherein the feature set includes at least two of account attribute features, account behavior features, small-amount transaction features, average transaction amount features, critical transaction amount features, transaction structured features, transaction splitting features, and graph structure features; performing feature encoding fusion on the feature set of each candidate account by using a multi-layer self-attention mechanism to obtain fused features; inputting the fused features of each candidate account into an account classification model to determine the M normal accounts, wherein the account classification model is obtained according to a machine learning algorithm.

3. The method of claim 1, wherein, The matching the first transaction set with a second transaction set of the suspicious account to obtain a first matching score comprises: constructing a first transaction graph based on attributes of each transaction record in the first transaction set; constructing a second transaction graph based on attributes of each transaction record in the second transaction set, the attributes including one or more transaction entities; obtaining the first matching score based on a similarity between the first transaction graph and the second transaction graph.

4. The method of claim 3, wherein, The obtaining the first matching score based on a similarity between the first transaction graph and the second transaction graph comprises: segmenting a plurality of local transaction graphs from the second transaction graph based on a suspicious transaction entity distribution in the second transaction set; calculating a plurality of similarities between the first transaction graph and the plurality of local transaction graphs respectively; obtaining the first matching score according to the plurality of similarities.

5. The method of claim 4, wherein, The segmenting a plurality of local transaction graphs from the second transaction graph based on a suspicious transaction entity distribution in the second transaction set comprises: dividing the second transaction graph into a plurality of grids; obtaining a concentration of suspicious transaction entities in each grid according to a position distribution of the suspicious transaction entities in the second transaction graph; In a case where the total concentration of at least one grid in a local area is greater than a preset value, a local transaction graph is obtained by segmenting the local area from the second transaction graph.

6. The method of claim 5, wherein, Before the local transaction graph is obtained by segmenting the local area from the second transaction graph, the following operations are further performed in a loop: The grids in the unsegmented area of the second transaction graph are sequentially traversed, and the concentration of the traversed grids is accumulated one by one; When the accumulation result is greater than a preset value, all the traversed grids are determined as the local area to be segmented.

7. The method of claim 1, wherein, The first transaction set and the third transaction set of the M normal accounts are matched to obtain a second matching score, including: The feature set of the first transaction set is converted into a first signature; The feature set of the third transaction set is converted into a second signature; The similarity of the first signature and the second signature is calculated to obtain the second matching score.

8. A transaction identification apparatus, comprising: an account classification module configured to classify N candidate accounts that have transactions with a suspicious account within a specific time period, and determine M normal accounts, N being an integer greater than or equal to 2, and M being less than N; a transaction screening module configured to screen a first transaction set between the M normal accounts and the suspicious account, wherein the first transaction set contains at least M transaction records; a first matching module configured to match the first transaction set with a second transaction set of the suspicious account to obtain a first matching score, wherein the second transaction set includes suspicious transaction data of the suspicious account within the specific time period except for the transaction records in the first transaction set; a second matching module configured to match the first transaction set with a third transaction set of the M normal accounts to obtain a second matching score, wherein the third transaction set includes normal transaction data of the M normal accounts within the specific time period except for the transaction records in the first transaction set; a transaction identification module configured to identify a transaction category of the first transaction set according to a weighted processing result of the first matching score and the second matching score.

9. An electronic device, comprising: one or more processors; a memory for storing one or more computer programs, characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1-7.

10. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method according to any one of claims 1-7.

11. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method according to any one of claims 1-7. The computer program is executed by the processor to implement the steps of the method according to any one of claims 1-7.

Images