Anti-money laundering monitoring system and method

Abstract

The invention relates to the technical field of financial security, and particularly discloses an anti-money laundering monitoring system and method, and the method comprises the steps: collecting multi-source heterogeneous data through building data interfaces with multiple departments, carrying out the preliminary cleaning, fusing the data through an auto-encoder, and combining with a PCA algorithm to extract a principal component; constructing a dynamic risk assessment model based on LSTM and an attention mechanism, and learning transaction characteristics to calculate risk scores; setting and adaptively adjusting a dynamic risk threshold value, identifying abnormal transactions and performing early warning; mining abnormal transaction association by using a graph neural network, and discovering a money laundering network; and optimizing the monitoring model according to an actual case. According to the invention, deep fusion and dynamic risk assessment of multi-source data are realized, money laundering behaviors are effectively identified, and the accuracy and timeliness of anti-money laundering monitoring are improved.

Description

Technical Field

[0001] The present invention relates to the field of financial security technology, and in particular to an anti-money laundering monitoring system and method. Background Art

[0002] With the rapid development of the financial industry and the increasing diversification of payment methods, money laundering crimes have become more covert and complex. Traditional anti-money laundering monitoring methods often rely on a single data source or simple rule matching, making it difficult to fully capture the characteristics of money laundering behavior.

[0003] On the one hand, monitoring solely based on a financial institution's own transaction data fails to capture relevant information about its clients in other areas, leading to blind spots in monitoring. For example, it is impossible to combine business data from the industrial and commercial tax authorities with import and export data from customs to make a comprehensive assessment, making it difficult to detect money laundering activities carried out through complex means such as fraudulent trade and fund transfers.

[0004] On the other hand, simple rule-matching approaches lack the ability to learn from the inherent characteristics and dynamic changes of data. When money laundering methods change, traditional rules struggle to adapt, making them prone to omissions or false positives, reducing the accuracy and effectiveness of anti-money laundering monitoring.

[0005] Therefore, an anti-money laundering monitoring system and method have become problems that need to be solved urgently. Summary of the Invention

[0006] The technical problem to be solved by the present invention is to provide an anti-money laundering monitoring system and method. By collecting multi-source heterogeneous data and using autoencoder algorithms, PCA algorithms, LSTM networks, attention mechanisms, graph neural network algorithms, etc., it can achieve accurate identification, dynamic monitoring and early warning of money laundering behaviors, improve the accuracy and effectiveness of anti-money laundering monitoring, and ensure financial security.

[0007] To solve the above technical problems, the present invention provides a technical solution: an anti-money laundering monitoring method, comprising the following steps:

[0008] S1. Multi-source heterogeneous data collection: Establish data interfaces with financial institutions, payment platforms, industrial and commercial taxation departments, and customs to collect basic customer information, transaction data, business operation data, and customs import and export data. Perform preliminary cleaning of the collected data to remove duplicate and invalid data.

[0009] S2. Data fusion and feature extraction: Using the autoencoder algorithm, the collected multi-source heterogeneous data is fused and processed;

[0010] The autoencoder learns the intrinsic feature representation of the data by encoding and decoding different types of data, and maps the fused data into a unified feature space. In the feature space, the PCA algorithm is used to extract the principal components that can effectively characterize the data features, reduce the data dimension, and retain the key information of the data, forming a feature vector set for subsequent analysis.

[0011] S3. Dynamic risk assessment model construction: Construct a dynamic risk assessment model based on LSTM and attention mechanism;

[0012] The extracted feature vectors are used as model inputs. The LSTM network learns the time series characteristics of the data and captures the temporal changes in trading behavior. The attention mechanism dynamically adjusts the model's attention weight for each feature based on its importance to risk assessment.

[0013] The dynamic risk assessment model learns the pattern characteristics of normal transactions and money laundering transactions through training on historical data, establishes a risk assessment function, and calculates the risk score of each transaction in real time;

[0014] S4. Abnormal transaction identification and early warning: Set dynamic risk thresholds and adjust them in real time through adaptive algorithms based on the distribution of historical transaction data, market environment changes, and regulatory requirements;

[0015] When the risk score of a transaction exceeds the set risk threshold, the system determines that the transaction is abnormal and triggers the early warning mechanism;

[0016] Send warning information to relevant regulators and risk control departments of financial institutions via SMS, email or system messages;

[0017] S5. Collaborative Analysis and Association Mining: For abnormal transactions that trigger early warnings, we use a graph neural network algorithm to construct a transaction relationship graph based on the transaction subject, counterparty, transaction time, and transaction amount.

[0018] By analyzing transaction relationship graphs, we can uncover potential relationships between transaction entities and discover hidden money laundering networks. We can also combine this with other information from multi-source data to conduct collaborative analysis and further verify the money laundering suspicion of abnormal transactions.

[0019] S6. Monitoring model optimization and update: Based on the investigation results of the regulatory authorities and actual money laundering cases, newly discovered money laundering patterns and characteristics are incorporated into the training data, the dynamic risk assessment model is retrained, the risk assessment function and risk threshold are adjusted, and the monitoring model's ability to identify new types of money laundering behavior is continuously improved.

