Big data-based expense reimbursement fraud chain identification method

Abstract

The invention relates to a method for identifying an expense reimbursement fraud chain based on big data, and relates to the technical field of solving reimbursement fraud by using a computer technology. The method mainly comprises the steps that a reimbursement data set is acquired, the reimbursement data set comprises multiple pieces of reimbursement application data, and the reimbursement application data comprises travel business reimbursement data and business recruitment data; respectively determining a fraud probability, a fraud mode and an abnormal time period corresponding to the reimbursement data set through the reimbursement application data; and identifying a cheating benefit chain according to the cheating probability, the cheating mode and the abnormal time period corresponding to the reimbursement data set.

Description

Technical Field

[0001] The present invention relates to the technical field of solving expense reimbursement fraud using computer technology, and in particular to a method for identifying expense reimbursement fraud chains based on big data. Background Art

[0002] In the increasingly complex corporate risk control scenarios, the risk control of travel reimbursements and business entertainment reimbursements is relatively simple. Traditional means are to issue a single warning for such reimbursements (such as exceeding the reimbursement amount, duplicate invoice reimbursement, etc.), which cannot achieve intelligent identification and complete sorting of the interest chain (such as multiple reimbursements by multiple people involving people, departments, branches and subsidiaries, etc.). Summary of the Invention

[0003] The present invention aims to provide a method for identifying expense reimbursement fraud chains based on big data to address the deficiencies in the prior art. The technical problems to be solved by the present invention are achieved through the following technical solutions.

[0004] An embodiment of the present invention provides a method for identifying expense reimbursement fraud chains based on big data, the method comprising: Acquire a reimbursement data set, wherein the reimbursement data set includes multiple reimbursement application data, and the reimbursement application data includes travel reimbursement data and business entertainment data; Determining the fraud probability, fraud pattern, and abnormal time period corresponding to the reimbursement data set respectively through the reimbursement application data; Identify the fraudulent interest chain based on the fraud probability, fraud pattern, and abnormal time period corresponding to the reimbursement data set.

[0005] In an optional embodiment, determining the fraud probability, fraud pattern, and abnormal time period corresponding to the reimbursement data set using the reimbursement application data includes: Inputting multiple reimbursement application data in the reimbursement data set into the regression model to predict the fraud probability corresponding to each reimbursement application data; Inputting the reimbursement data set into a random forest model to predict the fraud pattern corresponding to the reimbursement data set; The reimbursement data set is input into a neural network model to predict the abnormal time period corresponding to the reimbursement data set.

[0006] In an optional embodiment, inputting the plurality of reimbursement application data in the reimbursement data set into the regression model to predict the fraud probability corresponding to each reimbursement application data includes: Calculate the trip rationality index, consumption deviation index, and consumption time period abnormality based on the reimbursement application data; Converting the reimbursement application data and the corresponding trip rationality index, consumption deviation index, and consumption period abnormality into a reimbursement data feature vector; The reimbursement data feature vector is input into the regression model to predict the fraud probability corresponding to each reimbursement application data.

[0007] In an optional embodiment, inputting the reimbursement dataset into a random forest model to predict the fraud pattern corresponding to the reimbursement dataset includes: Converting the reimbursement data set into a structured data set, wherein each piece of structured data in the structured data set includes: a basic feature vector, a graph feature vector, a timestamp, and a spatial coordinate; The structured data set and the fraud probability corresponding to each reimbursement application data are input into the random forest model to predict the fraud pattern corresponding to the reimbursement data set, and the fraud pattern includes false itineraries, high-price cashing, related transactions, and bill forgery.

[0008] In an optional embodiment, inputting the reimbursement dataset into a neural network model to predict an abnormal time period corresponding to the reimbursement dataset includes: Converting the reimbursement data set into a plurality of data feature sequences of preset time lengths in the form of a sliding window; Determining statistical features corresponding to each of the data feature sequences; the statistical features include the total reimbursement amount, the number of reimbursement applications, the total number of employees, and the maximum reimbursement amount for the preset time period; The data feature sequence and the statistical features are input into a neural network model to predict the abnormal time period corresponding to the reimbursement data set.

