Financial fraud detection system and method

Abstract

The invention discloses a financial fraud detection method, which comprises the following steps: collecting real-time transaction data and carrying out data preprocessing, extracting transaction nodes and transaction edges according to the real-time transaction data after data preprocessing, the method comprises the following steps: acquiring transaction edges of transaction nodes, updating the weights of the transaction edges in real time according to a weight algorithm formula, constructing a transaction graph by utilizing the transaction nodes and the transaction edges with the updated weights, calculating priority values of the transaction nodes of the transaction graph, performing greedy coloring analysis according to the priority values to obtain color ID data of real-time transaction data, and displaying the color ID data of the real-time transaction data. And carrying out risk mapping on the color ID data, returning a risk level and a corresponding treatment measure of the real-time transaction data, and carrying out color space-time analysis on the color ID data of the transaction graph, so that the processing capability of the financial fraud detection system on a complex transaction relationship and the risk identification accuracy are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of fraud detection, and in particular to a financial fraud detection system and method. Background Art

[0002] In recent years, financial fraud has become increasingly prevalent worldwide, harming not only investors but also market fairness and transparency. Financial fraud refers to the practice of companies or individuals deliberately falsifying or fabricating financial data to mislead stakeholders, using deceptive tactics to obtain illicit economic gain. Financial fraud is a serious violation of the law that not only harms a company's reputation and profits but can also have far-reaching consequences for investors, creditors, and the market as a whole. Therefore, detecting and preventing corporate financial fraud is crucial for maintaining market order and protecting the rights and interests of all parties.

[0003] Currently, Chinese patent publication number CN117408825A discloses a financial fraud risk warning method and system. This method automatically maps original report items to standard report items through a mapping system. The standard report items are standardized financial statements developed for each industry. A financial analysis indicator system is constructed based on the characteristics and potential risks of each industry. The financial analysis indicator system covers both general and industry-specific indicators across various industries. The financial analysis indicator system is used to analyze the financial data of the mapped standard report items, identifying potential risks in various scenarios through a natural language intelligent reasoning model, and generating a text analysis report. While this method can, to a certain extent, identify risks in the financial data provided by customers, this method, based on financial report analysis, has a long data update cycle and cannot capture anomalies in real-time transactions. Furthermore, since this method only analyzes financial indicators such as the current ratio and debt ratio of individual companies, it cannot detect cross-enterprise correlation fraud. Its ability to perform correlation analysis of financial fraud is weak, making it difficult to identify complex network fraud and lacking the ability to analyze transaction network topology. Summary of the Invention

[0004] The technical problem solved by the present invention is that the existing technology is based on financial statements, has a long data update cycle, cannot capture anomalies in real-time transactions, and only analyzes financial indicators such as the current ratio and debt ratio of a single enterprise, cannot detect cross-enterprise related fraud, has weak ability to analyze financial fraud through related analysis, has difficulty identifying complex network fraud, and lacks the ability to analyze the topology of the transaction network.

[0005] To solve the above technical problems, the present invention provides the following technical solution: a financial fraud detection method, characterized in that it includes the following steps:

[0006] Step S100: collecting real-time transaction data and performing data preprocessing, wherein the real-time transaction data includes basic account information data, transaction behavior data, and transaction device data;

[0007] Step S200: extract transaction nodes and transaction edges based on the real-time transaction data after data preprocessing, and update the weights of the transaction edges in real time according to the weight algorithm formula, and construct a transaction graph using the transaction nodes and the transaction edges after the updated weights.

[0008] Step S300: Calculate the priority value of each transaction node in the transaction graph, perform greedy coloring analysis based on the priority value, and obtain color ID data of the real-time transaction data;

[0009] Step S400 , performing risk mapping on the color ID data, returning the risk level and corresponding disposal measures of the real-time transaction data, and performing color spatiotemporal analysis on the color ID data of the transaction graph.