[0020] Furthermore, the basic customer information includes identity information, contact information, and occupational information; the transaction data includes transaction time, transaction amount, counterparty information, and transaction frequency; the business operation data includes corporate financial statements, business scope, and business scale; and the customs import and export data includes cargo information, trade amount, and trading country.

[0021] Furthermore, in step S2, the specific method for fusing the collected multi-source heterogeneous data is as follows:

[0022] Construct a multi-layer nonlinear autoencoder network, which consists of two parts: encoder and decoder:

[0023] The encoder maps the input features to a low-dimensional latent space: h = f(W enc x+b enc ), where W enc is the encoding weight matrix, b enc is the bias vector, f is the ReLU activation function;

[0024] The decoder reconstructs the latent space representation into the original input: Among them, W dec is the decoding weight matrix, b dec is the bias vector, g is the linear activation function;

[0025] The fusion of multi-source data is achieved through the intermediate hidden layer representation h of the autoencoder;

[0026] Introducing the attention mechanism to dynamically adjust the importance weights of different data sources: Among them, the attention score e i Calculated as follows: e i =v T tanh(W s h i +b s );

[0027] The feature representation after weighted fusion is:

[0028] Centralize the fused feature matrix H:

[0029] Compute the covariance matrix:

[0030] Perform eigenvalue decomposition on the covariance matrix: C = PΛP T ; Where P is the eigenvector matrix and Λ is the diagonal eigenvalue matrix;

[0031] Select the eigenvectors corresponding to the first k largest eigenvalues ​​to form the projection matrix P k ;

[0032] The eigenvector after dimensionality reduction is: Z = H centered P k ;

[0033] The number of principal components is determined by the proportion of cumulative explained variance: Where θ is the preset threshold, 0.85≤θ≤0.95;

[0034] Calculate the importance score of each original feature based on the PCA loading matrix: Among them, P ij is the projection matrix P k The elements of λ i is the corresponding eigenvalue;

[0035] Feature screening is performed based on feature importance scores to retain key features.

[0036] Furthermore, in step S3, a dynamic risk assessment model based on LSTM and attention mechanism is constructed. The specific method for calculating the risk score of each transaction is as follows:

[0037] Sort the feature vector set obtained in step S2 by transaction timestamp to construct a fixed-length transaction sequence. Zero-fill sequences that are insufficient in length, and intercept sequences that exceed the fixed length by sliding the time window.

[0038] Construct a bidirectional LSTM network structure. The input layer receives the preprocessed feature sequence. The bidirectional LSTM layer uses the formula: h t =BiLSTM(x t ,h t-1 ) outputs a hidden state sequence, where x t is the input feature at time t, h t-1 is the hidden state of the previous moment, and the output layer is z t =W·h t +b generates intermediate feature representation, W is the weight matrix, and b is the bias vector;

[0039] Apply the temporal attention mechanism on the feature sequence output by the bidirectional LSTM, through the formula: t =v T tanh(W a ·z t +b a ) Calculate the attention score, where v, W a 、b a is a trainable parameter, through Normalization is performed to obtain the attention weight of each time step, through c = ∑ t α t ·z tWeighted aggregation generates a context vector;

[0040] Apply the feature attention mechanism on the context vector c, through formula s j =u T tanh(W f c j +b f ) Calculate the feature importance score, where u, W f 、b f is a trainable parameter, c j is the jth feature dimension of the context vector, through Normalization is performed to obtain the importance weight of each feature dimension, and c ′ =∑ j β j c j Feature weighting generates the final feature representation;

[0041] The final feature representation is mapped to the risk score through the fully connected layer, first through h = ReLU (W h c′+b h ) performs intermediate layer transformation, where W h 、b h is a trainable parameter, and then r=sigmoid(W r h+b r ) Output risk score, where W r 、b r is a trainable parameter, r∈[0,1] represents the money laundering risk probability of the transaction;

[0042] Use historical labeled data for model training and define the loss function: L = -∑ i [y i ·log(r i )+(1-y i )·log(1-r i )]; where y i is the true label, r i To predict risk scores, we use the Adam optimizer to minimize the loss function and update the model parameters. We apply Dropout and L2 regularization to prevent overfitting. We monitor the loss change on the validation set and stop training when there is no improvement after multiple epochs.

[0043] Based on the trained model, a risk assessment function R(x) is constructed. The input is the transaction feature sequence x, and the output is the risk score r∈[0,1]. The risk level is divided into low risk when r<0.3, medium risk when 0.3≤r<0.7, and high risk when r≥0.7. For real-time transaction data, the most recent transaction sequence is obtained through a sliding time window and input into the trained model to calculate the risk score, thereby realizing dynamic risk assessment.

[0044] Furthermore, in step S4, the specific method for determining the dynamic risk threshold is as follows:

[0045] The quantile of historical transaction risk scores is used as the basic threshold: Basic threshold = Quantile (R history ,q),q∈[0.9,0.99]; where R history is the historical risk score set, q is the quantile value;

[0046] An external indicator is introduced as the adjustment factor δ, and the relationship between the threshold and the external indicator is established through a linear regression model;

[0047] Dynamic risk threshold: Dynamic risk threshold = basic threshold × (1 + δ); where δ is obtained by extracting keywords and quantifying them through NLP from real-time data collected from regulatory announcements and industry risk reports.

