Method, system, device and medium for identifying coordinated market manipulation behavior

Abstract

The application provides a kind of method, system, equipment and medium for identifying coordinated market manipulation behavior.The method comprises: obtaining a transaction data set within a preset sampling duration;According to the security account identification in the transaction data set, the transaction data set is classified to generate the account transaction data set corresponding to each security account;From each account transaction data set, extract a variety of preset type of transaction behavior data, calculate the similarity of the corresponding type of transaction behavior data between different security accounts, obtain and save the correlation strength between different security accounts within the current sampling duration;According to each correlation strength within the current sampling duration and the corresponding correlation strength within the previous sampling duration, determine the relationship evolution rate between each security account;Call risk scoring model, based on the relationship evolution rate between each security account, identify coordinated market manipulation accounts.The application improves the accuracy and robustness of the model in complex market environment for identifying manipulation gangs.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of financial analysis, and in particular to a method, system, device and medium for identifying coordinated market manipulation behavior. BACKGROUND

[0002] In the securities market, coordinated market manipulation is a highly concealed and serious illegal behavior. It is a kind of behavior that multiple seemingly unrelated accounts create false market signals in a short period of time through methods such as counter-trading, counter-kicking, lifting and suppressing, etc., thereby misleading other investors and manipulating securities prices or trading volumes.

[0003] In recent years, with the rise of graph neural networks (GNN), some technologies have been developed to identify coordinated market manipulation behavior by constructing a relationship graph structure between accounts. However, most existing technologies are based on a sliding time window, aggregating the trading behavior between accounts into a dynamic graph within a certain period of time, and then performing reasoning through a graph model. However, this dynamic graph can only reflect the relationship state between accounts within a certain period of time. For the rapid assembly or disassembly of manipulation gangs, there is a lack of effective features to capture, which can easily lead to false positives or false negatives in identifying coordinated market manipulation behavior. Therefore, there is a need to provide a method, system, device and medium for identifying coordinated market manipulation accounts. SUMMARY

[0004] The present application provides a method, system, device and medium for identifying coordinated market manipulation accounts to improve the technical problem that existing technologies cannot effectively identify the behavior of rapid assembly or disassembly of manipulation gangs, resulting in low accuracy in identifying dynamically changing coordinated market manipulation behavior.

[0005] The present application provides a method for identifying coordinated market manipulation accounts, which comprises: obtaining a transaction data set within a preset sampling duration; classifying the transaction data set according to the securities account identifier in the transaction data set, generating an account transaction data set corresponding to each securities account; extracting a plurality of pre-set types of transaction behavior data from each account transaction data set, calculating the similarity of the corresponding type of transaction behavior data between different securities accounts, obtaining and saving the correlation strength between different securities accounts within the current sampling duration; determining the relationship evolution rate between each securities account according to each correlation strength within the current sampling duration and the corresponding correlation strength within the previous sampling duration; calling a risk scoring model to identify coordinated market manipulation accounts based on the relationship evolution rate between each securities account; wherein the risk scoring model is a graph convolution network with cascading and a gated recurrent neural network.

[0006] In an embodiment of the present application, the plurality of preset types of transaction behavior data are extracted from each account transaction data set, the similarity of the corresponding types of transaction behavior data between different security accounts is calculated, the correlation strength between different security accounts in the current sampling duration is obtained and saved, including: for each account transaction data set: extracting a plurality of preset types of transaction behavior data from the account transaction data set; combining each security account in the current sampling duration in pairs to generate a set of security account pairs; for each security account pair: calculating the similarity of each type of transaction behavior data respectively, and performing weighted summation on each similarity to obtain and save the correlation strength of the security account pair in the current sampling duration.

[0007] In an embodiment of the present application, the relationship evolution rate is , wherein, is the correlation strength between security account i and security account j in the current sampling duration, is the correlation strength between security account i and security account j in the previous sampling duration, is the sampling interval, is the relationship evolution rate of the security account pair (i, j) in the current sampling duration t.

[0008] In an embodiment of the present application, the risk scoring model is called to identify the coordinated market manipulation accounts based on the relationship evolution rate between each security account, including: taking each security account as an account node, taking the relationship evolution rate between security accounts as the weight of the edge connecting the corresponding account nodes, and constructing a related account graph; inputting the related account graph into the risk scoring model, processing the related account graph, and generating the risk score of each security account; based on the risk score of each security account, identifying the coordinated market manipulation accounts from the related account graph.

[0009] In an embodiment of the present application, the related account graph is input into the risk scoring model, the related account graph is processed, and the risk score of each security account is generated, including: inputting the related account graph into the graph convolution network of the risk scoring model, generating and saving the graph structure features of each account node in the current sampling duration based on the connection relationship between each account node and its adjacent account node; for each account node: inputting the graph structure features of the account node in the current sampling duration into the gated recurrent neural network of the risk scoring model, extracting the time sequence risk features of the account node based on the historical graph structure features of the account node, and obtaining the risk score of the corresponding security account accordingly.

[0010] In an embodiment of the present application, the identifying the coordinated market manipulation accounts based on the risk scores of the security accounts comprises: identifying a target account subgraph from the association account graph according to a graph community discovery algorithm; determining a structure density of the target account subgraph according to a ratio of an actual number of edges in the target account subgraph to a maximum theoretical number of edges; calculating an average risk score of the target account subgraph according to the risk scores of the account nodes in the target account subgraph; determining whether the structure density is greater than a preset density threshold and whether the average risk score is greater than a preset risk threshold; and if so, regarding each security account corresponding to the target account subgraph as a coordinated market manipulation account; otherwise, determining that there is no coordinated market manipulation account.