[0010] As a preferred embodiment of the financial fraud detection method of the present invention, step S100 specifically includes:

[0011] Step S101: collecting real-time transaction data from a transaction database and performing data preprocessing, wherein the real-time transaction data includes basic account information data, transaction behavior data, and transaction device data;

[0012] The basic account information data includes user attributes, enterprise information and account status;

[0013] The transaction behavior data includes transfer records, credit card spending and cross-border transactions;

[0014] The transaction device data includes device fingerprints, login logs and IP associations;

[0015] Step S102: performing data cleaning on the basic account information data. The data cleaning includes missing value processing and outlier processing, marking missing key fields, and merging similar users using fuzzy matching.

[0016] Extract time series features from transaction behavior data to generate transaction time series features;

[0017] The transaction device data is combined with device features to generate a unique fingerprint, a device account bipartite graph is constructed to perform device association analysis, and the distance between IP positioning and GPS is detected to perform geographic location cleaning.

[0018] As a preferred embodiment of the financial fraud detection method of the present invention, step S200 specifically includes:

[0019] Step S201: extracting transaction nodes and transaction edges based on the real-time transaction data after data preprocessing, wherein the transaction nodes include account transaction nodes and device transaction nodes, and the transaction edges include transaction edges, login edges, and external association edges;

[0020] Step S202: normalize the transaction amount using an amount normalization formula to obtain a standardized amount coefficient. The mathematical expression of the amount normalization formula is:

[0021] The time decay coefficient is calculated using the time decay coefficient formula. The half-life of the time decay coefficient is 30 days. The mathematical expression of the time decay coefficient formula is:

[0022] A(t)=A0e V ,

[0023] Where A(t) represents the function value at time t, A0 represents the starting value of the quantity under study at time t=0, e represents the natural constant 2.71828, ln 2 represents the natural logarithm, 30 represents the number of days of the half-life, and t represents the time variable.

[0024] Calculate the device similarity coefficient. If the devices are the same, the device similarity coefficient is 1. If the devices are different, the device similarity coefficient is 0.2.

[0025] The mathematical expression of the weight algorithm formula is:

[0026] P = 0.5*normalized amount coefficient + 0.3*time decay coefficient + 0.2*device similarity coefficient, where P represents the weight of the updated transaction edge.

[0027] As a preferred embodiment of the financial fraud detection method of the present invention, step S300 specifically includes:

[0028] Step S301, calculating the transaction time entropy and transaction node degree of each transaction node, and calculating the final priority value V of each transaction node in the transaction graph based on the transaction time entropy, transaction node degree and transaction edge weight;

[0029] Step S302: Obtain the priority values ​​of the transaction nodes, sort the priority values, and color the transaction edges in descending order according to the priority values ​​and the conflict edge determination results to obtain color ID data of each transaction node in the transaction graph.

[0030] As a preferred solution of the financial fraud detection method described in the present invention, wherein: the transaction time entropy value of each transaction node on the transaction graph is calculated, the transaction time entropy value is used as the first priority value, the weight of the transaction edge is used as the second priority value, and the transaction node degree of the transaction node is used as the third priority value;

[0031] The final priority value V is calculated according to the first priority value, the second priority value, and the third priority value. The mathematical expression for calculating the final priority value V is:

[0032] V = 0.6*second priority value + 0.2*third priority value - 0.2*first priority value;

[0033] The specific method for calculating the transaction time entropy value of each transaction node on the transaction graph is:

[0034] Collect the timestamp information of transactions of each transaction node, arrange the transactions in chronological order, calculate the time interval between two adjacent transactions, divide the time interval into different time interval intervals, and calculate the proportion of the number of time intervals in each time interval interval to the total number of time intervals P i , the transaction time entropy value of the corresponding transaction node is calculated using the transaction time entropy formula. The mathematical expression of the transaction time entropy formula is:

[0035]

[0036] Where H represents the transaction time entropy value, and m represents the total number of time intervals;

[0037] The specific method for calculating the transaction node degree of each transaction node includes: counting the frequency of capital inflow and the frequency of capital outflow of each transaction node, and adding the frequency of capital inflow and the frequency of capital outflow to obtain the transaction node degree.

[0038] As a preferred embodiment of the financial fraud detection method of the present invention, step S400 specifically includes:

[0039] Step S401: assign four color IDs, 0, 1, 2, and 3, which correspond to four risk levels: high risk, medium risk, low risk, and no risk.