[0009] In an optional embodiment, inputting the data feature sequence and the statistical features into a neural network model to predict the abnormal time period corresponding to the reimbursement data set includes: Inputting each of the data feature sequences and corresponding statistical features into a neural network model to obtain anomaly recognition results for the corresponding time period; According to the abnormal probability value corresponding to the abnormal recognition result of each time period, determine the data feature sequence whose abnormal probability value is greater than the target value; The time period in which the data feature sequence with an abnormal probability value greater than the target value is located is determined as the abnormal time period corresponding to the reimbursement data set.

[0010] In an optional embodiment, identifying the fraudulent interest chain based on the fraud probability, fraud pattern, and abnormal time period corresponding to the reimbursement data set includes: Constructing a heterogeneous network based on the reimbursement data set, wherein the heterogeneous network includes employee nodes, customer nodes, and approval nodes, and each node corresponds to an anomaly score; The fraudulent interest chain is identified based on the constructed heterogeneous network and the fraud probability, fraud pattern, and abnormal time period corresponding to the reimbursement data set.

[0011] In an optional embodiment, identifying the fraudulent interest chain based on the constructed heterogeneous network and the fraud probability, fraud pattern, and abnormal time period corresponding to the reimbursement data set includes: Determining an anomaly score for each node in the heterogeneous network based on an anomaly score corresponding to the node and a fraud probability corresponding to each reimbursement application data; Determine a node in the heterogeneous network whose abnormality score is greater than a target score as an abnormal node; The fraudulent interest chain is identified through the fraud patterns of abnormal nodes in the heterogeneous network and the abnormal time period in which they occur.

[0012] In an optional embodiment, identifying the fraudulent interest chain through the fraud patterns of abnormal nodes in the heterogeneous network and the abnormal time periods in which they occur includes: Acquire associated nodes associated with the abnormal node from the heterogeneous network according to the abnormal time period in which the abnormal node is located; Through the fraud pattern of the abnormal node, the abnormal node and its associated nodes determine the fraud benefit chain.

[0013] An embodiment of the present invention provides a device for identifying expense reimbursement fraud chains based on big data, wherein the device includes: An acquisition module is used to acquire a reimbursement data set, wherein the reimbursement data set includes a plurality of reimbursement application data, wherein the reimbursement application data includes travel reimbursement data and business entertainment data; a determination module, configured to determine the fraud probability, fraud pattern, and abnormal time period corresponding to the reimbursement data set based on the reimbursement application data; The identification module is used to identify the fraudulent interest chain based on the fraud probability, fraud pattern, and abnormal time period corresponding to the reimbursement data set.

[0014] The embodiments of the present invention include the following advantages: An embodiment of the present invention provides a method for identifying expense reimbursement fraud chains based on big data. The method first obtains a reimbursement data set, wherein the reimbursement data set includes multiple reimbursement application data, including travel reimbursement data and business entertainment data. The method then uses the reimbursement application data to determine the fraud probability, fraud pattern, and abnormal time period corresponding to the reimbursement data set. Finally, the fraud benefit chain is identified based on the fraud probability, fraud pattern, and abnormal time period corresponding to the reimbursement data set. This method enables in-depth calculation and prediction of fraud risks such as expense reimbursement, achieving complete supervision and monitoring of the expense reimbursement fraud benefit chain, thereby reducing corporate risk control costs. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 This is a flow chart of a method for identifying expense reimbursement fraud chains based on big data provided by an embodiment of the present invention; Figure 2 This is a flow chart for determining fraud probability, fraud pattern, and abnormal time period provided by an embodiment of the present invention; Figure 3 This is a structural diagram of a device for identifying expense reimbursement fraud chains based on big data provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0016] It should be noted that, in the absence of conflict, the embodiments and features of the embodiments in this application can be combined with each other. The present invention will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0017] like Figure 1 As shown in FIG, a method for identifying a fraudulent expense reimbursement chain based on big data is provided in this embodiment. The apparatus for identifying a fraudulent expense reimbursement chain based on big data is configured to perform the following steps: S101, obtaining a reimbursement data set, wherein the reimbursement data set includes a plurality of reimbursement application data, and the reimbursement application data includes travel reimbursement data and business entertainment data.