[0011] In an embodiment of the present application, the risk score model is obtained through online dynamic training according to a plurality of preset training intervals.

[0012] The present application further provides a system for identifying coordinated market manipulation accounts, comprising: a data acquisition module configured to acquire a transaction data set within a preset sampling duration; a classification module configured to classify the transaction data set according to security account identifiers in the transaction data set, and generate account transaction data sets corresponding to each security account; an association strength determination module configured to extract a plurality of preset types of transaction behavior data from each account transaction data set, and calculate and save association strengths between different security accounts within the current sampling duration; a relationship evolution rate determination module configured to determine relationship evolution rates between the security accounts according to each association strength within the current sampling duration and the corresponding association strength within a previous sampling duration; and an account identification module configured to call a risk score model to identify coordinated market manipulation accounts based on the relationship evolution rates between the security accounts, wherein the risk score model is a graph convolution network with cascading and a gated recurrent neural network.

[0013] The present application further provides an electronic device, comprising: one or more processors; and a storage device configured to store one or more programs, which, when executed by the one or more processors, cause the electronic device to implement any of the above-mentioned methods for identifying coordinated market manipulation accounts.

[0014] The present application further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor of a computer, causes the computer to perform any of the above-mentioned methods for identifying coordinated market manipulation accounts.

[0015] The beneficial effects of the present application: the present application provides a method, system, device and medium for identifying coordinated market manipulation accounts, which classifies the transaction data set obtained within the preset sampling time according to the securities account identifier, extracts various types of transaction behavior data in the data of each account, and determines the correlation strength between securities accounts according to the similarity of the corresponding type of transaction behavior data between accounts, so as to realize the quantification of the coordinated behavior between accounts. Further, by calculating the change rate of the correlation strength between the current sampling time and the previous sampling time, the dynamic evolution process of the coordinated behavior between accounts can be quantified, the capture ability of the dynamic risk behavior of the manipulation gang in a short time can be improved, and the problem of low recognition accuracy of the dynamic changing coordinated market manipulation behavior of the existing static graph model is improved. In addition, through the graph convolution network and the gated recurrent neural network, the accuracy and robustness of the model for identifying manipulation gangs in complex market environment are further improved. BRIEF DESCRIPTION OF DRAWINGS

[0016] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and serve to explain the principles of the present application. It is apparent that the accompanying drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor on the basis of these drawings.

[0017] In the drawings:

[0018] Figure 1 A flowchart of the method for identifying coordinated market manipulation accounts provided by an embodiment of the present application is shown in the figure.

[0019] Figure 2 A structure block diagram of the system for identifying coordinated market manipulation accounts provided in an embodiment of the present application is shown in the figure.

[0020] Figure 3 A structure diagram of the electronic device provided in an embodiment of the present application is shown in the figure. DETAILED DESCRIPTION

[0021] The embodiments of the present application are described below through specific concrete examples, and those skilled in the art can easily understand other advantages and effects of the present application from the disclosure in the specification. The present application can also be implemented or applied by different specific embodiments, and the details in the specification can be modified or changed based on different views and applications without departing from the spirit of the present application. In the case of no conflict, the following examples and features in the examples can be combined with each other.

[0022] It is to be understood that the figures provided in the following embodiments are only to schematically illustrate the basic concept of the present application, and the figures only show the components related to the present application, not the number, shape and size of the components when actually implemented. The actual implementation of each component may be a random change, and the component layout pattern may be more complex.

[0023] In the following description, numerous specific details are discussed in order to provide a thorough understanding of the embodiments of the present application. However, it will be apparent to one skilled in the art that the embodiments of the present application can be practiced without these specific details. In other instances, well-known structures and devices are shown in block diagram form in order to avoid obscuring the embodiments of the present application.

[0024] The applicant finds that although the prior art also uses graph structure to identify coordinated market manipulation behavior, it still has the following disadvantages: on the one hand, there is a lack of measurement of the "evolution process" of the relationship between accounts. Most methods only aggregate account behavior through a time window to construct a quasi-dynamic graph for the current time window. This quasi-dynamic graph can reflect the relationship state between each account at a certain moment, but it cannot effectively quantify the change speed of this relationship, resulting in the inability to capture key behavior characteristics such as the rapid assembly or disassembly of manipulation gangs in the short term. On the other hand, most existing graph neural network models use offline training or simple online incremental way to update parameters, which makes it difficult for the model to balance the rapid adaptation ability (i.e. sensitivity of the model) to new coordinated ways and the resistance ability (i.e. stability of the model) to market noise in the high-frequency fluctuation environment of the real market. In addition, the existing technology relies on a single node risk score threshold for early warning, lacks comprehensive consideration of the "structural tightness" of the gang, and is prone to a large number of false positives or false negatives due to fluctuations in the score of a single node, reducing the accuracy and stability of the early warning. In view of the above problems, it is necessary to provide a method that can deeply understand the evolution process of the coordinated relationship and balance the sensitivity and stability of the model, in order to efficiently and accurately identify possible coordinated market manipulation accounts.