[0040] When the risk level is high, real-time interception and manual review measures are implemented;

[0041] When the risk level is medium, OTP verification is enhanced;

[0042] When the risk level is low, the transaction is released but the corresponding transaction node is recorded;

[0043] When the risk level is no risk, the transaction is normal;

[0044] Step S402, collecting spatiotemporal feature data of the color ID data of the transaction graph, and performing color spatiotemporal analysis using the spatiotemporal feature data;

[0045] The spatiotemporal feature data includes the proportion of various color ID data in the transaction graph in different time windows, the switching frequency of the color ID data of each transaction node per unit time, the geographical coordinates of the transaction, the movement trajectory of the transaction location in different time periods, and the density of the color nodes of the transaction graph for various color ID data. The spatiotemporal feature data is divided into a training set and a test set according to a certain ratio of 7:3;

[0046] In step S403, the maximum depth is set to 6 and the minimum number of sample splits is set to 9. The feature data of the training set and the corresponding target variables are input into the decision tree model for training. The trained decision tree model is tested using the test set until the accuracy reaches 0.9.

[0047] As a preferred solution of the financial fraud detection method described in the present invention, the specific method for determining the conflicting edge result is:

[0048] When the weight of the transaction edge is greater than 0.8, different color ID data is forcibly assigned;

[0049] When the weight of the transaction edge is 0.4-0.8, there is a 50% probability of different color ID data;

[0050] When the weight of the transaction edge is less than 0.4, the same color ID data is assigned.

[0051] As a preferred solution of the financial fraud detection method of the present invention, the logic for coloring the transaction nodes of the transaction graph is:

[0052] Create an empty dictionary to store the mapping from transaction nodes to color ID data;

[0053] Process the corresponding transaction nodes in descending order according to the priority values. For the current transaction node, check all neighbor nodes. If the edge weight with the neighbor node is greater than 0.7, mark the neighbor's color as a prohibited color. Starting from color 0, find the first color that is not in the prohibited color set, select the smallest non-prohibited color number, and return a dictionary containing the color assignments of all nodes.

[0054] As a preferred solution of the financial fraud detection method described in the present invention, the target variable is 0 or 1, 0 represents real-time transaction data of normal transactions, and 1 represents real-time transaction data of fraudulent transactions.

[0055] A financial fraud detection system includes a data acquisition module, a transaction engine building module, a data analysis module, and a risk mapping module;

[0056] The data acquisition module is used to collect real-time transaction data from the transaction database and perform data preprocessing;

[0057] The said easy engine construction module is used to construct a transaction graph according to the transaction database;

[0058] The data analysis module is used to perform greedy coloring analysis on the transaction graph;

[0059] The data analysis module is used to perform risk and color spatiotemporal analysis on the colored transaction graph.

[0060] The beneficial effects of the present invention are as follows: by allocating color IDs to transaction nodes through a greedy coloring algorithm, the transaction network status is updated in real time, the risk level identification of the nodes is dynamically adjusted, and the overall abnormal pattern of the transaction network can be captured. The color spatiotemporal analysis function of the transaction graph can not only analyze the current transaction status, but also track the evolution of the color IDs of transaction nodes in time and space dimensions, and can timely warn organizations of fraudulent behavior;

[0061] By collecting real-time transaction data, performing data preprocessing, and constructing a transaction graph with corresponding real-time updated transaction edge weights, it is possible to continuously receive and process real-time transaction data. The dynamic graph weight update mechanism gives the system the ability to evolve in real time. The edge weights in the transaction graph will be adjusted instantly according to the latest transaction data. The weight value replacement is achieved through a carefully designed attenuation algorithm and influence factor calculation, which can accurately reflect the latest status of the transaction network and capture subtle risk changes. The transaction graph graphically distributes risks. Through the visual interface provided by the system, risk control personnel and investigators can immediately focus on risk hotspots and anomalies, and promptly discover anomalies in financial transactions. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] Figure 1 A schematic diagram of the basic flow of a financial fraud detection method provided by one embodiment of the present invention. DETAILED DESCRIPTION

[0063] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings. It is obvious that the described embodiments are only part of the embodiments of the present invention, but not all of the embodiments.