[0048] The basic threshold is recalculated daily / weekly based on the latest historical data; when a new money laundering case or a sudden change in regulatory policy is detected, the threshold recalculation is immediately triggered and the dynamic risk threshold is updated.

[0049] Furthermore, in step S4, the specific method for determining abnormal transactions is as follows:

[0050] If the risk score of a single transaction r ≥ the dynamic risk threshold, it is directly judged as abnormal;

[0051] For multiple transactions of the same customer within the time window T, calculate the cumulative risk score or abnormal transaction frequency:

[0052] Cumulative risk score: (n is the number of transactions in the window);

[0053] Abnormal frequency:

[0054] If R sum ≥T sum or f ≥ T freq , determined to be an abnormal transaction sequence, T sum 、T freq is the preset sequence threshold.

[0055] Furthermore, in step S4, the early warning mechanism divides the warning levels into yellow warning and red warning. When 0.7≤r<0.9, a yellow warning is issued, and its triggering condition is a single transaction or sequence abnormality. When r≥0.9, a red warning is issued, and its triggering condition is a transaction with significant high-risk characteristics.

[0056] Furthermore, the warning information includes basic information of the transaction, risk score and risk characteristics.

[0057] Furthermore, the other information includes the enterprise's equity structure and personnel relationships.

[0058] The present invention also provides an anti-money laundering monitoring system for implementing the above method, comprising:

[0059] Data collection module: used to establish data interfaces with financial institutions, payment platforms, industrial and commercial taxation departments, and customs, collect multi-source heterogeneous data, and perform preliminary cleaning;

[0060] Data processing module: including a data fusion unit and a feature extraction unit. The data fusion unit uses an autoencoder algorithm to fuse multi-source heterogeneous data; the feature extraction unit uses a PCA algorithm to extract principal components to form a feature vector set;

[0061] Risk Assessment Module: This module is used to build a dynamic risk assessment model based on LSTM and attention mechanism, conduct risk assessment on transaction data, and calculate risk scores.

[0062] Abnormal identification module: used to set dynamic risk thresholds, identify abnormal transactions based on risk scores, classify warning levels, and trigger warning mechanisms;

[0063] Association analysis module: Uses graph neural network algorithms to conduct collaborative analysis and association mining of abnormal transactions to discover potential money laundering networks;

[0064] Model update module: Incorporate new money laundering patterns and characteristics into training data based on actual conditions, retrain the dynamic risk assessment model, and optimize the anti-money laundering monitoring system.

[0065] The advantages of the present invention compared with the prior art are:

[0066] By establishing data interfaces with multiple departments and collecting heterogeneous data from multiple sources, the present invention can comprehensively understand customer behavior from multiple dimensions, making up for the deficiency of single data source of traditional methods, effectively expanding the monitoring scope and reducing monitoring blind spots.

[0067] This invention uses advanced algorithms such as autoencoder algorithm, PCA algorithm, LSTM network, attention mechanism, graph neural network algorithm, etc., which can deeply learn the intrinsic characteristics and dynamic change patterns of data, improve the ability to identify complex money laundering behaviors, and greatly reduce the omission and false alarm rates compared with traditional rule matching methods.

[0068] The dynamic risk assessment model of this invention calculates transaction risk scores in real time, and the dynamic risk threshold can be adjusted in real time based on a variety of factors, enabling dynamic monitoring of money laundering activities. Furthermore, the rational classification of warning levels and timely transmission of warning information facilitate rapid response by regulators and risk control departments of financial institutions, enabling them to take appropriate measures.

[0069] The present invention optimizes and updates the monitoring model based on actual cases and regulatory results, enabling the system to continuously adapt to changes in new money laundering behaviors, maintain high monitoring accuracy and effectiveness, and provide long-term and reliable protection for financial security. BRIEF DESCRIPTION OF THE DRAWINGS

[0070] Figure 1 The present invention is a flowchart of an anti-money laundering monitoring method.

[0071] Figure 2 It is a system block diagram of an anti-money laundering monitoring system of the present invention.

[0072] Figure 3 It is a workflow diagram for abnormal transaction identification and early warning. DETAILED DESCRIPTION

[0073] Various exemplary embodiments of the present invention will be described in detail below with reference to the accompanying drawings. It should be noted that unless otherwise specifically stated, the relative arrangements of components and steps, numerical expressions and numerical values ​​set forth in these embodiments do not limit the scope of the present invention.

[0074] The following description of at least one exemplary embodiment is merely illustrative in nature and is in no way intended to limit the invention, its application, or uses.

[0075] Technologies, methods, and equipment known to ordinary technicians in the relevant art may not be discussed in detail, but where appropriate, the technologies, methods, and equipment should be considered part of the specification.