[0018] In this example, we collect travel expense and entertainment data related to the enterprise and perform preprocessing operations such as cleaning and normalization on the data. After preprocessing, all features of the data set are within the range of [0, 1], so that the subsequent model can effectively process them. The normalization process uses the Min-Max normalization formula:

[0019] Specifically, travel reimbursement data includes employee ID, departure location, destination, transportation, start and end times, reimbursement time, and reimbursement amount. Business entertainment data includes employee ID, entertainment recipient, entertainment location, number of attendees, time spent, reimbursement time, and reimbursement amount. This embodiment does not specifically limit travel reimbursement data or business entertainment data. Furthermore, reimbursement application data also includes approval logs, including approver ID, approval time, approval result, and approval opinion, as well as external data, including merchant information, geographic location, consumption level index, and business registration information. This embodiment does not specifically limit these data.

[0020] S102: Determine the fraud probability, fraud pattern, and abnormal time period corresponding to the reimbursement data set respectively through the reimbursement application data.

[0021] The fraud probability represents the quantitative likelihood that a single reimbursement application will be identified as fraudulent, with a value range of [0, 1]. It can be predicted using predictive models (such as neural networks and random forests). The fraud pattern represents the regular feature combination of fraudulent behavior in the data, reflecting specific fraudulent methods. Fraud patterns can include false itineraries (such as fictitious dining expenses for entertained guests), high-priced cash withdrawals (such as inflating the number of participants to share excess expenses), related-party transactions (such as the approver's investment in a restaurant), and forged invoices (such as cross-departmental reimbursement of consecutive invoices). The abnormal time period is the irregular clustering interval of fraudulent behavior in the time dimension. For example, an audit of a company found that 87% of high-priced cash withdrawals occurred between 18:00 and 22:00 in the last week of each month, and the anomaly score for this period exceeded the threshold by 2.8 times.

[0022] like Figure 2 As shown, in an optional embodiment provided by the present application, the fraud probability, fraud pattern, and abnormal time period corresponding to the reimbursement data set are determined respectively through the reimbursement application data, including: S1021: Input the plurality of reimbursement application data in the reimbursement data set into the regression model to predict the fraud probability corresponding to each reimbursement application data.

[0023] The Logistic Regression model is used to predict the probability of fraud in each reimbursement application, and the risk level (such as low, medium, and high) is divided according to the probability and the preset risk impact. The formula of the Logistic Regression model can be:

[0024]

[0025] Where Y is the binary classification label (0 means no fraud, 1 means fraud), X is the feature vector, w is the model parameter, and n is the number of data types in the reimbursement application. are the 0th, 1st, ... nth dimension vectors in the feature vector X, and each dimension vector represents a type of data. For example, the 0th dimension vector represents the employee ID, the 1st dimension vector represents the departure place, and the nth dimension vector represents the destination. for The corresponding weight values ​​are model parameters obtained through model training.

[0026] Specifically, the multiple reimbursement application data in the reimbursement data set are respectively input into the regression model to predict the fraud probability corresponding to each reimbursement application data, including: calculating the trip rationality index, consumption deviation index, and consumption period abnormality based on the reimbursement application data; converting the reimbursement application data and the corresponding trip rationality index, consumption deviation index, and consumption period abnormality into a reimbursement data feature vector; inputting the reimbursement data feature vector into the regression model to predict the fraud probability corresponding to each reimbursement application data.

[0027] In this embodiment, the itinerary rationality index is used to quantify the rationality of the itinerary in travel reimbursement and detect fraudulent behaviors such as fictitious itineraries or detour reimbursements. It can be calculated using the following formula:

[0028] The consumption deviation index is used to assess the degree of deviation between the time of consumption and normal business / working hours and to identify fictitious consumption during non-business hours. It can be calculated using the following formula:

[0029] The consumption period anomaly degree is used to quantify the degree of deviation between the consumption amount and the reasonable market level and detect fraud such as inflated quotes. It can be calculated using the following formula:

[0030] in, is the shortest distance between the actual trajectory and the reimbursement location, is the distance tolerance factor (default 50km), Used to indicate whether it is outside the business hours of the merchant (1=yes, 0=no). It is used to indicate whether it is a statutory holiday (1=yes, 0=no), t is the consumption time, is the peak consumption period of this type (unit: hours), 、 、 is the weight coefficient, which can be 0.6, 0.3, and 0.1 respectively; The actual reimbursement amount is The average price of similar local consumer markets, is the market price standard deviation, is the local consumer price index.

