Abnormal account monitoring method, system and device based on feature graph model

Abstract

The invention discloses an abnormal account monitoring method, system and device based on a feature graph model, and the method comprises the steps: obtaining a transaction account and a transaction record, and forming a feature graph model; inputting the node attribute of each node into a score prediction model to obtain a predicted credit score of each node, searching neighbor nodes, and adding the predicted credit scores to the neighbor nodes as node attributes; whether the transaction account is abnormal or not is judged, if yes, the transaction account is marked as an early warning account, and a directed subgraph model is formed based on the early warning account; based on the predicted credit score of each node in the directed subgraph model, calculating a balanced credit score of each node, traversing all nodes of the directed subgraph model, and if the balanced credit score is lower than a preset credit score threshold, marking the nodes as early warning nodes; and determining communities where the early warning nodes are located, traversing each community, and if a plurality of early warning nodes exist in the communities, marking all early warning accounts as abnormal accounts. According to the invention, accuracy and response time are improved.

Description

Technical Field

[0001] This invention relates to the field of big data technology, and in particular to an abnormal account monitoring method, system and device based on feature graph model. Background Technology

[0002] With the rapid development of internet technology and applications, various internet services and platforms have emerged. In order to meet the regulatory requirements for these internet services and platforms, risk monitoring technology has been widely used.

[0003] Currently, identifying online financial violations is relatively simple, primarily relying on expert rules. However, this approach struggles to detect complex financial transactions involving multiple fund flows, and expert rules also have difficulty tracking dynamically changing abnormal financial transaction strategies. Machine learning methods are sometimes used, but these often require labeled samples, which are difficult to label and have limited availability. Therefore, machine learning models face challenges in both training and validation, leading to false positives and false negatives, resulting in a high false positive rate for anomaly detection. Summary of the Invention

[0004] To address the shortcomings of existing technologies, this invention provides a method, system, and apparatus for monitoring abnormal accounts based on a feature graph model.

[0005] To solve the above-mentioned technical problems, the present invention provides the following technical solution: An abnormal account monitoring method based on a feature map model includes the following steps: Obtain transaction accounts, transaction records, and transaction amounts. Treat transaction accounts as nodes, the interests between transaction records and transaction accounts as edges, and transaction amounts as edge weights to form a feature graph model. Each node has node attributes. Each node's node attributes are input into the rating prediction model to obtain the predicted credit score for each node. The node with the lowest predicted credit score is then identified as a neighbor node, and the predicted credit score is added as a node attribute to the neighbor node. Determine if a trading account is abnormal; if so, mark it as an alert account and form a directed subgraph model based on the alert account. Based on the predicted credit score of each node in the directed subgraph model, calculate the balanced credit score of each node. Traverse all nodes in the directed subgraph model. If the balanced credit score is lower than the preset credit score threshold, mark the corresponding node as a warning node. The community discovery algorithm determines the community where the warning node is located. Each community is traversed. If there are multiple warning nodes in the community, all warning accounts in the current community are marked as abnormal accounts.

[0006] As one possible implementation, finding the node with the lowest predicted credit score as a neighbor node and adding the predicted credit score as a node attribute to the neighbor node includes the following steps: Take the node represented by each transaction account as the current node, find all the first neighbor nodes belonging to the current node in the feature graph model, and select several first neighbor nodes with the lowest credit scores as neighbor nodes. If there is only one edge connecting each pair of nodes in the feature graph model, then each pair of nodes is a neighbor node. Obtain the order and credit score of neighboring nodes, get the average credit score of all neighboring nodes, and add the average credit score as the estimated credit score attribute to the node represented by the corresponding entity.

[0007] As one possible implementation method, the method of forming a directed subgraph model based on the early warning account specifically involves: obtaining the transaction records and associated accounts of the early warning account, and forming a directed subgraph model of the early warning account based on the nodes composed of the early warning account and associated accounts, and using the interest relationships between the transaction records and transaction accounts as edges.

[0008] As one possible implementation, all nodes are traversed, and if a node's balanced credit score is lower than a preset credit score threshold, it is marked as a warning node, including the following steps: Based on the directed subgraph model, the estimated credit score of each node is used as the initial value of the credit score, and the balanced credit score is calculated based on the balanced credit score model. Traverse all nodes, find all nodes whose balanced credit scores are lower than the preset credit score threshold, and mark them as warning nodes; The balanced credit score model is expressed as follows: ; in, This represents the balanced credit score, and n represents the subgraph node number. This indicates the initial credit score corresponding to the i-th node. This represents the adjacency matrix of a directed subgraph model.