[0064] Example 1, with reference to Figure 1 , as an embodiment of the present invention, provides a financial fraud detection method, comprising the following steps:

[0065] Step S100: collecting real-time transaction data and performing data preprocessing. The real-time transaction data includes basic account information data, transaction behavior data, and transaction device data.

[0066] Step S200: extracting transaction nodes and transaction edges from the pre-processed real-time transaction data, updating the weights of the transaction edges in real time according to a weighting algorithm, and constructing a transaction graph using the transaction nodes and the weighted transaction edges.

[0067] Step S300: Calculate the priority value of each transaction node in the transaction graph, perform greedy coloring analysis based on the priority value, and obtain color ID data of the real-time transaction data;

[0068] Step S400 , performing risk mapping on the color ID data, returning the risk level and corresponding disposal measures of the real-time transaction data, and performing color spatiotemporal analysis on the color ID data of the transaction graph.

[0069] Step S100 specifically includes:

[0070] Step S101: collecting real-time transaction data from a transaction database and performing data preprocessing. The real-time transaction data includes basic account information data, transaction behavior data, and transaction device data.

[0071] Basic account information data includes user attributes, enterprise information, and account status;

[0072] Transaction behavior data includes transfer records, credit card spending, and cross-border transactions;

[0073] Transaction device data includes device fingerprints, login logs, and IP associations;

[0074] Step S102: Clean the basic account information data. Data cleaning includes missing value processing and outlier processing. Missing key fields are marked and similar users are merged using fuzzy matching.

[0075] Extract time series features from transaction behavior data to generate transaction time series features;

[0076] The transaction device data is combined with device features to generate a unique fingerprint, a device account bipartite graph is constructed to perform device association analysis, and the distance between IP positioning and GPS is detected to perform geographic location cleaning.

[0077] In this embodiment, by cleaning the basic account information data, marking the missing key fields, and using fuzzy matching technology to merge similar users, the noise in the data can be reduced and the integrity of the data can be improved. By merging similar users, the transaction user portrait can be further enriched and the accuracy of risk identification can be improved. By performing time series analysis on the transaction behavior data, the dynamic changes of the user's transaction behavior can be reflected. By generating a unique fingerprint of the device and constructing a device account bipartite graph for device association analysis, it is helpful to track the usage of the device and identify whether there is abnormal device association or impersonation. By detecting the distance between the IP positioning and the GPS and performing geographic location cleaning, the authenticity of the transaction can be further verified, the risk of fraud related to geographic location can be reduced, and multi-dimensional analysis of the transaction data can be achieved. The transaction database contains the basic account information data, transaction behavior data, transaction device data and external association data of historical transactions and the corresponding target variables.

[0078] Step S200 specifically includes:

[0079] Step S201: extracting transaction nodes and transaction edges based on the real-time transaction data after data preprocessing. Transaction nodes include account transaction nodes and device transaction nodes. Transaction edges include transaction edges, login edges, and external association edges.

[0080] Step S202: normalize the transaction amount using the amount normalization formula to obtain a standardized amount coefficient. The mathematical expression of the amount normalization formula is:

[0081] The time decay coefficient formula is used to calculate the time decay coefficient. The half-life of the time decay coefficient is 30 days. The mathematical expression of the time decay coefficient formula is:

[0082] A(t)=A0e V ,

[0083] Where A(t) represents the function value at time t, A0 represents the starting value of the quantity under study at time t=0, e represents the natural constant 2.71828, ln 2 represents the natural logarithm, 30 represents the number of days of the half-life, and t represents the time variable.

[0084] Calculate the device similarity coefficient. If the devices are the same, the device similarity coefficient is 1. If the devices are different, the device similarity coefficient is 0.2.

[0085] The mathematical expression of the weight algorithm formula is:

[0086] P = 0.5*normalized amount coefficient + 0.3*time decay coefficient + 0.2*device similarity coefficient, where P represents the weight of the updated transaction edge.