[0076] In all examples shown and discussed herein, any specific values ​​should be interpreted as merely exemplary and not limiting. Therefore, other examples of the exemplary embodiments may have different values.

[0077] The following is a further detailed description of an anti-money laundering monitoring system and method of the present invention with reference to the accompanying drawings.

[0078] Combined with attachment Figure 1-3 , the present invention is introduced in detail.

[0079] An anti-money laundering monitoring method specifically comprises the following steps:

[0080] S1. Multi-source heterogeneous data collection: By establishing data interfaces with financial institutions, payment platforms, industrial and commercial tax authorities, and customs, we collect basic customer information, transaction data, business operating data, and customs import and export data. Basic customer information includes identity, contact information, and occupation; transaction data includes transaction time, transaction amount, counterparty information, and transaction frequency; business operating data includes corporate financial statements, business scope, and scale; and customs import and export data includes cargo information, trade amount, and trading countries. Collected data is initially cleaned to remove duplicate and invalid data, providing a high-quality data foundation for subsequent processing.

[0081] S2. Data Fusion and Feature Extraction: An autoencoder algorithm is used to fuse the collected multi-source heterogeneous data. Specifically, a multi-layer nonlinear autoencoder network is constructed, which consists of an encoder and a decoder.

[0082] The encoder maps the input features to a low-dimensional latent space: h = f(W enc x+b enc ), where W enc is the encoding weight matrix, b enc is the bias vector, f is the ReLU activation function;

[0083] The decoder reconstructs the latent space representation into the original input: Among them, W dec is the decoding weight matrix, b dec is the bias vector, g is the linear activation function;

[0084] The fusion of multi-source data is achieved through the intermediate hidden layer representation h of the autoencoder, and the attention mechanism is introduced to dynamically adjust the importance weights of different data sources: Among them, the attention score e i Calculated as follows: e i =v T tanh(W s h i +b s );

[0085] The feature representation after weighted fusion is:

[0086] Centralize the fused feature matrix H:

[0087] Compute the covariance matrix:

[0088] Perform eigenvalue decomposition on the covariance matrix: C = PΛP T ; Where P is the eigenvector matrix and Λ is the diagonal eigenvalue matrix;

[0089] Select the eigenvectors corresponding to the first k largest eigenvalues ​​to form the projection matrix P k ;

[0090] The eigenvector after dimensionality reduction is: Z = H centered P k ;

[0091] The number of principal components is determined by the proportion of cumulative explained variance: Where θ is the preset threshold, 0.85≤θ≤0.95;

[0092] Calculate the importance score of each original feature based on the PCA loading matrix: Among them, P ij is the projection matrix P k The elements of λ i is the corresponding eigenvalue;

[0093] Feature screening is performed based on feature importance scores, key features are retained, and a feature vector set is formed for subsequent analysis.

[0094] S3. Dynamic Risk Assessment Model Construction: Build a dynamic risk assessment model based on LSTM and attention mechanisms. Sort the extracted feature vectors by transaction timestamp to construct a fixed-length transaction sequence. Zero-padded sequences are applied to sequences that are shorter than the fixed length, and sequences that exceed the fixed length are truncated using a sliding time window.

[0095] Construct a bidirectional LSTM network structure. The input layer receives the preprocessed feature sequence. The bidirectional LSTM layer uses the formula: h t =BiLSTM(x t ,h t-1 ) outputs a hidden state sequence, where x t is the input feature at time t, h t-1 is the hidden state of the previous moment, and the output layer is z t =W·h t +b generates intermediate feature representation, W is the weight matrix, and b is the bias vector;

[0096] Apply the temporal attention mechanism on the feature sequence output by the bidirectional LSTM, through the formula: t =v T tanh(W a ·z t +b a ) Calculate the attention score, where v, Wa 、b a is a trainable parameter, through Normalization is performed to obtain the attention weight of each time step, through c = ∑ t α t ·z t Weighted aggregation generates a context vector;

[0097] Apply the feature attention mechanism on the context vector c, through formula s j =u T tanh(W f c j +b f ) Calculate the feature importance score, where u, W f 、b f is a trainable parameter, c j is the jth feature dimension of the context vector, through Normalization is performed to obtain the importance weight of each feature dimension, and c ′ =∑ j β j c j Feature weighting generates the final feature representation;

[0098] The final feature representation is mapped to the risk score through the fully connected layer, first through h = ReLU (W h c ′ +b h ) performs intermediate layer transformation, where W h 、b h is a trainable parameter, and then r=sigmoid(W r h+b r ) Output risk score, where W r 、b r is a trainable parameter, r∈[0,1] represents the money laundering risk probability of the transaction;

[0099] Use historical labeled data for model training and define the loss function: L = -∑ i [y i ·log(r i )+(1-y i )·log(1-r i )]; where y i is the true label, r i To predict risk scores, we use the Adam optimizer to minimize the loss function and update the model parameters. We apply Dropout and L2 regularization to prevent overfitting. We monitor the loss change on the validation set and stop training when there is no improvement after multiple epochs.

