Risk identification processing method and device based on transfer fund link

Abstract

The invention provides a risk identification processing method and device based on a transfer fund link, and the method comprises the steps: determining a multi-level transfer fund link through an account which transfers an account participating in a specified transaction activity within a preset time period; performing connected component analysis on the multi-stage transfer fund link to obtain a plurality of connected body communities in the multi-stage transfer fund link; each connected community comprises a plurality of nodes, each node is an account, and accounts corresponding to the plurality of nodes have a transfer association relationship; determining a risk value of each connected body community in the multi-level transfer fund link according to the number of accounts of each connected body community in the multi-level transfer fund link and the number of merchants of each connected body community; according to the invention, the marketing abnormal risk can be effectively determined according to the fund link, the fund security of the user is protected, and the risk value can also be applied to marketing risk prevention and control to provide effective data support for marketing risk prevention and control activities.

Description

Technical Field

[0001] The present invention relates to the field of Internet risk control technology, and in particular to a method and device for risk identification and disposal based on a transfer funds link. Background Art

[0002] This section is intended to provide a background or context to the embodiments of the invention that are recited in the claims. No statement herein is admitted to be prior art by virtue of its inclusion in this section.

[0003] Financial institutions need to identify unusual marketing risks when processing transfer transactions. For example, during the initial launch of an app, platforms often offer subsidies to quickly attract users and build popularity. Subsidies are particularly generous for new users. However, these generous subsidies inevitably attract online merchants who, seeking illicit profits, impersonate real users on the platform in an attempt to exploit these subsidies. This unusual trading activity undoubtedly poses a threat to the healthy development of the financial ecosystem.

[0004] Therefore, there is an urgent need for a method that can identify and handle risks based on the account's funding chain. Summary of the Invention

[0005] An embodiment of the present invention provides a method for identifying and handling risks based on a transfer funds link, which is used to effectively determine abnormal marketing risks based on the funds link and protect user funds. The method for identifying and handling risks based on a transfer funds link includes:

[0006] An account that transfers funds to an account participating in a designated transaction within a preset time period is identified as a primary source of funds account; an account that transfers funds to a primary source of funds account within a preset time period is identified as a secondary source of funds account; an account that transfers funds to a secondary source of funds account within a preset time period is identified as a tertiary source of funds account; and so on, to identify a multi-level transfer funds chain;

[0007] Connectivity analysis is performed on the multi-level transfer fund chain to obtain multiple connected communities in the multi-level transfer fund chain; each connected community includes multiple nodes, each node is an account, and the accounts corresponding to the multiple nodes have transfer association relationships;

[0008] The risk value of each liantong community in the multi-level transfer funds chain is determined based on the number of accounts in each liantong community and the number of merchants in each liantong community.

[0009] An embodiment of the present invention further provides a risk identification and handling device based on a transfer funds link, which is used to effectively determine abnormal marketing risks based on the funds link and protect user funds. The risk identification and handling device based on the transfer funds link includes:

[0010] A multi-level transfer fund link determination module is used to determine an account that transfers funds to an account participating in a designated transaction activity within a preset time period as a primary fund source account; to determine an account that transfers funds to an account that is a primary fund source within a preset time period as a secondary fund source account; to determine an account that transfers funds to an account that is a secondary fund source within a preset time period as a tertiary fund source account; and so on, to determine a multi-level transfer fund link;

[0011] A connected component analysis module is used to perform connected component analysis on a multi-level transfer fund chain to obtain multiple connected community groups in the multi-level transfer fund chain; each connected community group includes multiple nodes, each node is an account, and the accounts corresponding to the multiple nodes have transfer association relationships;

[0012] The risk value determination module is used to determine the risk value of each liantong community in the multi-level transfer fund link according to the number of accounts in each liantong community and the number of merchants in each liantong community in the multi-level transfer fund link.

[0013] An embodiment of the present invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the above-mentioned risk identification and disposal method based on the transfer funds link is implemented.

[0014] An embodiment of the present invention further provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the above-mentioned risk identification and disposal method based on the transfer funds link.

[0015] An embodiment of the present invention further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, it implements the above-mentioned risk identification and disposal method based on the transfer funds link.

