Abnormal transaction management system based on multi-source data collaborative analysis

Abstract

The invention relates to the technical field of fund management, in particular to an abnormal transaction management system based on multi-source data collaborative analysis. Comprising an information acquisition module, a fund flow analysis tracking module and an information optimization module. According to the method, the risk level of a target account is adjusted, abnormal transaction behaviors are limited, the target account is associated with a historical account, the path weight of a new transaction path is calculated, and the distribution condition of the path weights and the risk levels of the historical account and the target account can be visually seen by constructing a risk matrix, so that a data basis is provided for risk strategy adjustment. In addition, monitoring key points on the transaction path are divided based on the risk level of the transaction path, and efficient resource allocation and accurate risk prevention and control are ensured by formulating differentiated monitoring key points, so that the condition of imbalance of a resource allocation algorithm is reduced, and the resource allocation efficiency is improved. The resources are preferentially allocated to the fund flow with a great relationship, the key point is accurately investigated, and the tracking difficulty is reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of fund management, and in particular to an abnormal transaction management system based on collaborative analysis of multi-source data. Background Art

[0002] In recent years, the situation of financial crimes committed through new types of networks has become increasingly serious, mainly manifested in the large number of cases, huge amounts of money involved, funds being transferred among multiple parties, and difficulty in tracking.

[0003] In order to find out the flow of funds and then track the beneficiary account (usually also called the suspect account) to which the funds ultimately flow, in the prior art, automatic queries are often used to obtain the fund details (i.e., flow situation) of the accounts involved in the case funds over a period of time, and the accounts corresponding to the queried fund details are used as nodes to construct a fund flow graph, thereby converting the fund transfer relationship between the accounts involved in the case funds into a path relationship in a topological graph, and then using the topological graph to quickly and intuitively reflect the fund flow situation.

[0004] However, due to the large amount of funds and many accounts involved in the current case, and the fact that funds are repeatedly transferred and processed by multiple parties, a complex network relationship system has been formed. Under this system, the relationship between the fund nodes that need to be tracked and the fund flow has become extremely complicated. This complexity has directly led to an imbalance in the resource allocation algorithm, so that too many resources are allocated to some fund flows with weak relationships, which has shifted the focus of the investigation and increased the difficulty of tracking. Summary of the invention

[0005] The purpose of the present invention is to provide an abnormal transaction management system based on collaborative analysis of multi-source data, which calculates the path weight of funds transferred out of historical accounts, adopts a behavioral pattern matching method to adjust the risk level of a target account associated with the historical account, calculates the path weight of the target account, and then uses data visualization technology to construct a scatter plot of path weights and risk levels. Based on the distribution of path weights and risk levels in the scatter plot, the abnormal transaction monitoring object is adjusted to solve the problems raised in the above background technology.

[0006] The present invention provides an abnormal transaction management system based on multi-source data collaborative analysis, including an information acquisition module, a capital flow analysis and tracking module, and an information optimization module; The information acquisition module is used to retrieve all historical account information, pre-process the information, and store the acquired information in the database; The fund flow analysis and tracking module calculates the path weights of the funds transferred out of the historical accounts one by one according to the historical account information through the weight ratio algorithm, and uses the behavior pattern matching method to adjust the risk level of the target account associated with the historical account. Based on the relevance between the target account and the historical account and the risk level of the target account, the path weight of the target account is calculated. Then, the data visualization technology is used to construct a scatter plot of the path weights and risk levels. Based on the distribution of the path weights and risk levels in the scatter plot, the abnormal transaction monitoring objects are adjusted. The information optimization module optimizes the account information in the database according to the data feedback of the adjustment results in practice.

[0007] In the above technical solution: The behavior pattern matching method is used to adjust the risk level of the target account. This pattern matching method can quickly locate abnormal transaction behaviors according to the abnormal transaction conditions, improve the risk management efficiency, and adjust the risk level of the target account and restrict abnormal transaction behaviors according to the matching results, so as to intercept and control the fund transaction behaviors.

