Collaborative market manipulation behavior identification method, system, device and medium

Abstract

The invention provides a collaborative market manipulation behavior identification method, system and device and a medium. The method comprises the following steps: acquiring a transaction data set within a preset sampling duration; classifying the transaction data set according to security account identifiers in the transaction data set, and generating an account transaction data set corresponding to each security account; multiple preset types of transaction behavior data are extracted from each account transaction data set, the similarity of the transaction behavior data of the corresponding types among different security accounts is calculated, and the association strength among the different security accounts within the current sampling duration is obtained and stored; according to each association strength in the current sampling duration and the corresponding association strength in the previous sampling duration, determining a relationship evolution rate between the security accounts; and calling the risk scoring model, and identifying a collaborative market manipulation account based on the relationship evolution rate among the security accounts. According to the method, the accuracy and the robustness of the model to control gang identification in a complex market environment are improved.

Description

Technical Field

[0001] The present invention relates to the field of financial analysis technology, and in particular to a method, system, device and medium for identifying collaborative market manipulation behavior. Background Art

[0002] In the securities trading market, coordinated market manipulation is a highly concealed and seriously harmful illegal behavior. It involves multiple seemingly unrelated accounts using methods such as arbitrage, cross-trading, and price manipulation to collaboratively create false market signals in a relatively short period of time, thereby misleading other investors and manipulating securities prices or trading volumes.

[0003] With the recent rise of graph neural networks (GNNs), some technologies have emerged that construct graphs of transactions between accounts to identify coordinated market manipulation. However, most existing technologies rely on sliding time windows, aggregating transaction behavior between accounts into a dynamic graph over a period of time and performing inference using a graph model. However, this dynamic graph can only reflect the relationship between accounts within a specific time period. There is a lack of effective features to capture the rapid formation and disbanding of manipulation groups, which can easily lead to false positives or false negatives in coordinated market manipulation. Therefore, there is a need for a method, system, device, and medium for identifying coordinated market manipulation accounts. Summary of the Invention

[0004] The present invention provides a method, system, device and medium for identifying collaborative market manipulation accounts, so as to improve the technical problem that the existing technology is difficult to effectively identify the behavior of manipulation groups that quickly assemble or disband, resulting in low accuracy in identifying dynamically changing collaborative market manipulation behaviors.

[0005] The present invention provides a method for identifying collaborative market manipulation accounts, which includes: obtaining a transaction data set within a preset sampling time; classifying the transaction data set according to securities account identifiers in the transaction data set to generate account transaction data sets corresponding to each securities account; extracting multiple preset types of transaction behavior data from each account transaction data set, calculating the similarity of corresponding types of transaction behavior data between different securities accounts, and obtaining and saving the correlation strength between different securities accounts within the current sampling time; determining the relationship evolution rate between each securities account based on the respective correlation strengths within the current sampling time and the corresponding correlation strengths within the previous sampling time; calling a risk scoring model to identify collaborative market manipulation accounts based on the relationship evolution rate between each securities account; wherein the risk scoring model includes a cascaded graph convolutional network and a gated recurrent neural network.

[0006] In an embodiment of the present application, the plurality of preset types of transaction behavior data are extracted from each account transaction data set, the similarity of the corresponding types of transaction behavior data between different security accounts is calculated, the correlation strength between different security accounts in the current sampling duration is obtained and saved, including: for each account transaction data set: extracting a plurality of preset types of transaction behavior data from the account transaction data set; combining each security account in the current sampling duration in pairs to generate a set of security account pairs; for each security account pair: calculating the similarity of each type of transaction behavior data respectively, and performing weighted summation on each similarity to obtain and save the correlation strength of the security account pair in the current sampling duration.

[0007] In an embodiment of the present application, the relationship evolution rate is , wherein, is the correlation strength between security account i and security account j in the current sampling duration, is the correlation strength between security account i and security account j in the previous sampling duration, is the sampling interval, is the relationship evolution rate of the security account pair (i, j) in the current sampling duration t.

[0008] In an embodiment of the present application, the risk scoring model is called to identify the coordinated market manipulation accounts based on the relationship evolution rate between each security account, including: taking each security account as an account node, taking the relationship evolution rate between security accounts as the weight of the edge connecting the corresponding account nodes, and constructing a correlation account graph; inputting the correlation account graph into the risk scoring model, processing the correlation account graph, and generating the risk score of each security account; based on the risk score of each security account, identifying the coordinated market manipulation accounts from the correlation account graph.

[0009] In an embodiment of the present application, the correlation account graph is input into the risk scoring model, the correlation account graph is processed, and the risk score of each security account is generated, including: inputting the correlation account graph into the graph convolution network of the risk scoring model, generating and saving the graph structure features of each account node in the current sampling duration based on the connection relationship between each account node and its adjacent account node; for each account node: inputting the graph structure features of the account node in the current sampling duration into the gated recurrent neural network of the risk scoring model, extracting the time sequence risk features of the account node based on the historical graph structure features of the account node, and obtaining the risk score of the corresponding security account accordingly.

