Bank anti-money laundering data model construction method based on privacy calculation

Abstract

The invention provides a bank anti-money laundering data model construction method based on privacy computing, and the method comprises the steps: recognizing node role diversity and topology mutation characteristics through an encryption topology framework, extracting transaction paths and a multi-layer nesting relation between nodes, analyzing the role distribution of a transaction main body, and obtaining a dynamic path mutation set; according to the dynamic path mutation set, accounts with short use cycles and accounts with frequently changed transaction subjects are screened out and marked as potential suspicious transaction subjects, and a preliminary suspicious transaction subject list is obtained; identifying transaction records of the preliminary suspicious transaction subject list, screening out high-risk transaction subjects with false registration information or key identity information missing, and obtaining a high-risk transaction subject subset; and counting a plurality of small transactions of the high-risk transaction subject subset, identifying distribution characteristics and multi-layer transfer paths of the small transactions, and extracting fund splitting modes and hidden flow direction characteristics to obtain a high-risk transaction path characteristic graph.

Description

Technical Field

[0001] The present invention relates to the field of information technology, and in particular to a method for constructing a bank anti-money laundering data model based on privacy computing. Background Art

[0002] Anti-money laundering is a core issue in financial security, directly impacting the stability of the global economic order and social equity. Money laundering conceals the source of illicit proceeds through complex fund flows, threatening the compliance of financial institutions and public safety. Currently, pattern mining methods based on secure multi-party computation have become a hot topic of research, aiming to uncover hidden money laundering activities through multi-party collaboration. However, existing methods have significant limitations in addressing emerging money laundering techniques. Traditional technologies often rely on data analysis from a single institution, making it difficult to reconstruct transaction chains distributed across multiple institutions. They are also slow to respond to the rapid evolution of money laundering techniques, particularly when fund flows become complex and transaction features are artificially distorted, significantly reducing identification efficiency. New money laundering techniques can cause sudden changes in the topology of the money laundering network, such as shifting from a simple chain-like structure to a multi-layered mesh, making it difficult for traditional algorithms to accurately track the fund path. This topological change further causes anomalies in time series characteristics. By artificially disrupting transaction cycles, money launderers disrupt the normal cyclical patterns, rendering detection methods based on historical patterns ineffective. A deeper challenge lies in the deliberate concealment of the strength of the connections between transacting entities. Money laundering rings frequently change transacting entities or use false identities, weakening the traceability of these connections. These factors compound each other, creating a complex dilemma for pattern recognition. Therefore, designing a collaborative algorithm that dynamically updates the feature library while ensuring that data from various institutions remains within the domain, adapting to sudden changes in the money laundering network's topology, interference with time series features, and the trend of concealed connection strength, has become a key issue in anti-money laundering pattern mining. Summary of the Invention

[0003] The present invention provides a method for constructing a bank anti-money laundering data model based on privacy computing, which mainly includes:

[0004] Obtain the capital flow of each financial institution. Based on the transaction complexity and data fragmentation distribution, stratified sampling is used to integrate the multi-institutional mesh path data to obtain preliminary flow map fragments, identify the path density and concealment level, and perform perturbation processing on the key paths to obtain the global capital flow map encryption framework.

[0005] Through the encrypted topology framework, we identify the diversity of node roles and topological mutation characteristics, extract the transaction paths and multi-layer nested relationships between nodes, analyze the role distribution of transaction entities, and obtain a dynamic path mutation set.

[0006] Based on the dynamic path mutation set, accounts with short usage cycles and accounts with frequent changes in transaction subjects are screened out and marked as potentially suspicious transaction subjects, resulting in a preliminary list of suspicious transaction subjects.

[0007] Identify transaction records on the preliminary list of suspicious transaction entities, screen out high-risk transaction entities with false registration information or missing key identity information, and obtain a subset of high-risk transaction entities;

[0008] Counting multiple small transactions from a subset of high-risk transaction entities, identifying their distribution characteristics and multi-layer transfer paths, extracting fund splitting patterns and hidden flow characteristics, and obtaining a high-risk transaction path feature map;

[0009] The irregular distribution of transaction time intervals and the frequency of regional switching are analyzed using the high-risk transaction path feature graph. If the time interval deviates from the preset regularity or the regional switching frequency exceeds the preset threshold, it is marked as an abnormal transaction pattern, and the abnormal transaction pattern set is obtained;

[0010] Based on the set of abnormal transaction patterns, the differential distribution of transaction amounts at different levels and the degree of visualization of the correlation between nodes are calculated, the core transaction nodes and key capital flow paths are determined, and the core transaction subgraph is obtained. Combined with the subset of high-risk transaction entities, path feature graph, and set of abnormal transaction patterns, the anti-money laundering risk is predicted through the graph neural network, and a money laundering risk warning is output.

[0011] Furthermore, the paper captures the capital flows of various financial institutions. To address transaction complexity and data fragmentation, stratified sampling is used to integrate multi-institutional mesh path data, generating preliminary flow map fragments. Path density and concealment are identified, and key paths are perturbed to create a global capital flow map encryption framework. This framework includes: stratified sampling of capital flow density based on the geographic coordinates of institutional outlets and transaction time series using a five-layer feedforward neural network, with 128, 64, 32, 16, and 8 nodes per layer, respectively. The activation function uses Reinforced Luminance (ReLU). The sampled data is categorized and aggregated according to capital flow frequency and transaction volatility periodicity. Representative transaction records are extracted from each group of outlets to generate a multi-level sample dataset. To address capital flow speed and transaction complexity, inter-financial institution fund transfer details are obtained from the sample dataset. Transaction paths are grouped and decomposed using a red-black tree structure. The decomposed data is then labeled at three levels: high, medium, and low, combining the path fuzziness coefficient and transaction concealment. Path extension calculations are performed on the labeled data using a minimum spanning tree algorithm to generate an initial transaction network diagram. The initial transaction network graph is used to obtain node connectivity. Node importance is calculated using the PageRank algorithm. Transaction paths are segmented and encoded based on node importance. The encoded data is encrypted in blocks using the SHA256 hash algorithm to obtain encrypted path data. Subgraphs are extracted from the encrypted path data and then partitioned by modularity using the Louvain community discovery algorithm. Nodes are grouped and clustered based on the partitioning results. The strength of association between node groups is determined using edge metrics to generate a path density distribution map. Institutional-level distribution data is obtained from the path density distribution map. Key path data is perturbed using the secp256k1 elliptic curve. Perturbation parameters include base point coordinates and curve coefficients. The processed data is segmented and encoded based on the degree of data dispersion. The encoded data is encrypted in blocks using the SM4 algorithm, yielding an encrypted capital flow map.

[0012] Furthermore, the encrypted topology framework is used to identify node role diversity and topological mutation characteristics, extract inter-node transaction paths and multi-layer nested relationships, analyze the role distribution of transaction entities, and obtain a dynamic path mutation set. This includes: clustering node behavior features using random forests based on node transaction frequency and transaction link length in the encrypted topology data. The tree depth is set to 16, the minimum number of leaf node samples is 5, and the feature dimensions include transaction amount, transaction time interval, and number of counterparties. The clustering results are labeled according to node activity and transaction scale ratio. Transaction feature vectors are extracted from the node behavior data to obtain the initial node role dataset. For the initial node role dataset, a directed acyclic graph is constructed using the adjacency matrix to structurally decompose the multi-layer nested relationships between nodes. Binary encoding is performed according to the nesting level depth and node connection density. The encoding rule uses the correspondence between level depth and position. A hierarchical clustering algorithm is used to classify the encoded data into roles. The clustering distance is Manhattan distance, resulting in a node role mapping table. Role transition speed data is obtained from the node role mapping table. Node transaction time series associations are sampled in 24-hour windows with a sampling interval of 1 hour. The sampled data is grouped according to the path change amplitude. Feature extraction is performed on the grouped data using discrete wavelet transforms, using Dobesh wavelet basis functions to generate a 128-dimensional path change feature vector. Node role importance is calculated based on the path change feature vector. The importance value is based on the weighted sum of node degree centrality and node feature vector centrality, with a weight ratio of 3:7. Node distribution features are subjected to principal component analysis for dimensionality reduction, retaining principal components with a cumulative explained variance of 90%. Path mutation probability is calculated from the reduced feature space. The mutation rate is calculated by dividing the Euclidean distance of nodes in adjacent time windows by the time window size. If the mutation rate exceeds a preset threshold of 0.8, it is identified as a mutation point. The DBSCAN algorithm is used to density cluster these mutation points to obtain a dynamic path mutation set.