[0031] For example, an employee claims travel expenses for a "Shanghai-Hangzhou-Nanjing" trip, but the actual route is a direct flight from Shanghai to Nanjing. The extracted trajectory key points include Shanghai and Nanjing, and the reimbursement location is a hotel in Hangzhou (120.12E, 30.16N). The Shanghai-Nanjing flight distance is 275 km, and the shortest distance from Hangzhou is 82 km. The formula for calculating the trip rationality index is as follows:

[0032] In this example, the result of 0.194 is rounded to 0, indicating a completely unreasonable trip (the Hangzhou consumption point is not covered by the trajectory). In this embodiment, after calculating the trip rationality index, consumption deviation index, and consumption time period anomaly, the reimbursement application data and the corresponding trip rationality index, consumption deviation index, and consumption time period anomaly are converted into feature vectors. All converted feature vectors are then combined to form a reimbursement data feature vector. This reimbursement data feature vector is then input into a regression model to predict the fraud probability corresponding to each reimbursement application data.

[0033] It should be noted that the regression model in this embodiment is trained based on sample data and fraud probability labels (0 or 1). The sample data is a reimbursement data feature vector determined based on the reimbursement application sample data. The reimbursement data feature vector is a feature vector composed of the trip rationality index, consumption deviation index, consumption period abnormality and reimbursement application sample data determined in the reimbursement application sample data.

[0034] S1022: Input the reimbursement dataset into a random forest model to predict the fraud pattern corresponding to the reimbursement dataset.

[0035] It should be noted that the random forest model is based on an ensemble of decision trees, and the splitting rule of each decision tree is based on information gain or the Gini index. XGBoost is a gradient boosting tree algorithm that builds a strong classifier by iteratively training multiple weak classifiers.

[0036] In this embodiment, the inputting of the reimbursement data set into the random forest model to predict the fraud pattern corresponding to the reimbursement data set includes: converting the reimbursement data set into a structured data set, each structured data in the structured data set includes: basic feature vectors, graph feature vectors, timestamps, and spatial coordinates; inputting the structured data set and the fraud probability corresponding to each reimbursement application data into the random forest model to predict the fraud pattern corresponding to the reimbursement data set, the fraud pattern including false itineraries, high-price cashing, related transactions, and bill forgery.

[0037] Among them, the basic feature vector includes the reimbursement amount, reimbursement type, etc., the timestamp is the time when the reimbursement occurs, and the spatial coordinates are the location coordinates of the consumption location.

[0038] In this embodiment, the graph feature vector includes: weighted degree centrality, which is used to measure the degree of connection between a node and its neighbors through weighted edges; betweenness centrality, which is used to measure the importance of a node as a bridge in the entire network, that is, the frequency with which a node appears on the shortest path between other pairs of nodes; closeness centrality, which is used to measure the inverse of the average shortest path length from a node to all other nodes in the network, reflecting the efficiency of the node in transmitting information; eigenvector centrality, which is used to measure the importance of a node based on the importance of its neighbors (that is, the score of a node is the weighted sum of the scores of its neighbors); clustering coefficient, which is used to measure the closeness of the connection between the node's neighbors (that is, the proportion of the actual number of edges between the node's neighbors to the total possible number of edges); modularity, which is used to measure the structural strength of the community in which the node is located, that is, the difference between the connection density within the community and the random connection expectation; closeness coefficient, which is based on the average distance from the node to other nodes in the community, measuring the centrality of the node within the community; inter-community connection strength, which is used to measure the connection strength between the node and other communities, reflecting its cross-community influence.