[0009] As one possible implementation, the method of determining the community where the early warning node is located based on the community discovery algorithm, traversing each community, and if there are multiple early warning nodes within the community, then marking all early warning accounts in the current community as abnormal accounts, includes the following steps: Get all nodes of the directed subgraph model, and select the first node and the first edge that are related to the node within four steps. The community discovery algorithm determines the community to which the first node belongs. Specifically, it obtains the weight of each first edge and the weight of each first node, obtains the sum of the weights of the first edges within the community and the sum of the weights of the first edges connected to all the first nodes contained in the community, and then obtains the total degree of modularity. When the total degree of modularity reaches the maximum value, the community division is complete. Iterate through each community. If there are at least n warning nodes in the same community, mark all warning accounts in the community as abnormal accounts.

[0010] As one possible implementation method, the scoring prediction model is learned and constructed through the following steps: Based on the real credit score, the predicted credit score, and the complexity of the decision tree, an objective function is constructed. The splitting process is as follows: In each iteration, all node attributes of the nodes in the initial decision tree are traversed, the improvement value of the node attributes is calculated based on the objective function, and when the improvement value is the largest, the corresponding node is taken as the splitting node, the splitting node is split into multiple child nodes, and the node attributes are assigned to the corresponding child nodes. Repeat the splitting process until the splitting stop condition is met, and a complete decision tree will be constructed.

[0011] As one possible implementation method, the following steps are also included: Obtain the node attributes, transaction records, and transaction amount of the corresponding transaction account for each abnormal account, and compare them one by one with the existing transaction accounts in the feature database to obtain the feature database matching score; When the feature library matching score is greater than the preset threshold, the abnormal account will be marked as a key abnormal account. The process of obtaining the feature database matching score is as follows: the node attributes of the abnormal account are compared with the node attributes in the feature database using cosine similarity to obtain the attribute similarity; the number of transactions and transaction amount of the abnormal account are aggregated at the time unit to obtain the transaction feature sequence; the DTW value of the transaction feature sequence and the feature sequence corresponding to the abnormal account in the feature database is calculated; the attribute similarity and DTW value are weighted and summed, and the highest value is taken as the feature database matching score.

[0012] An abnormal account monitoring system based on a feature graph model includes: The data acquisition module acquires transaction accounts, transaction records, and transaction amounts. It uses transaction accounts as nodes, the relationships between transaction records and transaction accounts as edges, and transaction amounts as edge weights to form a feature graph model. Each node has node attributes. The credit score addition module inputs the node attributes of each node into the scoring prediction model to obtain the predicted credit score of each node, and finds the node with the lowest predicted credit score as a neighbor node, adding the predicted credit score as a node attribute to the neighbor node. The judgment module determines whether a trading account has any abnormalities. If an abnormality is found, it is marked as an alert account, and a directed subgraph model is formed based on the alert account. The judgment and marking module calculates the balanced credit score of each node based on the predicted credit score of each node in the directed subgraph model. It iterates through all nodes in the directed subgraph model. If the balanced credit score is lower than the preset credit score threshold, the corresponding node is marked as a warning node. The result determination module determines the community where the warning node is located based on the community discovery algorithm. It traverses each community, and if there are multiple warning nodes in the community, it marks all warning accounts in the current community as abnormal accounts.

[0013] A computer-readable storage medium storing a computer program that, when executed by a processor, implements the following method: Obtain transaction accounts, transaction records, and transaction amounts. Treat transaction accounts as nodes, the interests between transaction records and transaction accounts as edges, and transaction amounts as edge weights to form a feature graph model. Each node has node attributes. Each node's node attributes are input into the rating prediction model to obtain the predicted credit score for each node. The node with the lowest predicted credit score is then identified as a neighbor node, and the predicted credit score is added as a node attribute to the neighbor node. Determine if a trading account is abnormal; if so, mark it as an alert account and form a directed subgraph model based on the alert account. Based on the predicted credit score of each node in the directed subgraph model, calculate the balanced credit score of each node. Traverse all nodes in the directed subgraph model. If the balanced credit score is lower than the preset credit score threshold, mark the corresponding node as a warning node. The community discovery algorithm determines the community where the warning node is located. Each community is traversed. If there are multiple warning nodes in the community, all warning accounts in the current community are marked as abnormal accounts.