[0013] Furthermore, based on the dynamic path mutation set, accounts with short usage cycles and accounts that frequently change transaction subjects were screened and marked as potentially suspicious transaction subjects, resulting in a preliminary list of suspicious transaction subjects. This list included: Based on node role classification data and account duration, the frequency of transaction subject changes was divided into five groups using the natural breakpoint method, with a threshold for inter-group difference set at 0.85. The grouped data were weighted according to the distribution of single transaction amount and transaction time, with a weight ratio of 4:6. A 12-dimensional account activity feature vector, including transaction frequency, amount fluctuation, and time interval, was extracted from the transaction dataset to obtain account behavior benchmark data. For this account behavior benchmark data, a support vector machine was used to perform binary classification on fund flow density and account activation level, with a density threshold set at an average daily number of transactions of 8 and an activation threshold set at an average monthly number of transactions of 15. Features were extracted based on transaction link length and subject association strength. Principal component dimensionality reduction was used to retain features with an explained variance ratio of 90%, resulting in an account anomaly index. Data on transaction stability was obtained from the account anomaly index. The proportion of funds was statistically analyzed according to the three tiers of small, medium, and large amounts, with the amount cutoffs set at 10,000 and 100,000 yuan. The statistical data was spatially clustered based on the geographical span of the transactions, with an inter-cluster distance threshold of 0.75. The clustering results were combined and matched using an association rule mining algorithm with a minimum support value of 0.3 to generate an account association graph. Node attributes were extracted from the account association graph, and accounts with a lifespan of less than 90 days and an average monthly transaction subject change of more than five were flagged. Three filtering thresholds were set based on the risk warning level: 0.8, 0.6, and 0.4, respectively, to generate a preliminary screening set of accounts. Transaction behavior data was obtained from this preliminary screening set of accounts and classified using a decision tree with a tree depth of five levels, a splitting criterion using the Gini coefficient, and a minimum leaf node sample size of 10. Nodes with a risk score exceeding 0.75 were flagged as suspicious transactions, resulting in a preliminary list of suspicious transactions.

[0014] Furthermore, transaction records on the preliminary list of suspicious transaction entities are identified, and high-risk transaction entities with false registration information or missing key identity information are screened out to obtain a subset of high-risk transaction entities. This includes: Based on the preliminary list of suspicious transaction entities, a data integrity verification tool is used to verify the integrity of registration information. The verification items include ID number, organization code, registered address, and business scope. Three levels of identification are set according to the identity verification status: passed, pending verification, and failed. Basic data features are extracted from the entity registration information database to obtain an information integrity assessment table. For the information integrity assessment table, address information is accurately matched using a geocoder. The matching rules include four-level positioning of province, city, district, and street number. Verification rules for the authenticity of mobile phone numbers and the correspondence of landline area codes are set according to the validity of contact information. Random forest classification is used with a tree depth of 8 layers. Feature dimensions include address accuracy, contact information verification results, and registered capital authenticity. The authenticity index of the entity information is obtained. Business scope data was obtained from the subject information authenticity index. Legal person information was cross-validated across three sources: industrial and commercial, tax, and banking. A related subject graph was constructed based on the correspondence between related accounts. Edge weights were set to the normalized values ​​of transaction frequency and amount. Anomalous information was grouped using a spectral clustering algorithm with the number of eigenvalues ​​set to 6, resulting in a subject information anomaly mapping table. Change records were extracted from the subject information anomaly mapping table, with a threshold of 3 changes in the past 90 days. The information was classified into three levels based on the degree of missing information: no missing, single missing, and multiple missing. This yielded a preliminary information risk assessment table. Risk warning data was obtained from the preliminary information risk assessment table. Risk level assessment was performed using XGBoost with a learning rate of 0.1, a maximum tree depth of 6, and a minimum number of child node samples of 50. Feature dimensions included information integrity, authenticity index, change frequency, and missing level, resulting in a subset of high-risk transaction subjects.

[0015] Furthermore, statistics were collected for multiple small transactions from a subset of high-risk transaction entities to identify their distribution characteristics and multi-layer transfer paths. Fund splitting patterns and hidden flow characteristics were extracted to obtain a high-risk transaction path feature graph. This included: based on the transaction records in the high-risk transaction entity subset, adaptive binning was used to divide the transaction amount distribution into intervals, with a minimum bin width of 1,000 yuan and a maximum bin number of 20. Data was grouped according to transfer frequency characteristics and the average daily number of split transactions. Fund split sequences were extracted from transaction flow records. K-means clustering was used to perform pattern recognition on the sequence data, with the number of cluster centers set to 5, to obtain a split transaction feature table. Based on the split transaction feature table, fund flow characteristics were reconstructed using a directed graph. Path weights were set based on the time interval between consecutive transfers and the number of path jumps. The weights were calculated by multiplying the inverse of the time interval by the number of jumps. Transfer links were extracted from the inter-node relationship data. The Dijkstra algorithm was used to optimize the shortest path of the link data to obtain a multi-layer transfer path set. We obtained data on the number of split transactions from a multi-layer transfer path set and calculated the ratio of small transactions to a single large transaction. We then divided the transfer hierarchy into three layers based on path length, setting an inter-layer distance threshold of 2. We then sorted the funds based on the time interval between splitting and converging. We then grouped the sorted results using a hierarchical clustering algorithm and used the Euclidean distance metric to generate a split pattern mapping table. We then calculated the fund dispersion between nodes based on the split pattern mapping table, setting a fund dispersion threshold between 0.6 and 0.8. We then calculated a complexity coefficient based on the ratio of the number of nodes in a path to its length, and labeled paths above the threshold to generate an abnormal path dataset. We then extracted node features from the abnormal path dataset and constructed a three-layer graph neural network with 64, 32, and 16 hidden layer nodes, respectively. We used ReLU as the activation function and extracted path features through graph convolution. This yielded a high-risk transaction path feature map containing three types of feature data: node attributes, edge weights, and path length.

[0016] Furthermore, a heat map of the amount distribution is constructed based on the records of multiple small transactions by high-risk transaction entities, the time series fluctuation indicators of the transactions are extracted, the star-shaped dispersion structure and the chain transfer pattern are identified, and the abnormal split ratio and the regional mismatch flow direction are identified based on the star-shaped dispersion structure and the chain transfer pattern, so as to obtain the node risk level and path complexity, and generate a transaction feature map including capital dispersion, path concealment and regional span, including: based on the records of multiple small transactions by high-risk transaction entities, a heat map of the transaction amount distribution is constructed through kernel density estimation, the kernel function uses a Gaussian kernel, the bandwidth is set to 0.15, normalization is performed according to the transaction frequency ratio and the time series fluctuation characteristics, daily transaction amount series is extracted from the transaction data set, and the sequence data is decomposed into three layers using the De Besch wavelet transform to obtain the amount distribution heat map. For the node distribution in the heat map, we identified star structures based on a central node connectivity greater than 5, and chain structures based on a path length greater than 3 and a branch count less than 2. We extracted three topological features from the node connectivity data: in-degree, betweenness centrality, and clustering coefficient. We then used spectral clustering for pattern classification, setting the number of eigenvalues ​​to 6, to generate a transaction structure feature table. We then obtained split ratio data from the transaction structure feature table and calculated the ratio of the amount of a single large transaction to smaller transactions. We then performed spatial statistics on the inter-regional distances for cross-regional transactions, setting the region matching threshold to three adjacent provinces. We then used the k-nearest neighbor algorithm for anomaly detection, setting the number of neighbors to 5, to generate a transaction anomaly index. We then calculated a node risk score based on the transaction anomaly index, setting the capital dispersion coefficient threshold to 0.6 to 0.8. We then calculated structural complexity based on the ratio of the number of nodes in a path to its length. Paths above the threshold were labeled to generate a risky path set. Node features are extracted from the risk path set and represented using the DeepWalk graph embedding algorithm. The walk sequence length is set to 80, the window size is set to 10, and the embedding dimension is set to 64. The embedding vector is reduced to three dimensions using the tSNE algorithm to obtain a transaction feature map. The map contains three types of attribute data: node risk, path concealment, and geographical span.