[0016] The risk identification and disposal method and device based on the transfer fund link of the embodiment of the present invention determines a multi-level transfer fund link by analyzing the accounts that transfer funds to accounts participating in designated transaction activities within a preset time period; performs connected component analysis on the multi-level transfer fund link to obtain multiple connected body communities in the multi-level transfer fund link; each connected body community includes multiple nodes, each node is an account, and there is a transfer association relationship between the accounts corresponding to the multiple nodes; based on the number of accounts in each connected body community and the number of merchants in each connected body community in the multi-level transfer fund link, the risk value of each connected body community in the multi-level transfer fund link is determined; through the embodiment of the present invention, it is possible to effectively determine marketing abnormal risks based on the fund link to protect the safety of user funds. At the same time, the risk value can also be applied to marketing risk prevention and control, providing effective data support for marketing risk prevention and control activities. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0018] Figure 1 This is an example diagram of a method for risk identification and disposal based on a transfer funds link in an embodiment of the present invention;

[0019] Figure 2 A diagram showing a specific example of a unicom community in an embodiment of the present invention;

[0020] Figure 3 A diagram showing a specific example of assessing the risk of a connected community in an embodiment of the present invention;

[0021] Figure 4 This is a structural example diagram of a risk identification and handling device based on a transfer funds link in an embodiment of the present invention;

[0022] Figure 5 This is an interactive example diagram of a risk identification and handling method based on a transfer funds link in an embodiment of the present invention. DETAILED DESCRIPTION

[0023] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0024] The inventors have found that the main subjects of common abnormal transactions have the following behavioral characteristics:

[0025] (1) Batch registration of fake accounts: Abnormal transaction entities usually register multiple fake accounts in batches in order to obtain more platform new customer rewards during activities; these fake accounts may be generated by machines or manually registered, and have obvious similarities or regularities; for example, a large number of accounts with the same IP address or the same registered email address may be abnormal transaction entity accounts.

[0026] (2) Use of fake accounts: Abnormal transaction entities may use fake accounts to participate in activities. These accounts are usually obtained through false identity information or hacker attacks. The use of fake accounts violates the rules of the activity.

[0027] (3) Malicious order manipulation: In some platform marketing activities, users can receive rewards by completing designated tasks or purchasing designated products. Abnormal trading entities may exploit this mechanism to obtain rewards through malicious order manipulation. They may use multiple fake accounts to manipulate orders in order to obtain rewards. For example, accounts that purchase a large number of designated products or complete a certain task at the same time may be abnormal trading entity accounts.

[0028] As for the field of marketing risk identification and disposal, existing technologies mainly achieve marketing risk identification and disposal through marketing risk identification and disposal solutions based on big data, and do not provide specific methods for mining abnormal transaction entities.

[0029] Based on the defects of the existing technology and the experience of identifying and handling APP marketing risks, the inventor determined that abnormal transaction subjects usually register small accounts in batches, and then transfer money to downstream fake accounts through the core control account of the abnormal transaction subject, and then the downstream account completes the platform preferential rights and interests verification behavior; the accounts of abnormal transaction subjects usually have hidden connections, such as sharing IP addresses, email addresses, bank accounts, or performing similar activities (such as registering or receiving coupons) at similar times. By tracking and analyzing the fund transfer relationship between these accounts, the key roles in the abnormal transaction subject can be revealed, especially the core control account of the abnormal transaction subject; in view of this behavioral characteristic of the abnormal transaction subject, the embodiment of the present invention mainly traces the funds used by users to participate in preferential activities, tracks the third-hand source of funds, explores the hidden relationships between abnormal transaction subjects, identifies their relationship networks, and rates users according to the risk level of the relationship network, and applies the rating results to marketing prevention and control. At the same time, the results of the abnormal transaction subject relationship network output by the model can be provided to the risk control department as an important basis for subsequent risk investigation.

[0030] Figure 1 FIG. 1 is an example diagram of a method for identifying and handling risks based on a transfer fund link in an embodiment of the present invention. Figure 1 As shown, the method includes:

[0031] Step 101: Determine an account that has transferred funds to an account participating in a designated transaction activity within a preset time period as a primary source of funds account; determine an account that has transferred funds to a primary source of funds account within a preset time period as a secondary source of funds account; determine an account that has transferred funds to a secondary source of funds account within a preset time period as a tertiary source of funds account; and so on, to determine a multi-level transfer funds chain;

[0032] Step 102: Perform connected component analysis on the multi-level transfer fund link to obtain multiple connected community groups in the multi-level transfer fund link; each connected community group includes multiple nodes, each node is an account, and the accounts corresponding to the multiple nodes have transfer association relationships;

[0033] Step 103: Determine the risk value of each liantong community in the multi-level transfer funds link based on the number of accounts in each liantong community and the number of merchants in each liantong community.