[0010] In an embodiment of the present application, the identifying the coordinated market manipulation accounts based on the risk scores of the security accounts comprises: identifying a target account subgraph from the association account graph according to a graph community discovery algorithm; determining a structure density of the target account subgraph according to a ratio of an actual number of edges in the target account subgraph to a maximum theoretical number of edges; calculating an average risk score of the target account subgraph according to the risk scores of the account nodes in the target account subgraph; determining whether the structure density is greater than a preset density threshold and whether the average risk score is greater than a preset risk threshold; and if so, regarding each security account corresponding to the target account subgraph as a coordinated market manipulation account; otherwise, determining that there is no coordinated market manipulation account.

[0011] In an embodiment of the present application, the risk score model is obtained through online dynamic training according to a plurality of preset training intervals.

[0012] The present application further provides a system for identifying coordinated market manipulation accounts, comprising: a data acquisition module configured to acquire a transaction data set within a preset sampling duration; a classification module configured to classify the transaction data set according to security account identifiers in the transaction data set, and generate account transaction data sets corresponding to each security account; an association strength determination module configured to extract a plurality of preset types of transaction behavior data from each account transaction data set, and calculate and save association strengths between different security accounts within the current sampling duration; a relationship evolution rate determination module configured to determine relationship evolution rates between the security accounts according to each association strength within the current sampling duration and the corresponding association strength within a previous sampling duration; and an account identification module configured to call a risk score model to identify coordinated market manipulation accounts based on the relationship evolution rates between the security accounts, wherein the risk score model is a graph convolution network with cascading and a gated recurrent neural network.

[0013] The present application further provides an electronic device, comprising: one or more processors; and a storage device configured to store one or more programs, which, when executed by the one or more processors, cause the electronic device to implement any of the above-mentioned methods for identifying coordinated market manipulation accounts.

[0014] The present application further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor of a computer, causes the computer to perform any of the above-mentioned methods for identifying coordinated market manipulation accounts.

[0015] Beneficial effects of the present invention: The present invention proposes a method, system, device and medium for identifying collaborative market manipulation accounts, which classifies and processes the transaction data set obtained within a preset sampling period according to the securities account identifier, and extracts multiple types of transaction behavior data from the data of each account, and determines the correlation strength between securities accounts based on the similarity of corresponding types of transaction behavior data between accounts, thereby realizing the quantification of collaborative behavior between accounts. Furthermore, by calculating the rate of change of the correlation strength between the current sampling period and the previous sampling period, the dynamic evolution process of collaborative behavior between accounts can be quantified, which can improve the ability to capture the dynamic risk behavior of the manipulation group in a short period of time, and improve the problem that the existing static graph model has low accuracy in identifying dynamically changing collaborative market manipulation behaviors. In addition, through the graph convolutional network and the gated recurrent neural network, the accuracy and robustness of the model in identifying manipulation groups in complex market environments are further improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The accompanying drawings are incorporated into and constitute a part of the specification, illustrate embodiments consistent with the present application, and together with the specification, are used to explain the principles of the present application. Obviously, the drawings described below are only some embodiments of the present application. For those of ordinary skill in the art, other drawings can be derived from these drawings without inventive effort.

[0017] In the attached figure: Figure 1 A flowchart of a method for identifying collaborative market manipulation accounts provided by one embodiment of the present invention; Figure 2 This is a structural block diagram of a system for identifying collaborative market manipulation accounts provided in one embodiment of the present invention; Figure 3 A schematic structural diagram of an electronic device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0018] The following describes the embodiments of the present invention through specific examples. Those skilled in the art will readily understand the other advantages and benefits of the present invention from the disclosure herein. The present invention may also be implemented or applied through various other specific embodiments. The details in this specification may be modified or altered based on different viewpoints and applications without departing from the spirit of the present invention. The following embodiments and features therein may be combined with one another without conflict.

[0019] It should be noted that the illustrations provided in the following embodiments are merely schematic illustrations of the basic concept of the present invention. The drawings only show components related to the present invention and are not drawn according to the number, shape, and size of components in actual implementation. In actual implementation, the type, quantity, and proportion of each component may be changed arbitrarily, and the component layout may also be more complex.

[0020] In the following description, numerous details are discussed to provide a more thorough explanation of the embodiments of the present invention. However, it will be apparent to those skilled in the art that the embodiments of the present invention may be practiced without these specific details. In other embodiments, well-known structures and devices are shown in block diagram form rather than in detail to avoid obscuring the embodiments of the present invention.

[0021] The applicant discovered that while existing technologies utilize graph structures to identify coordinated market manipulation, they still suffer from the following drawbacks: First, they lack a measure of the "evolutionary process" of relationships between accounts. Most methods simply aggregate account behavior over a time window, constructing a quasi-dynamic graph of the current time window. While this quasi-dynamic graph can reflect the state of relationships between accounts at a given moment, it cannot effectively quantify the rate of change in these relationships, resulting in an inability to capture key behavioral characteristics such as the rapid assembly or disbanding of manipulation groups in a short period of time. Second, existing graph neural network models mostly employ offline training or simple online incremental parameter updates. This makes it difficult to strike a balance between rapid adaptability to new forms of coordination (i.e., model sensitivity) and resistance to market noise (i.e., model stability) in the high-frequency volatility of real markets. Furthermore, existing technologies often rely on a single node risk score threshold for early warning, lacking a comprehensive consideration of the group's "structural tightness." This can easily lead to numerous false positives or false negatives due to fluctuations in individual node scores, reducing the accuracy and stability of early warnings. In view of the above problems, it is necessary to provide a method that can provide deep insights into the evolution process of collaborative relationships and take into account both model sensitivity and stability, so as to efficiently and accurately identify possible collaborative market manipulation accounts.