[0014] An abnormal account monitoring device based on a feature map model includes a memory, a processor, and a computer program stored in the memory and running on the processor. When the processor executes the computer program, it implements the following method: Obtain transaction accounts, transaction records, and transaction amounts. Treat transaction accounts as nodes, the interests between transaction records and transaction accounts as edges, and transaction amounts as edge weights to form a feature graph model. Each node has node attributes. Each node's node attributes are input into the rating prediction model to obtain the predicted credit score for each node. The node with the lowest predicted credit score is then identified as a neighbor node, and the predicted credit score is added as a node attribute to the neighbor node. Determine if a trading account is abnormal; if so, mark it as an alert account and form a directed subgraph model based on the alert account. Based on the predicted credit score of each node in the directed subgraph model, calculate the balanced credit score of each node. Traverse all nodes in the directed subgraph model. If the balanced credit score is lower than the preset credit score threshold, mark the corresponding node as a warning node. The community discovery algorithm determines the community where the warning node is located. Each community is traversed. If there are multiple warning nodes in the community, all warning accounts in the current community are marked as abnormal accounts.

[0015] This invention, by adopting the above technical solutions, has significant technical effects: This invention improves the applicability of current expert rules and manual identification of abnormal accounts, and enhances accuracy and response time. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 This is a schematic diagram of the overall process of the method of the present invention; Figure 2 This is a schematic diagram of the overall structure of the system of the present invention. Detailed Implementation

[0018] The present invention will be further described in detail below with reference to the embodiments. The following embodiments are explanations of the present invention, but the present invention is not limited to the following embodiments.

[0019] Example 1: An abnormal account monitoring method based on feature graph model, such as Figure 1 As shown, it includes the following steps: S100. Obtain the transaction account, transaction record, and transaction amount. Use the transaction account as a node, the interest relationship between the transaction record and the transaction account as an edge, and the transaction amount as the weight of the edge to form a feature graph model. Each node has node attributes. S200. Input the node attributes of each node into the rating prediction model to obtain the predicted credit score of each node, and find the node with the lowest predicted credit score as the neighbor node, and add the predicted credit score as a node attribute to the neighbor node. S300: Determine if there are any abnormalities in the trading account. If there are abnormalities, mark it as an alert account and form a directed subgraph model based on the alert account. S400. Based on the predicted credit score of each node in the directed subgraph model, calculate the balanced credit score of each node. Traverse all nodes in the directed subgraph model. If the balanced credit score is lower than the preset credit score threshold, mark the corresponding node as a warning node. S500: Based on the community discovery algorithm, determine the community where the warning node is located, traverse each community, and if there are multiple warning nodes in the community, mark all warning accounts in the current community as abnormal accounts.

[0020] Steps S100, S200, and S300 can be understood as the data preparation process, which involves obtaining transaction accounts, transaction records, and transaction amounts within a specific time period. The transaction amount can be the transaction amount of various financial products, and the transaction account can be an individual or a corporate entity. The individuals or corporate entities and their accounts constitute the nodes of the feature graph model. The nodes have node attributes, including account opening information, asset holdings, etc. The transaction records between transaction accounts and the interests between entities constitute the edges of the feature graph model. The transaction record attributes include transaction amount, transaction time, etc., and the interest attribute includes relationship type, etc. The transaction amount and the transaction amount of other financial products are used as the weights of the edges. All data will be retained according to the transaction time, retaining the transaction record data of the most recent d days. d can usually be 30. Here, d can be understood as a specific time.

[0021] For each node, its own node attributes are input into the rating prediction model to obtain the credit score for each node. The rating prediction model typically uses a supervised training decision tree model, such as XGBoost. Assuming each node has the same number of m attributes, let the attribute of the i-th node be denoted as... Real credit is divided into Predicting credit scores Then the objective function is ,in, The complexity of the k-th tree is It is the sum of the number of leaf nodes T and the squares of the node weights. The linear combination representation, and These are the hyperparameters of the model. A single splitting process is as follows: In each iteration, all node attributes of the nodes in the initial decision tree are traversed. The improvement value of the node attribute is calculated based on the objective function. When the improvement value is maximized, the corresponding node is designated as the splitting node, splitting it into multiple child nodes, and the node attributes are assigned to the corresponding child nodes. This splitting process is repeated until the splitting stopping condition is met, thus constructing a complete decision tree.