[0039] Specifically, this embodiment first constructs a graph based on reimbursement data. Node types include employees, customers, and approvers, and edges include relationships such as transactions, approvals, and associations. Based on the constructed graph, eight eigenvalues ​​(weighted degree centrality, betweenness centrality, closeness centrality, eigenvector centrality, clustering coefficient, modularity, closeness coefficient, and intercommunity connectivity strength) are determined for each node in the graph. All eigenvalues ​​are then normalized (e.g., using Z-score normalization) to a mean of 0 and a standard deviation of 1. Finally, the eight normalized eigenvalues ​​are combined to form a graph feature vector.

[0040] It should be noted that the sample data input into the training process of the random forest model in this embodiment is obtained by training the structured sample data set determined according to the above method and the fraud label corresponding to each reimbursement application sample data.

[0041] S1023: Input the reimbursement data set into a neural network model to predict the abnormal time period corresponding to the reimbursement data set.

[0042] Among them, the forward propagation formula of the neural network is: , where l represents the number of layers, W is the weight matrix, b is the bias vector, and g is the activation function.

[0043] In this embodiment, the inputting of the reimbursement data set into the neural network model to predict the abnormal time period corresponding to the reimbursement data set includes: converting the reimbursement data set into a plurality of data feature sequences of preset time lengths in the form of a sliding window; determining the statistical features corresponding to each of the data feature sequences; the statistical features include the total reimbursement amount, the number of reimbursement applications, the total number of employees, and the maximum reimbursement amount of the preset time length; and inputting the data feature sequence and the statistical features into the neural network model to predict the abnormal time period corresponding to the reimbursement data set.

[0044] Specifically, the data feature sequence and the statistical features are input into a neural network model to predict the abnormal time period corresponding to the reimbursement data set, including: inputting each of the data feature sequences and the corresponding statistical features into the neural network model to obtain the corresponding time period abnormality identification result; determining the data feature sequence whose abnormal probability value is greater than the target value based on the abnormal probability value corresponding to the abnormal identification result of each time period; and determining the time period in which the data feature sequence whose abnormal probability value is greater than the target value is located as the abnormal time period corresponding to the reimbursement data set.

[0045] S103: Identify the fraudulent interest chain based on the fraud probability, fraud pattern, and abnormal time period corresponding to the reimbursement data set.

[0046] In one embodiment provided in the present application, identifying the fraudulent interest chain based on the fraud probability, fraud pattern, and abnormal time period corresponding to the reimbursement data set includes: S1031: Construct a heterogeneous network based on the reimbursement data set. The heterogeneous network includes employee nodes, customer nodes, and approval nodes. Each node has a corresponding anomaly score.

[0047] Among them, the total node set of the heterogeneous network is constructed , Employee nodes, each node corresponds to an employee ID; For customer nodes, each node corresponds to a customer ID; The node is the approver node, and each node corresponds to an approver ID. The edge weight between nodes in the heterogeneous network is calculated as follows: Employee-Customer Side ( ) weights: For each employee-customer pair (e, s), within the time window [t-7d, t], where t is the current time and t-7d is seven days ago, there may be multiple transactions. Calculate the total transaction amount within this window and then take its logarithm (add 1 to avoid zero): (Where S is the total amount reimbursed by employee e to customer s during the time window) If there is no transaction, there is no edge.

[0048] Employee-Approver Side ( ) weight: For each employee-approver pair (e, a), within the time window [t-7d, t], calculate the average response speed of all approval records (take the inverse so that the faster the response, the greater the weight). Specifically: suppose the time of a certain reimbursement submission is The approval completion time is , the response time is (In hours). Take the shortest response time of all approval records within this window (Unit: hours), then the weight is calculated as: ( The smaller it is, the greater the weight; =0 when the weight is 1) Customer-Customer Edge ( ) weight: If two customers s1 and s2 have the same legal representative in the business information (or other strong associations, such as the same registered address, the same contact number, etc.), then add an edge with a weight of 1 (i.e. =1).

[0049] S1032: Identify the fraudulent interest chain based on the constructed heterogeneous network and the fraud probability, fraud pattern, and abnormal time period corresponding to the reimbursement data set.