[0022] In order to improve the above-mentioned problems, the present invention provides a method for identifying collaborative market manipulation accounts, aiming to solve the problem that the existing technology is insufficient in identifying dynamically evolving manipulation groups. The present invention proposes a relationship evolution rate for quantifying the speed of formation and dissipation of collaborative behavioral relationships between securities accounts, and based on this, constructs a dynamically updated associated account graph. The risk scoring model composed of a cascade of a graph convolutional network and a gated recurrent neural network can not only mine the association relationship of accounts in the graph structure, but also capture the temporal characteristics of their behavioral evolution, thereby making subsequent identification results more accurate. Among them, the model adopts a multi-frequency coupling online learning strategy based on a gradient accumulation mechanism, and dynamically updates at different frequencies to take into account the sensitivity and stability of risk detection, thereby improving the recognition accuracy of the model in a complex market environment. In addition, the present invention also combines the dual thresholds of node risk score and account subgraph density structure as the basis for judgment, thereby improving the recognition accuracy of manipulation groups.

[0023] like Figure 1 As shown, the method for identifying coordinated market manipulation accounts includes the following steps: S11. Obtain a transaction data set within a preset sampling time period.

[0024] Obtain a transaction dataset with a preset sampling duration (e.g., 5 minutes) from a securities trading platform. This transaction dataset includes transaction behaviors generated by multiple securities accounts within the current sampling duration. Transaction behaviors include, but are not limited to, buy and sell instructions, transaction records, pending orders, and order cancellation information.

[0025] Preferably, considering processing speed and real-time requirements, transaction data can be written to a message queue (such as Apache Kafka) in real time as a data stream. Multiple Graphics Processing Unit (GPU) nodes act as consumers, continuously consuming the data stream stored in the message queue through asynchronous monitoring. Within each sampling period, the received transaction data is batch-aggregated to form a transaction dataset corresponding to the current sampling period. For example, a real-time transaction data stream (e.g., approximately 50,000 transactions per second (TPS)) is written to an Apache Kafka cluster. GPUs consume data from the message queue, extracting transaction data within a preset sampling period to form a transaction dataset. By utilizing a message queue and multiple GPUs consuming data in parallel, the real-time transmission requirements of massive, high-frequency data are guaranteed and data responsiveness is improved. By writing the transaction data stream to the message queue and asynchronously updating the graph on the GPU compute nodes, this present invention achieves real-time and accurate identification of covert coordinated manipulation.

[0026] To improve data processing speed, the hardware configuration for this application can be one or more servers equipped with 96 vCPUs, 512GB of memory, and four NVIDIA A100 80GB GPUs. The operating system is Linux, and the deployment is containerized using Docker.

[0027] S12. Classify the transaction data set according to the securities account identifiers in the transaction data set to generate account transaction data sets corresponding to each securities account.

[0028] Because the transaction dataset includes transaction data from a large number of different securities accounts, each transaction data item carries a related securities account identifier. To facilitate subsequent analysis of individual account characteristics, all currently acquired transaction data must be categorized by securities account identifier. All transaction data for the same securities account identifier within the current sampling period is aggregated into the account transaction dataset for that securities account.

[0029] S13. Extract multiple preset types of transaction behavior data from each account transaction data set, calculate the similarity of corresponding types of transaction behavior data between different securities accounts, and obtain and save the correlation strength between different securities accounts within the current sampling period; wherein the correlation strength is used to characterize the intensity of collaborative behavior between the corresponding two securities accounts.

[0030] For each account transaction dataset obtained above, multiple preset types of transaction behavior data are extracted from the dataset. It is understood that the preset types of transaction behavior data can be directly extracted from the dataset or calculated using transaction data in the dataset according to preset calculation rules, without specific limitations. Securities accounts within the current sampling period are paired to form a set of account pairs. For each account pair, similarity scores are calculated for each transaction behavior dimension and weighted to combine these similarity scores to obtain the correlation strength for the account pair within the current sampling period. Correlation strength is a composite metric constructed based on behavioral similarity characteristics, used to characterize the degree of coordinated behavior between two corresponding securities accounts within the current sampling period. For example, correlation strength can represent the degree of similarity or hedging between accounts A and B in terms of trading behavior, direction, timing, and other aspects within the current sampling period.

[0031] In an optional embodiment of the present invention, step S13 includes the following process: for each account transaction data set: extracting multiple preset types of transaction behavior data from the account transaction data set; combining each securities account within the current sampling period in pairs to generate a set of securities account pairs; for each securities account pair: calculating the similarity of each type of transaction behavior data separately, and performing weighted summation on each similarity to obtain and save the correlation strength of the securities account pair within the current sampling period.