[0025] To improve the above problems, the application provides a method for identifying coordinated market manipulation accounts, aiming to solve the problem of insufficient identification ability of the prior art for dynamically evolving manipulation groups. The application proposes a relationship evolution rate for quantifying the formation and dissipation speed of the coordinated behavior relationship between security accounts, and constructs a dynamically updated associated account graph based on this. Through a risk scoring model composed of a graph convolution network and a gated recurrent neural network in cascade, not only the association relationship of the accounts in the graph structure can be mined, but also the time sequence features of the behavior evolution can be captured, so that the subsequent identification result is more accurate. Among them, the model adopts a multi-frequency coupling online learning strategy based on a gradient accumulation mechanism, which is dynamically updated at different frequencies to balance the sensitivity and stability of risk detection, thereby improving the identification accuracy of the model in complex market environments. In addition, the application also uses the dual thresholds of node risk score and account subgraph density structure as the basis for judgment, thereby improving the identification accuracy of the manipulation group.

[0026] As shown in Figure 1 The method for identifying coordinated market manipulation accounts comprises the following steps:

[0027] S11, acquiring a transaction data set within a preset sampling duration.

[0028] A transaction data set within a preset sampling duration (such as 5 minutes) is acquired from a securities trading platform. The transaction data set includes transaction behaviors generated by a plurality of security accounts within the current sampling duration, wherein the transaction behaviors include but are not limited to buy / sell orders, transaction records, order placement or cancellation information, etc.

[0029] Preferably, considering the processing rate and real-time requirements, the transaction data can be written into a message queue (such as Apache Kafka) in the form of a data stream in real time. A plurality of graphics processing unit (GPU) nodes are used as consumers to continuously consume the data stream stored in the message queue through asynchronous listening, and the received transaction data is batch-aggregated within each sampling duration to form a transaction data set corresponding to the current sampling duration. Illustratively, a real-time transaction data stream (such as Transactions Per Second (TPS) of about 50,000) is written into an Apache Kafka cluster, and a GPU consumes data from the message queue to extract transaction data within a preset sampling duration to form a transaction data set. By using a message queue and a plurality of GPU parallel consumption mechanisms, the real-time transmission requirements of massive high-frequency data are guaranteed, and the response capability of the data is improved. The application realizes real-time and accurate identification of hidden coordinated manipulation behaviors by writing the transaction data stream into the message queue and asynchronously updating the graph on the GPU computing node.

[0030] It should be noted that, in order to improve the data processing rate, the hardware of the present application can be configured as one or more servers equipped with 96 vCPUs, 512 GB of memory and 4 NVIDIA A100 80GB GPUs. The operating system is Linux, and Docker containerization deployment is adopted.

[0031] S12, according to the security account identification in the transaction data set, the transaction data set is classified, and the account transaction data set corresponding to each security account is generated.

[0032] Since the transaction data set includes a large amount of transaction data of different security accounts, each transaction data carries a related security account identification. In order to facilitate subsequent analysis of individual characteristics of the account, it is necessary to classify all the transaction data currently obtained according to the security account identification, and aggregate all the transaction data of the same security account identification within the current sampling duration as the account transaction data set of the security account.

[0033] S13, from each account transaction data set, extract a plurality of preset types of transaction behavior data, calculate the similarity of the corresponding type of transaction behavior data between different security accounts, and obtain and save the correlation strength between different security accounts within the current sampling duration; wherein the correlation strength is used to represent the cooperative behavior strength between the corresponding two security accounts.

[0034] For each account transaction data set obtained as described above, a plurality of preset types of transaction behavior data are extracted from the account transaction data set. It can be understood that the preset type of transaction behavior data can be directly extracted from the account transaction data set, or can be calculated according to the preset calculation rule using the transaction data in the account transaction data set, and the specific calculation rule is not limited. The security accounts within the current sampling duration are combined in pairs to form an account pair set. For each account pair, the similarity scores of the account pair in each type of transaction behavior dimension are calculated, and these similarity scores are weighted and fused to obtain the correlation strength of the account pair within the current sampling duration. The correlation strength is a composite measure based on behavior similarity characteristics, and is used to represent the cooperative behavior degree of the corresponding two security accounts within the current sampling duration. For example, the correlation strength can represent the similarity or hedging degree of account A and B in the current sampling duration in terms of transaction behavior, direction, timing, etc.

[0035] In an optional embodiment of the present application, step S13 comprises the following process: for each account transaction data set: extracting a plurality of preset types of transaction behavior data from the account transaction data set; combining each security account in the current sampling duration in pairs to generate a set of security account pairs; for each security account pair: respectively calculating the similarity of each type of transaction behavior data, and performing weighted summation on each similarity to obtain and save the correlation strength of the security account pair in the current sampling duration.