[0017] Furthermore, the irregular distribution of transaction time intervals and the frequency of regional switching are analyzed using a high-risk transaction path feature graph. If the time interval deviates from a preset pattern or the regional switching frequency exceeds a preset threshold, it is marked as an abnormal transaction pattern. This results in a set of abnormal transaction patterns, including: based on the high-risk transaction path feature graph, using a time series analysis tool to reconstruct the distribution of transaction time intervals, normalizing the data according to the time series fluctuation amplitude and transaction periodicity, extracting a timestamp sequence from the transaction records, and modeling regularity using a three-layer variational autoencoder with 128-64-32 encoder and decoder layers and a ReLU activation function to obtain a time series feature vector. For the time series feature vector, spatial statistical methods are used to count the frequency of regional switching. A weight matrix is ​​constructed based on the spatial span index and the regional transition speed, with the weight value set to the inverse of the distance between regions. A spatial coordinate sequence is extracted from the transaction address data, and a second-order Markov chain is used to calculate the transition probability to obtain a regional transition feature table. Transaction anomaly data was obtained from the regional transfer feature table. The DBSCAN algorithm was used to cluster regional migration intensity, with a neighborhood radius of 0.5 and a minimum sample size of 5. Kernel density estimation was performed on the clustered data based on the time series deviation, with a bandwidth parameter of 0.1, to produce a density distribution map. Abnormal transaction indicators were extracted from the density distribution map. Anomaly detection was performed using the Isolation Forest algorithm with a sample contamination rate of 0.1 and a number of trees of 100. The degree of anomaly was scored to produce a transaction anomaly index. Based on the transaction anomaly index, transaction paths with time intervals exceeding three standard deviations or with more than five regional switches per day were marked. Pattern regularity was calculated based on the entropy of the transaction patterns, with a regularity threshold of 0.7, to produce a set of abnormal paths. Feature data was extracted from the set of abnormal paths, and classification was performed using a support vector machine (SVM) with a radial basis function kernel, a penalty parameter C of 1.0, and a kernel parameter gamma of 0.1 to produce a set of abnormal transaction patterns.

[0018] Furthermore, based on the set of abnormal transaction patterns, the differential distribution of transaction amounts at different levels and the degree of visualization of inter-node associations were calculated. Core transaction nodes and key capital flow paths were identified, resulting in a core transaction subgraph. Combining the high-risk transaction subject subset, path feature graph, and abnormal transaction pattern set, a graph neural network was used to predict anti-money laundering risk and output money laundering risk warnings. This process involved: Based on the set of abnormal transaction patterns, a hierarchical analysis was used to statistically analyze the differences in transaction amounts at different levels. The hierarchical structure was divided into three levels: small, medium, and large, with amount cutoffs of 10,000 yuan and 100,000 yuan. 12-dimensional hierarchical features, including transaction amount, transaction frequency, and time interval, were extracted from the transaction data. Spectral clustering was used to group transactions, with the number of eigenvalues ​​set to 6, to generate an amount differential distribution table. Based on the amount differential distribution table, a force-directed layout algorithm was used to spatially map node associations, with a repulsion coefficient of 0.8 and an attraction coefficient of 0.6. Node coordinates were represented using polar coordinates. Three topological features, degree centrality, eigenvector centrality, and betweenness centrality, were extracted from the inter-node relationship data to generate a node association topology graph. Node weights were obtained from the node association topology graph, and the capital flow intensity was normalized. The path importance threshold was set to 0.75. Edge importance was quantified using the Betanis centrality algorithm, with a centrality threshold set to 0.8. This yielded the core transaction subgraph. Node features were extracted from the core transaction subgraph, and a three-layer graph convolutional network was constructed with hidden layer dimensions set to 128-64-32, using ReLU as the activation function and max pooling as the pooling method. Node embedding vectors were obtained. Entity association features were extracted from the node embedding vectors. A training dataset was constructed combining a subset of high-risk transaction entities, a path feature graph, and a set of abnormal transaction patterns. 80% of the data was used for training and 20% for validation to obtain model parameters. Based on the trained model parameters, feature fusion was performed using an 8-head attention mechanism with a head dimension of 32 and a dropout rate of 0.1. Prediction results were normalized using the softmax function, and a risk warning threshold of 0.85 was set to obtain a money laundering risk warning value.

[0019] The technical solution provided by the embodiment of the present invention may have the following beneficial effects:

[0020] The present invention discloses a method for constructing a bank anti-money laundering data model based on privacy computing. By performing stratified sampling and encryption processing on the capital flow data of financial institutions, a global capital flow map is constructed, node roles and transaction path characteristics are identified, and high-risk transaction entities and abnormal transaction patterns are screened out. The method first obtains capital flow data from multiple institutions, uses stratified sampling to construct a preliminary flow map, and performs perturbation processing on key paths to obtain an encrypted topological framework. Then, node roles and transaction paths are analyzed, suspicious transaction entities are identified, and high-risk transaction path characteristics are extracted. Finally, abnormal transaction patterns are determined based on transaction time intervals and regional switching frequencies, and a graph neural network model is constructed to achieve accurate early warning of money laundering risks. The present invention can effectively identify complex money laundering transaction patterns and improve the accuracy and efficiency of anti-money laundering work. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 This is a flowchart of a method for constructing a bank anti-money laundering data model based on privacy computing according to the present invention.

[0022] Figure 2 This is a schematic diagram of a method for constructing a bank anti-money laundering data model based on privacy computing according to the present invention. DETAILED DESCRIPTION

[0023] The technical solutions of the present invention will be clearly and completely described below in conjunction with the embodiments. Obviously, the embodiments described are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0024] To facilitate understanding of the present application, a brief description of the embodiments of the present application is given here:

[0025] The construction of the anti-money laundering data model aims to uncover hidden money laundering behaviors by analyzing the flow of funds in financial institutions. Traditional methods are limited to the data scope of a single institution and are difficult to deal with the topological mutations of the money laundering network and the concealment of transaction characteristics. The embodiment of the present application is based on privacy computing technology and realizes cross-institutional data collaborative analysis through secure multi-party computing and encryption processing. Fund flow data includes information such as transaction time, amount, payer and payee, which may be distributed in the outlets of multiple institutions. The topological structure of the money laundering network may appear in the form of chain, mesh or star, and may show dynamic changes due to human interference. The embodiment of the present application generates a global fund flow encryption framework through technologies such as layered sampling, path disassembly and encryption perturbation to provide support for subsequent money laundering pattern identification.

[0026] In the embodiments of this application, the following key terms are involved:

[0027] Fund flow data refers to transaction records between financial institutions or outlets, including transaction time, amount, subject information, etc. It may be locally stored offline data or real-time data from an online platform.

[0028] Privacy computing refers to a method of achieving collaborative analysis through technologies such as encryption, federated learning, or secure multi-party computing without leaving the data locally.