[0087] In this embodiment, by constructing a corresponding transaction graph for real-time transaction data, the association between devices and accounts can be reflected. By constructing a corresponding transaction network, transaction behaviors and their associations can be more intuitively displayed, providing a basis for subsequent risk assessment and anomaly detection. At the same time, the influence of transaction time and device similarity is taken into account, and the influence of early transactions in weight calculation can be gradually reduced. The weight of the transaction edge integrates data from three dimensions: transaction amount, time, and device, providing a more comprehensive and accurate basis for subsequent risk assessment and anomaly detection.

[0088] Step S300 specifically includes:

[0089] Step S301: Calculate the transaction time entropy and transaction node degree of each transaction node, and calculate the final priority value V of each transaction node in the transaction graph based on the transaction time entropy, transaction node degree, and transaction edge weights;

[0090] Step S302: Obtain the priority value of each transaction node, sort the priority values, and color the transaction edges in descending order according to the priority values ​​and the conflict edge determination results to obtain the color ID data of each transaction node in the transaction graph.

[0091] In this embodiment, by calculating the priority values ​​of transaction nodes and coloring them, risk assessment and importance ranking of each node in the transaction graph are achieved, providing basic data support for subsequent abnormal transaction detection, risk warning and visual display. By prioritizing high-risk or important transaction nodes, potential risks and problems can be identified more effectively, improving transaction security and risk management efficiency. The coloring results can provide business personnel with intuitive visual feedback, which can help business personnel better understand the structure and risk distribution of the transaction network.

[0092] Calculate the transaction time entropy value of each transaction node on the transaction graph, use the transaction time entropy value as the first priority value, the transaction edge weight as the second priority value, and the transaction node degree of the transaction node as the third priority value;

[0093] The final priority value V is calculated based on the first priority value, the second priority value, and the third priority value. The mathematical expression for calculating the final priority value V is:

[0094] V = 0.6*second priority value + 0.2*third priority value - 0.2*first priority value;

[0095] The specific method for calculating the transaction time entropy value of each transaction node on the transaction graph is:

[0096] Collect the timestamp information of transactions of each transaction node, arrange the transactions in chronological order, calculate the time interval between two adjacent transactions, divide the time interval into different time interval intervals, and calculate the proportion of the number of time intervals in each time interval interval to the total number of time intervals P i , the transaction time entropy value of the corresponding transaction node is calculated using the transaction time entropy formula. The mathematical expression of the transaction time entropy formula is:

[0097]

[0098] Where H represents the transaction time entropy value, and m represents the total number of time intervals;

[0099] The specific method for calculating the transaction node degree of each transaction node includes: counting the frequency of capital inflow and the frequency of capital outflow of each transaction node, and adding the frequency of capital inflow and the frequency of capital outflow to obtain the transaction node degree.

[0100] In this embodiment, by calculating the transaction time entropy, transaction edge weight, and transaction node degree for each transaction node on the transaction graph and combining them into a final priority value, V, a more comprehensive assessment of the importance and risk level of a transaction node in the transaction network can be achieved. This not only considers direct factors such as the transaction amount and time, but also the temporal distribution characteristics of transaction behavior and the degree of node connectivity in the network. This provides strong data support for subsequent tasks such as abnormal transaction detection, risk warning, and visualization.

[0101] Step S400 specifically includes:

[0102] Step S401: assign four color IDs, 0, 1, 2, and 3, which correspond to four risk levels: high risk, medium risk, low risk, and no risk.

[0103] When the risk level is high, real-time interception and manual review measures are implemented;

[0104] When the risk level is medium, OTP verification is enhanced;

[0105] When the risk level is low, the transaction is released but the corresponding transaction node is recorded;

[0106] When the risk level is no risk, the transaction is normal;

[0107] Step S402, collecting spatiotemporal feature data of the color ID data of the transaction graph, and performing spatiotemporal color analysis using the spatiotemporal feature data;

[0108] The spatiotemporal feature data includes the proportion of various color ID data in the transaction graph within different time windows, the switching frequency of the color ID data of each transaction node per unit time, the geographical coordinates of the transaction, the movement trajectory of the transaction location in different time periods, and the density of the color nodes of the transaction graph with various color ID data. The spatiotemporal feature data is divided into training set and test set according to a certain ratio of 7:3;

[0109] In step S403, the maximum depth is set to 6 and the minimum number of sample splits is set to 9. The feature data of the training set and the corresponding target variables are input into the decision tree model for training. The trained decision tree model is tested using the test set until the accuracy reaches 0.9.