[0036] For each account transaction data set, the following processing is performed: a plurality of preset types of transaction behavior data are extracted from the account transaction data set, such as 25 types of transaction behavior data including transaction time series, transaction direction series, order price trajectory, order cancellation behavior, and transaction target series. After extraction, all security accounts in the current sampling duration are combined in pairs to form a plurality of security account pairs. For each security account pair, the following processing is performed: similarity calculation of corresponding category data is performed in each type of transaction behavior dimension, i.e., transaction time dimension data is compared only with transaction time data, order price trajectory is compared only with order price trajectory, and so on. Each transaction behavior dimension corresponds to one type of transaction behavior data. After calculating the similarity of all preset types of transaction behavior data, the similarity of each transaction behavior dimension is weighted and summed according to formula (1), and the correlation strength of the security account pair in the current sampling duration is obtained through multi-dimensional transaction behavior data matching analysis, which is used to represent the comprehensive behavior coupling degree of the security account pair in the current sampling duration:

[0037] (1)

[0038] wherein, is the correlation strength of security account A and security account B in the current sampling duration t, is the weighting coefficient of the kth type of transaction behavior dimension, and satisfies =1, is the similarity of security account A and security account B with respect to the kth type of transaction behavior in the current sampling duration, is the total amount of transaction behavior data types. It can be understood that the weighting coefficient can be obtained through statistical experience, or can be automatically learned and adjusted by a model, and the specific manner is not limited.

[0039] It should be noted that due to the difference in distribution characteristics of different types of transaction behavior data, the similarity calculation method adopted is also different, and each type of transaction behavior is taken as an independent similarity calculation dimension. Exemplarily, for the "transaction direction consistency" dimension, it can be judged according to whether the operation direction of account A and account B on the same transaction object is consistent: if buying synchronously or selling synchronously at similar time points, it is assigned a value of 1, indicating that the two are strongly positively correlated; if the directions are opposite, it is assigned a value of -1, indicating that the two are strongly negatively correlated; and if there is no corresponding transaction, it is 0. For the "transaction time synchronization" dimension, a Gaussian kernel function can be used to perform nonlinear mapping on the transaction time difference of the two accounts to reflect the closeness of the order placement time of the two accounts. For the "co-transaction object coincidence degree" dimension, the Jaccard similarity can be used to calculate the ratio of the intersection to the union of the transaction object sets involved by the two accounts within the current sampling time length. For the "order placement price sequence similarity", the dynamic time warping algorithm can be used to dynamically align and match the order placement price sequence to capture the similarity of the price paths between the accounts. For the "order cancellation behavior correlation" dimension, the Pearson correlation coefficient can be used to measure whether the order cancellation rate trend of the two accounts in the time series dimension has a positive correlation or a negative correlation. In addition, more dimensions of similarity measurement can be extended, such as co-holding coincidence degree, consistency of transfer / fund flow path, co-occurrence frequency of account behavior mode, etc., to comprehensively characterize the potential cooperative behavior relationship between the securities accounts.

[0040] It can be understood that those skilled in the art can adaptively set a suitable measurement method for similarity calculation based on the type of transaction behavior data required, which is not described here in detail.

[0041] S14, according to the correlation strength in the current sampling time length and the corresponding correlation strength in the previous sampling time length, determine the relationship evolution rate between the securities accounts.

[0042] For each securities account pair (A, B), the following process is performed: the correlation strength of the current sampling time length is obtained in the foregoing manner , and the pre-stored correlation strength of the same securities account pair in the previous sampling time length is also extracted It can be understood that if there is no correlation strength of the securities account pair in the previous sampling time length , the is initialized to a preset initial correlation strength value (such as 0). According to the correlation strength in the adjacent sampling time length, the relationship evolution rate of the securities account in the current sampling time length is calculated by formula (2):

[0043] (2)

[0044] , wherein an association strength of the security account A and the security account B in a current sampling duration, an association strength of the security account A and the security account B in a previous sampling duration, a preset sampling interval, that is, a time interval of the current sampling duration and the previous sampling duration, a relationship evolution rate of the security account pair (A, B) in the current sampling duration t. The generated relationship evolution rate can be used to quantify the change rate of the cooperative relationship between the corresponding two security accounts, that is, the degree of the trend of "warming up" or "cooling down". Therefore, the relationship evolution rate can reflect the dynamic evolution state of the relationship between the security accounts, and is especially suitable for capturing the key behavior characteristics of the manipulation gang in the short time of rapid gathering or rapid disbanding, thereby providing data support for subsequent abnormal account identification. By introducing the relationship evolution rate feature, the application can sensitively find the dramatic change of the association strength when the gang rapidly gathers or disbands, thereby issuing a warning in the budding period or the ending period of the manipulation behavior, and realizing the accurate capture of the "premeditation period" and the "disbanding period" of the manipulation.

[0045] S15, calling a risk scoring model to identify cooperative market manipulation accounts based on the relationship evolution rates between the security accounts; wherein the risk scoring model is a graph convolution network and a gated recurrent neural network in cascade.

[0046] The application adopts a network constructed by cascading a graph convolution network and a gated recurrent neural network as a risk scoring model. On the one hand, through the graph convolution network, multi-dimensional interaction features between each security account and its adjacent security accounts in the current sampling duration can be extracted, so that the cooperative behavior of the security account in the transaction network can be obtained. On the other hand, through the gated recurrent neural network, the evolution trend of the graph structure features of the security account in different sampling periods can be further captured, and the risk level of the account can be evaluated.

[0047] In an optional embodiment of the application, the step S15 comprises steps S151 to S153:

[0048] S151, taking each security account as an account node, taking the relationship evolution rate between the security accounts as the weight of the edge connecting the corresponding account nodes, and constructing a related account graph.

[0049] The application depicts the coordinated trading behavior between security accounts by constructing a dynamically updated associated account graph. In the associated account graph, each security account is an account node, and the node characteristics are jointly coded by the multi-dimensional trading behavior data of the security account within the current sampling period, wherein the trading behavior includes but is not limited to the trading frequency (the number of orders), the average order size, the order cancellation rate, the average and volatility of the fund flow, the diversity of the transaction target, the price and direction sequence of the order in the same period, the centrality index of the account (such as degree centrality, betweenness centrality, clustering coefficient, etc.), etc. The node can depict the individual behavior characteristics and risk performance of the account.