[0029] The money laundering network topology refers to the network structure formed by the flow of funds, which includes nodes (transaction entities or outlets) and edges (transaction paths), and may appear complex or hidden due to money laundering activities.

[0030] In order to illustrate the technical solution described in this application, specific embodiments are provided for illustration.

[0031] Figure 1 The following is a flowchart of the method for constructing a bank anti-money laundering data model based on privacy computing, as provided in Example 1 of this application.

[0032] S101. Obtain the capital flow data of each financial institution. In view of the transaction complexity and data dispersion, use stratified sampling to integrate the multi-institutional mesh path data, generate preliminary capital flow map fragments, analyze the path density and concealment, perform encryption perturbation processing on the key paths, and build a global capital flow encryption framework.

[0033] The method for obtaining funds flow data can be determined based on the actual scenario. For example, transaction records can be extracted from each institution's local database through a secure multi-party computing protocol. Transaction complexity is reflected in the network structure and cross-regional nature of funds flows, while data dispersion stems from the distribution of transaction records across multiple institutions. To address these characteristics, the embodiments of this application use stratified sampling technology to integrate data, ensuring that the sample covers transaction characteristics of different amounts, time periods, and regions.

[0034] like Figure 2 ,S1011, stratified sampling of capital flow data is performed through a multi-layer neural network, and a multi-level sample data set is generated based on transaction frequency and time series characteristics.

[0035] The multi-layer neural network can adopt a five-layer feedforward structure, with the number of nodes being 128, 64, 32, 16, and 8, respectively, and the activation function being ReLU. The network categorizes and aggregates fund flow data based on transaction frequency and the cyclical characteristics of the time series. For example, 15% of transaction records from a bank's 652 branches, covering an average of 87,000 daily transactions at various amounts and time periods, were sampled to generate a multi-level sample dataset to ensure data representativeness.

[0036] S1012. Use a tree structure to perform path decomposition on the multi-level sample data set, and generate an initial transaction network diagram in combination with hidden labels.

[0037] The tree structure uses a red-black tree, leveraging its balancing properties to achieve efficient path decomposition. Each transaction path includes transaction time, amount, and subject information. During decomposition, the path fuzziness coefficient is combined to assign three levels of concealment: high, medium, and low. For example, a 10 million yuan fund flowing through three branches and two sub-branches can be traced in a red-black tree, with the dwell time and distribution ratio of transit nodes marked. The marked data is then extended using a minimum spanning tree algorithm to generate an initial transaction network diagram.

[0038] S1013. According to the node connection relationship of the initial transaction network diagram, importance calculation is performed and the path is encrypted to generate encrypted path data.

[0039] Importance is calculated using the PageRank algorithm, with the initial importance set to 1. After iterative convergence, the node importance distribution is obtained. For example, the node importance of a major branch is 0.82, significantly higher than the average of 0.23 for general branches, indicating its role as a capital transfer hub. After segmenting and encoding important paths, the SHA256 hash algorithm is used to generate encrypted path data to ensure data security.

[0040] S1014. Modularize the encrypted path data through the community discovery algorithm and combine it with the encrypted perturbation to generate a global capital flow encryption framework.

[0041] The community discovery algorithm uses the Louvain algorithm, which optimizes the modularity metric to divide the network into multiple communities. For example, 652 outlets can be divided into 12 communities, with intra-community transactions reaching 430 million yuan, while inter-community transactions are only 120 million yuan, reflecting the concentration of capital flows. Key paths are perturbed using the secp256k1 elliptic curve, and then encrypted using the national SM4 algorithm for block encryption, generating a global capital flow encryption framework.

[0042] Through stratified sampling and encryption processing, data from multiple institutions can be effectively integrated to generate a secure map of fund flows. Compared to traditional methods, this embodiment of the application can dynamically adapt to the complex changes in money laundering networks, significantly improving the efficiency and security of data analysis and providing a solid foundation for the construction of anti-money laundering models.

[0043] S102. Analyze the node role diversity and dynamic topology change characteristics of the money laundering network, extract transaction paths and nested relationships, determine the role distribution of transaction entities, and generate a node role classification set and a path mutation feature set.

[0044] The encrypted topology framework encrypts fund flow data through a secure multi-party computing protocol, ensuring data privacy while supporting analysis of node roles and path changes. Node role diversity is reflected in the different functions of transaction entities, such as fund collection, transit, or terminal nodes, while topological change characteristics reflect the dynamic adjustments of money laundering networks, such as the transition from a chain structure to a mesh structure. By extracting transaction paths and nested relationships, embodiments of the present application can identify key nodes and abnormal patterns in money laundering networks, providing accurate input for anti-money laundering models.

[0045] S1021. Based on the node transaction frequency and link length data in the encrypted topology framework, a random forest algorithm is used to cluster the node behavior characteristics to generate an initial node role dataset.

[0046] The random forest algorithm is used to analyze node transaction frequency and link length to construct a behavioral feature space. Algorithm parameters include a tree depth of 16, a minimum leaf node sample size of 5, and feature dimensions covering transaction amount, time interval, and number of counterparties. For example, within a bank's 5,836-node network, the random forest algorithm can identify fund collection nodes (with an average daily transaction amount exceeding 50 million yuan and more than 50 counterparties) and transit nodes (with transaction intervals concentrated within 1 hour). Clustering results are mapped to labels based on node activity and transaction size, generating an initial node role dataset, which provides a foundation for subsequent role analysis.

[0047] S1022. Use the adjacency matrix to construct a directed acyclic graph, encode the nested relationship between nodes, use a hierarchical clustering algorithm to classify roles, and generate a node role mapping table.

[0048] The directed acyclic graph (DAG) uses an adjacency matrix to represent transaction relationships between nodes. The matrix size is 5836×5836, and non-zero elements reflect direct transaction connections. Nested relationships are encoded using hierarchical depth and connection density. For example, a branch node is coded as 10110, indicating it is located at the second level and has three connections to the upper level. A hierarchical clustering algorithm uses the Manhattan distance as the metric, with a threshold of 0.75, to group similar nodes into the same role category, generating a node role mapping table. This table clearly reflects the functional distribution of nodes in the money laundering network.

[0049] S1023: extract role conversion speed data from the node role mapping table, extract path change features through time window slicing and discrete wavelet transform, and generate a feature vector.

[0050] Role transition speed data is acquired by slicing a 24-hour time window with a sampling interval of one hour. For example, analyzing transaction data from March 1 to March 31, 2024, generates 744 time slices, each recording changes in node transaction relationships. A discrete wavelet transform (DWT) uses Dobesh wavelet basis functions to extract a 128-dimensional feature vector, with each dimension corresponding to transaction pattern characteristics at a different scale. This vector captures the dynamic nature of path changes and supports mutation detection.

[0051] S1024. Calculate the importance of node roles based on the path change feature vector, combine principal component analysis with dimensionality reduction, detect path mutation points, and generate a dynamic path mutation set through density clustering.

[0052] Node role importance is calculated as the weighted sum of degree centrality and eigenvector centrality, with a weighting ratio of 3:7. For example, a core branch node had a degree centrality of 0.86, an eigenvector centrality of 0.92, and a comprehensive importance of 0.90, ranking in the top 3%. Principal component analysis retains principal components with a cumulative explained variance of 90%, with the first six principal components accounting for 92.3%. The path mutation rate is calculated by dividing the Euclidean distance between adjacent time windows by the window size, with a threshold of 0.8. For example, 28 mutation points were detected between 10:00 and 11:00 on a trading day. DBSCAN clustering generated three mutation clusters, with the largest cluster involving 860 million yuan, reflecting abnormal fund flows. The mutation set generated through density clustering can accurately pinpoint abnormal changes in money laundering networks.