[0110] In this embodiment, through the risk mapping of color ID data, it is possible to quickly judge and deal with the risk level of real-time transaction data in a targeted manner, thereby ensuring transaction security. By collecting and analyzing spatiotemporal feature data and using decision tree models for training and optimization, the potential patterns of transaction behaviors in the spatiotemporal dimensions are explored, thereby improving the accuracy and intelligence level of financial fraud detection, providing strong technical support for financial security, and also helping to timely discover potential fraud patterns and enhance the system's adaptability to complex transaction scenarios.

[0111] The specific method for determining the conflicting edge result is as follows:

[0112] When the weight of a transaction edge is greater than 0.8, different color ID data is assigned forcibly;

[0113] When the weight of the transaction edge is 0.4-0.8, there is a 50% probability of different color ID data;

[0114] When the weight of a transaction edge is less than 0.4, the same color ID data is assigned.

[0115] In this embodiment, through differentiated color ID data allocation strategies, the degree of correlation between transaction nodes is closely linked to potential risks, and different processing methods are adopted for different weight intervals. This can not only accurately capture high-risk transactions, but also effectively avoid misjudgment of low-risk transactions. At the same time, it realizes the rational allocation of computing resources, lays a solid foundation for the construction of transaction graphs and subsequent risk analysis, and significantly enhances the reliability, accuracy and efficiency of the financial fraud detection system.

[0116] The logic for coloring the transaction nodes of the transaction graph is:

[0117] Create an empty dictionary to store the mapping from transaction nodes to color ID data;

[0118] Process the corresponding transaction nodes in descending order of priority. For the current transaction node, check all neighbor nodes. If the edge weight with the neighbor node is greater than 0.7, mark the neighbor's color as a prohibited color. Starting from color 0, find the first color that is not in the prohibited color set, select the smallest non-prohibited color number, and return a dictionary containing the color assignments of all nodes.

[0119] In this embodiment, by creating a mapping dictionary, processing nodes in descending order of priority, marking prohibited colors and selecting the smallest non-prohibited color, and assigning color IDs to transaction nodes, the degree of correlation and potential risks between transaction nodes can be intuitively reflected, and highly correlated and high-risk nodes can be clearly presented in the transaction graph, thereby quickly locating suspicious transaction groups and building a clear transaction relationship network. This provides an intuitive and effective data foundation for subsequent risk mapping and fraud behavior analysis, and improves the financial fraud detection system's ability to handle complex transaction relationships and the accuracy of risk identification.

[0120] The target variable is 0 or 1, where 0 represents real-time transaction data of normal transactions and 1 represents real-time transaction data of fraudulent transactions.

[0121] In this embodiment, real-time transaction data corresponding to target variables 0 and 1 are obtained from the transaction database. The target variable is set to 0 or 1, corresponding to normal transactions and fraudulent transactions, respectively. This provides key support for the training, evaluation, and practical application of financial fraud detection models, can learn the characteristic patterns of transaction data, help optimize the model to improve performance, and provide a clear basis for risk decision-making.

[0122] A financial fraud detection system includes a data acquisition module, a transaction engine building module, a data analysis module, and a risk mapping module;

[0123] The data acquisition module is used to collect real-time transaction data from the transaction database and perform data preprocessing;

[0124] The YiEngine building module is used to build a transaction graph based on the transaction database;

[0125] The data analysis module is used to perform greedy coloring analysis on the transaction graph;

[0126] The data analysis module is used to perform risk and color spatiotemporal analysis on the colored transaction graph.

[0127] By assigning color IDs to transaction nodes through a greedy coloring algorithm, the transaction network status is updated in real time, and the risk level identification of nodes is dynamically adjusted. This can capture the overall abnormal patterns of the transaction network. The color spatiotemporal analysis function of the transaction graph can not only analyze the current transaction status, but also track the evolution of the color IDs of transaction nodes in time and space dimensions, providing timely warnings for fraudulent activities.