[0050] An edge is established between two account nodes with a relationship evolution rate, and the weight of the edge is set as the relationship evolution rate between the two accounts to reflect the trend of the coordinated behavior strength between the corresponding accounts. Further, the edge also has attributes, and the attributes of the edge are obtained by jointly coding the trading behavior between the corresponding pairs of security accounts, which includes but is not limited to the relationship evolution rate, the similarity score between the accounts, the similarity of each type of trading behavior, the time sequence relationship characteristics, etc., wherein the time sequence relationship characteristics include but are not limited to the transaction time difference of the pair of security accounts, the transaction direction consistency, the dynamic time warping sequence matching score of the order price sequence, and the transaction target overlap degree. The associated account graph constructed in this way can more accurately reflect the behavior similarity and interaction strength between different security accounts.

[0051] It can be understood that in the associated account graph of the application, the attributes of the nodes and edges are dynamically updated, and can be dynamically updated after each sampling period to construct an account association graph with high timeliness and high resolution, thereby realizing fine monitoring of user behavior.

[0052] S152, input the associated account graph into the risk score model, process the associated account graph, and generate a risk score of each security account.

[0053] The associated account graph is input into the risk score model, the associated relationship of each account node and its adjacent nodes in the graph is extracted and coded by the graph convolution network, and the graph structure features of each account node within the current sampling period are obtained. The changes of the graph structure features of each security account in the current sampling period and multiple historical sampling periods are captured by using the gated recurrent neural network, so as to obtain the risk score of each security account. The risk score is used to represent the risk degree of the security account participating in the potential manipulation behavior. Obviously, the higher the risk score is, the greater the possibility of the security account participating in the coordinated market manipulation is.

[0054] In an optional embodiment of the present application, step S152 comprises the following process: inputting the associated account graph into the graph convolution network of the risk scoring model, generating and saving the graph structure features of each account node within the current sampling duration based on the connection relationship between each account node and its adjacent account nodes; for each account node: inputting the graph structure features of the account node within the current sampling duration into the gated recurrent neural network of the risk scoring model, extracting the time series risk features of the account node based on the historical graph structure features of the account node, and obtaining the risk score of the corresponding securities account accordingly.

[0055] The associated account graph is input into the graph convolution network of the risk scoring model, and for each account node: the node features of the account node and the node features of its adjacent account nodes are weighted and fused according to the weight of the corresponding edge to obtain the graph structure features of the account node within the current sampling duration and save them. The graph structure features of the account node within the current sampling duration and the graph structure features of the account node within the plurality of historical sampling durations are spliced into a graph structure feature sequence, which is input into the gated recurrent neural network of the risk scoring model to obtain the time series risk features of the account node by using the gating mechanism. The time series risk features are used to represent the evolution trend of the association relationship between the current securities account and other securities accounts within different time periods. The time series risk features of the account node are input into the subsequent output layer (such as a fully connected layer) of the risk scoring model to generate the risk score of the corresponding securities account, wherein the risk score is used to evaluate the risk degree of the securities account participating in the coordinated manipulation behavior.

[0056] S153, based on the risk score of each securities account, identifying the coordinated market manipulation accounts from the associated account graph.

[0057] The topology structure in the associated account graph is utilized to perform clustering processing on each account node in the graph community discovery algorithm, thereby identifying a plurality of account sub-graphs with highly coupled trading behaviors, wherein the graph community discovery algorithm includes but is not limited to Louvain, Label Propagation, etc. For each account sub-graph: calculating the average risk score of all account nodes within the account sub-graph and the structural density of the account sub-graph, and determining whether each securities account contained in the account sub-graph is a coordinated market manipulation account according to a preset evaluation mechanism.

[0058] Specifically, in an optional embodiment of the present application, step S153 comprises the following process: identifying a target account subgraph from the association account graph according to a graph community discovery algorithm; determining the structural density of the target account subgraph according to the ratio of the actual number of edges in the target account subgraph to the maximum theoretical number; calculating the average risk score of the target account subgraph according to the risk scores of the account nodes in the target account subgraph; judging whether the structural density is greater than a preset density threshold and whether the average risk score is greater than a preset risk threshold; if yes, regarding each security account corresponding to the target account subgraph as a coordinated market manipulation account; otherwise, determining that there is no coordinated market manipulation account.

[0059] In order to more efficiently and accurately identify the coordinated market manipulation accounts from the complex account network, the entire association account graph can be divided into several target account subgraphs by a graph community discovery algorithm based on the connection tightness between the account nodes. For each target account subgraph, the following processing is performed: calculating the structural density of the target account subgraph, that is, the ratio of the number of connected edges in the target account subgraph to the maximum possible number of connection edges between nodes, wherein the maximum possible number of connection edges is , and n is the number of nodes of the target account subgraph. The structural density is used to reflect the connection tightness between the security accounts, and the greater the structural density, the stronger the tightness of the coordinated behavior between the security accounts. In addition, the average risk score of the target account subgraph is calculated, that is, the average value of the risk scores of all account nodes in the target account subgraph. The abnormality degree of the corresponding account group can be effectively measured through the average risk score. If the structural density of the target account subgraph is greater than a preset structural density threshold (such as 0.7), and the average risk score is greater than a preset risk threshold (such as 0.85), it can be determined that the account group contained in the target account subgraph has relatively tight coordinated trading behavior between the accounts, and the behavior is highly similar, and there is a suspicion of coordinated manipulation. Therefore, all the security accounts in the account subgraph are determined as coordinated market manipulation accounts, which are used as early warning objects for subsequent regulatory disposal. Through the above double-threshold decision mechanism, it is required that a gang not only has "evil intentions" (that is, the average risk score of the node is high), but also has "strict discipline" (that is, the structural density is large), effectively filtering a large number of accidental high-risk aggregation caused by market noise, making the early warning result more reliable.