[0053] By analyzing node roles and path mutation characteristics using algorithms such as random forests, hierarchical clustering, and wavelet transforms, the resulting role classification and mutation set effectively support the construction of anti-money laundering models. Compared to traditional methods, this approach enables dynamic analysis while preserving privacy, improving the accuracy and real-time performance of abnormal pattern recognition.

[0054] S103. Based on the node role classification and the dynamic path mutation set, screen out accounts with short life cycles and frequent changes in transaction subjects, mark them as potentially suspicious transaction subjects, and generate a preliminary list of suspicious transaction subjects.

[0055] Node role classification reflects the functional positioning of transaction entities within the money laundering network, such as fund collection or transit nodes, while dynamic path mutation collection reveals unusual changes in the network structure. By screening accounts with short life cycles and frequent changes in transaction entities, potential money laundering risk points can be accurately identified. The resulting preliminary list of suspicious transaction entities provides a reliable foundation for subsequent high-risk account analysis, significantly improving the targeted nature of anti-money laundering monitoring.

[0056] S1031. Utilize the transaction data set and group the transaction subject change frequency using the natural breakpoint method, extract the account activity feature vector, and generate account behavior benchmark data.

[0057] The natural breakpoint method categorizes accounts into five groups based on the distribution of transaction subject change frequency, with a threshold for inter-group difference set at 0.85. For example, among 15,623 corporate accounts at a provincial bank, the highest-frequency group experienced an average of 8.6 counterparty changes per month, far exceeding the average of 0.9. Feature extraction encompasses transaction frequency, amount fluctuations, and time intervals, forming a 12-dimensional feature vector with a weighting of 4% for transaction amount and 6% for time distribution. For example, the feature vector for a corporate account shows an average of 12.3 daily transactions, with amount fluctuations reaching 45.213 million yuan. This generates benchmark account behavior data, laying the foundation for anomaly detection.

[0058] S1032. Based on the account behavior benchmark data, a support vector machine is used to perform binary classification, and anomaly indicators are extracted in combination with the transaction link length.

[0059] A support vector machine classifies fund flow density and account activation levels using thresholds of 8 daily transactions and 15 monthly trading days. Feature extraction considers transaction link length and subject-to-subject correlation strength, retaining 90.5% of the explained variance through principal component analysis. For example, a trading account with an average daily transaction density of 12.3 and 26 monthly active days is classified as high-risk. The anomaly index reflects the degree of deviation from normal trading patterns, providing a quantitative basis for analysis.

[0060] S1033. Extract transaction direction stability data based on the anomaly index, and generate an account association graph through spatial clustering and association rule mining.

[0061] Transaction direction stability data was stratified by small (less than 10,000 yuan), medium (10,000 to 100,000 yuan), and large (over 100,000 yuan). For example, a certain account had 1,836 small transactions, 526 medium transactions, and 89 large transactions, spanning 15 provinces. Spatial clustering was used to delineate the transaction network using an inter-cluster distance threshold of 0.75. Association rule mining was performed with a minimum support of 0.3, generating an account association map. This revealed a close network of 372 related accounts, with a confidence level of 0.86, revealing a potential closed loop of money laundering transactions.

[0062] S1034. Extract node attributes from the account association graph, classify and mark suspicious transaction entities through a decision tree, and generate a preliminary list of suspicious transaction entities.

[0063] Node attributes include duration and change frequency. Accounts with a duration of less than 90 days and an average of more than five changes per month are flagged. The decision tree depth is set to five levels, with the Gini coefficient as the splitting criterion and a minimum sample size of 10. For example, an account with a duration of 75 days and an average of 7.3 changes per month, resulting in a risk score of 0.89, falls in the top 5% high-risk range and is therefore flagged as suspicious. A preliminary list shows that 25% of the suspicious accounts involved 120 million yuan in capital turnover, with complex transaction networks that significantly deviate from normal patterns.

[0064] By using association rule mining algorithms to screen out high-risk accounts, the resulting association graphs and suspicious lists can effectively reveal the hidden characteristics of money laundering networks. Compared to traditional methods, this approach achieves precise identification while protecting privacy, improving the efficiency and accuracy of anti-money laundering monitoring.

[0065] S104. Based on the transaction records of the preliminary list of suspicious transaction entities, high-risk transaction entities with false registration information or missing key identity information are screened out to generate a subset of high-risk transaction entities.

[0066] The preliminary list of suspicious transaction entities includes accounts with potential money laundering risks. By verifying the authenticity and completeness of registration information, we further identify high-risk entities. False or missing information, such as inconsistent legal entity identities or ambiguous business scopes, often serve as a means for money launderers to conceal their true intentions. This resulting subset of high-risk transaction entities provides precise targeting for anti-money laundering monitoring, significantly improving risk prevention and control efficiency.

[0067] S1041. Extract the certificate number, organization code, registered address and business scope from the entity registration information database, use the data integrity verification tool to verify, and generate an information integrity assessment form.

[0068] The data integrity verification tool uses automated scripts to verify the integrity of registration information, checking items such as document number format, organization code validity, registered address compliance, and business scope clarity. For example, among 8,526 entities initially screened in one province, 3,215 (approximately 37.7%) had missing information, with incomplete registered addresses being the highest percentage. Verification results are categorized as passed, pending verification, and failed, generating an information integrity assessment form that provides foundational data for authenticity analysis.

[0069] S1042. For the information integrity assessment table, use the geocoder to verify the accuracy of the address information and combine it with random forest classification to generate the subject information authenticity index.

[0070] The geocoder uses a four-level positioning mechanism to verify address accuracy down to the province, city, district, and street number. For example, the registered address of a trading company is No. 23, Road A, District A, City A. However, the geocoding indicates that the building corresponding to the house number does not match the business registration. The landline area code in the contact information does not match the address area, and the mobile phone number is from another province. A random forest classifier with a tree depth of 8 layers and feature dimensions including address accuracy, contact information validity, and registered capital authenticity determined that the entity's authenticity score was only 0.35. This authenticity metric effectively quantifies information credibility and provides a basis for screening outliers.

[0071] S1043. Based on the business scope data in the authenticity index, group them using a spectral clustering algorithm, and generate a subject information anomaly mapping table in combination with the change record.

[0072] Business scope data is grouped using a spectral clustering algorithm, with the number of eigenvalues ​​set to six, based on cross-validation of data from the three parties involved: industrial and commercial administration, tax authorities, and banks. For example, a technology company's legal entity information was inconsistent across the three registrations and formed a high-frequency trading network with 12 associated accounts, averaging 26 transactions per day, with amounts concentrated between 50,000 and 80,000 yuan. Spectral clustering grouped this company into the same community as seven other anomalous entities. Analysis of change records revealed that a wholesale enterprise completed four legal entity changes and three business scope adjustments within 90 days, exceeding the threshold by three. This generated an anomaly mapping table, clearly reflecting the characteristics of the information anomalies.

[0073] S1044. Use the XGBoost algorithm to classify the abnormal mapping table data and generate a subset of high-risk transaction entities based on multi-dimensional features.

[0074] The XGBoost algorithm uses a learning rate of 0.1, a maximum tree depth of 6, and a minimum number of child node samples of 50 for classification. Features include information completeness, authenticity index, change frequency, and missingness level. For example, a wholesale enterprise was missing multiple pieces of information, resulting in a risk score of 0.87, placing it in the high-risk range. The classification results show that 385 entities were identified as high-risk, 82.3% of whom had authenticity anomalies and 56.8% had multiple pieces of missing information. These entities often exhibited inconsistent information, difficulty locating addresses, frequent changes, and significant discrepancies between transaction behavior and registered information.

[0075] Compared with traditional methods, this embodiment realizes multi-dimensional verification under privacy protection, significantly improves the accuracy and efficiency of identifying money laundering entities, and provides strong support for anti-money laundering compliance.