[0050] Specifically, the method of identifying a fraudulent interest chain based on the constructed heterogeneous network, the fraud probability, the fraud pattern, and the abnormal time period corresponding to the reimbursement data set includes: determining an abnormal score for each node in the heterogeneous network based on the abnormal score corresponding to the node and the fraud probability corresponding to each reimbursement application data; determining a node in the heterogeneous network whose abnormal score is greater than a target score as an abnormal node; and identifying a fraudulent interest chain through the fraud pattern of the abnormal node in the heterogeneous network and the abnormal time period in which it is located.

[0051] More specifically, the method of identifying the fraudulent interest chain through the fraud pattern of the abnormal node in the heterogeneous network and the abnormal time period in which the abnormal node is located includes: obtaining associated nodes associated with the abnormal node from the heterogeneous network according to the abnormal time period in which the abnormal node is located; and determining the fraudulent interest chain through the fraud pattern of the abnormal node, the abnormal node and its associated nodes.

[0052] This embodiment provides a method for identifying expense reimbursement fraud chains based on big data. The method first obtains a reimbursement data set, wherein the reimbursement data set includes multiple reimbursement application data, including travel reimbursement data and business entertainment data; then, the fraud probability, fraud pattern, and abnormal time period corresponding to the reimbursement data set are determined based on the reimbursement application data; finally, the fraud benefit chain is identified based on the fraud probability, fraud pattern, and abnormal time period corresponding to the reimbursement data set. This application enables in-depth calculation and prediction of fraud risks such as expense reimbursement, achieving complete supervision and monitoring of the expense reimbursement fraud benefit chain, thereby reducing corporate risk control costs.

[0053] It should be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0054] In one embodiment, a device for identifying expense reimbursement fraud chains based on big data is provided. Figure 3 As shown, the functional modules of the device for identifying expense reimbursement fraud chains based on big data are described in detail as follows: An acquisition module 31 is configured to acquire a reimbursement data set, wherein the reimbursement data set includes a plurality of reimbursement application data, wherein the reimbursement application data includes travel reimbursement data and business entertainment data; A determination module 32, configured to determine the fraud probability, fraud pattern, and abnormal time period corresponding to the reimbursement data set based on the reimbursement application data; The identification module 33 is used to identify the fraudulent interest chain based on the fraud probability, fraud pattern, and abnormal time period corresponding to the reimbursement data set.

[0055] In an optional embodiment, the determination module 32 is specifically configured to: Inputting multiple reimbursement application data in the reimbursement data set into the regression model to predict the fraud probability corresponding to each reimbursement application data; Inputting the reimbursement data set into a random forest model to predict the fraud pattern corresponding to the reimbursement data set; The reimbursement data set is input into a neural network model to predict the abnormal time period corresponding to the reimbursement data set.

[0056] In an optional embodiment, the determination module 32 is specifically configured to: Calculate the trip rationality index, consumption deviation index, and consumption time period abnormality based on the reimbursement application data; Converting the reimbursement application data and the corresponding trip rationality index, consumption deviation index, and consumption period abnormality into a reimbursement data feature vector; The reimbursement data feature vector is input into the regression model to predict the fraud probability corresponding to each reimbursement application data.

[0057] In an optional embodiment, the determination module 32 is specifically configured to: Converting the reimbursement data set into a structured data set, wherein each piece of structured data in the structured data set includes: a basic feature vector, a graph feature vector, a timestamp, and a spatial coordinate; The structured data set and the fraud probability corresponding to each reimbursement application data are input into the random forest model to predict the fraud pattern corresponding to the reimbursement data set, and the fraud pattern includes false itineraries, high-price cashing, related transactions, and bill forgery.

[0058] In an optional embodiment, the determination module 32 is specifically configured to: Converting the reimbursement data set into a plurality of data feature sequences of preset time lengths in the form of a sliding window; Determining statistical features corresponding to each of the data feature sequences; the statistical features include the total reimbursement amount, the number of reimbursement applications, the total number of employees, and the maximum reimbursement amount for the preset time period; The data feature sequence and the statistical features are input into a neural network model to predict the abnormal time period corresponding to the reimbursement data set.