[0060] It should be noted that the structural density threshold and the risk threshold can be pre-set fixed values, or can be obtained by statistically analyzing the real historical data according to the 95% quantile point in a predetermined period, so as to improve the accuracy of the model to abnormal group behavior in the complex and changeable securities market environment, and make the model more applicable to the identification of abnormal behavior in the actual securities market environment.

[0061] In an optional embodiment of the present application, the risk score model is obtained through online dynamic training according to preset multiple training intervals. The present application uses a multi-frequency coupling online learning strategy, so that the model can quickly follow the market rhythm through high-frequency updates, avoid model drift and overfitting through medium and low-frequency calibration and enhancement, and maintain excellent comprehensive performance in a highly antagonistic environment. The adaptability-stability dilemma of the model is systematically solved.

[0062] Specifically, a preset first sampling duration (such as 5 minutes) is used as a high-frequency sampling period, and the risk score model is input with the current constructed associated account graph in each high-frequency sampling period, and the model parameter weight obtained in the previous high-frequency sampling period is used for forward inference to generate the risk score of each security account node. From the recent several historical high-frequency sampling periods, the risk score of the account generated by the model in the historical period is used as a label, and the difference between the current risk score and the true label is minimized, and the model parameters are optimized through gradient descent under the condition of a preset first learning rate (such as 1e-4), to complete an incremental online update. This high-frequency fine-tuning mechanism can make the risk score model adapt to short-term fluctuations in market behavior, thereby enhancing the ability to capture abnormal account behavior.

[0063] Further, the present application also uses a preset second sampling duration (such as every 6 hours) as a medium-frequency sampling period, and through an active learning mechanism, selects account nodes falling within a preset score range (such as 0.4-0.6) from the risk score results generated by the current medium-frequency sampling period model, and uses them as fuzzy boundary samples. The adjacent sub-graphs of these fuzzy boundary samples are identified from the corresponding associated account graph, and are submitted to the supervisor for manual review in a visual manner, and the accounts are manually labeled as to whether they are coordinated market manipulation accounts, thereby obtaining a batch of "high-value samples" with clear labels. These manually labeled samples are included in the training set, and the risk score model is trained with a preset second learning rate (such as 1e-3) to calibrate the parameters, thereby enhancing the model's ability to identify risk boundary samples and improving its ability to distinguish fuzzy boundary samples.

[0064] Further, the application also starts a low-frequency enhancement training process based on a generative adversarial network as a preset third sampling time length (such as every 48 hours) as a low-frequency sampling period. The structural representation features (such as node degree distribution, edge density, risk spectrum features, etc.) are extracted from the historical identified typical coordinated manipulation atlas, encoded and input into the graph generator together with the Gaussian noise to generate a fake atlas with similar structural attributes but diverse behavior patterns. The discriminator is responsible for judging the difference between the generated atlas and the real manipulation atlas, and optimizing the graph generator in the reverse direction to improve the credibility of the generated samples. The high-quality simulation atlas screened out is supplemented as an additional training sample to the risk scoring model to improve its recognition coverage of abnormal variant manipulation behaviors such as "atypical groups" or "strategic deformation behaviors".

[0065] Table 1 is a comparison table of experimental results of the application and the baseline model. It can be seen from Table 1 that the method of the application is superior to the traditional baseline model in AUC and recall rate, indicating that the application has higher recognition accuracy in the coordinated manipulation behavior recognition task, and is especially suitable for financial supervision scenarios that require high reliability warning.

[0066] Table 1 Comparison of experimental results of the application and the baseline model

[0067]

[0068] As shown in Figure 2 The coordinated market manipulation account identification system 200 includes a data acquisition module 210, a classification module 220, an association strength determination module 230, a relationship evolution rate determination module, and an account identification module 250. The data acquisition module 210 is used to acquire a transaction data set within a preset sampling time length. The classification module 220 is used to classify the transaction data set according to the security account identifier in the transaction data set, and generate an account transaction data set corresponding to each security account. The association strength determination module 230 is used to extract a plurality of preset types of transaction behavior data from each account transaction data set, and calculate and save the association strength between different security accounts within the current sampling time length. The relationship evolution rate determination module 240 is used to determine the relationship evolution rate between each security account according to each association strength within the current sampling time length and the corresponding association strength within the previous sampling time length. The account identification module 250 is used to call a risk scoring model to identify coordinated market manipulation accounts based on the relationship evolution rate between each security account, wherein the risk scoring model is a graph convolution network and a gated recurrent neural network.