[0076] S105. Analyze the characteristics of multiple small-amount transactions of a subset of high-risk transaction entities, identify fund splitting patterns, hidden flows, and multi-layer transfer paths, generate a high-risk transaction path feature map, and extract abnormal transaction patterns through topological structure analysis to construct a transaction feature map that includes risk level, path complexity, and geographical span.

[0077] Transaction records for a subset of high-risk transaction entities often consist of multiple, small transactions, obscuring the true flow of funds. By analyzing transaction amount distribution, transfer paths, and network topology, this application can reveal patterns in fund splitting and cross-regional transfers in money laundering activities. The resulting transaction path feature graph and transaction feature map provide intuitive and accurate data support for anti-money laundering monitoring, improving the efficiency of identifying abnormal transactions.

[0078] S1051. Adaptive binning is used to divide transaction amount intervals according to transaction records, and fund splitting features are extracted through k-means clustering to generate a split transaction feature table.

[0079] Adaptive binning divides transaction amounts into up to 20 bins based on their distribution, with a minimum bin width of 1,000 yuan. For example, among 3,526 high-risk entities at a certain bank, 85% of transactions were concentrated between 1,000 and 9,000 yuan, with an average daily number of split transactions reaching 12, far exceeding the normal level of 2.3. K-means clustering, using transfer frequency and number of split transactions as features, sets five cluster centers. Through iterative optimization, transaction sequences are classified into distinct patterns, generating a split transaction feature table that provides basic data for path analysis.

[0080] S1052. Construct a directed graph model for the split transaction feature table, calculate the path weight and optimize it using the Dijkstra algorithm to generate a multi-layer transfer path set. Simultaneously, construct a transaction amount distribution heat map through kernel density estimation to extract time series fluctuation characteristics.

[0081] The directed graph model uses transaction flows as edges and accounts as nodes. Path weight is defined as the product of the inverse of the time interval and the number of hops. For example, a trading company's 3.5 million yuan in funds was split into 86 small transfers, averaging 40,700 yuan each. After 4.8 transfers, the path weight reached 0.92. The Dijkstra algorithm identified the five shortest transfer paths by minimizing weights and optimizing paths. Simultaneously, a Gaussian kernel density estimation with a bandwidth of 0.15 analyzed the distribution of transaction amounts, generating a heat map showing that amounts were concentrated in the 3,000 to 9,000 yuan range. The De Besch wavelet transform performed a three-layer decomposition of the heat map to extract periodic fluctuations, revealing temporal regularities in transactions and providing a multi-dimensional basis for anomaly detection.

[0082] S1053. Extract the number of split transactions and topological features from the multi-layer transfer path set, and generate a split pattern mapping table and a transaction structure feature table through hierarchical clustering and spectral clustering grouping.

[0083] The number of splits is determined by calculating the ratio of large transactions to smaller ones. Transfer paths are divided into three layers based on length, with an inter-layer distance threshold set at 2. For example, a wholesale company's funds took 6.5 hours to be split and then aggregated. Hierarchical clustering, grouped by Euclidean distance, identified eight split patterns. Spectral clustering also analyzes node in-degree, betweenness centrality, and clustering coefficient, with a set number of eigenvalues ​​of 6. It identifies star structures (central node connectivity exceeding 5) and chain structures (path length exceeding 3 and fewer than 2 branches). For example, a company exhibited a star structure, with a central node connecting eight accounts, each generating more than 15 transfers. A transaction structure feature table was generated, clearly reflecting the topological characteristics of capital flows.

[0084] S1054. Based on the split pattern mapping table and the transaction structure feature table, calculate the fund dispersion and split ratio, detect anomalies through the k-nearest neighbor algorithm, and use the graph neural network and DeepWalk algorithm to generate high-risk transaction path feature graphs and transaction feature maps.

[0085] Fund dispersion is calculated as the ratio of the number of nodes to path length, with a threshold range of 0.6 to 0.8. For example, a company with a dispersion of 0.75 and a complexity coefficient of 1.8 is labeled an anomalous path. The k-nearest neighbor algorithm uses five nearest neighbors to detect abnormal split ratios. Cross-regional transactions exceed the threshold of three adjacent provinces, resulting in an anomaly index of 0.82. A three-layer graph neural network performs convolutions with 64, 32, and 16 nodes and the ReLU activation function, extracting node attributes, edge weights, and path lengths to generate a path feature graph. The DeepWalk algorithm captures network features using 80-step walk sequences and 64-dimensional embeddings. Dimensionality reduction to three dimensions is performed using the t-SNE algorithm, generating a transaction feature map. This includes attributes such as a risk score of 0.75 or higher, a concealment score of 0.82, and a geographical span of 1,500 kilometers, clearly demonstrating anomalous patterns in fund flows.

[0086] Using techniques such as adaptive binning, the Dijkstra algorithm, spectral clustering, and graph neural networks, we analyze the splitting patterns and topological structures of small, multiple transactions. Compared to traditional methods, this application achieves multi-dimensional feature extraction while preserving privacy, significantly improving the accuracy and real-time performance of money laundering identification, providing a highly effective tool for financial regulation.

[0087] S106. By analyzing the irregularity of transaction time intervals and the frequency of regional switching in the high-risk transaction path characteristic graph, abnormal transaction patterns are identified and marked to generate an abnormal transaction pattern set.

[0088] High-risk transaction path feature maps reveal the temporal and spatial characteristics of capital flows. Money laundering activities often conceal their tracks through irregular time intervals and frequent geographical shifts. By quantifying time series fluctuations and the dynamics of regional shifts, this application can accurately identify abnormal transaction behavior. The resulting collection of abnormal transaction patterns provides a key basis for anti-money laundering monitoring, effectively improving the accuracy and timeliness of risk warnings.

[0089] S1061. Extract the transaction time interval sequence from the transaction path feature graph, use the variational autoencoder to model the time series features, and generate a time series feature vector.

[0090] Time series analysis tools reconstruct transaction time intervals and normalize them to account for fluctuations and periodicity. For example, a trading company completed 3,628 transactions within 90 days, with a standard deviation of 286 minutes, far exceeding the normal 85 minutes. A three-layer variational autoencoder with a 1,286,432-node structure and a ReLU activation function encodes the nonlinear patterns of the time series, generating a time series feature vector that captures the randomness of transaction intervals and provides a high-dimensional feature representation for subsequent anomaly detection.

[0091] S1062. For the time series feature vector, a weight matrix is ​​constructed in combination with the regional switching frequency. A regional transfer feature table is generated through Markov chain analysis. A density distribution map is generated using DBSCAN clustering and kernel density estimation.

[0092] Spatial statistical analysis calculates the frequency of regional switching, using a weight matrix based on the inverse of inter-regional distance. For example, the company's transactions involved 15 provinces, with 58.7% of transactions spanning 1,000 kilometers. The probability of consecutive transactions within the same region was only 0.15. A second-order Markov chain was used to calculate transition probabilities and generate a regional transition feature table. The DBSCAN algorithm, with a neighborhood radius of 0.5 and a minimum sample size of 5, clustered migration intensities and identified six anomalous clusters. The largest cluster contained 82 transactions spanning four provinces. Kernel density estimation, with a bandwidth of 0.1, generated a density distribution map, revealing the inter-regional nature of transactions and providing a spatial basis for analyzing anomalous patterns.

[0093] S1063. Extract abnormal transaction indicators based on the density distribution map, and generate an abnormal path set and an abnormal transaction pattern set through isolation forest detection combined with support vector machine classification.

[0094] Abnormal transaction indicators were extracted from density distribution maps. Anomalies were detected using an isolation forest with 100 trees and a contamination rate of 0.1. 156 transactions with a standard deviation of 3.8 times the normal time interval were identified, with an average of 7.2 daily regional switches, exceeding the threshold by 5. Pattern regularity, calculated using entropy, was only 0.45, below the threshold of 0.7. A support vector machine classification using a radial basis kernel function, a penalty parameter of 1.0, and a kernel parameter of 0.1 achieved an accuracy of 91.5%, generating a collection of abnormal paths and patterns that clearly characterized anomalies characterized by high temporal randomness, large geographical spans, and short capital stays. Compared to traditional methods, this application achieves efficient anomaly detection while protecting privacy, significantly improving the accuracy of identifying money laundering activities and providing reliable support for financial regulation.