[0008] Secondly, the scatter plot of the path weights and risk levels is constructed as follows: The first step: Obtain the path weights of the historical accounts, the path weights of the target accounts, and the risk levels corresponding to the path weights of the historical accounts and the target accounts. The second step: Construct a risk matrix: Use the path weight as the horizontal axis and the risk level as the vertical axis to construct a two-dimensional risk matrix. Each cell in the matrix represents a path combination with specific weights and risk levels. The third step: Judge the risk status of the path according to the position of the path in the matrix and based on the path weight corresponding to the path, and then optimize the monitoring path according to the risk status of the path.

[0009] Regarding the above technical solution: The target account is associated with the historical account, the path weight of the new transaction path is calculated, and by constructing a risk matrix, the distribution of the path weights and risk levels of the historical account and the target account can be intuitively seen, providing a data basis for risk strategy adjustment to more accurately track the fund flow.

[0010] Compared with the prior art, the beneficial effects of the present invention are: In the abnormal transaction management system based on multi-source data collaborative analysis, the path weights of the historical account fund transactions are pre-calculated through a weight ratio algorithm to preliminarily analyze the risk status of the paths. Then, a behavior pattern matching method is used to adjust the risk level of the target account. This pattern matching method can quickly locate according to the abnormal transaction situation, adjust the risk level of the target account and restrict abnormal transaction behaviors, associate the target account with the historical account, calculate the path weights of the new transaction paths, and by constructing a risk matrix, the distribution of the path weights and risk levels of the historical account and the target account can be intuitively seen, providing a data basis for risk strategy adjustment to more accurately track the fund flow. Moreover, based on the risk level division of the transaction paths, the monitoring focus of the transaction paths is determined. By formulating differentiated monitoring focuses, efficient resource allocation and accurate risk prevention and control are ensured, reducing the imbalance of the resource allocation algorithm, preferentially allocating resources to some well-connected fund flows, and determining the focus of precise investigation, thus reducing the difficulty of tracking. Brief Description of the Drawings

[0011] Figure 1 It is a system block diagram of the present invention.

[0012] Reference Signs: 100, information acquisition module; 200, fund flow analysis and tracking module; 210, path weight calculation unit; 211, target account risk level adjustment unit; 212, graph construction unit; 300, information optimization module. Detailed Embodiments

[0013] Next, the technical solutions in the present invention will be clearly and completely described in conjunction with the drawings in the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

[0014] As Figure 1 shown, an abnormal transaction management system based on multi-source data collaborative analysis is provided, including an information acquisition module 100, a fund flow analysis and tracking module 200, and an information optimization module 300; The information acquisition module 100 is used to retrieve all historical account information, preprocess the information, and store the acquired information in a database; The fund flow analysis and tracking module 200 calculates the path weights of the funds transferred out of the historical accounts one by one according to the historical account information through the weight ratio algorithm, and uses the behavior pattern matching method to adjust the risk level of the target account associated with the historical account. Based on the relevance between the target account and the historical account and the risk level of the target account, the path weight of the target account is calculated. Then, the data visualization technology is used to construct a scatter plot of the path weights and risk levels. Based on the distribution of the path weights and risk levels in the scatter plot, the abnormal transaction monitoring objects are adjusted. The information optimization module 300 optimizes the account information in the database according to the data feedback of the adjustment results in practice.

[0015] Among them, the acquisition of the account information and the fund transaction details of the involved accounts needs to be obtained through legal procedures. The account information mainly includes the account subject identity, ID number, contact information, bank of deposit and account number. The fund transaction details mainly cover the transaction time, transaction amount, transaction type (transfer / consumption / cash withdrawal), transaction channel (ATM / online banking / POS), etc. And the above fund transaction details are sourced from the bank core system, payment institution database, third-party payment platform, etc.