[0069] Further, the above-mentioned system for identifying coordinated market manipulation accounts further comprises a distributed graph storage module and a GPU inference service module. The distributed graph storage module is configured to store a dynamic association account graph, and the GPU inference service module is configured to execute the above-mentioned method for identifying coordinated market manipulation behaviors. In order to achieve extreme performance, the distributed graph storage module and the GPU inference service module are connected by RDMA-over-Converged-Ethernet (RDMA-over-Converged-Ethernet) supporting remote direct memory access, which significantly reduces the delay of large-scale graph data transmission. In addition, the distributed graph storage module also interacts with data based on the Gremlin application interface or the Flink-Gelly interface.

[0070] The specific limitations of the system for identifying coordinated market manipulation accounts can be seen in the above limitations of the method for identifying coordinated market manipulation accounts, which will not be repeated here. Each module in the above-mentioned system for identifying coordinated market manipulation accounts can be realized by software, hardware and their combinations in whole or in part. The above-mentioned modules can be embedded in or independent of the processor in the computer device in hardware format, or can be stored in the memory in the computer device in software format, so that the processor can call the operations corresponding to the above-mentioned modules.

[0071] It should be noted that, in order to highlight the innovative part of the present application, modules not closely related to solving the technical problems proposed by the present application are not introduced in this embodiment, but this does not mean that there are no other modules in this embodiment.

[0072] As shown in Figure 3 The electronic device 3 can include a memory 31, a processor 32 and a bus, and can further include a computer program stored in the memory 31 and executable on the processor 32, such as a program for identifying coordinated market manipulation accounts.

[0073] The memory 31 includes at least one type of readable storage medium, such as a flash memory, a mobile hard disk, a multimedia card, a card-type memory (e.g., an SD or DX memory, etc.), a magnetic memory, a disk, an optical disk, etc. The memory 31 can be an internal storage unit of the electronic device 3 in some embodiments, such as a mobile hard disk of the electronic device 3. The memory 31 can also be an external storage device of the electronic device 3 in other embodiments, such as a plug-in mobile hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the electronic device 3. Further, the memory 31 can include both an internal storage unit and an external storage device of the electronic device 3. The memory 31 can be used to store application software installed on the electronic device 3 and various data, such as codes for identifying accounts involved in market manipulation, and can also be used to temporarily store data that has been output or will be output.

[0074] The processor 32 can be composed of an integrated circuit in some embodiments, such as a single packaged integrated circuit or a plurality of packaged integrated circuits with the same or different functions, including one or more combinations of a central processing unit (CPU), a microprocessor, a digital processing chip, a graphics processor, and various control chips, etc. The processor 32 is a control core of the electronic device 3, which connects various components of the electronic device 3 through various interfaces and lines, executes programs or modules stored in the memory 31 (such as an account identification program involved in market manipulation), and calls data stored in the memory 31, to perform various functions of the electronic device 3 and process data.

[0075] The processor 32 executes an operating system of the electronic device 3 and various installed application programs. The processor 32 executes the application programs to implement the steps in the above-mentioned account identification method involved in market manipulation.

[0076] For example, the computer program can be divided into one or more modules, which are stored in the memory 31 and executed by the processor 32 to complete the present application. One or more modules can be a series of computer program instruction segments capable of completing a specific function, which are used to describe the execution process of the computer program in the electronic device 3. For example, the computer program can be divided into a data acquisition module 210, a classification module 220, an association strength determination module 230, a relationship evolution rate determination module, and an account identification module 250.

[0077] The integrated unit implemented in the form of the software function module can be stored in a computer readable storage medium, which can be non-volatile or volatile. The software function module is stored in a storage medium, and includes a plurality of instructions for enabling a computer device (which can be a personal computer, a computer device, or a network device, etc.) or a processor to execute part of the functions of the method for identifying a coordinated market manipulation account according to various embodiments of the present application.

[0078] In summary, by introducing the innovative index of relationship evolution rate, in the process of constructing the correlation strength between accounts, the present application first realizes the fine description and dynamic monitoring of the coordinated behavior strength between security accounts by using the way of comparing each item similarity with multi-dimensional transaction behavior characteristics, combining the similarity calculation and weighted fusion mechanism. It breaks through the bottleneck that the traditional graph neural network is difficult to effectively quantify the "change speed" of the behavior relationship between accounts in the process of identifying dynamic manipulation groups. The present application not only improves the semantic expression ability of the input features of the risk scoring model, but also makes the dynamically constructed correlation account graph highly sensitive to the behavior of the "rapid assembly period" and "strategy dissipation period" of the manipulation group, so as to discover abnormal accounts in time.

[0079] The above embodiments only exemplarily illustrate the principles and effects of the present application, and are not used to limit the present application. Any person skilled in the art can modify or change the above embodiments without departing from the spirit and scope of the present application. Therefore, all equivalent modifications or changes completed by those skilled in the art without departing from the spirit and technical thought disclosed by the present application should be covered by the claims of the present application.