[0100] Based on the trained model, a risk assessment function R(x) is constructed. The input is the transaction feature sequence x, and the output is the risk score r∈[0,1]. The risk level is divided into low risk when r<0.3, medium risk when 0.3≤r<0.7, and high risk when r≥0.7. For real-time transaction data, the most recent transaction sequence is obtained through a sliding time window and input into the trained model to calculate the risk score, thereby realizing dynamic risk assessment.

[0101] S4. Abnormal transaction identification and early warning: Set a dynamic risk threshold and adjust it in real time through an adaptive algorithm based on the distribution of historical transaction data, changes in the market environment, and regulatory requirements. The specific determination method is: the quantile of the historical transaction risk score is used as the basic threshold: Basic threshold = Quantile (R history ,q),q∈[0.9,0.99]; where R history is the historical risk score set, q is the quantile value;

[0102] An external indicator is introduced as the adjustment factor δ, and the relationship between the threshold and the external indicator is established through a linear regression model;

[0103] Dynamic risk threshold: Dynamic risk threshold = basic threshold × (1 + δ); where δ is obtained by extracting keywords and quantifying them through NLP from real-time data collected from regulatory announcements and industry risk reports.

[0104] The basic threshold is recalculated daily / weekly based on the latest historical data; when a new money laundering case or a sudden change in regulatory policy is detected, the threshold recalculation is immediately triggered and the dynamic risk threshold is updated.

[0105] The specific methods for determining abnormal transactions are as follows:

[0106] If the risk score of a single transaction r ≥ the dynamic risk threshold, it is directly judged as abnormal;

[0107] For multiple transactions of the same customer within the time window T, calculate the cumulative risk score or abnormal transaction frequency:

[0108] Cumulative risk score: (n is the number of transactions in the window);

[0109] Abnormal frequency:

[0110] If R sum ≥T sum or f ≥ T freq , determined to be an abnormal transaction sequence, T sum 、T freq is the preset sequence threshold.

[0111] The early warning mechanism categorizes warning levels into yellow and red. When 0.7 ≤ r < 0.9, a yellow warning is issued, triggered by a single transaction or sequence anomaly. When r ≥ 0.9, a red warning is issued, triggered by transactions with significant high-risk characteristics. Warning information includes basic transaction information, risk score, and risk characteristics.

[0112] S5. Collaborative Analysis and Association Mining: For unusual transactions that trigger alerts, we use a graph neural network algorithm to construct a transaction relationship graph, combining the transaction subject, counterparty, transaction time, and transaction amount. By analyzing this transaction relationship graph, we uncover potential relationships between transaction subjects and uncover hidden money laundering networks. Furthermore, we combine this with other information from multi-source data, such as corporate equity structure and personnel relationships, to conduct collaborative analysis and further verify the money laundering suspicion of unusual transactions.

[0113] S6. Monitoring model optimization and update: Based on the investigation results of the regulatory authorities and actual money laundering cases, newly discovered money laundering patterns and characteristics are incorporated into the training data, the dynamic risk assessment model is retrained, the risk assessment function and risk threshold are adjusted, and the monitoring model's ability to identify new types of money laundering behavior is continuously improved.

[0114] The present invention also provides an anti-money laundering monitoring system for implementing the above-mentioned anti-money laundering monitoring method, the system comprising:

[0115] Data collection module: used to establish data interfaces with financial institutions, payment platforms, industrial and commercial tax departments, and customs, collect multi-source heterogeneous data, and perform preliminary cleaning.

[0116] Data processing module: includes data fusion unit and feature extraction unit. The data fusion unit adopts autoencoder algorithm to fuse multi-source heterogeneous data; the feature extraction unit uses PCA algorithm to extract principal components and form a feature vector set.

[0117] Risk Assessment Module: Used to build a dynamic risk assessment model based on LSTM and attention mechanism, perform risk assessment on transaction data, and calculate risk scores.

[0118] Abnormal identification module: used to set dynamic risk thresholds, identify abnormal transactions based on risk scores, and classify warning levels to trigger warning mechanisms.

[0119] Association analysis module: Uses graph neural network algorithms to conduct collaborative analysis and association mining of abnormal transactions to discover potential money laundering networks.

[0120] Model update module: Incorporate new money laundering patterns and characteristics into training data based on actual conditions, retrain the dynamic risk assessment model, and optimize the anti-money laundering monitoring system.

[0121] The specific implementation process of the anti-money laundering monitoring system and method of the present invention is as follows:

[0122] 1. Multi-source heterogeneous data collection

[0123] A commercial bank established data interfaces with partner financial institutions, third-party payment platforms, local industrial and commercial tax authorities, and customs authorities. Within a month, the bank collected 1 million pieces of basic customer information, including identity information such as ID numbers and passport numbers, contact information including phone numbers and email addresses, and occupations such as corporate executives and freelancers. The data also included 5 million transaction records, with transaction times accurate to the second and amounts ranging from a few yuan to over 100 million yuan. The data also included counterparty names and account numbers, with transaction frequency ranging from several times a day to once every few months. The bank also collected 50,000 pieces of business data, including balance sheets and income statements from financial statements. Business scope spanned manufacturing and services, with scale measured by employee numbers and operating revenue. The data also collected 20,000 pieces of customs import and export data, covering goods such as electronics and textiles, with a wide range of trade values ​​and trading countries worldwide. After collection, a data cleaning process removed 300,000 duplicate and 200,000 invalid data items, resulting in valid data.