[0032] The following processing is performed on each account transaction data set: multiple preset types of transaction behavior data are extracted from the account transaction data set, such as 25 types of transaction behavior data such as transaction time series, transaction direction series, pending order price trajectory, order cancellation behavior, and transaction target series. After the extraction is completed, all securities accounts are combined in pairs within the current sampling period to form multiple securities account pairs. The following processing process is performed on each securities account pair: the similarity of the corresponding category data is calculated under each type of transaction behavior dimension, that is, the data of the transaction time dimension is only compared with the transaction time data, the pending order price trajectory is only compared with the pending order price trajectory, and so on. Each transaction behavior dimension corresponds to a type of transaction behavior data. After calculating the similarity of all preset types of transaction behavior data, the similarity of each transaction behavior dimension is weighted and summed according to formula (1). By matching and analyzing the multi-dimensional transaction behavior data, the correlation strength of the securities account pair at the current sampling period is obtained, which is used to characterize the comprehensive behavioral coupling degree of the securities account pair at the current sampling period: (1) in, is the correlation strength between securities account A and securities account B within the current sampling time t, is the weighted coefficient of the k-th type of transaction behavior dimension, and satisfies =1, is the similarity between securities account A and securities account B regarding the k-th type of transaction behavior in the current sampling time, The total number of transaction behavior data types. It is understood that the weighting coefficient can be obtained through statistical experience or automatically learned and adjusted using a model, and the specific method is not limited.

[0033] It should be noted that different types of transaction behavior data require different similarity calculation methods due to their varying distribution characteristics. This application considers each transaction behavior type as a separate similarity calculation dimension. For example, for the "Transaction Direction Consistency" dimension, the similarity between account A and account B's operations on the same transaction target can be determined: if they simultaneously buy or sell at similar times, the value is assigned to 1, indicating a strong positive correlation; if they do so in opposite directions, the value is assigned to -1, indicating a strong negative correlation; and if there are no corresponding transactions, the value is assigned to 0. For the "Transaction Time Synchronicity" dimension, a Gaussian kernel function can be used to nonlinearly map the transaction time differences between the two accounts to reflect the proximity of their orders. For the "Common Transaction Target Overlap" dimension, Jaccard similarity can be used to calculate the ratio of the intersection to the union of the sets of transaction targets involved in the two accounts during the current sampling period. For the "Order Price Series Similarity," a dynamic time warping algorithm can be used to dynamically align order price series to capture the similarity of price paths between accounts. For the "order cancellation behavior correlation" dimension, the Pearson correlation coefficient can be used to measure whether the change trends in the order cancellation rates of two accounts over time are positively or negatively correlated. Furthermore, this application can also expand similarity metrics to include more dimensions, such as the overlap of common holdings, the consistency of transfer / fund flow paths, and the co-occurrence frequency of account behavior patterns, to comprehensively characterize the potential collaborative behavior relationships between securities accounts.

[0034] It is understandable that those skilled in the art can adaptively set a suitable metric method to perform similarity calculation based on the type of transaction behavior data required, which will not be described in detail here.

[0035] S14. Determine the relationship evolution rate between each securities account based on the respective correlation strengths within the current sampling period and the corresponding correlation strengths within the previous sampling period.

[0036] For each securities account pair (A, B), the following process is performed: Obtain the correlation strength of the current sampling time according to the above method After that, the correlation strength of the same securities account pair within the previous sampling period will be extracted. , it is understandable that if the correlation strength of the securities account pair does not exist in the previous sampling period , then Initialize to the preset initial value of the association strength (such as 0). According to the association strength in the adjacent sampling time, calculate the relationship evolution rate of the securities account in the current sampling time by formula (2): (2) in, is the correlation strength between securities account A and securities account B during the current sampling period, is the correlation strength of security account A and security account B in the previous sampling duration, is a preset sampling interval, that is, the time interval between the current sampling duration and the previous sampling duration, is the relationship evolution rate of the security account pair (A, B) in the current sampling duration t. The generated relationship evolution rate can be used to quantify the change rate of the cooperative relationship between the corresponding two security accounts, that is, the degree of the "warming up" or "cooling down" trend. Therefore, the relationship evolution rate can reflect the dynamic evolution state of the relationship between the security accounts, and is especially suitable for capturing the key behavior characteristics of the manipulation gang in the short time of rapid gathering or rapid disbanding, thereby providing data support for subsequent abnormal account identification. By introducing the relationship evolution rate feature, the application can sensitively discover the dramatic change of the correlation strength when the gang rapidly gathers or disbands, thereby issuing an early warning in the budding or ending period of the manipulation behavior, and realizing accurate capture of the "pre-planning period" and "disbanding period" of the manipulation.

[0037] S15, calling a risk scoring model to identify the cooperative market manipulation accounts based on the relationship evolution rates between the security accounts; wherein the risk scoring model is a graph convolution network and a gated recurrent neural network in cascade.

[0038] The application adopts the network constructed by cascading the graph convolution network and the gated recurrent neural network as the risk scoring model. On the one hand, through the graph convolution network, the multi-dimensional interaction features between each security account and its adjacent security accounts in the current sampling duration can be extracted, so that the cooperative behavior of the security account in the transaction network can be obtained. On the other hand, through the gated recurrent neural network, the evolution trend of the graph structure features of the security account in different sampling periods can be further captured, and the risk level of the account can be evaluated.

[0039] In an optional embodiment of the application, the step S15 comprises steps S151 to S153: S151, constructing a correlation account graph by taking each security account as an account node and taking the relationship evolution rate between the security accounts as the weight of the edge connecting the corresponding account nodes.

