Abnormal account monitoring method, system and device based on feature map model

Abstract

The application discloses an abnormal account monitoring method, system and device based on a feature graph model, and the method comprises the following steps: acquiring a transaction account and a transaction record to form a feature graph model; inputting the node attribute of each node into a scoring prediction model to obtain the predicted credit score of each node, and searching for a neighbor node; the predicted credit score is added to the neighbor node as a node attribute; it is judged whether the transaction account is abnormal, if abnormal, it is marked as a warning account, and a directed subgraph model is formed based on the warning account; based on the predicted credit score of each node in the directed subgraph model, the balance credit score of each node is calculated, all nodes of the directed subgraph model are traversed, if the balance credit score is lower than a preset credit score threshold, it is marked as a warning node; the community where the warning node is located is determined, each community is traversed, if there are multiple warning nodes in the community, all warning accounts are marked as abnormal accounts. The application improves the accuracy and response time.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of big data, and particularly relates to an abnormal account monitoring method, system and device based on a feature graph model. BACKGROUND

[0002] With the rapid development of Internet technology and application, various Internet services and platforms emerge as the times require, in order to meet the regulatory requirements for these Internet services and platforms, risk monitoring technology has been widely applied.

[0003] At present, the method for identifying network financial violations is relatively simple, basically all through expert rules to make judgments, but it is difficult to detect abnormal financial transaction behaviors in complex fund flow, in addition, it is difficult for expert rules to track dynamically changing abnormal financial transaction strategies. Machine learning methods are also used for judgment, but this method often requires sample labeling, and sample labeling of abnormal financial transaction behaviors is difficult and the samples are relatively few, so there are challenges in training and verification of machine learning models, resulting in missed detection and false detection, leading to a high false detection rate of abnormal detection. SUMMARY

[0004] The present application provides an abnormal account monitoring method, system and device based on a feature graph model to solve the problems in the prior art.

[0005] To solve the above technical problems, the present application solves the problems by the following technical solutions:

[0006] An abnormal account monitoring method based on a feature graph model, comprising the following steps:

[0007] Obtaining a transaction account, transaction records and transaction amounts, taking the transaction account as a node, taking the relationship between the transaction records and the transaction account as an edge, and taking the transaction amount as the weight of the edge to form a feature graph model, each node having a node attribute;

[0008] Inputting the node attribute of each node into a scoring prediction model to obtain a predicted credit score of each node, and finding a node with the lowest predicted credit score as a neighbor node, and adding the predicted credit score as a node attribute to the neighbor node;

[0009] Judging whether the transaction account is abnormal, if so, marking it as a pre-warning account, and forming a directed subgraph model based on the pre-warning account;

[0010] Based on the predicted credit score of each node in the directed subgraph model, calculating the balance credit score of each node, and traversing all nodes of the directed subgraph model, if the balance credit score is lower than a preset credit score threshold, marking the corresponding node as a pre-warning node;

[0011] Determine the community where the early warning node is located based on a community discovery algorithm, traverse each community, and if there are multiple early warning nodes in the community, mark all early warning accounts in the current community as abnormal accounts.

[0012] As an implementable manner, the node with the lowest predicted credit score is searched as a neighbor node, and the predicted credit score is added to the neighbor node as a node attribute, including the following steps:

[0013] Each transaction account represents a node as a current node, all first neighbor nodes belonging to the current node are searched in the feature graph model, and several first neighbor nodes with the lowest credit scores are selected as neighbor nodes, wherein if there is only one edge between two nodes in the feature graph model, the two nodes are neighbor nodes;

[0014] The order and credit score of the neighbor node are obtained, the average credit score of all neighbor nodes is obtained, and the average credit score is added to the node represented by the corresponding entity as an estimated credit score attribute.

[0015] As an implementable manner, a directed subgraph model is formed based on the early warning account, specifically: obtaining the transaction records and associated accounts of the early warning account, and based on the early warning account and the associated account, nodes are constituted, and the interests and relationships between the transaction records and the transaction accounts are edges, forming a directed subgraph model of the early warning account.