[0016] Secondly, when the information acquisition module 100 retrieves information, it uses data cleaning technology to preprocess the retrieved information, which includes missing value processing and duplicate data removal, as follows: Missing value processing: For records with missing transaction amounts in part, intercept the stage where the historical transaction amount distribution of the account is stable, and fill the missing records with the average value of this stage. Duplicate data removal: Based on the field matching principle, delete the records with the same transaction being repeated, and keep the latest transaction record.

[0017] Through data cleaning, the original information is transformed into a high-quality information dataset to provide reliable information for the subsequent fund flow tracking.

[0018] In order to facilitate the search of the information dataset when tracking the fund flow, analyze the information dataset and make decisions based on it. Therefore, the information corresponding to the historical account ID is stored in the database. When querying the information of each transaction of the involved account, the information dataset of the account ID is obtained by inputting the account ID of the involved account. The corresponding time field can also be set to match the information dataset of the account ID within the specified time period. In this way, the transaction information of the account ID within the specified time period can be obtained, providing evidence and reference for tracking the fund flow and supporting multi-dimensional analysis.

[0019] Further, after the database is established, since the same involved account will convert the funds in its account through various methods, this will increase the difficulty of tracking. For example: transfer splitting: dispersing the large amount of funds in the involved account to multiple accounts to avoid the single transaction limit; consumption cash-out: using the funds in the involved account to purchase goods, antiques, calligraphy and paintings and then reselling them for cash; cross-border transfer: transferring the funds to overseas accounts or offshore companies to evade investigation by taking advantage of regulatory loopholes.

[0020] In order to further track and identify the transactions of the involved account, based on the historical transaction information of the account, the historical transaction situation of the account is analyzed. Among them, the fund flow analysis and tracking module 200 includes a path weight calculation unit 210, and the method steps of the weight ratio algorithm in the path weight calculation unit 210 are as follows: S110. Obtain the information of the involved account within a specified historical time period, including the transaction amount , transaction frequency , account risk level , transaction method ; S112. Standardize the transaction amount , transaction frequency . , , , represents the weights of various factors, represents the preset maximum amount, preset maximum frequency; S113. Assign weights to the transaction amount , transaction frequency , account risk level , transaction method . The weight assignment standard is as follows: respectively represent the transaction amount , account risk level , transaction frequency , transaction method weight ratios; S114. According to the parameters in S113, use the risk assessment calculation formula to calculate the path weight path by path .

[0021] For example: when assigning weights to each factor, the weight assignment ratios of the transaction amount , account risk level , transaction frequency , transaction method are 40%, 30%, 20%, 10%. The following data are available, The involved account A and the counterparty account B Transaction amount is 10,000 ( if it is 50,000, then ); Transaction frequency is 5 times per month ( if it is 20 times, then ); Account risk level is 80 ( the range is from 0 to the information acquisition module 100); Transaction method The weight is 0.5 (for example: the weight of the transfer method is 0.5, the consumption is 0.3, and the cash withdrawal is 0.2); Then, substitute the above values into the following formula for calculation, that is, the risk assessment calculation formula in S114 is combined as shown below: ; That is, , therefore, in the same way as the above calculation method, by successively calculating the path weights , it is obtained that the paths a, b, c.... After analyzing the risk paths, the larger the value, the higher the risk level of the transaction. For the transaction amount , transaction frequency , and transaction method , by using the stream processing technology, the transaction data can be captured in real time, so as to judge whether the system immediately triggers an alarm by detecting abnormal situations and focus on monitoring the abnormal situations.

[0022] It should be clear that: the involved account is the core account, the core account refers to the confirmed account, and the counterparty accounts associated with the involved account are all associated accounts, and the associated accounts are divided into direct associated accounts and indirect associated accounts. Define the core account as Layer 0, then the direct associated account (Layer 1) represents the account with direct fund transactions with the core account (Layer 0), and the indirect associated account (Layer N) is the account indirectly associated through the N - 1 layer account. Then, by successively calculating the path weights , it is obtained that the paths a, b, c.... Among them, path a consists of the core account, direct associated accounts, and several indirect associated accounts. Similarly, paths b and c have the same principle as path a and will not be elaborated here.