[0095] S107. Analyze the hierarchical difference distribution of transaction amounts and the visualization features of the association between nodes based on the set of abnormal transaction patterns, identify core transaction nodes and key capital flow paths, generate a core transaction subgraph, and combine the high-risk transaction subject subset, path feature graph and abnormal transaction pattern set to construct a graph neural network anti-money laundering prediction model and output money laundering risk warning results.

[0096] A collection of abnormal transaction patterns provides temporal and spatial characteristics of money laundering behavior. By analyzing differences in dollar amounts and node correlations, key nodes and paths in the capital flow can be precisely located. The core transaction subgraph reveals the backbone structure of the money laundering network. Graph neural networks capture complex transaction patterns through deep learning, and the resulting early warnings provide efficient and accurate decision-making for anti-money laundering regulators, significantly improving financial compliance.

[0097] S1071. Utilize transaction data to extract amount, frequency, and time interval features, generate an amount difference distribution table through hierarchical analysis, and use spectral clustering to group.

[0098] A hierarchical analysis classifies transaction amounts into three tiers: small amounts below 10,000 yuan, medium amounts between 10,000 and 100,000 yuan, and large amounts above 100,000 yuan. For example, among 2,856 abnormal transaction patterns at a provincial bank, small transactions accounted for 62.3%, medium amounts 28.5%, and large amounts 9.2%. The extracted 12-dimensional feature vectors, including the average daily transaction frequency, amount variance, and time interval standard deviation, were grouped using six eigenvalues ​​through spectral clustering to generate a distribution table of amount differences. This clearly reflects the distribution patterns of transaction amounts and provides data support for network analysis.

[0099] S1072. For the amount difference distribution table, a force-directed layout algorithm is used to map node associations, extract centrality features, and generate a node association topology graph.

[0100] The force-directed layout algorithm uses a repulsive coefficient of 0.8 and an attractive coefficient of 0.6, representing node positions using polar coordinates to ensure that unrelated nodes are dispersed and related nodes are close together. For example, a wholesale enterprise node has a degree centrality of 0.86, an eigenvector centrality of 0.92, and a betweenness centrality of 0.78, indicating that it is a capital flow hub. Extracting the degree centrality, eigenvector centrality, and betweenness centrality features generates a node association topology graph, revealing the structural characteristics of the transaction network and laying the foundation for extracting the core subgraph.

[0101] S1073. Extract weight values ​​from the node association topology graph, quantify edge importance through the Betanis centrality algorithm, and combine with the graph convolutional network to generate the core transaction subgraph and node embedding vector.

[0102] Node weights are normalized based on the strength of capital flows, with a path importance threshold of 0.75. The Betanis centrality algorithm quantifies edge importance with a centrality threshold of 0.8 to identify key paths. For example, a path connecting eight entities with an edge importance exceeding 0.8 and an average daily transaction volume of 8.76 million yuan constitutes a core transaction subgraph. A three-layer graph convolutional network with 1,286,432 nodes, ReLU activation, and max pooling processes node features to generate embedding vectors that capture the network's deep correlation patterns.

[0103] S1074. Based on the node embedding vector, the characteristics of high-risk transaction entities and abnormal pattern data are integrated to generate money laundering risk warning values ​​through the attention mechanism.

[0104] The training dataset combines a subset of high-risk transaction entities, path feature graphs, and a collection of abnormal transaction patterns, with 80% used for training and 20% for validation, achieving a validation accuracy of 92.3%. An 8-head attention mechanism fuses features with 32 head dimensions and a dropout rate of 0.1. The predictions are normalized using a softmax function, with a risk warning threshold of 0.85. For example, among the 1,526 entities in a certain wholesale and retail cluster, 86 had risk values ​​exceeding 0.85, demonstrating frequent small-value transfers, complex transit routes, and irregular time series, highly consistent with money laundering patterns. Compared to traditional methods, this application achieves multi-dimensional feature fusion under privacy protection, significantly improving the accuracy of identifying complex money laundering networks and providing strong support for financial risk prevention and control.

[0105] It should also be noted that the various specific technical features described in the above specific embodiments can be combined in any appropriate manner without contradiction. In order to avoid unnecessary repetition, the present invention will not further describe various possible combinations. In addition, the various different embodiments of the present invention can also be arbitrarily combined, as long as they do not violate the concept of the present invention, they should also be regarded as the content disclosed by the present invention.

Claims

1. A method for constructing a bank anti-money laundering data model based on privacy computing, characterized in that: The method comprises: Obtain the capital flow of each financial institution. Based on the transaction complexity and data fragmentation distribution, stratified sampling is used to integrate the multi-institutional mesh path data to obtain preliminary flow map fragments, identify the path density and concealment level, and perform perturbation processing on the key paths to obtain the global capital flow map encryption framework. Through the encrypted topology framework, we identify the diversity of node roles and topological mutation characteristics, extract the transaction paths and multi-layer nested relationships between nodes, analyze the role distribution of transaction entities, and obtain a dynamic path mutation set. Based on the dynamic path mutation set, accounts with short usage cycles and accounts with frequent changes in transaction subjects are screened out and marked as potentially suspicious transaction subjects, resulting in a preliminary list of suspicious transaction subjects. Identify transaction records on the preliminary list of suspicious transaction entities, screen out high-risk transaction entities with false registration information or missing key identity information, and obtain a subset of high-risk transaction entities; Counting multiple small transactions from a subset of high-risk transaction entities, identifying their distribution characteristics and multi-layer transfer paths, extracting fund splitting patterns and hidden flow characteristics, and obtaining a high-risk transaction path feature map; The irregular distribution of transaction time intervals and the frequency of regional switching are analyzed using the high-risk transaction path feature graph. If the time interval deviates from the preset regularity or the regional switching frequency exceeds the preset threshold, it is marked as an abnormal transaction pattern, and the abnormal transaction pattern set is obtained; Based on the set of abnormal transaction patterns, the differential distribution of transaction amounts at different levels and the degree of visualization of the correlation between nodes are calculated, the core transaction nodes and key capital flow paths are determined, and the core transaction subgraph is obtained. Combined with the subset of high-risk transaction entities, path feature graph, and set of abnormal transaction patterns, the anti-money laundering risk is predicted through the graph neural network, and a money laundering risk warning is output.

2. A method for constructing a bank anti-money laundering data model based on privacy computing according to claim 1, characterized in that: The method of obtaining the capital flow of each financial institution adopts stratified sampling to integrate the mesh path data of multiple institutions in view of the transaction complexity and data fragmentation distribution, obtains the preliminary flow map fragments, identifies the path density and concealment level, and performs perturbation processing on the key paths to obtain the global capital flow map encryption framework, including: The density of fund transactions between institutional branches is obtained through a five-layer feedforward neural network. The feedforward neural network classifies and aggregates sample data according to the frequency of fund flows to obtain a multi-level sample data set; Using a red-black tree structure to perform transaction path decomposition on the multi-level sample data set, and generating an initial transaction network graph based on the path fuzzy coefficient through the transaction path decomposition; Execute PageRank algorithm calculation based on the node connection relationship of the initial transaction network graph, segment the transaction path using the PageRank algorithm, and then generate encrypted path data using the SHA256 hash algorithm; The Louvain community discovery algorithm is used to perform modularity division on the encrypted path data. The modularity division result is processed by the secp256k1 elliptic curve perturbation to generate a global capital flow map encryption framework.