[0016] As an implementable manner, all nodes are traversed, and if the balance credit score is lower than the node corresponding to the preset credit score threshold, the node is marked as an early warning node, including the following steps:

[0017] Based on the directed subgraph model, the estimated credit score of each node is taken as the initial credit score, and the balance credit score is calculated based on the balance credit score model;

[0018] Traverse all nodes to find all nodes corresponding to the preset credit score threshold and mark them as early warning nodes;

[0019] The balance credit score model is represented as: ;

[0020] wherein, n represents the node number of the subgraph, represents the initial credit score corresponding to the i-th node, represents the adjacency matrix of the directed subgraph model.

[0021] As an implementable manner, the community where the early warning node is located is determined based on a community discovery algorithm, each community is traversed, and if there are multiple early warning nodes in the community, all early warning accounts in the current community are marked as abnormal accounts, including the following steps:

[0022] obtaining all nodes of the directed subgraph model, selecting a first node and a first edge associated with the node within four steps;

[0023] determining a community in which the first node is located by a community discovery algorithm, specifically, obtaining a weight of each first edge and a weight of each first node, obtaining a weight sum of the first edges within the community and a weight sum of the first edges connected to all first nodes contained in the community, and then obtaining a modularity sum, when the modularity sum reaches a maximum value, the community division is completed;

[0024] traversing each community, if there are at least n early warning nodes in the same community, marking all early warning accounts in the community as abnormal accounts.

[0025] As an implementable manner, the scoring prediction model is learned and constructed by the following steps:

[0026] Based on the real credit score, the predicted credit score and the complexity of the decision tree, a target function is constructed;

[0027] The splitting process is performed, specifically, in each iteration, all node attributes of the nodes in the initial decision tree are traversed, the improvement value of the node attribute is calculated based on the target function, when the improvement value is maximum, the corresponding node is taken as a split node, the split node is split into multiple sub-nodes, and the node attribute is assigned to the corresponding sub-node;

[0028] The splitting process is repeated until the splitting stop condition is met, and a complete decision tree is constructed.

[0029] As an implementable manner, the following steps are further included:

[0030] Obtaining the node attribute, transaction record and transaction amount of each abnormal account corresponding to the transaction account, and comparing with the existing transaction accounts in the feature database one by one to obtain a feature library matching score;

[0031] When the feature library matching score is greater than a preset threshold, the abnormal account is marked as a key abnormal account;

[0032] The process of obtaining the feature library matching score is: the node attribute of the abnormal account and the node attribute in the feature database are calculated by cosine similarity to obtain an attribute similarity; the transaction frequency and the transaction amount of the abnormal account are aggregated based on the time unit to obtain a transaction feature sequence, and the DTW value of the transaction feature sequence and the feature sequence corresponding to the abnormal account in the feature database is calculated; the attribute similarity and the DTW value are weighted and summed to obtain the highest value, which is the feature library matching score.

[0033] An abnormal account monitoring system based on a feature map model, comprising:

[0034] A data acquisition module acquires a transaction account, a transaction record, and a transaction amount, takes the transaction account as a node, takes a relationship between the transaction record and the transaction account as an edge, takes the transaction amount as a weight of the edge, forms a feature graph model, and each node has a node attribute;

[0035] A credit score adding module inputs the node attribute of each node into a score prediction model, obtains a predicted credit score of each node, finds a node with the lowest predicted credit score as a neighbor node, and adds the predicted credit score as a node attribute to the neighbor node;

[0036] A judgment forming module judges whether the transaction account is abnormal, and if so, marks it as a pre-warning account, and forms a directed subgraph model based on the pre-warning account;

[0037] A judgment marking module calculates a balanced credit score of each node based on the predicted credit score of each node in the directed subgraph model, traverses all nodes of the directed subgraph model, and if the balanced credit score is lower than a preset credit score threshold, marks the corresponding node as a pre-warning node;

[0038] A result determining module determines a community in which the pre-warning node is located based on a community discovery algorithm, traverses each community, and if there are multiple pre-warning nodes in the community, marks all pre-warning accounts in the current community as abnormal accounts.