[0034] In an embodiment, determining a multi-level transfer funds link may include:

[0035] Based on the funds transfer data of the accounts participating in the designated transaction activities within the preset time period, the accounts that transferred funds to the accounts participating in the designated transaction activities within the preset time period are determined as the first-hand source of funds accounts; based on the funds transfer data of the first-hand source of funds accounts within the preset time period, the accounts that transferred funds to the first-hand source of funds accounts within the preset time period are determined as the second-hand source of funds accounts; based on the funds transfer data of the second-hand source of funds accounts within the preset time period, the accounts that transferred funds to the second-hand source of funds accounts within the preset time period are determined as the third-hand source of funds accounts; and so on, a multi-level transfer funds chain is determined.

[0036] For example, first filter the data: filter the accounts involved in the specified trading activities and the account's activity time period, as well as the funds transfer data;

[0037] Tracking the source of primary funds: Find the account fund transfer information of accounts participating in designated trading activities within 15 days before participating in the activities, and identify the accounts that transfer funds within 15 days before participating in the designated trading activities as the source of primary funds.

[0038] Tracking secondary funding sources: Find out the account fund transfers of the primary funding source account within 15 days before participating in the activity. Accounts that have transferred funds within 15 days before participating in the activity will be identified as secondary funding source accounts.

[0039] Tracking third-hand funding sources: Find the account fund transfer status of the second-hand funding source account within 15 days before participating in the activity, and identify the account that transfers funds to the second-hand funding source account within 15 days before participating in the activity as the third-hand funding source account.

[0040] Similarly, continue to track the source of funds of the above accounts and determine the multi-level transfer fund chain.

[0041] During implementation, after determining the multi-level transfer funding chain, key account identification can also be performed: analyze the multi-level transfer funding chain, identify accounts that have financial transactions with multiple active accounts, and identify these accounts as abnormal accounts (which may be the core control accounts of the abnormal transaction subjects).

[0042] In the embodiment, a connected component analysis is performed on a multi-level transfer fund link to obtain multiple connected communities in the multi-level transfer fund link, which may include:

[0043] Using a connected component algorithm, the connected community in the multi-level transfer fund chain is identified, and a network diagram of the multi-level transfer fund chain is output. The network diagram includes multiple connected communities, each connected community includes multiple nodes, each node is an account, and the lines between the nodes represent the transfer relationship between the accounts.

[0044] In specific implementation, the connected components algorithm (Connected Components) in the open source package is used to identify connected communities in the multi-level transfer capital chain and output a network diagram of the multi-level transfer capital chain; in the network diagram, each connected community is composed of connected nodes, each node is an account, and the lines between the nodes indicate that there is a transfer relationship between the accounts.

[0045] During implementation, if the entire network graph is a connected graph, there are paths between all nodes, indicating that the entire network graph is a connected community; if not, the network graph can be divided into several connected communities.

[0046] Figure 2 FIG. 1 is a specific example of a unicom community in an embodiment of the present invention. Figure 2 As shown, the ID of the node with the smallest sequence number in each connected community is used as the representative ID of the connected community; for example Figure 2 The middle ones are Unicom Community 1 and Unicom Community 4.

[0047] In an embodiment, determining the risk value of each liantong community in the multi-level transfer funds link based on the number of accounts in each liantong community and the number of merchants in each liantong community in the multi-level transfer funds link may include:

[0048] For a Unicom community with a number of active accounts greater than a preset number in a multi-level transfer fund link, the risk value of the Unicom community is calculated based on the number of active accounts, the number of merchants, and the preset weights.

[0049] For example, Figure 3 FIG. 1 is a specific example diagram of assessing the risk of a connected community in an embodiment of the present invention. Figure 3 As shown in the figure, in order to assess the risk of each connected community in the multi-level transfer fund chain, two main indicators are used:

[0050] 1. Number of active accounts within the Unicom community: Risk is assessed by calculating the logarithm of the number of accounts participating in activities within the Unicom community (Log(Number of active accounts within the Unicom community)). A larger logarithm indicates a higher risk.