[0022] In one embodiment, finding the node with the lowest predicted credit score as a neighbor node and adding the predicted credit score as a node attribute to the neighbor node includes the following steps: Each transaction account's node is taken as the current node. In the feature graph model, all first neighbor nodes belonging to the current node are found, and several first neighbor nodes with the lowest credit scores are selected as neighbors. If any two nodes in the feature graph model are connected by only one edge, then those two nodes are neighbors. The order and credit scores of the neighbor nodes are obtained, and the average credit score of all neighbor nodes is calculated. This average credit score is then added as a predicted credit score attribute to the node representing the corresponding entity. The average credit score is expressed as: ,in, This represents the credit score of neighboring nodes, where k represents the number of neighboring nodes with the lowest credit scores to select. The purpose of this step is to ensure that the node attributes on each node have an estimated credit score, which will make the subsequent detection of alerted accounts more accurate.

[0023] In one embodiment, the number and amount of transfers for each transaction account are monitored. When the change in the number of transactions and the magnitude of the change both exceed preset values ​​in a recent period, such as an increase of 10 transactions in the past 7 days with a month-on-month increase of more than 5%, the transaction account is marked as a warning account. When a transaction account is marked as a warning account, based on the previous data source, the transaction records and associated transaction accounts within the past t days (usually t=7) are first searched. Then, nodes are formed by these transaction accounts and their owners, such as individuals or enterprises, and edges are formed by the interests between the transaction records and entities, thus forming a directed subgraph model.

[0024] For a directed subgraph model, traverse all nodes. If a node's balanced credit score is lower than a preset credit score threshold, mark it as a warning node. This includes the following steps: Based on the directed subgraph model, the estimated credit score of each node is used as the initial value of the credit score, and the balanced credit score is calculated based on the balanced credit score model. Traverse all nodes, find all nodes whose balanced credit scores are lower than the preset credit score threshold, and mark them as warning nodes; The balanced credit score model is expressed as follows: ; in, This represents the balanced credit score, and n represents the subgraph node number. This indicates the initial credit score corresponding to the i-th node. This represents the adjacency matrix of a directed subgraph model.

[0025] In one embodiment, the step of determining the community where the warning node is located based on the community discovery algorithm, traversing each community, and if there are multiple warning nodes within a community, marking all warning accounts in the current community as abnormal accounts includes the following steps: Get all nodes in the directed subgraph model, select the first node and the first edge that are related to the node within four steps; determine the community to which the first node belongs through the community detection algorithm, specifically: get the weight of each first edge and the weight of each first node, get the sum of the weights of the first edges inside the community and the sum of the weights of the first edges connected to all the first nodes contained in the community, and then get the total degree of the modularity. When the total degree of the modularity reaches the maximum value, the community division is complete. Traverse each community. If there are at least n warning nodes in the same community, mark all warning accounts in the community as abnormal accounts. The total modularity used in this embodiment is represented as follows:

[0026] in, This represents the sum of the edge weights within the community. Let m represent the sum of the weights of all edges connected to all nodes within the community, m represent the sum of the weights of all edges in the graph, and Q represent the total modularity.

[0027] In one embodiment, abnormal accounts are compared one by one with the feature database. Accounts that pass the comparison are marked as key abnormal accounts. Key abnormal accounts undergo manual review, and abnormal accounts not marked as key abnormal accounts undergo manual spot checks. Accounts confirmed as abnormal by manual review are added to the feature database. Specifically, for each abnormal account, the node's own attributes and transaction records are taken and compared with the existing accounts in the feature database one by one. Specifically, the cosine similarity between the node attributes of the abnormal account and the node attributes in the feature database is calculated; the number of transactions and the amount of the abnormal account are aggregated at the hourly granularity to obtain a transaction feature sequence; the DTW value of the feature sequence is calculated with the feature sequences of abnormal accounts in the feature database; the cosine similarity and DTW value are weighted and summed, and the highest value is taken to obtain the feature database matching score. The cosine similarity used in this embodiment is expressed as follows:

[0028] in, The node attributes that represent abnormal accounts. This represents the node attributes of existing accounts in the feature database, and A represents the cosine similarity.

[0029] The feature library matching score used in this embodiment is represented as follows:

[0030] in, This represents the cosine similarity between the abnormal account and the m-th record in the feature database. DTW value represents the feature sequence of the abnormal account and the m-th record in the feature database, and S represents the feature database matching score; When S is greater than the preset value, the abnormal account will be marked as a key abnormal account.

[0031] All key abnormal accounts and randomly selected abnormal accounts that were not marked as key abnormal accounts were submitted for manual review, and accounts confirmed to be abnormal were added to the feature database.