[0039] A computer readable storage medium stores a computer program, and the computer program is executed by a processor to implement the method described below:

[0040] A data acquisition module acquires a transaction account, a transaction record, and a transaction amount, takes the transaction account as a node, takes a relationship between the transaction record and the transaction account as an edge, takes the transaction amount as a weight of the edge, forms a feature graph model, and each node has a node attribute;

[0041] A credit score adding module inputs the node attribute of each node into a score prediction model, obtains a predicted credit score of each node, finds a node with the lowest predicted credit score as a neighbor node, and adds the predicted credit score as a node attribute to the neighbor node;

[0042] A judgment forming module judges whether the transaction account is abnormal, and if so, marks it as a pre-warning account, and forms a directed subgraph model based on the pre-warning account;

[0043] A judgment marking module calculates a balanced credit score of each node based on the predicted credit score of each node in the directed subgraph model, traverses all nodes of the directed subgraph model, and if the balanced credit score is lower than a preset credit score threshold, marks the corresponding node as a pre-warning node;

[0044] The community discovery algorithm determines the community where the warning node is located. Each community is traversed. If there are multiple warning nodes in the community, all warning accounts in the current community are marked as abnormal accounts.

[0045] An abnormal account monitoring device based on a feature map model includes a memory, a processor, and a computer program stored in the memory and running on the processor. When the processor executes the computer program, it implements the following method:

[0046] Obtain transaction accounts, transaction records, and transaction amounts. Treat transaction accounts as nodes, the interests between transaction records and transaction accounts as edges, and transaction amounts as edge weights to form a feature graph model. Each node has node attributes.

[0047] Each node's node attributes are input into the rating prediction model to obtain the predicted credit score for each node. The node with the lowest predicted credit score is then identified as a neighbor node, and the predicted credit score is added as a node attribute to the neighbor node.

[0048] Determine if a trading account is abnormal; if so, mark it as an alert account and form a directed subgraph model based on the alert account.

[0049] Based on the predicted credit score of each node in the directed subgraph model, calculate the balanced credit score of each node. Traverse all nodes in the directed subgraph model. If the balanced credit score is lower than the preset credit score threshold, mark the corresponding node as a warning node.

[0050] The community discovery algorithm determines the community where the warning node is located. Each community is traversed. If there are multiple warning nodes in the community, all warning accounts in the current community are marked as abnormal accounts.

[0051] This invention, by adopting the above technical solutions, has significant technical effects:

[0052] This invention improves the applicability of current expert rules and manual identification of abnormal accounts, and enhances accuracy and response time. Attached Figure Description

[0053] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0054] Figure 1 This is a schematic diagram of the overall process of the method of the present invention;

[0055] Figure 2 This is a schematic diagram of the overall structure of the system of the present invention. Detailed Implementation

[0056] The present invention will be further described in detail below with reference to the embodiments. The following embodiments are explanations of the present invention, but the present invention is not limited to the following embodiments.

[0057] Example 1:

[0058] An abnormal account monitoring method based on feature graph model, such as Figure 1 As shown, it includes the following steps:

[0059] S100. Obtain the transaction account, transaction record, and transaction amount. Use the transaction account as a node, the interest relationship between the transaction record and the transaction account as an edge, and the transaction amount as the weight of the edge to form a feature graph model. Each node has node attributes.

[0060] S200. Input the node attributes of each node into the rating prediction model to obtain the predicted credit score of each node, and find the node with the lowest predicted credit score as the neighbor node, and add the predicted credit score as a node attribute to the neighbor node.

[0061] S300: Determine if there are any abnormalities in the trading account. If there are abnormalities, mark it as an alert account and form a directed subgraph model based on the alert account.

[0062] S400. Based on the predicted credit score of each node in the directed subgraph model, calculate the balanced credit score of each node. Traverse all nodes in the directed subgraph model. If the balanced credit score is lower than the preset credit score threshold, mark the corresponding node as a warning node.

[0063] S500: Based on the community discovery algorithm, determine the community where the warning node is located, traverse each community, and if there are multiple warning nodes in the community, mark all warning accounts in the current community as abnormal accounts.