[0128] By collecting real-time transaction data, performing data preprocessing, and constructing a transaction graph with corresponding real-time updated transaction edge weights, it is possible to continuously receive and process real-time transaction data. The dynamic graph weight update mechanism gives the system the ability to evolve in real time. The edge weights in the transaction graph will be adjusted instantly according to the latest transaction data. The weight value replacement is achieved through a carefully designed attenuation algorithm and influence factor calculation, which can accurately reflect the latest status of the transaction network and capture subtle risk changes. The transaction graph graphically distributes risks. Through the visual interface provided by the system, risk control personnel and investigators can immediately focus on risk hotspots and anomalies, and promptly discover anomalies in financial transactions.

[0129] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a fully hardware embodiment, a fully software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media containing computer-usable program code. The storage medium may be implemented by any type of volatile or non-volatile storage device, or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0130] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A financial fraud detection method, characterized in that: The steps include: Step S100: collecting real-time transaction data and performing data preprocessing, wherein the real-time transaction data includes basic account information data, transaction behavior data, and transaction device data; Step S200: extracting transaction nodes and transaction edges based on the real-time transaction data after data preprocessing, updating the weights of the transaction edges in real time according to a weight algorithm formula, and constructing a transaction graph using the transaction nodes and the transaction edges with updated weights; Step S300: Calculate the priority value of each transaction node in the transaction graph, perform greedy coloring analysis based on the priority value, and obtain color ID data of the real-time transaction data; Step S400 , performing risk mapping on the color ID data, returning the risk level and corresponding disposal measures of the real-time transaction data, and performing color spatiotemporal analysis on the color ID data of the transaction graph.

2. A financial fraud detection method according to claim 1, characterized in that: Step S100 specifically includes: Step S101: collecting real-time transaction data from a transaction database and performing data preprocessing, wherein the real-time transaction data includes basic account information data, transaction behavior data, and transaction device data; The basic account information data includes user attributes, enterprise information and account status; The transaction behavior data includes transfer records, credit card spending and cross-border transactions; The transaction device data includes device fingerprints, login logs and IP associations; Step S102: performing data cleaning on the basic account information data. The data cleaning includes missing value processing and outlier processing, marking missing key fields, and merging similar users using fuzzy matching. Extract time series features from transaction behavior data to generate transaction time series features; The transaction device data is combined with device features to generate a unique fingerprint, a device account bipartite graph is constructed to perform device association analysis, and the distance between IP positioning and GPS is detected to perform geographic location cleaning.

3. The financial fraud detection method according to claim 1, wherein: Step S200 specifically includes: Step S201: extracting transaction nodes and transaction edges based on the real-time transaction data after data preprocessing, wherein the transaction nodes include account transaction nodes and device transaction nodes, and the transaction edges include transaction edges, login edges, and external association edges; Step S202: normalize the transaction amount using an amount normalization formula to obtain a standardized amount coefficient. The mathematical expression of the amount normalization formula is: The time decay coefficient is calculated using the time decay coefficient formula. The half-life of the time decay coefficient is 30 days. The mathematical expression of the time decay coefficient formula is: A(t)=A0e V , Where A(t) represents the function value at time t, A0 represents the starting value of the quantity under study at time t=0, e represents the natural constant 2.71828, ln 2 represents the natural logarithm, 30 represents the number of days of the half-life, and t represents the time variable. Calculate the device similarity coefficient. If the devices are the same, the device similarity coefficient is 1. If the devices are different, the device similarity coefficient is 0.

2. The mathematical expression of the weight algorithm formula is: P = 0.5*normalized amount coefficient + 0.3*time decay coefficient + 0.2*device similarity coefficient, where P represents the weight of the updated transaction edge.

4. The financial fraud detection method according to claim 1, wherein: Step S300 specifically includes: Step S301, calculating the transaction time entropy and transaction node degree of each transaction node, and calculating the final priority value V of each transaction node in the transaction graph based on the transaction time entropy, transaction node degree and transaction edge weight; Step S302: Obtain the priority values ​​of the transaction nodes, sort the priority values, and color the transaction edges in descending order according to the priority values ​​and the conflict edge determination results to obtain color ID data of each transaction node in the transaction graph.