[0059] In an optional embodiment, the determination module 32 is specifically configured to: Inputting each of the data feature sequences and corresponding statistical features into a neural network model to obtain anomaly recognition results for the corresponding time period; According to the abnormal probability value corresponding to the abnormal recognition result of each time period, determine the data feature sequence whose abnormal probability value is greater than the target value; The time period in which the data feature sequence with an abnormal probability value greater than the target value is located is determined as the abnormal time period corresponding to the reimbursement data set.

[0060] In an optional embodiment, the identification module 33 is specifically configured to: Constructing a heterogeneous network based on the reimbursement data set, wherein the heterogeneous network includes employee nodes, customer nodes, and approval nodes, and each node corresponds to an anomaly score; The fraudulent interest chain is identified based on the constructed heterogeneous network and the fraud probability, fraud pattern, and abnormal time period corresponding to the reimbursement data set.

[0061] In an optional embodiment, the identification module 33 is specifically configured to: Determining an anomaly score for each node in the heterogeneous network based on an anomaly score corresponding to the node and a fraud probability corresponding to each reimbursement application data; Determine a node in the heterogeneous network whose abnormality score is greater than a target score as an abnormal node; The fraudulent interest chain is identified through the fraud patterns of abnormal nodes in the heterogeneous network and the abnormal time period in which they occur.

[0062] In an optional embodiment, the identification module 33 is specifically configured to: Acquire associated nodes associated with the abnormal node from the heterogeneous network according to the abnormal time period in which the abnormal node is located; Through the fraud pattern of the abnormal node, the abnormal node and its associated nodes determine the fraud benefit chain.

[0063] It should be noted that the above detailed description is exemplary and is intended to provide further explanation of the present application. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by those of ordinary skill in the art to which this application belongs.

[0064] Regarding the specific limitations of the device system for identifying expense reimbursement fraud chains based on big data, please refer to the limitations of the method for identifying expense reimbursement fraud chains based on big data above, and will not be repeated here. Each module in the above-mentioned device can be implemented in whole or in part through software, hardware, or a combination thereof. Each of the above-mentioned modules can be embedded in or independent of the processor in the computer device in hardware form, or can be stored in the memory of the computer device in software form, so that the processor can call and execute the operations corresponding to each of the above modules.

[0065] Those skilled in the art will clearly understand that for the sake of convenience and brevity in description, only the division of the above-mentioned functional units and modules is used as an example. In actual applications, the above-mentioned functions can be distributed and completed by different functional units and modules as needed, that is, the internal structure of the system can be divided into different functional units or modules to complete all or part of the functions described above.

[0066] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention, and should all be included in the scope of protection of the present invention.

Claims

1. A method for identifying expense reimbursement fraud chains based on big data, characterized in that: The method comprises: Acquire a reimbursement data set, wherein the reimbursement data set includes multiple reimbursement application data, and the reimbursement application data includes travel reimbursement data and business entertainment data; Determining the fraud probability, fraud pattern, and abnormal time period corresponding to the reimbursement data set respectively through the reimbursement application data; Identify the fraudulent interest chain based on the fraud probability, fraud pattern, and abnormal time period corresponding to the reimbursement data set; Determining the fraud probability, fraud pattern, and abnormal time period corresponding to the reimbursement data set using the reimbursement application data includes: Inputting multiple reimbursement application data in the reimbursement data set into the regression model to predict the fraud probability corresponding to each reimbursement application data; Inputting the reimbursement data set into a random forest model to predict the fraud pattern corresponding to the reimbursement data set; The reimbursement data set is input into a neural network model to predict the abnormal time period corresponding to the reimbursement data set.

2. The method according to claim 1, characterized in that The step of inputting the plurality of reimbursement application data in the reimbursement data set into the regression model to predict the fraud probability corresponding to each reimbursement application data includes: Calculate the trip rationality index, consumption deviation index, and consumption time period abnormality based on the reimbursement application data; Converting the reimbursement application data and the corresponding trip rationality index, consumption deviation index, and consumption period abnormality into a reimbursement data feature vector; The reimbursement data feature vector is input into the regression model to predict the fraud probability corresponding to each reimbursement application data.