[0051] 2. Average number of active accounts per merchant within the Unicom community: Calculate the logarithm of the ratio of the number of active accounts within the Unicom community to the number of merchants (Log(number of active accounts within the Unicom community / number of merchants within the Unicom community)). The larger this value, the higher the risk.

[0052] In actual analysis, we found that 98.69% of all liantongti communities have a small number of active accounts (e.g., only one user). These communities, due to their low number of active accounts, are generally not subject to risk calculations. However, for liantongti communities with more than five active accounts, a risk calculation is performed.

[0053] In an embodiment, for a Unicom community with a number of active accounts greater than a preset number in a multi-level transfer fund link, the risk value of the Unicom community is calculated based on the number of active accounts, the number of merchants, and the preset weights, including:

[0054] The risk value of the connected community is calculated using the following formula:

[0055]

[0056] Among them, score is the risk value of the Unicom community, and a and b are preset weights.

[0057] For example, a can take the value b can take the value The risk value calculation formula of the Liantong community is:

[0058]

[0059] In an embodiment, after calculating the risk value of each connected community in the multi-level transfer funds link based on the number of accounts in each connected community and the number of merchants in each connected community, the method may further include: marking a connected community in the multi-level transfer funds link whose risk value is greater than a threshold as an abnormal connected community.

[0060] In specific implementation, when observing the network diagram of the multi-level transfer fund chain, special attention is paid to those connected communities with higher risk values; in these connected communities, accounts usually show significant clustering and organization; for example, in these connected communities with higher risk values, multiple "core control accounts of abnormal transaction entities" can often be seen, and these accounts directly control or have fund transactions with multiple accounts participating in the activities; at the same time, there are also fund transfers between the core control accounts of these abnormal transaction entities and the core control accounts of larger abnormal transaction entities in the connected communities, indicating that these accounts may be directly controlled by the core control accounts of larger abnormal transaction entities or participate in activities under their command; in actual analysis, these connected communities with higher risk values can be marked as abnormal connected communities to facilitate subsequent risk investigation.

[0061] The present invention also provides a device for identifying and handling risks in a fund transfer chain, as described in the following embodiments. Because the principles underlying the device's solutions are similar to those of the method for identifying and handling risks in a fund transfer chain, the implementation of the device can be referenced to the implementation of the method for identifying and handling risks in a fund transfer chain, and any repetitions will not be repeated.

[0062] Figure 4 FIG. 1 is a structural example diagram of a risk identification and disposal device based on a transfer fund link in an embodiment of the present invention. Figure 4 As shown, the device includes:

[0063] The multi-level transfer fund link determination module 401 is configured to determine an account that has transferred funds to an account participating in a designated transaction activity within a preset time period as a primary fund source account; determine an account that has transferred funds to a primary fund source account within a preset time period as a secondary fund source account; determine an account that has transferred funds to a secondary fund source account within a preset time period as a tertiary fund source account; and so on, to determine a multi-level transfer fund link.

[0064] Connected component analysis module 402 is used to perform connected component analysis on the multi-level transfer fund link to obtain multiple connected community groups in the multi-level transfer fund link; each connected community group includes multiple nodes, each node is an account, and the accounts corresponding to the multiple nodes have transfer association relationships;

[0065] The risk value determination module 403 is used to determine the risk value of each liantong community in the multi-level transfer fund link according to the number of accounts in each liantong community and the number of merchants in each liantong community.

[0066] In one embodiment, the multi-level transfer funds link determination module 401 is specifically configured to determine, based on the funds transfer data of the accounts participating in the specified transaction activities within the preset time period, the accounts that transferred funds to the accounts participating in the specified transaction activities within the preset time period as the primary funds source accounts;

[0067] Based on the fund transfer data of the primary source account within a preset time period, the account that has transferred funds from the primary source account within the preset time period is determined as the secondary source account;

[0068] Determine the funds transfer data of the second-hand funds source account within a preset time period, and determine the account that transferred funds from the second-hand funds source account within the preset time period as the third-hand funds source account;

[0069] And so on, determine the multi-level transfer fund chain.

[0070] In one embodiment, the attributes of the transaction detail data include a global tracking number, and the grouping module 501 is specifically configured to group the transaction detail data according to the global tracking number of the transaction detail data, and determine each group of transaction detail data as a transaction line.