3. The method for constructing a bank anti-money laundering data model based on privacy computing according to claim 1, characterized in that: The encrypted topology framework is used to identify node role diversity and topology mutation characteristics, extract transaction paths and multi-layer nested relationships between nodes, analyze the role distribution of transaction entities, and obtain a dynamic path mutation set, including: Based on the node transaction frequency data and link length data, the random forest algorithm is used to cluster the node behavior characteristics and obtain the node initial role dataset; For the node initial role data set, a directed acyclic graph is constructed through an adjacency matrix to perform binary encoding on the nested relationship between nodes, and a hierarchical clustering algorithm is used to classify the encoded data into roles to obtain a node role mapping table; Obtain role conversion speed data from the node role mapping table, perform window slicing sampling on the node transaction time series association, perform feature extraction on the sampled data through discrete wavelet transform, and obtain a path change feature vector; The node role importance value is calculated based on the path change feature vector, and the node distribution characteristics are subjected to principal component analysis and dimensionality reduction. The mutation rate is obtained by dividing the Euclidean distance of the nodes in adjacent time windows by the time window size. If the mutation rate exceeds a preset threshold, the DBSCAN algorithm is used to density cluster the mutation points to obtain a dynamic path mutation set.

4. The method for constructing a bank anti-money laundering data model based on privacy computing according to claim 1, characterized in that: The dynamic path mutation set is used to screen out accounts with short usage cycles and accounts with frequent changes in transaction subjects, and mark them as potentially suspicious transaction subjects, thereby obtaining a preliminary list of suspicious transaction subjects, including: The frequency of transaction subject changes is divided into five equal groups using the natural breakpoint method. From these groups, the account activity feature vectors, including transaction frequency and amount fluctuations, are extracted to obtain account behavior benchmark data. Based on the account behavior benchmark data, a support vector machine is used to perform binary classification on the fund transaction density and account activation degree, and features are extracted according to the transaction link length to obtain the account abnormality index; Acquiring transaction direction stability data based on the account anomaly index, performing spatial clustering on the transaction direction stability data, and combining and matching the clustering results using an association rule mining algorithm to obtain an account association graph; Node attributes are extracted from the account association graph and classified and judged through a decision tree. If the node risk score exceeds a preset threshold, it is marked as a suspicious transaction subject, and a preliminary list of suspicious transaction subjects is obtained.

5. The method for constructing a bank anti-money laundering data model based on privacy computing according to claim 1, characterized in that: The transaction records of the preliminary suspicious transaction subject list are identified, and high-risk transaction subjects with false registration information or missing key identity information are screened out to obtain a subset of high-risk transaction subjects, including: Obtain the certificate number, organization code, registered address, and business scope from the subject registration information database, and use data integrity verification tools to verify the registered information to obtain an information integrity assessment form; For the information integrity assessment table, the address information is accurately matched using a geocoder, and the matching results are classified using a random forest method to obtain the authenticity index of the subject information; According to the business scope data in the subject information authenticity index, the business scope data is grouped by a spectral clustering algorithm to obtain a subject information anomaly mapping table; For the subject information abnormal mapping table, the XGBoost algorithm is used to classify the abnormal mapping data to obtain a subset of high-risk transaction subjects.

6. The method for constructing a bank anti-money laundering data model based on privacy computing according to claim 1, characterized in that: The method of counting multiple small-amount transactions of a subset of high-risk transaction entities, identifying their distribution characteristics and multi-layer transfer paths, extracting fund splitting patterns and hidden flow characteristics, and obtaining a high-risk transaction path feature graph includes: Adaptive binning is used to divide transaction amounts into intervals based on transaction record data, and a split transaction feature table is extracted from the interval division results using K-means clustering. A directed graph model is constructed based on the split transaction feature table. Path weights are obtained by multiplying the inverse of the time interval between nodes in the directed graph by the number of jumps. The path weights are optimized using the Dijkstra algorithm to obtain a multi-layer transfer path set. The number of splits in the multi-layer transfer path set is hierarchically divided according to the path length, and the hierarchical division results are grouped using a hierarchical clustering algorithm to obtain a split pattern mapping table; The inter-node feature data is extracted from the split pattern mapping table, and a convolution operation is performed on the inter-node feature data through a three-layer graph neural network to obtain a high-risk transaction path feature graph.

7. The method according to claim 6, characterized in that Also includes: Based on the records of multiple small-amount transactions by high-risk trading entities, we construct a heat map of the amount distribution, extract the time series fluctuation indicators of the transactions, identify the star-shaped dispersion structure and chain transfer pattern, and identify abnormal split ratios and regional mismatch flows based on the star-shaped dispersion structure and chain transfer pattern. This method can be used to determine the node risk level and path complexity, and generate a transaction feature map that includes fund dispersion, path concealment, and regional span. Specifically, it includes: The transaction amount distribution heat map is constructed based on the transaction subject's multiple small-amount transaction records using Gaussian kernel density estimation, and the transaction amount distribution heat map is decomposed into three layers using Debesch wavelet transform to obtain a heat map; Extracting three types of topological features, namely node in-degree, betweenness centrality, and clustering coefficient, from the heat map, and using a spectral clustering algorithm to perform pattern classification on the topological features to obtain a transaction structure feature table; Obtaining split ratio data from the transaction structure feature table, and performing anomaly detection on the split ratio data using a k-nearest neighbor algorithm to obtain a transaction anomaly index; The node risk score is calculated based on the transaction anomaly index. If the node risk score is higher than the capital dispersion coefficient threshold, the DeepWalk algorithm is used to perform feature representation on the node to obtain the transaction feature map.

8. The method for constructing a bank anti-money laundering data model based on privacy computing according to claim 1, characterized in that: The irregular distribution of transaction time intervals and the frequency of regional switching are analyzed through the high-risk transaction path characteristic graph. If the time interval deviates from a preset regularity or the regional switching frequency is higher than a preset threshold, it is marked as an abnormal transaction pattern, and the abnormal transaction pattern set is obtained, including: Obtaining a transaction time interval sequence based on the transaction path feature graph, reconstructing the time interval sequence using a time series analysis tool, and obtaining a time series feature vector using a variational autoencoder model; Performing spatial statistical analysis on the time series feature vectors, constructing a weight matrix based on the regional switching frequency, and using Markov chain calculation to obtain a regional transfer feature table; Obtaining migration intensity data according to the regional transfer feature table, clustering the migration intensity data using the DBSCAN algorithm, and obtaining a density distribution map through kernel density estimation; Abnormal transaction indicators are extracted from the density distribution map, the abnormal transaction indicators are detected using isolation forest, and a set of abnormal transaction patterns is obtained by marking them through a scoring mechanism.

9. The method for constructing a bank anti-money laundering data model based on privacy computing according to claim 1, characterized in that: Based on the set of abnormal transaction patterns, the differential distribution of transaction amounts at different levels and the degree of visualization of the association between nodes are calculated, the core transaction nodes and key capital flow paths are determined, and the core transaction subgraph is obtained. Combined with the subset of high-risk transaction entities, the path feature graph, and the set of abnormal transaction patterns, the anti-money laundering risk is predicted through the graph neural network, and a money laundering risk warning is output, including: Obtain transaction amount, transaction frequency, and time interval characteristics based on transaction data, and obtain a distribution table of characteristic amount differences through hierarchical analysis; A force-directed layout algorithm is used to perform node mapping on the amount difference distribution table, and degree centrality, eigenvector centrality, and betweenness centrality are extracted from the relationship data between nodes to obtain a node association topology graph; Extracting node weight values ​​from the node association topology graph, quantifying edge importance using the Betanis centrality algorithm, and obtaining a core transaction subgraph; A graph convolutional network is constructed based on the core transaction subgraph, and node embedding vectors are obtained from the graph convolutional network. The node embedding vectors are fused with the characteristics of high-risk transaction entities using an attention mechanism to obtain a money laundering risk warning value.

Images