5. The financial fraud detection method according to claim 1, wherein: Calculating the transaction time entropy value of each transaction node on the transaction graph, using the transaction time entropy value as a first priority value, using the weight of the transaction edge as a second priority value, and using the transaction node degree of the transaction node as a third priority value; The final priority value V is calculated according to the first priority value, the second priority value, and the third priority value. The mathematical expression for calculating the final priority value V is: V = 0.6*second priority value + 0.2*third priority value - 0.2*first priority value; The specific method for calculating the transaction time entropy value of each transaction node on the transaction graph is: Collect the timestamp information of transactions of each transaction node, arrange the transactions in chronological order, calculate the time interval between two adjacent transactions, divide the time interval into different time interval intervals, and calculate the proportion of the number of time intervals in each time interval interval to the total number of time intervals P i , the transaction time entropy value of the corresponding transaction node is calculated using the transaction time entropy formula. The mathematical expression of the transaction time entropy formula is: Where H represents the transaction time entropy value, and m represents the total number of time intervals; The specific method for calculating the transaction node degree of each transaction node includes: counting the frequency of capital inflow and the frequency of capital outflow of each transaction node, and adding the frequency of capital inflow and the frequency of capital outflow to obtain the transaction node degree.

6. The financial fraud detection method according to claim 1, wherein: Step S400 specifically includes: Step S401: assign four color IDs, 0, 1, 2, and 3, which correspond to four risk levels: high risk, medium risk, low risk, and no risk. When the risk level is high, real-time interception and manual review measures are implemented; When the risk level is medium, OTP verification is enhanced; When the risk level is low, the transaction is released but the corresponding transaction node is recorded; When the risk level is no risk, the transaction is normal; Step S402, collecting spatiotemporal feature data of the color ID data of the transaction graph, and performing color spatiotemporal analysis using the spatiotemporal feature data; The spatiotemporal feature data includes the proportion of various color ID data in the transaction graph in different time windows, the switching frequency of the color ID data of each transaction node per unit time, the geographical coordinates of the transaction, the movement trajectory of the transaction location in different time periods, and the density of the color nodes of the transaction graph for various color ID data. The spatiotemporal feature data is divided into a training set and a test set according to a certain ratio of 7:3; In step S403, the maximum depth is set to 6 and the minimum number of sample splits is set to 9. The feature data of the training set and the corresponding target variables are input into the decision tree model for training. The trained decision tree model is tested using the test set until the accuracy reaches 0.

9.

7. The financial fraud detection method according to claim 1, wherein: The specific method for determining the conflicting edge result is as follows: When the weight of the transaction edge is greater than 0.8, different color ID data is forcibly assigned; When the weight of the transaction edge is 0.4-0.8, there is a 50% probability of different color ID data; When the weight of the transaction edge is less than 0.4, the same color ID data is assigned.

8. The financial fraud detection method according to claim 1, wherein: The logic for coloring the transaction nodes of the transaction graph is: Create an empty dictionary to store the mapping from transaction nodes to color ID data; Process the corresponding transaction nodes in descending order according to the priority values. For the current transaction node, check all neighbor nodes. If the edge weight with the neighbor node is greater than 0.7, mark the neighbor's color as a prohibited color. Starting from color 0, find the first color that is not in the prohibited color set, select the smallest non-prohibited color number, and return a dictionary containing the color assignments of all nodes.

9. The financial fraud detection method according to claim 1, wherein: The target variable is 0 or 1, 0 represents real-time transaction data of normal transactions, and 1 represents real-time transaction data of fraudulent transactions.

10. A financial fraud detection system, comprising a financial fraud detection method according to any one of claims 1 to 9, characterized in that: It includes data collection module, transaction engine construction module, data analysis module and risk mapping module; The data acquisition module is used to collect real-time transaction data from the transaction database and perform data preprocessing; The said easy engine construction module is used to construct a transaction graph according to the transaction database; The data analysis module is used to perform greedy coloring analysis on the transaction graph; The data analysis module is used to perform risk and color spatiotemporal analysis on the colored transaction graph.

Images