[0071] In one embodiment, the connected component analysis module 402 is specifically configured to use a connected component algorithm to identify connected communities in a multi-level transfer fund chain and output a network diagram of the multi-level transfer fund chain, wherein the network diagram includes multiple connected communities, each connected community includes multiple nodes, each node is an account, and the lines between the nodes represent transfer relationships between the accounts.

[0072] In one embodiment, the risk value determination module 403 is specifically configured to calculate the risk value of a Unicom community whose number of active accounts in a multi-level transfer fund link is greater than a preset number based on the number of active accounts, the number of merchants, and a preset weight.

[0073] In one embodiment, the risk value determination module 403 is specifically configured to calculate the risk value of the connected community according to the following formula:

[0074]

[0075] Among them, score is the risk value of the Unicom community, and a and b are preset weights.

[0076] In one embodiment, the risk value determination module 403 is further configured to calculate the risk value of each connected community in the multi-level transfer funds link based on the number of accounts in each connected community and the number of merchants in each connected community in the multi-level transfer funds link, and then mark the connected community in the multi-level transfer funds link whose risk value is greater than a threshold as an abnormal connected community.

[0077] Below, a specific example is given to illustrate the execution process of the risk identification and disposal method and device based on the transfer funds link according to an embodiment of the present invention; Figure 5 FIG is an interactive example diagram of a risk identification and disposal method based on a transfer fund link in an embodiment of the present invention. Figure 5 As shown, the process includes:

[0078] Server module: receives user operation requests (such as receiving coupons);

[0079] Online interface module: includes the marketing risk identification and disposal online service module, which can make judgments on users' operation requests such as coupon collection based on marketing risk identification and disposal rules and models, that is, determine whether to agree to the user's operation request.

[0080] Abnormal transaction subject module: You can query the risk value of the abnormal transaction subject Liantong community to which the account ID belongs through the platform account ID.

[0081] The system execution process is as follows:

[0082] a. The user performs the coupon collection operation, and the server module requests the online interface module;

[0083] b. The online interface module determines whether the user is allowed to receive the coupon this time;

[0084] c. The online interface module passes the user account ID information to the abnormal transaction subject module. The abnormal transaction subject module will query the risk value of the abnormal transaction subject group to which the user account ID belongs based on the user account ID information, and determine whether to approve the current coupon collection based on calculations, and return the judgment result to the online interface module;

[0085] d. If the risk value of the abnormal transaction entity Unicom community to which the account ID belongs is greater than 0.6, the user's coupon collection behavior will be rejected.

[0086] The risk identification and disposal method based on the transfer funds link according to the embodiment of the present invention can be seen to have the following beneficial effects:

[0087] a) Implemented a mining algorithm based on transfer fund links: This algorithm can identify the financial relationship network between abnormal transaction entities by tracking the sources of funds used by accounts participating in activities. This method not only improves the efficiency of identifying abnormal behavior such as scalping, but also effectively increases the cost and difficulty of implementing abnormal behavior.

[0088] b) Development of risk value calculation methods for the Unicom community relationship network: When establishing the risk value calculation methods, statistical indicators such as the data distribution of the Unicom community were comprehensively considered and customized based on actual business needs; these calculation methods have been verified through offline evaluation and can effectively classify and calculate risk values for the Unicom communities identified through the capital link mining algorithm.

[0089] c) Refinement of implementation steps: The embodiment of the present invention provides a technical solution for abnormally marking connected communities with abnormal risk values; for connected communities with high risk values, it can be directly integrated into the real-time risk identification and disposal service solution to accurately intercept abnormal behavior; for medium-risk communities, it can be used in regular offline risk screening to ensure the overall security and stability of the system.

[0090] An embodiment of the present invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the above-mentioned risk identification and disposal method based on the transfer funds link is implemented.

[0091] An embodiment of the present invention further provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the above-mentioned risk identification and disposal method based on the transfer funds link.

[0092] An embodiment of the present invention further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, it implements the above-mentioned risk identification and disposal method based on the transfer funds link.

[0093] The risk identification and disposal method and device based on the transfer fund link of the embodiment of the present invention determines a multi-level transfer fund link by analyzing the accounts that transfer funds to accounts participating in designated transaction activities within a preset time period; performs connected component analysis on the multi-level transfer fund link to obtain multiple connected body communities in the multi-level transfer fund link; each connected body community includes multiple nodes, each node is an account, and there is a transfer association relationship between the accounts corresponding to the multiple nodes; based on the number of accounts in each connected body community and the number of merchants in each connected body community in the multi-level transfer fund link, the risk value of each connected body community in the multi-level transfer fund link is determined; through the embodiment of the present invention, it is possible to effectively determine marketing abnormal risks based on the fund link to protect the safety of user funds. At the same time, the risk value can also be applied to marketing risk prevention and control, providing effective data support for marketing risk prevention and control activities.