[0032] Example 2: An abnormal account monitoring system based on a feature graph model, such as Figure 2 As shown, it includes: The data acquisition module 100 acquires transaction accounts and transaction records, uses transaction accounts as nodes, and uses the interests between transaction records and transaction accounts as edges to form a feature graph model, where each node has node attributes. The credit score addition module 200 inputs the node attributes of each node into the scoring prediction model to obtain the predicted credit score of each node, and finds the node with the lowest predicted credit score as a neighbor node, adding the predicted credit score as a node attribute to the neighbor node. The judgment module 300 determines whether there are any abnormalities in the trading account. If there are abnormalities, it marks the account as an early warning account and forms a directed subgraph model based on the early warning account. The judgment and marking module 400 calculates the balanced credit score of each node based on the predicted credit score of each node in the directed subgraph model. It iterates through all nodes in the directed subgraph model. If the balanced credit score is lower than the preset credit score threshold, the corresponding node is marked as a warning node. The result determination module 500 determines the community where the warning node is located based on the community discovery algorithm. It traverses each community, and if there are multiple warning nodes in the community, it marks all warning accounts in the current community as abnormal accounts.

[0033] Various changes and modifications made without departing from the spirit and scope of this invention, and all equivalent technical solutions, also fall within the scope of this invention.

[0034] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0035] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, apparatus, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0036] This invention is described with reference to flowchart illustrations and / or block diagrams of the method, terminal device (system), and computer program product according to the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing terminal device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing terminal device, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0037] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing terminal device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0038] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal equipment, causing a series of operational steps to be performed on the computer or other programmable terminal equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable terminal equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0039] It should be noted that: The phrase "an embodiment" or "an embodiment" used in this specification means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the invention. Therefore, the phrase "an embodiment" or "an embodiment" appearing in various places throughout the specification does not necessarily refer to the same embodiment.

[0040] Furthermore, it should be noted that the shapes and names of the parts and components described in the specific embodiments described in this specification may differ. All equivalent or simple variations made to the structure, features, and principles described in this patent concept are included within the protection scope of this patent. Those skilled in the art to which this invention pertains may make various modifications or additions to the described specific embodiments or use similar methods to replace them, as long as they do not depart from the structure of this invention or exceed the scope defined in these claims, they should all fall within the protection scope of this invention.