[0023] Since when the involved account transfers funds to multiple counterparty accounts, some of the counterparty accounts are normal accounts and some are risk accounts, how to judge whether a normal account is transformed into a potential risk account is shown below: The fund flow analysis and tracking module 200 further includes a target account risk level adjustment unit 211. The target account risk level adjustment unit 211 uses a behavior pattern matching method to adjust the risk level of the target account. Here, the target account is a new account that appears in the fund transfer path. The method is as follows: Step 1: Obtain historical account behavior data, and use this data to construct a normal behavior pattern library. Take the normal behavior pattern library as the matching benchmark, and monitor the target account behavior data in real time to match it with the normal behavior pattern library to determine whether the target account behavior deviates from the normal pattern; Step 2: If the target account behavior deviates from the normal pattern, obtain the relevance between the counterparty account information and the target account, and verify the authenticity of the target account; Compare the matching result with the preset index threshold, adjust the risk level of the target account, and take security measures; If the target account behavior does not deviate from the normal pattern, maintain the current risk level of the target account, and add the latest behavior data to the normal pattern library to optimize the normal behavior pattern library.

[0024] First, when constructing the normal behavior pattern library, collect data first: collect the transaction data of the target account in the past 6 months; single transaction amount: average 5,000 yuan, standard deviation 1,200 yuan; transaction frequency: 3 times a day on average, concentrated between 9:00 - 18:00; transaction objects: 80% are fixed accounts, 20% are new accounts; Set the normal behavior threshold: Upper limit of single transaction amount: 8,000 yuan (average value + 2 times standard deviation); Proportion of transactions during non-working hours: <10%; Proportion of new transaction objects: <30%; Monitor the transaction records in real time. It is detected that the transaction time of account C is: 22:00 (non-working hours), amount: 20,000 yuan; transaction object: new account; Match the transaction record with the normal behavior pattern. Through matching analysis, it can be concluded that the amount, time, and object are all abnormal, triggering 3 abnormal indicators, that is, the number of abnormal indicators is greater than the preset index threshold, and this transaction behavior is determined to be a high-risk behavior. At this time, although this transaction behavior is determined to be a high-risk behavior, in actual situations, there may be emergency needs for new accounts (such as medical assistance), that is, this behavior is a normal behavior but is determined to be an abnormal behavior.

[0025] Then, the authenticity of the account identity is verified through secondary verification (such as face recognition + dynamic password), and the detailed information of the target account and the counterparty account is extracted, and the relevance between the two is analyzed (such as kinship: relatives, colleagues, or historical fund transactions). If the target account identity is authentic and it belongs to a relative account, the historical transaction information of the relative account is obtained and analyzed to determine whether there is a fund transaction between the relative account and the risk account. If so, the target account is marked as a potential risk account, the fund transaction amount between the target account and the relative account is restricted, this transaction is determined as a high-risk behavior, and the risk level of the target account is raised by one level; If the target account identity is not authentic, directly freeze the target account or go to the manual counter for verification; If the target account identity is authentic, it belongs to a relative account, and there is no fund transaction between the relative account and the risk account, then the high-risk behavior is eliminated, and the focus of fund flow monitoring is adjusted. Priority is given to monitoring identity verification failures and high-risk behaviors, and this behavior is added to the normal behavior pattern library; Therefore, a behavior pattern matching method is used to adjust the risk level of the target account. This pattern matching method can quickly locate abnormal transaction behaviors based on transaction anomalies, improve risk management efficiency, and adjust the risk level of the target account and restrict abnormal transaction behaviors according to the matching results, so as to intercept and control fund transaction behaviors.