[0124] 2. Data Fusion and Feature Extraction

[0125] A multi-layer nonlinear autoencoder network is constructed. The encoder maps the collected multi-source data into a low-dimensional latent space, and the decoder performs the reconstruction. An attention mechanism is introduced. During a particular transaction data fusion, the weights of different data sources are dynamically adjusted based on their importance to the risk assessment of the transaction, increasing the weight of key information such as transaction amount and counterparty. The fused feature matrix is ​​subjected to centering, covariance matrix calculation, and eigenvalue decomposition. By setting the cumulative explained variance ratio threshold to 0.9, the top 20 principal components are retained to form the feature vector set. The importance score of each original feature is calculated, and key features such as transaction amount and transaction time interval are screened out.

[0126] 3. Construction of dynamic risk assessment model

[0127] The processed feature vector set is sorted by transaction timestamp, and a fixed-length transaction sequence of 100 is constructed. Sequences shorter than this length are zero-padded, and sequences exceeding this length are truncated using a sliding time window. A bidirectional LSTM network is constructed, taking the transaction sequence features as input. After processing through the bidirectional LSTM layer, temporal and feature attention mechanisms are applied to the output feature sequence to highlight key time points and key feature dimensions. The final feature representation is mapped to a risk score using a fully connected layer. The model is trained using 100,000 historically annotated transaction data. A loss function is defined, and the Adam optimizer is used to update parameters. Dropout and L2 regularization are applied to prevent overfitting. Loss is monitored on the validation set. After training, a risk assessment function is constructed, and risk scores are categorized into low, medium, and high risk levels.

[0128] IV. Abnormal Transaction Identification and Early Warning

[0129] The 0.95th percentile of historical transaction risk scores from the past year is used as the baseline threshold, which is 0.5. External indicators such as regulatory announcements and industry risk reports are introduced as adjustment factors. After keyword extraction and quantification through NLP, the adjustment factor is 0.1, and the dynamic risk threshold is 0.5×(1+0.1)=0.55. The baseline threshold is recalculated daily based on the latest historical data. For a single transaction, if the risk score r ≥ 0.55, it is considered abnormal. For multiple transactions by the same client within a one-hour time window, the cumulative risk score and abnormal transaction frequency are calculated. If the cumulative risk score ≥ 10 or the abnormal frequency ≥ 0.3, it is considered an abnormal transaction sequence. At the same time, the warning level is divided into yellow warnings when 0.7 ≤ r < 0.9 and red warnings when r ≥ 0.9. Warning information, including basic transaction information, risk score, and risk characteristics, is sent to regulators and risk control departments.

[0130] 5. Collaborative Analysis and Association Mining

[0131] For unusual transactions that trigger alerts, we use a graph neural network algorithm to construct a transaction relationship graph based on the transaction subject, counterparty, transaction time, and transaction amount. For example, in one unusual transaction, analysis of the transaction relationship graph revealed frequent small-value transactions between the transaction subject and multiple high-risk accounts. Combined with the company's equity structure and personnel relationships, we further verified the possibility of money laundering in this transaction and uncovered a hidden money laundering network.

[0132] 6. Monitoring Model Optimization and Update

[0133] Based on the investigation results of the regulatory authorities and actual money laundering cases, the newly discovered virtual currency money laundering patterns and characteristics were incorporated into the training data, the dynamic risk assessment model was retrained, and the risk assessment function and risk threshold were adjusted, so that the model's recognition accuracy for new money laundering behaviors was increased from 85% to 90%.

[0134] VII. Specific Implementation of the Anti-Money Laundering Monitoring System

[0135] Data collection module: Deployed on the bank's data center server, it establishes a connection with partners through the API interface, collects data regularly, performs preliminary cleaning, and stores it in the database.

[0136] Data processing module: runs on a server cluster. The data fusion unit and feature extraction unit are implemented through Python programs, calling deep learning frameworks such as TensorFlow to complete the autoencoder and PCA algorithm operations.

[0137] Risk assessment module: Based on the trained model, the prediction service is deployed on the server, which receives real-time transaction data and calculates the risk score.

[0138] Anomaly identification module: runs on the monitoring server, monitors risk scores in real time, triggers early warning mechanisms and divides warning levels.

[0139] Correlation analysis module: Use high-performance servers to run graph neural network algorithms to analyze and mine abnormal transactions.

[0140] Model update module: Based on actual conditions, technical personnel will import new data into the training environment, retrain the model, and update the system.

[0141] The present invention and its embodiments are described above. This description is not restrictive. The drawings show only one embodiment of the present invention, and the actual structure is not limited thereto. In short, if a person skilled in the art is inspired by this and, without departing from the purpose of the present invention, designs structures and embodiments similar to this technical solution without inventiveness, they shall fall within the scope of protection of the present invention.