[0040] The application can dynamically update the correlation account graph to depict the cooperative transaction behavior between the security accounts. In the correlation account graph, each security account is taken as an account node, and the node features of the account node are generated by jointly encoding the multi-dimensional transaction behavior data of the security account in the current sampling duration, wherein the transaction behavior includes but is not limited to the transaction frequency (the number of orders), the average order size, the order cancellation rate, the fund flow average and volatility, the transaction subject diversity, the price and direction sequence of the orders in the same period, the centrality index of the account (such as the degree centrality, the betweenness centrality, the clustering coefficient, etc.), and the like. The node can depict the individual behavior characteristics and risk performance of the account.

[0041] An edge is established between two account nodes with a relationship evolution rate, and the weight of the edge is set to the relationship evolution rate between the two accounts to reflect the changing trend of the intensity of collaborative behavior between the corresponding accounts. Furthermore, the edge also has attributes, which are obtained by jointly encoding the trading behavior between the corresponding securities account pairs. These attributes include but are not limited to the relationship evolution rate, the similarity score between accounts, the similarity of various types of trading behavior, and temporal relationship characteristics. Among them, temporal relationship characteristics include but are not limited to the trading time difference between securities account pairs, the consistency of trading direction, the dynamic time warping sequence matching score of the pending order price series, and the overlap of transaction targets. The associated account graph constructed in this way can more accurately reflect the behavioral similarity and interaction intensity between different securities accounts.

[0042] It can be understood that in the associated account graph of the present invention, the attributes of nodes and edges are dynamically updated, and can be dynamically updated after each sampling period to construct a highly timely and high-resolution account association graph, thereby achieving refined monitoring of user behavior.

[0043] S152: Input the associated account graph into the risk scoring model, process the associated account graph, and generate a risk score for each securities account.

[0044] The associated account graph is input into the risk scoring model. A graph convolutional network is used to extract and encode the relationships between each account node and its adjacent nodes in the graph, obtaining the graph structural features of each account node within the current sampling period. A gated recurrent neural network is used to capture the changes in the graph structural features of each securities account during the current sampling period and multiple historical sampling periods, thereby obtaining a risk score for each securities account. The risk score is used to characterize the risk level of a securities account's involvement in potential manipulative behavior. A higher risk score indicates a greater likelihood of the securities account engaging in coordinated market manipulation.

[0045] In an optional embodiment of the present invention, step S152 includes the following process: inputting the associated account graph into the graph convolutional network of the risk scoring model, and generating and saving the graph structure features of each account node within the current sampling period based on the connection relationship between each account node and its adjacent account nodes; for each account node: inputting the graph structure features of the account node within the current sampling period into the gated recurrent neural network of the risk scoring model, extracting the temporal risk features of the account node based on the historical graph structure features of the account node, and obtaining the risk score of the corresponding securities account accordingly.

[0046] The graph convolution network of the association account graph is input into a risk scoring model, and for each account node: the node features of the account node and the node features of its adjacent account nodes are weighted and fused according to the weights of the corresponding edges to obtain the graph structure features of the account node in the current sampling duration and are saved. The graph structure features of the account node in the current sampling duration and the graph structure features of the account node in a plurality of historical sampling durations are spliced into a graph structure feature sequence, which is input into a gated recurrent neural network of the risk scoring model, and the time sequence risk features of the account node are obtained by using a gating mechanism. The time sequence risk features are used to represent the evolution trend of the association relationship between the current securities account and other securities accounts in different time periods. The time sequence risk features of the account node are input into a subsequent output layer (such as a fully connected layer) of the risk scoring model to generate a risk score of the corresponding securities account, wherein the risk score is used to evaluate the risk degree of the securities account participating in the coordinated manipulation behavior.

[0047] S153, based on the risk score of each securities account, identifying a coordinated market manipulation account from the association account graph.

[0048] The topology of the association account graph is used to perform clustering processing on each account node in the graph by using a graph community discovery algorithm, so as to identify a plurality of account sub-graphs with highly coupled trading behaviors, wherein the graph community discovery algorithm includes but is not limited to Louvain, Label Propagation, etc. For each account sub-graph: the average risk score of all account nodes inside the account sub-graph is calculated, and the structural density of the account sub-graph is calculated, and according to a preset evaluation mechanism, it is determined whether each securities account contained in the account sub-graph is a coordinated market manipulation account.

[0049] Specifically, in an optional embodiment of the present application, step S153 includes the following processes: identifying a target account sub-graph from the association account graph according to the graph community discovery algorithm; determining the structural density of the target account sub-graph according to the ratio of the actual number of edges in the target account sub-graph to the maximum theoretical number of edges; calculating the average risk score of the target account sub-graph according to the risk scores of each account node in the target account sub-graph; determining whether the structural density is greater than a preset density threshold and whether the average risk score is greater than a preset risk threshold: if yes, each securities account corresponding to the target account sub-graph is a coordinated market manipulation account; otherwise, it is determined that there is no coordinated market manipulation account.