[0064] Steps S100, S200, and S300 can be understood as the data preparation process, which involves obtaining transaction accounts, transaction records, and transaction amounts within a specific time period. The transaction amount can be the transaction amount of various financial products, and the transaction account can be an individual or a corporate entity. The individuals or corporate entities and their accounts constitute the nodes of the feature graph model. The nodes have node attributes, including account opening information, asset holdings, etc. The transaction records between transaction accounts and the interests between entities constitute the edges of the feature graph model. The transaction record attributes include transaction amount, transaction time, etc., and the interest attribute includes relationship type, etc. The transaction amount and the transaction amount of other financial products are used as the weights of the edges. All data will be retained according to the transaction time, retaining the transaction record data of the most recent d days. d can usually be 30. Here, d can be understood as a specific time.

[0065] For each node, its own node attributes are input into the rating prediction model to obtain the credit score for each node. The rating prediction model typically uses a supervised training decision tree model, such as XGBoost. Assuming each node has the same number of m attributes, let the attribute of the i-th node be denoted as... Real credit is divided into Predicting credit scores Then the objective function is ,in, The complexity of the k-th tree is It is the sum of the number of leaf nodes T and the squares of the node weights. The linear combination representation, and These are the hyperparameters of the model. A single splitting process is as follows: In each iteration, all node attributes of the nodes in the initial decision tree are traversed. The improvement value of the node attribute is calculated based on the objective function. When the improvement value is maximized, the corresponding node is designated as the splitting node, splitting it into multiple child nodes, and the node attributes are assigned to the corresponding child nodes. This splitting process is repeated until the splitting stopping condition is met, thus constructing a complete decision tree.

[0066] In one embodiment, finding the node with the lowest predicted credit score as a neighbor node and adding the predicted credit score as a node attribute to the neighbor node includes the following steps:

[0067] Each transaction account's node is taken as the current node. In the feature graph model, all first neighbor nodes belonging to the current node are found, and several first neighbor nodes with the lowest credit scores are selected as neighbors. If any two nodes in the feature graph model are connected by only one edge, then those two nodes are neighbors. The order and credit scores of the neighbor nodes are obtained, and the average credit score of all neighbor nodes is calculated. This average credit score is then added as a predicted credit score attribute to the node representing the corresponding entity. The average credit score is expressed as: ,in, This represents the credit score of neighboring nodes, where k represents the number of neighboring nodes with the lowest credit scores to select. The purpose of this step is to ensure that the node attributes on each node have an estimated credit score, which will make the subsequent detection of alerted accounts more accurate.

[0068] In one embodiment, the number and amount of transfers for each transaction account are monitored. When the change in the number of transactions and the magnitude of the change both exceed preset values ​​in a recent period, such as an increase of 10 transactions in the past 7 days with a month-on-month increase of more than 5%, the transaction account is marked as a warning account. When a transaction account is marked as a warning account, based on the previous data source, the transaction records and associated transaction accounts within the past t days (usually t=7) are first searched. Then, nodes are formed by these transaction accounts and their owners, such as individuals or enterprises, and edges are formed by the interests between the transaction records and entities, thus forming a directed subgraph model.

[0069] For a directed subgraph model, traverse all nodes. If a node's balanced credit score is lower than a preset credit score threshold, mark it as a warning node. This includes the following steps:

[0070] Based on the directed subgraph model, the estimated credit score of each node is used as the initial value of the credit score, and the balanced credit score is calculated based on the balanced credit score model.

[0071] Traverse all nodes, find all nodes whose balanced credit score is lower than the preset credit score threshold, and mark them as warning nodes;

[0072] The balanced credit score model is expressed as follows: ;

[0073] in, This represents the balanced credit score, and n represents the subgraph node number. This indicates the initial credit score corresponding to the i-th node. This represents the adjacency matrix of a directed subgraph model.