Claims

1. A feature map model-based abnormal account monitoring method, characterized in that, The method comprises the following steps: obtaining a transaction account, a transaction record and a transaction amount, taking the transaction account as a node, taking a relationship between the transaction record and the transaction account as an edge, and taking the transaction amount as a weight of the edge to form a feature graph model, each node having a node attribute; inputting the node attribute of each node into a score prediction model to obtain a predicted credit score of each node, and finding a node with the lowest predicted credit score as a neighbor node and adding the predicted credit score as a node attribute to the neighbor node; judging whether the transaction account is abnormal, and if so, marking the transaction account as a warning account, and forming a directed subgraph model based on the warning account; calculating a balanced credit score of each node based on the predicted credit score of each node in the directed subgraph model, and traversing all nodes of the directed subgraph model, and if the balanced credit score is lower than a preset credit score threshold, marking the corresponding node as a warning node; determining a community in which the warning node is located based on a community discovery algorithm, and traversing each community, and if there are multiple warning nodes in the community, marking all warning accounts in the current community as abnormal accounts. 2.The feature map model based abnormal account monitoring method of claim 1, wherein, The finding of the node with the lowest predicted credit score as the neighbor node and the adding of the predicted credit score as the node attribute to the neighbor node comprises the following steps: taking each transaction account as a node, finding all first neighbor nodes belonging to the current node in the feature graph model, and selecting a plurality of first neighbor nodes with the lowest credit scores as neighbor nodes, wherein if there is only one edge connecting two nodes in the feature graph model, the two nodes are neighbor nodes; obtaining the order and credit score of the neighbor nodes, obtaining the average credit score of all neighbor nodes, and adding the average credit score as an estimated credit score attribute to the node represented by the corresponding entity. 3.The feature map model based abnormal account monitoring method of claim 1, wherein, The forming of the directed subgraph model based on the warning account comprises the following steps: 4.The feature map model based abnormal account monitoring method of claim 1, wherein, obtaining the transaction record and the associated account of the warning account, taking the warning account and the associated account as nodes, taking the relationship between the transaction record and the transaction account as an edge, and forming a directed subgraph model of the warning account. Traversing all nodes, if the balanced credit score of the corresponding node is lower than the preset credit score threshold, marking the corresponding node as a warning node, comprising the following steps: based on the directed subgraph model, taking the estimated credit score of each node as an initial credit score, and calculating the balanced credit score based on a balanced credit score model; The balanced credit score model is represented as: ; wherein, represents the balanced credit score, n represents the node number of the subgraph, represents the initial credit score corresponding to the i-th node, represents the adjacency matrix of the directed subgraph model. 5.The feature map model based abnormal account monitoring method of claim 1, wherein, traversing all nodes, finding all nodes with a balanced credit score lower than a preset credit score threshold and marking them as warning nodes; The determination of the community in which the warning node is located based on the community discovery algorithm, the traversal of each community, and the marking of all warning accounts in the current community as abnormal accounts if there are multiple warning nodes in the community, comprises the following steps: obtaining all nodes of the directed subgraph model, selecting a first node and a first edge associated with the node within four steps; determining the community in which the first node is located through a community discovery algorithm, specifically: obtaining the weight of each first edge and the weight of each first node, obtaining the weight sum of the first edges inside the community and the weight sum of the first edges connected to all first nodes contained in the community, and then obtaining the total sum of modularity, when the total sum of modularity reaches the maximum value, the community division is completed; Traverse each community, if there are at least n warning nodes in the same community, mark all warning accounts in the community as abnormal accounts. 6.The feature graph model based abnormal account monitoring method of claim 1, wherein, The scoring prediction model is learned and constructed by the following steps: Based on the real credit score, the predicted credit score and the decision tree complexity, a target function is constructed. The splitting process is performed, specifically: in each iteration, traverse all node attributes of the initial decision tree nodes, calculate the improvement value of the node attribute based on the target function, when the improvement value is maximum, the corresponding node is taken as the split node, the split node is split into multiple sub-nodes, and the node attribute is assigned to the corresponding sub-node. Repeat the splitting process until the splitting stop condition is met, and a complete decision tree is constructed. 7.The feature map model based abnormal account monitoring method of claim 1, wherein, Further comprising the following steps: Obtain the node attribute, transaction record and transaction amount of each abnormal account corresponding to the transaction account, and compare them with the existing transaction accounts in the feature database one by one to obtain the feature library matching score; When the feature library matching score is greater than the preset threshold, the abnormal account is marked as a key abnormal account; The process of obtaining the feature library matching score is: the node attribute of the abnormal account and the node attribute in the feature database are calculated by cosine similarity to obtain the attribute similarity; the transaction frequency and transaction amount of the abnormal account are aggregated based on the time unit to obtain the transaction feature sequence, and the DTW value of the transaction feature sequence and the feature sequence corresponding to the abnormal account in the feature database is calculated; the attribute similarity and the DTW value are weighted and summed to obtain the highest value, which is the feature library matching score.

8. An anomaly account monitoring system based on a feature map model, the system comprising: It includes: The data acquisition module acquires transaction accounts, transaction records and transaction amounts, takes the transaction accounts as nodes, takes the interests and relationships between the transaction records and the transaction accounts as edges, and takes the transaction amounts as edge weights to form a feature graph model, each node has a node attribute; The credit score adding module inputs the node attribute of each node into the scoring prediction model to obtain the predicted credit score of each node, and finds the node with the lowest predicted credit score as the neighbor node, and adds the predicted credit score as the node attribute to the neighbor node; The judgment forming module judges whether the transaction account is abnormal, and if it is abnormal, it is marked as a warning account, and a directed subgraph model is formed based on the warning account; The judgment marking module calculates the balance credit score of each node in the directed subgraph model based on the predicted credit score of each node in the directed subgraph model, and traverses all nodes of the directed subgraph model, if the balance credit score is lower than the preset credit score threshold, the corresponding node is marked as a warning node; The result determination module determines the community where the warning node is located based on the community discovery algorithm, traverses each community, if there are multiple warning nodes in the community, mark all warning accounts in the current community as abnormal accounts.

9. A computer-readable storage medium storing a computer program, the computer program comprising instructions that, when executed by a computer, cause the computer to perform the method of any one of claims 1 to 8. The computer program is executed by the processor to realize the method of any one of claims 1 to 6.

10. An abnormal account monitoring apparatus based on a feature map model, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, The processor executes the computer program to realize the method of any one of claims 1 to 6.

Images