Claims

1. An anti-money laundering monitoring method, characterized by: The following steps are involved: S1. Multi-source heterogeneous data collection: Establish data interfaces with financial institutions, payment platforms, industrial and commercial taxation departments, and customs to collect basic customer information, transaction data, business operation data, and customs import and export data. Perform preliminary cleaning of the collected data to remove duplicate and invalid data. S2. Data fusion and feature extraction: Using the autoencoder algorithm, the collected multi-source heterogeneous data is fused and processed; The autoencoder learns the intrinsic feature representation of the data by encoding and decoding different types of data, and maps the fused data into a unified feature space; In the feature space, the PCA algorithm is used to extract the principal components that can effectively characterize the data characteristics, reduce the data dimension, and retain the key information of the data to form a feature vector set for subsequent analysis; S3. Dynamic risk assessment model construction: Construct a dynamic risk assessment model based on LSTM and attention mechanism; The extracted feature vectors are used as model inputs. The LSTM network learns the time series characteristics of the data and captures the temporal changes in trading behavior. The attention mechanism dynamically adjusts the model's attention weight for each feature based on its importance to risk assessment. The dynamic risk assessment model learns the pattern characteristics of normal transactions and money laundering transactions through training on historical data, establishes a risk assessment function, and calculates the risk score of each transaction in real time; S4. Abnormal transaction identification and early warning: Set dynamic risk thresholds and adjust them in real time through adaptive algorithms based on the distribution of historical transaction data, market environment changes, and regulatory requirements; When the risk score of a transaction exceeds the set risk threshold, the system determines that the transaction is abnormal and triggers the early warning mechanism; Send warning information to relevant regulators and risk control departments of financial institutions via SMS, email or system messages; S5. Collaborative Analysis and Association Mining: For abnormal transactions that trigger early warnings, we use a graph neural network algorithm to construct a transaction relationship graph based on the transaction subject, counterparty, transaction time, and transaction amount. By analyzing transaction relationship graphs, we can uncover potential relationships between transaction entities and discover hidden money laundering networks. We can also combine this with other information from multi-source data to conduct collaborative analysis and further verify the money laundering suspicion of abnormal transactions. S6. Monitoring model optimization and update: Based on the investigation results of the regulatory authorities and actual money laundering cases, newly discovered money laundering patterns and characteristics are incorporated into the training data, the dynamic risk assessment model is retrained, the risk assessment function and risk threshold are adjusted, and the monitoring model's ability to identify new types of money laundering behavior is continuously improved.

2. The anti-money laundering monitoring method according to claim 1, characterized in that: The basic customer information includes identity information, contact information, and occupation information; the transaction data includes transaction time, transaction amount, counterparty information, and transaction frequency; the business operation data includes corporate financial statements, business scope, and business scale; the customs import and export data includes cargo information, trade amount, and trading country.

3. The anti-money laundering monitoring method according to claim 2, characterized in that: In step S2, the specific method for fusing the collected multi-source heterogeneous data is as follows: Construct a multi-layer nonlinear autoencoder network, which consists of two parts: encoder and decoder: The encoder maps the input features to a low-dimensional latent space: h = f(W enc x+b enc ), where W enc is the encoding weight matrix, b enc is the bias vector, f is the ReLU activation function; The decoder reconstructs the latent space representation into the original input: Among them, W dec is the decoding weight matrix, b dec is the bias vector, g is the linear activation function; The fusion of multi-source data is achieved through the intermediate hidden layer representation h of the autoencoder; Introducing the attention mechanism to dynamically adjust the importance weights of different data sources: Among them, the attention score e i Calculated as follows: e i =v T tanh(W s h i +b s ); The feature representation after weighted fusion is: Centralize the fused feature matrix H: Compute the covariance matrix: Perform eigenvalue decomposition on the covariance matrix: C = PΛP T ; Where P is the eigenvector matrix and Λ is the diagonal eigenvalue matrix; Select the eigenvectors corresponding to the first k largest eigenvalues ​​to form the projection matrix P k ; The eigenvector after dimensionality reduction is: Z = H centered P k ; The number of principal components is determined by the proportion of cumulative explained variance: Where θ is the preset threshold, 0.85≤θ≤0.95; Calculate the importance score of each original feature based on the PCA loading matrix: Among them, P ij is the projection matrix P k The elements of λ i is the corresponding eigenvalue; Feature screening is performed based on feature importance scores to retain key features.