[0094] It will be understood by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0095] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts and / or block diagrams. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0096] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0097] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0098] The specific embodiments described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A risk identification and disposal method based on a transfer funds link, characterized in that: include: The account that transfers funds to the account participating in the designated trading activity within the preset time period is determined as the primary funding source account; An account that has transferred funds from a primary source account within a preset time period is identified as a secondary source account; an account that has transferred funds from a secondary source account within a preset time period is identified as a tertiary source account; and so on, to determine a multi-level transfer fund chain; Connectivity analysis is performed on the multi-level transfer fund chain to obtain multiple connected communities in the multi-level transfer fund chain; each connected community includes multiple nodes, each node is an account, and the accounts corresponding to the multiple nodes have transfer association relationships; The risk value of each liantong community in the multi-level transfer funds chain is determined based on the number of accounts in each liantong community and the number of merchants in each liantong community.

2. The method according to claim 1, wherein Determine the multi-level transfer fund chain, including: Based on the fund transfer data of the accounts participating in the designated trading activities within the preset time period, the accounts that transferred funds to the accounts participating in the designated trading activities within the preset time period are determined as the primary fund source accounts; Based on the fund transfer data of the primary source account within a preset time period, the account that has transferred funds from the primary source account within the preset time period is determined as the secondary source account; Determine the funds transfer data of the second-hand funds source account within a preset time period, and determine the account that transferred funds from the second-hand funds source account within the preset time period as the third-hand funds source account; And so on, determine the multi-level transfer fund chain.

3. The method according to claim 1, wherein By analyzing the connected components of the multi-level transfer fund chain, we can obtain multiple connected communities in the multi-level transfer fund chain, including: Using a connected component algorithm, the connected community in the multi-level transfer fund chain is identified, and a network diagram of the multi-level transfer fund chain is output. The network diagram includes multiple connected communities, each connected community includes multiple nodes, each node is an account, and the lines between the nodes represent the transfer relationship between the accounts.

4. The method according to claim 1, wherein Based on the number of accounts and merchants in each liantong community in the multi-level transfer fund chain, the risk value of each liantong community in the multi-level transfer fund chain is determined, including: For a Unicom community with a number of active accounts greater than a preset number in a multi-level transfer fund link, the risk value of the Unicom community is calculated based on the number of active accounts, the number of merchants, and the preset weights.

5. The method according to claim 4, wherein For a Unicom community with more active accounts than the preset number in a multi-level transfer fund chain, the risk value of the Unicom community is calculated based on the number of active accounts, the number of merchants, and the preset weights, including: The risk value of the connected community is calculated using the following formula: Among them, score is the risk value of the Unicom community, and a and b are preset weights.

6. The method according to claim 1, wherein Based on the number of accounts and merchants in each liantong community in the multi-level transfer fund chain, the risk value of each liantong community in the multi-level transfer fund chain is calculated, which also includes: The connected community whose risk value in the multi-level transfer fund chain is greater than the threshold will be marked as an abnormal connected community.

7. A risk identification and disposal device based on a transfer funds link, characterized in that: include: A multi-level transfer fund link determination module is used to determine the account that transfers funds to the account participating in the designated transaction activity within a preset time period as the primary fund source account; An account that has transferred funds from a primary source account within a preset time period is identified as a secondary source account; an account that has transferred funds from a secondary source account within a preset time period is identified as a tertiary source account; and so on, to determine a multi-level transfer fund chain; A connected component analysis module is used to perform connected component analysis on a multi-level transfer fund chain to obtain multiple connected community groups in the multi-level transfer fund chain; each connected community group includes multiple nodes, each node is an account, and the accounts corresponding to the multiple nodes have transfer association relationships; The risk value determination module is used to determine the risk value of each liantong community in the multi-level transfer fund link according to the number of accounts in each liantong community and the number of merchants in each liantong community in the multi-level transfer fund link.

8. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the method according to any one of claims 1 to 6 is implemented.

9. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images