3. The method according to claim 2, characterized in that Inputting the reimbursement dataset into a random forest model to predict the fraud pattern corresponding to the reimbursement dataset includes: Converting the reimbursement data set into a structured data set, wherein each piece of structured data in the structured data set includes: a basic feature vector, a graph feature vector, a timestamp, and a spatial coordinate; The structured data set and the fraud probability corresponding to each reimbursement application data are input into the random forest model to predict the fraud pattern corresponding to the reimbursement data set, and the fraud pattern includes false itineraries, high-price cashing, related transactions, and bill forgery.

4. The method according to claim 1, wherein Inputting the reimbursement data set into a neural network model to predict an abnormal time period corresponding to the reimbursement data set includes: Converting the reimbursement data set into a plurality of data feature sequences of preset time lengths in the form of a sliding window; Determining statistical features corresponding to each of the data feature sequences; the statistical features include the total reimbursement amount, the number of reimbursement applications, the total number of employees, and the maximum reimbursement amount for the preset time period; The data feature sequence and the statistical features are input into a neural network model to predict the abnormal time period corresponding to the reimbursement data set.

5. The method according to claim 4, characterized in that Inputting the data feature sequence and the statistical features into a neural network model to predict the abnormal time period corresponding to the reimbursement data set includes: Inputting each of the data feature sequences and corresponding statistical features into a neural network model to obtain anomaly recognition results for the corresponding time period; According to the abnormal probability value corresponding to the abnormal recognition result of each time period, determine the data feature sequence whose abnormal probability value is greater than the target value; The time period in which the data feature sequence with an abnormal probability value greater than the target value is located is determined as the abnormal time period corresponding to the reimbursement data set.

6. The method according to any one of claims 1 to 5, characterized in that The identifying of the fraudulent interest chain based on the fraud probability, fraud pattern, and abnormal time period corresponding to the reimbursement data set includes: Constructing a heterogeneous network based on the reimbursement data set, wherein the heterogeneous network includes employee nodes, customer nodes, and approval nodes, and each node corresponds to an anomaly score; The fraudulent interest chain is identified based on the constructed heterogeneous network and the fraud probability, fraud pattern, and abnormal time period corresponding to the reimbursement data set.

7. The method according to claim 6, characterized in that The identifying of the fraudulent interest chain based on the constructed heterogeneous network and the fraud probability, fraud pattern, and abnormal time period corresponding to the reimbursement data set includes: Determining an anomaly score for each node in the heterogeneous network based on an anomaly score corresponding to the node and a fraud probability corresponding to each reimbursement application data; Determine a node in the heterogeneous network whose abnormality score is greater than a target score as an abnormal node; The fraudulent interest chain is identified through the fraud patterns of abnormal nodes in the heterogeneous network and the abnormal time period in which they occur.

8. The method according to claim 7, characterized in that The identifying of the fraudulent interest chain through the fraud patterns of abnormal nodes in the heterogeneous network and the abnormal time periods in which they occur includes: Acquire associated nodes associated with the abnormal node from the heterogeneous network according to the abnormal time period in which the abnormal node is located; Through the fraud pattern of the abnormal node, the abnormal node and its associated nodes determine the fraud benefit chain.

9. A device for identifying expense reimbursement fraud chains based on big data, characterized in that: The device comprises: An acquisition module is used to acquire a reimbursement data set, wherein the reimbursement data set includes a plurality of reimbursement application data, wherein the reimbursement application data includes travel reimbursement data and business entertainment data; A determination module is configured to input the plurality of reimbursement application data in the reimbursement data set into a regression model to predict the fraud probability corresponding to each reimbursement application data; input the reimbursement data set into a random forest model to predict the fraud pattern corresponding to the reimbursement data set; and input the reimbursement data set into a neural network model to predict the abnormal time period corresponding to the reimbursement data set; The identification module is used to identify the fraudulent interest chain based on the fraud probability, fraud pattern, and abnormal time period corresponding to the reimbursement data set.

Images