[0026] The fund flow analysis and tracking module 200 further includes a graph construction unit 212. In the graph construction unit 212, the visualization technology is based on the risk matrix and combines the path weights in S114 formula to calculate the path weight of the target account , and construct a scatter plot of path weights and risk levels. The steps for constructing the scatter plot of path weights and risk levels are as follows: The first step: Obtain the historical account path weight, the path weight of the target account, and the risk levels corresponding to the historical account path weight and the path weight of the target account; The second step: Construct a risk matrix: Use the path weight as the horizontal axis and the risk level as the vertical axis to construct a two-dimensional risk matrix. Each cell in the matrix represents a path combination with specific weights and risk levels; The third step: According to the position of the path in the matrix and based on the path weight corresponding to the path, judge the risk status of the path, and then optimize the monitoring path according to the risk status of the path. For example, a path with a higher weight and a higher risk level has a greater overall risk; while a path with a lower weight and a lower risk level has a smaller overall risk.

[0027] Example: During the fund transfer process, there are three transfer paths. The weight of path A is 0.8, and the risk level is high. Immediately freeze the path, suspend all transactions, initiate manual review, verify the account association relationship, report to the regulatory agency, and cooperate with the investigation; the weight of path B is 0.5, and the risk level is medium. Enhance verification measures (such as face recognition, SMS verification code), limit the transaction amount or frequency, and continuously monitor. Mark this transaction as a key attention path; the weight of path C is 0.3, and the risk level is low. Maintain regular monitoring without additional intervention; In the information optimization module 300, according to the identified abnormal transaction situation, the module will propose corresponding adjustment suggestions, such as: updating monitoring rules, strengthening account security measures, or setting additional verification steps for specific transaction behaviors, etc. Secondly, based on the data feedback of the adjustment results in practice, the module will analyze which adjustments are effective and which need further optimization. Through machine learning and data analysis techniques, optimize the account information in the database, including but not limited to updating user information, restricting transaction rules, etc.

[0028] In addition, the optimized data needs to be continuously monitored to detect new abnormal transaction behaviors and potential hazards. Through regular iteration and update, continuously optimize the data to improve the detection and response capabilities for abnormal transactions.

[0029] Pre-calculate the path weights of each historical account fund transaction through the weight ratio algorithm, and initially analyze the risk status of the path. Then, use the behavior pattern matching method to adjust the risk level of the target account. This pattern matching method can quickly locate according to the abnormal transaction situation, and adjust the risk level of the target account and restrict abnormal transaction behaviors. Associate the target account with the historical account, calculate the path weight of the new transaction path, and by constructing a risk matrix, the distribution of the path weights and risk levels of the historical account and the target account can be intuitively seen, providing a data basis for risk strategy adjustment to more accurately track the fund flow. And, based on the risk level division of the transaction path, determine the monitoring focus of the transaction path. By formulating differentiated monitoring focuses, ensure the efficient allocation of resources and the precise prevention and control of risks, so as to reduce the imbalance of the resource allocation algorithm, give priority to allocating resources to some well-connected fund flows, and accurately detect the key points, reducing the difficulty of tracking.

[0030] The foregoing has shown and described the basic principles, main features and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited by the above embodiments, and the above embodiments and the descriptions in the specification are only preferred examples of the present invention and are not used to limit the present invention. Without departing from the spirit and scope of the present invention, the present invention will have various changes and improvements, and these changes and improvements fall within the scope of the present invention claimed. The scope of protection claimed by the present invention is defined by the appended claims and their equivalents.

Claims

1. Abnormal transaction management system based on collaborative analysis of multi-source data, characterized by: It includes an information acquisition module (100), a capital flow analysis and tracking module (200) and an information optimization module (300); The information acquisition module (100) is used to retrieve all historical account information, pre-process the information, and store the acquired information in a database; The fund flow analysis and tracking module (200) calculates the path weights of the funds transferred out of the historical accounts one by one according to the historical account information through a weight matching algorithm, and uses a behavior pattern matching method to adjust the risk level of the target account associated with the historical account; Based on the correlation between the target account and historical accounts and the risk level of the target account, the path weight of the target account is calculated, and then a scatter plot of path weight and risk level is constructed using data visualization technology. Based on the distribution of path weight and risk level in the scatter plot, the abnormal transaction monitoring object is adjusted; The information optimization module (300) optimizes the account information in the database according to the actual data feedback of the adjustment result.