[0050] In order to more efficiently and accurately identify coordinated market manipulation accounts from a complex account network, the entire associated account graph can be divided into several target account subgraphs based on the connection density between each account node through the graph community discovery algorithm. For each target account subgraph, the following processing is performed: the structural density of the target account subgraph is calculated, that is, the ratio of the number of connected edges to the maximum possible number of connected edges between nodes in the target account subgraph, where the maximum possible number of connected edges is , n is the number of nodes in the target account subgraph. Structural density reflects the closeness of connections between securities accounts. A higher structural density indicates a stronger degree of coordinated behavior among securities accounts. Furthermore, the average risk score of the target account subgraph is calculated—the average risk score of all account nodes in the target account subgraph. This average risk score effectively measures the degree of behavioral anomaly within the corresponding account group. If the structural density of the target account subgraph exceeds a preset structural density threshold (e.g., 0.7) and the average risk score exceeds a preset risk threshold (e.g., 0.85), it can be determined that the account group within the target account subgraph exhibits close coordinated trading behavior and highly similar behaviors, suggesting suspicion of coordinated manipulation. Therefore, all securities accounts within the subgraph are identified as coordinated market manipulation accounts and are designated as early warning targets for subsequent regulatory action. This dual-threshold decision-making mechanism requires that a group not only have "evil intentions" (i.e., a high average node risk score) but also be "strictly disciplined" (i.e., a high structural density). This effectively filters out a large number of accidental high-risk clusters caused by market noise, making early warning results more reliable.

[0051] It should be noted that the above-mentioned structural density threshold and risk threshold can be pre-set fixed values, and can also be obtained by performing statistical analysis on real historical data according to a predetermined period, and adaptively setting them dynamically according to their 95% quantiles, so as to improve the accuracy of the model in detecting abnormal group behavior in a complex and changing securities market environment, making the model more suitable for identifying abnormal behavior in the actual securities market environment.

[0052] In an optional embodiment of the present invention, the risk scoring model is obtained through online dynamic training according to multiple preset training intervals. This invention utilizes a multi-frequency coupled online learning strategy, enabling the model to rapidly keep pace with market trends through high-frequency updates while also preventing model drift and overfitting through mid- and low-frequency calibration and enhancements. This approach maintains excellent overall performance in highly adversarial environments, systematically resolving the model's adaptability-stability dilemma.

[0053] Specifically, a preset first sampling duration (e.g., 5 minutes) is used as a high-frequency sampling cycle. During each high-frequency sampling cycle, the currently constructed associated account graph is input into the risk scoring model. Forward reasoning is performed using the model parameter weights obtained during the previous high-frequency sampling cycle to generate risk scores for each securities account node. The risk scores of accounts generated by the model during the most recent high-frequency sampling cycles are used as labels. By minimizing the difference between the current risk score and the true label and optimizing the model parameters via gradient descent at a preset first learning rate (e.g., 1e-4), an incremental online update is completed. This high-frequency fine-tuning mechanism enables the risk scoring model to adapt to short-term fluctuations in market behavior, thereby enhancing its ability to capture abnormal account behavior.

[0054] Furthermore, the present invention uses a preset second sampling period (e.g., every 6 hours) as a medium-frequency sampling cycle. Through an active learning mechanism, it selects account nodes that fall within a preset scoring range (e.g., 0.4-0.6) from the risk scoring results generated by the current medium-frequency sampling cycle model and uses them as fuzzy boundary samples. The adjacent subgraphs of these fuzzy boundary samples are identified from the corresponding associated account graph and submitted to regulators for manual review in a visual manner. These accounts are also manually labeled to determine whether they are collaborative market manipulation accounts, thereby obtaining a batch of "high-value samples" with clear labels. These manually labeled samples are included in the training set, and the risk scoring model is calibrated and trained with a preset second learning rate (e.g., 1e-3), thereby enhancing the model's ability to identify risk boundary samples and improving its ability to discriminate fuzzy boundary samples.

[0055] Furthermore, the present invention uses a preset third sampling period (e.g., every 48 hours) as a low-frequency sampling cycle to initiate a low-frequency enhanced training process based on a generative adversarial network. Structural features (such as node degree distribution, edge density, and risk spectrum characteristics) are extracted from historically identified typical collaborative manipulation graphs. These features are encoded and input into a graph generator along with Gaussian noise to produce forged graphs with similar structural properties but diverse behavioral patterns. A discriminator determines the differences between the generated graphs and the real manipulation graphs, and reversely optimizes the graph generator to improve the credibility of the generated samples. The high-quality simulated graphs obtained from the screening serve as additional training samples to supplement the risk scoring model, improving its coverage of abnormal manipulation behaviors such as "atypical gangs" or "strategy-shifting behaviors."

[0056] Table 1 shows that the method of the present invention and the baseline model (i.e., semi-supervised graph neural network) were tested on the same annotated dataset. It can be seen that the method of the present invention outperforms the traditional baseline model in both AUC and recall rate, indicating that the present invention has higher recognition accuracy in the collaborative manipulation behavior recognition task and is particularly suitable for financial regulatory scenarios that require high-reliability early warnings. Table 1 Comparison of experimental results of the present invention and the baseline model

[0057] like Figure 2 As shown, the system 200 for identifying coordinated market manipulation accounts includes a data acquisition module 210, a classification module 220, a correlation strength determination module 230, a relationship evolution rate determination module, and an account identification module 250. The data acquisition module 210 is used to acquire a transaction dataset within a preset sampling period. The classification module 220 is used to classify the transaction dataset based on the securities account identifiers in the transaction dataset to generate account transaction datasets corresponding to each securities account. The correlation strength determination module 230 is used to extract multiple preset types of transaction behavior data from each account transaction dataset and, based on this data, calculate and store the correlation strengths between different securities accounts within the current sampling period. The relationship evolution rate determination module 240 is used to determine the relationship evolution rate between each securities account based on the correlation strengths within the current sampling period and the corresponding correlation strengths within the previous sampling period. The account identification module 250 is used to invoke a risk scoring model to identify coordinated market manipulation accounts based on the relationship evolution rates between each securities account. The risk scoring model comprises a cascaded graph convolutional network and a gated recurrent neural network.