Claims

1. A method for identifying accounts involved in coordinated market manipulation, characterized in that, The method includes: Obtain the transaction dataset within the preset sampling period; Based on the securities account identifiers in the transaction dataset, the transaction dataset is classified to generate account transaction datasets corresponding to each securities account; Extract various preset types of transaction behavior data from the transaction datasets of each account, calculate the similarity of corresponding types of transaction behavior data between different securities accounts, and obtain and save the correlation strength between different securities accounts within the current sampling period; Based on the correlation strengths within the current sampling period and the corresponding correlation strengths within the previous sampling period, determine the rate of evolution of the relationship between each securities account. The risk scoring model is invoked to identify accounts that engage in coordinated market manipulation based on the evolution rate of relationships between various securities accounts; wherein, the risk scoring model comprises a cascaded graph convolutional network and a gated recurrent neural network. The aforementioned invocation of the risk scoring model, based on the evolution rate of relationships between various securities accounts, identifies accounts involved in coordinated market manipulation, including: Using each securities account as an account node, and taking the evolution rate of the relationship between securities accounts as the weight of the edge connecting the corresponding account node, a related account graph is constructed. The associated account diagram is input into the risk scoring model, and the associated account diagram is processed to generate risk scores for each securities account; Based on the risk scores of each securities account, accounts involved in coordinated market manipulation are identified from the associated account diagram. The rate of relation evolution is ,in, To determine the correlation strength between securities account i and securities account j within the current sampling period, To represent the correlation strength between securities account i and securities account j during the previous sampling period, The sampling interval is... Let be the rate of evolution of the relationship between securities account pairs (i, j) within the current sampling duration t.

2. The method for identifying coordinated market manipulation accounts according to claim 1, characterized in that, The process of extracting multiple preset types of transaction behavior data from various account transaction datasets, calculating the similarity of corresponding types of transaction behavior data between different securities accounts, and obtaining and saving the correlation strength between different securities accounts within the current sampling period includes: For each account transaction dataset: extract multiple preset types of transaction behavior data from that account transaction dataset; Each securities account within the current sampling period is paired up to generate a set of securities account pairs. For each pair of securities accounts: calculate the similarity for each type of transaction behavior data, and sum the weighted similarities to obtain and store the association strength of the pair of securities accounts within the current sampling period.

3. The method for identifying coordinated market manipulation accounts according to claim 1, characterized in that, The step of inputting the related account diagram into the risk scoring model, processing the related account diagram, and generating risk scores for each securities account includes: The associated account graph is input into the graph convolutional network of the risk scoring model. Based on the connection relationship between each account node and its neighboring account nodes, the graph structure features of each account node within the current sampling time are generated and saved. For each account node: the graph structure features of the account node within the current sampling period are input into the gated recurrent neural network of the risk scoring model. Based on the historical graph structure features of the account node, the temporal risk features of the account node are extracted, and the risk score of the corresponding securities account is obtained accordingly.

4. The method for identifying coordinated market manipulation accounts according to claim 1, characterized in that, The method of identifying coordinated market manipulation accounts from the associated account graph based on risk scores of each securities account includes: Based on the graph community detection algorithm, the target account subgraph is identified from the associated account graph; The structural density of the target account subgraph is determined based on the ratio of the actual number of edges to the maximum theoretical number. Calculate the average risk score of the target account subgraph based on the risk scores of each account node in the target account subgraph; Determine whether the structure density is greater than a preset density threshold, and whether the average risk score is greater than a preset risk threshold: If so, then each securities account corresponding to the target account sub-graph will be regarded as a coordinated market manipulation account; Otherwise, it is determined that there are no accounts involved in coordinated market manipulation.

5. The method for identifying coordinated market manipulation accounts according to claim 1, characterized in that, The risk scoring model is obtained through online dynamic training at multiple preset training intervals.

6. A system for identifying accounts involved in coordinated market manipulation, characterized in that, The system includes: The data acquisition module is used to acquire the transaction dataset within a preset sampling period; The classification module is used to classify the transaction dataset according to the securities account identifiers in the transaction dataset and generate account transaction datasets corresponding to each securities account. The association strength determination module is used to extract multiple preset types of transaction behavior data from the transaction datasets of various accounts, calculate the similarity of corresponding types of transaction behavior data between different securities accounts, and obtain and save the association strength between different securities accounts within the current sampling period. The relationship evolution rate determination module is used to determine the relationship evolution rate between each securities account based on the correlation strength within the current sampling period and the corresponding correlation strength within the previous sampling period. The account identification module is used to call the risk scoring model and identify accounts that are colluding to manipulate the market based on the evolution rate of the relationship between various securities accounts; wherein, the risk scoring model includes a cascaded graph convolutional network and a gated recurrent neural network. The aforementioned invocation of the risk scoring model, based on the evolution rate of relationships between various securities accounts, identifies accounts involved in coordinated market manipulation, including: Using each securities account as an account node, and taking the evolution rate of the relationship between securities accounts as the weight of the edge connecting the corresponding account node, a related account graph is constructed. The associated account diagram is input into the risk scoring model, and the associated account diagram is processed to generate risk scores for each securities account; Based on the risk scores of each securities account, accounts involved in coordinated market manipulation are identified from the associated account diagram. The rate of relation evolution is ,in, To determine the correlation strength between securities account i and securities account j within the current sampling period, To represent the correlation strength between securities account i and securities account j during the previous sampling period, The sampling interval is... Let be the rate of evolution of the relationship between securities account pairs (i, j) within the current sampling duration t.

7. An electronic device, characterized in that, The electronic device includes: One or more processors; A storage device for storing one or more programs that, when executed by one or more processors, cause the electronic device to implement the method for identifying coordinated market manipulation accounts as described in any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, It stores a computer program that, when executed by the computer's processor, causes the computer to perform the method for identifying coordinated market manipulation accounts as described in any one of claims 1 to 5.

Images