4. The anti-money laundering monitoring method according to claim 3, characterized in that: In step S3, a dynamic risk assessment model based on LSTM and attention mechanism is constructed. The specific method for calculating the risk score of each transaction is as follows: Sort the feature vector set obtained in step S2 by transaction timestamp to construct a fixed-length transaction sequence. Zero-fill sequences that are insufficient in length, and intercept sequences that exceed the fixed length by sliding the time window. Construct a bidirectional LSTM network structure. The input layer receives the preprocessed feature sequence. The bidirectional LSTM layer uses the formula: h t =BiLSTM(x t ,h t-1 ) outputs a hidden state sequence, where x t is the input feature at time t, h t-1 is the hidden state of the previous moment, and the output layer is z t =W·h t +b generates intermediate feature representation, W is the weight matrix, and b is the bias vector; Apply the temporal attention mechanism on the feature sequence output by the bidirectional LSTM, through the formula: t =v T tanh(W a ·z t +b a ) Calculate the attention score, where v, W a 、b a is a trainable parameter, through Normalization is performed to obtain the attention weight of each time step, through c = ∑ t α t ·z t Weighted aggregation generates a context vector; Apply the feature attention mechanism on the context vector c, through formula s j =u T tanh(W f c j +b f ) Calculate the feature importance score, where u, W f 、b f is a trainable parameter, c j is the jth feature dimension of the context vector, through Normalization is performed to obtain the importance weight of each feature dimension, and c′=∑ j β j c j Feature weighting generates the final feature representation; The final feature representation is mapped to the risk score through the fully connected layer, first through h = ReLU (W h c′+b h ) performs intermediate layer transformation, where W h 、b h is a trainable parameter, and then r=sigmoid(W r h+b r ) Output risk score, where W r 、b r is a trainable parameter, r∈[0,1] represents the money laundering risk probability of the transaction; Use historical labeled data for model training and define the loss function: L = -∑ i [y i ·log(r i )+(1-y i )·log(1-r i )]; where y i is the true label, r i To predict risk scores, we use the Adam optimizer to minimize the loss function and update the model parameters. We apply Dropout and L2 regularization to prevent overfitting. We monitor the loss change on the validation set and stop training when there is no improvement after multiple epochs. Based on the trained model, a risk assessment function R(x) is constructed. The input is the transaction feature sequence x, and the output is the risk score r∈[0,1]. The risk level is divided into low risk when r<0.3, medium risk when 0.3≤r<0.7, and high risk when r≥0.

7. For real-time transaction data, the most recent transaction sequence is obtained through a sliding time window and input into the trained model to calculate the risk score, thereby realizing dynamic risk assessment.

5. The anti-money laundering monitoring method according to claim 4, characterized in that: In step S4, the specific method for determining the dynamic risk threshold is as follows: The quantile of historical transaction risk scores is used as the basic threshold: Basic threshold = Quantile (R history ,q),q∈[0.9,0.99]; where R history is the historical risk score set, q is the quantile value; An external indicator is introduced as the adjustment factor δ, and the relationship between the threshold and the external indicator is established through a linear regression model; Dynamic risk threshold: Dynamic risk threshold = basic threshold × (1 + δ); where δ is obtained by extracting keywords and quantifying them through NLP from real-time data collected from regulatory announcements and industry risk reports. The basic threshold is recalculated daily / weekly based on the latest historical data; when a new money laundering case or a sudden change in regulatory policy is detected, the threshold recalculation is immediately triggered and the dynamic risk threshold is updated.

6. The anti-money laundering monitoring method according to claim 5, characterized in that: In step S4, the specific method for determining abnormal transactions is as follows: If the risk score of a single transaction r ≥ the dynamic risk threshold, it is directly judged as abnormal; For multiple transactions of the same customer within the time window T, calculate the cumulative risk score or abnormal transaction frequency: Cumulative risk score: n is the number of transactions within the window; Abnormal frequency: If R sum ≥T sum or f ≥ T freq , determined to be an abnormal transaction sequence, T sum 、T freq is the preset sequence threshold.

7. The anti-money laundering monitoring method according to claim 6, characterized in that: In step S4, the early warning mechanism divides the warning levels into yellow and red warnings. When 0.7≤r<0.9, a yellow warning is issued, and its triggering condition is a single transaction or sequence abnormality. When r≥0.9, a red warning is issued, and its triggering condition is a transaction with significant high-risk characteristics.

8. The anti-money laundering monitoring method according to claim 7, characterized in that: The warning information includes basic transaction information, risk score and risk characteristics.

9. The anti-money laundering monitoring method according to claim 8, characterized in that: The other information includes the company's equity structure and personnel relationships.

10. An anti-money laundering monitoring system, used to implement the anti-money laundering monitoring method according to any one of claims 1 to 9, characterized in that: include: Data collection module: used to establish data interfaces with financial institutions, payment platforms, industrial and commercial taxation departments, and customs, collect multi-source heterogeneous data, and perform preliminary cleaning; Data processing module: including a data fusion unit and a feature extraction unit. The data fusion unit uses an autoencoder algorithm to fuse multi-source heterogeneous data; the feature extraction unit uses a PCA algorithm to extract principal components to form a feature vector set; Risk Assessment Module: This module is used to build a dynamic risk assessment model based on LSTM and attention mechanism, conduct risk assessment on transaction data, and calculate risk scores. Abnormal identification module: used to set dynamic risk thresholds, identify abnormal transactions based on risk scores, classify warning levels, and trigger warning mechanisms; Association analysis module: Uses graph neural network algorithms to conduct collaborative analysis and association mining of abnormal transactions to discover potential money laundering networks; Model update module: Incorporate new money laundering patterns and characteristics into training data based on actual conditions, retrain the dynamic risk assessment model, and optimize the anti-money laundering monitoring system.

Images