[0058] Furthermore, the aforementioned system for identifying coordinated market manipulation accounts also includes a distributed graph storage module and a GPU inference service module. The distributed graph storage module is used to store the dynamically associated account graph, while the GPU inference service module executes the aforementioned method for identifying coordinated market manipulation. To achieve optimal performance, the distributed graph storage module and the GPU inference service module utilize a high-speed interconnection over Converged Ethernet (RDMA) supporting Remote Direct Memory Access (RDMA), significantly reducing latency in large-scale graph data transmission. Furthermore, the distributed graph storage module utilizes the Gremlin API or the Flink-Gelly API for data exchange.

[0059] The specific limitations of the system for identifying collusive market manipulation accounts can refer to the limitations of the method for identifying collusive market manipulation accounts described above, which will not be repeated here. Each module in the system for identifying collusive market manipulation accounts described above can be implemented by software, hardware, and combinations thereof, in whole or in part. The above-mentioned modules can be embedded in or independent of the processor in the computer device in hardware format, or can be stored in the memory of the computer device in software format, so that the processor invokes the corresponding operations of each module.

[0060] It should be noted that, in order to highlight the innovative part of the present application, modules not closely related to solving the technical problems proposed in the present application are not introduced in this embodiment, but this does not mean that there are no other modules in this embodiment.

[0061] As shown in Figure 3 The electronic device 3 can include a memory 31, a processor 32, and a bus, and can further include a computer program stored in the memory 31 and executable on the processor 32, such as a collusive market manipulation account identification program.

[0062] The memory 31 includes at least one type of readable storage medium, including flash memory, mobile hard disk, multimedia card, card-type memory (such as SD or DX memory, etc.), magnetic memory, disk, optical disk, etc. In some embodiments, the memory 31 can be an internal storage unit of the electronic device 3, such as a mobile hard disk of the electronic device 3. In other embodiments, the memory 31 can also be an external storage device of the electronic device 3, such as a plug-in mobile hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. Further, the memory 31 can include both an internal storage unit and an external storage device of the electronic device 3. The memory 31 can be used not only to store application software and various data installed on the electronic device 3, such as collusive market manipulation account identification code, etc., but also to temporarily store data that has been output or will be output.

[0063] In some embodiments, processor 32 may be comprised of an integrated circuit, such as a single packaged integrated circuit or multiple packaged integrated circuits with the same or different functions, including one or more central processing units (CPUs), microprocessors, digital processing chips, graphics processors, and combinations of various control chips. Processor 32 is the control core (control unit) of electronic device 3. It utilizes various interfaces and circuits to connect the various components of electronic device 3. It executes programs or modules stored in memory 31 (such as a program for identifying collaborative market manipulation accounts) and accesses data stored in memory 31 to perform various functions and process data.

[0064] The processor 32 executes the operating system and various installed applications of the electronic device 3. The processor 32 executes the applications to implement the steps in the above-mentioned method for identifying coordinated market manipulation accounts.

[0065] Exemplarily, the computer program may be divided into one or more modules, one or more of which are stored in the memory 31 and executed by the processor 32 to implement the present application. One or more modules may be a series of computer program instruction segments capable of performing specific functions, and the instruction segments are used to describe the execution process of the computer program in the electronic device 3. For example, the computer program may be divided into a data acquisition module 210, a classification module 220, an association strength determination module 230, a relationship evolution rate determination module, and an account identification module 250.

[0066] The aforementioned integrated unit implemented in the form of a software functional module may be stored in a computer-readable storage medium, which may be either non-volatile or volatile. The aforementioned software functional module, stored in a storage medium, includes instructions for causing a computer device (which may be a personal computer, computing device, or network device, etc.) or a processor to execute portions of the methods for identifying collaborative market manipulation accounts according to various embodiments of this application.

[0067] In summary, the present invention introduces the innovative indicator of relationship evolution rate. In the process of constructing the strength of association between accounts, it uses multi-dimensional transaction behavior characteristics to conduct item-by-item similarity comparison, combined with similarity calculation and weighted fusion mechanism, to achieve the first detailed characterization and dynamic monitoring of the intensity of collaborative behavior between securities accounts. It breaks through the bottleneck of traditional graph neural networks in the process of identifying dynamic manipulation groups, which makes it difficult to effectively quantify the "speed of change" of behavioral relationships between accounts. The present invention not only improves the semantic expression ability of the input features of the risk scoring model, but also enables the dynamically constructed associated account graph to be highly sensitive to behaviors such as the "rapid assembly period" and "strategy dissolution period" of the manipulation group, so as to detect abnormal accounts in a timely manner.

[0068] The above embodiments are merely illustrative of the principles and effects of the present invention and are not intended to limit the present invention. Anyone skilled in the art may modify or alter the above embodiments without departing from the spirit and scope of the present invention. Therefore, all equivalent modifications or alterations made by one of ordinary skill in the art without departing from the spirit and technical principles disclosed herein are intended to be covered by the claims of the present invention.