2. The abnormal transaction management system based on multi-source data collaborative analysis according to claim 1 is characterized by: When retrieving information, the information acquisition module (100) uses data cleaning technology to pre-process the retrieved information, which includes missing value processing and duplicate data removal, as follows: Missing value processing: For records with missing transaction amounts, we intercept the period when the distribution of the historical transaction amounts of the account is stable, and fill the missing records with the mean value of that period; Remove duplicate data: Based on the field matching principle, delete duplicate records of the same transaction and keep the latest transaction record.

3. The abnormal transaction management system based on multi-source data collaborative analysis according to claim 1 is characterized by: The fund flow analysis and tracking module (200) comprises a path weight calculation unit (210), and the method steps of the weight matching algorithm in the path weight calculation unit (210) are as follows: S110. Obtain the historical information of the account involved in the case within a specified period of time, including the transaction amount , Trading frequency , Account Risk Level , Trading Method ; S112. Transaction Amount , Trading frequency To standardize the process, , , , represents the weight of each factor, Indicates the preset maximum amount. Preset maximum frequency; S113. Transaction amount , Trading frequency , Account Risk Level , Trading Method Perform weight distribution, where the weight distribution standard is: Represents the transaction amount , Account Risk Level , Trading frequency , Trading Method The weight ratio of S114: Calculate the path weights path by path using the risk assessment calculation formula based on the parameters in S113 .

4. The abnormal transaction management system based on multi-source data collaborative analysis according to claim 3 is characterized by: The risk assessment calculation formula in S114 is combined as follows: 。 5. The abnormal transaction management system based on multi-source data collaborative analysis according to claim 4 is characterized by: The fund flow analysis and tracking module (200) further comprises a target account risk level adjustment unit (211), wherein the target account risk level adjustment unit (211) uses a behavior pattern matching method to adjust the target account risk level, wherein the target account is a new account appearing in the fund transfer path.

6. The abnormal transaction management system based on multi-source data collaborative analysis according to claim 5 is characterized by: The behavior pattern matching method is as follows: Step 1: Obtain historical account behavior data and use this data to build a normal behavior pattern library. Use the normal behavior pattern library as a matching benchmark, monitor the target account behavior data in real time and match it with the normal behavior pattern library to determine whether the target account behavior deviates from the normal pattern; Step 2: If the target account behavior deviates from the normal pattern, obtain the correlation between the other party’s account information and the target account, and verify the authenticity of the target account; Compare the matching results with the preset indicator thresholds, adjust the risk level of the target account, and take security measures; If the target account behavior does not deviate from the normal pattern, maintain the current risk level of the target account, add the latest behavior data to the normal pattern library, and optimize the normal behavior pattern library.

7. The abnormal transaction management system based on multi-source data collaborative analysis according to claim 6 is characterized by: The fund flow analysis and tracking module (200) further includes a graph construction unit (212), wherein the visualization technology in the graph construction unit (212) is based on the risk matrix and combined with the path weight in S114. Formula to calculate target account path weight , construct a scatter plot of path weights and risk levels, and construct a scatter plot of path weights and risk levels.

8. The abnormal transaction management system based on multi-source data collaborative analysis according to claim 7 is characterized by: The steps for constructing the path weight and risk level scatter plot are as follows: Step 1: Obtain the historical account path weight, the target account path weight, and the risk level corresponding to the historical account path weight and the target account path weight; Step 2: Construct a risk matrix: With the path weight as the horizontal axis and the risk level as the vertical axis, a two-dimensional risk matrix is ​​constructed. Each cell in the matrix represents a path combination with a specific weight and risk level. Step 3: Determine the risk status of the path based on the position of the path in the matrix and the path weight corresponding to the path, and then optimize the monitoring path based on the risk status of the path.

Images