Claims

1. A method for identifying accounts involved in collaborative market manipulation, characterized in that: The method comprises: Obtain transaction data sets within the preset sampling period; classifying the transaction dataset according to the securities account identifiers in the transaction dataset to generate account transaction datasets corresponding to each securities account; Extracting multiple preset types of transaction behavior data from each account's transaction data set, calculating the similarity of corresponding types of transaction behavior data between different securities accounts, and obtaining and saving the correlation strength between different securities accounts within the current sampling period; Determine the relationship evolution rate between each securities account based on the strength of each association within the current sampling period and the corresponding strength of the association within the previous sampling period; A risk scoring model is called to identify collaborative market manipulation accounts based on the evolution rate of the relationship between each securities account; wherein the risk scoring model includes a cascaded graph convolutional network and a gated recurrent neural network.

2. The method for identifying collaborative market manipulation accounts according to claim 1, characterized in that: The method extracts multiple preset types of transaction behavior data from each account transaction data set, calculates the similarity of corresponding types of transaction behavior data between different securities accounts, and obtains and saves the correlation strength between different securities accounts within the current sampling period, including: For each account transaction data set: extract multiple preset types of transaction behavior data from the account transaction data set; Combine each securities account within the current sampling period into pairs to generate a securities account pair set; For each securities account pair: perform similarity calculations on each type of transaction behavior data, perform weighted summation on each similarity, and obtain and save the correlation strength of the securities account pair within the current sampling period.

3. The method for identifying collaborative market manipulation accounts according to claim 1, characterized in that: The relationship evolution rate is ,in, is the correlation strength between securities account i and securities account j during the current sampling period, is the correlation strength between securities account i and securities account j in the previous sampling period, is the sampling interval, is the relationship evolution rate of the securities account pair (i, j) within the current sampling time t.

4. The method for identifying collaborative market manipulation accounts according to claim 1, characterized in that: The risk scoring model is invoked to identify coordinated market manipulation accounts based on the rate of evolution of relationships between securities accounts, including: Each securities account is used as an account node, and the relationship evolution rate between securities accounts is used as the weight of the edge connecting the corresponding account node to construct an associated account graph; Inputting the associated account graph into the risk scoring model, processing the associated account graph, and generating a risk score for each securities account; Based on the risk score of each securities account, coordinated market manipulation accounts are identified from the associated account map.

5. The method for identifying collaborative market manipulation accounts according to claim 4, characterized in that: The step of inputting the associated account graph into the risk scoring model, processing the associated account graph, and generating a risk score for each securities account includes: Input the associated account graph into the graph convolutional network of the risk scoring model, and generate and save the graph structure features of each account node within the current sampling period based on the connection relationship between each account node and its adjacent account nodes; For each account node: the graph structure features of the account node within the current sampling period are input into the gated recurrent neural network of the risk scoring model. Based on the historical graph structure features of the account node, the temporal risk features of the account node are extracted, and the risk score of the corresponding securities account is obtained accordingly.

6. The method for identifying collaborative market manipulation accounts according to claim 4, characterized in that: The step of identifying the coordinated market manipulation accounts from the associated account graph based on the risk scores of the respective securities accounts includes: Identify a target account subgraph from the associated account graph based on a graph community discovery algorithm; Determine the structural density of the target account subgraph based on the ratio of the actual number of edges in the target account subgraph to the maximum theoretical number; Calculate the average risk score of the target account subgraph based on the risk scores of each account node in the target account subgraph; Determine whether the structure density is greater than a preset density threshold, and whether the average risk score is greater than a preset risk threshold: If so, each securities account corresponding to the target account subgraph is used as a collaborative market manipulation account; Otherwise, it is determined that there is no coordinated market manipulation account.

7. The method for identifying collaborative market manipulation accounts according to claim 1, characterized in that: The risk scoring model is obtained through online dynamic training according to preset multiple training intervals.

8. A system for identifying accounts involved in collaborative market manipulation, characterized in that: The system comprises: The data acquisition module is used to obtain the transaction data set within the preset sampling time; a classification module, configured to classify the transaction data set according to the securities account identifiers in the transaction data set, and generate an account transaction data set corresponding to each securities account; The correlation strength determination module is used to extract multiple preset types of transaction behavior data from each account transaction data set, calculate the similarity of corresponding types of transaction behavior data between different securities accounts, and obtain and save the correlation strength between different securities accounts within the current sampling period; A relationship evolution rate determination module is used to determine the relationship evolution rate between each securities account based on the respective association strengths within the current sampling period and the corresponding association strengths within the previous sampling period; An account identification module is used to call a risk scoring model to identify accounts that collaborate in market manipulation based on the rate of evolution of the relationships between securities accounts; wherein the risk scoring model comprises a cascaded graph convolutional network and a gated recurrent neural network.

9. An electronic device, characterized in that: The electronic device comprises: one or more processors; A storage device for storing one or more programs, which, when executed by the one or more processors, enables the electronic device to implement the method for identifying collaborative market manipulation accounts as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that A computer program is stored thereon, which, when executed by a processor of a computer, causes the computer to execute the method for identifying coordinated market manipulation accounts as claimed in any one of claims 1 to 7.

Images