[0074] In one embodiment, the step of determining the community where the warning node is located based on the community discovery algorithm, traversing each community, and if there are multiple warning nodes within a community, marking all warning accounts in the current community as abnormal accounts includes the following steps:

[0075] Get all nodes in the directed subgraph model, select the first node and the first edge that are related to the node within four steps; determine the community to which the first node belongs through the community detection algorithm, specifically: get the weight of each first edge and the weight of each first node, get the sum of the weights of the first edges inside the community and the sum of the weights of the first edges connected to all the first nodes contained in the community, and then get the total degree of the modularity. When the total degree of the modularity reaches the maximum value, the community division is complete.

[0076] Traverse each community. If there are at least n warning nodes in the same community, mark all warning accounts in the community as abnormal accounts.

[0077] The total modularity used in this embodiment is represented as follows:

[0078]

[0079] in, This represents the sum of the edge weights within the community. Let m represent the sum of the weights of all edges connected to all nodes within the community, m represent the sum of the weights of all edges in the graph, and Q represent the total modularity.

[0080] In one embodiment, abnormal accounts are compared one by one with the feature database. Accounts that pass the comparison are marked as key abnormal accounts. Key abnormal accounts undergo manual review, and abnormal accounts not marked as key abnormal accounts undergo manual spot checks. Accounts confirmed as abnormal by manual review are added to the feature database. Specifically, for each abnormal account, the node's own attributes and transaction records are taken and compared with the existing accounts in the feature database one by one. Specifically, the cosine similarity between the node attributes of the abnormal account and the node attributes in the feature database is calculated; the number of transactions and the amount of the abnormal account are aggregated at the hourly granularity to obtain a transaction feature sequence; the DTW value of the feature sequence is calculated with the feature sequences of abnormal accounts in the feature database; the cosine similarity and DTW value are weighted and summed, and the highest value is taken to obtain the feature database matching score.

[0081] The cosine similarity used in this embodiment is expressed as follows:

[0082]

[0083] in, The node attributes that represent abnormal accounts. This represents the node attributes of existing accounts in the feature database, and A represents the cosine similarity.

[0084] The feature library matching score used in this embodiment is represented as follows:

[0085]

[0086] in, This represents the cosine similarity between the abnormal account and the m-th record in the feature database. DTW value represents the feature sequence of the abnormal account and the m-th record in the feature database, and S represents the feature database matching score;

[0087] When S is greater than the preset value, the abnormal account will be marked as a key abnormal account.

[0088] All key abnormal accounts and randomly selected abnormal accounts that were not marked as key abnormal accounts were submitted for manual review, and accounts confirmed to be abnormal were added to the feature database.

[0089] Example 2:

[0090] An abnormal account monitoring system based on a feature graph model, such as Figure 2 As shown, it includes:

[0091] The data acquisition module 100 acquires transaction accounts and transaction records, uses transaction accounts as nodes, and uses the interests between transaction records and transaction accounts as edges to form a feature graph model, where each node has node attributes.

[0092] The credit score addition module 200 inputs the node attributes of each node into the scoring prediction model to obtain the predicted credit score of each node, and finds the node with the lowest predicted credit score as a neighbor node, adding the predicted credit score as a node attribute to the neighbor node.

[0093] The judgment module 300 determines whether there are any abnormalities in the trading account. If there are abnormalities, it marks the account as an early warning account and forms a directed subgraph model based on the early warning account.

[0094] The judgment and marking module 400 calculates the balanced credit score of each node based on the predicted credit score of each node in the directed subgraph model. It iterates through all nodes in the directed subgraph model. If the balanced credit score is lower than the preset credit score threshold, the corresponding node is marked as a warning node.

[0095] The result determination module 500 determines the community where the warning node is located based on the community discovery algorithm. It traverses each community, and if there are multiple warning nodes in the community, it marks all warning accounts in the current community as abnormal accounts.

[0096] Various changes and modifications made without departing from the spirit and scope of this invention, and all equivalent technical solutions, also fall within the scope of this invention.

[0097] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0098] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, apparatus, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0099] This invention is described with reference to flowchart illustrations and / or block diagrams of the method, terminal device (system), and computer program product according to the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing terminal device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing terminal device, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0100] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing terminal device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0101] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal equipment, causing a series of operational steps to be performed on the computer or other programmable terminal equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable terminal equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0102] It should be noted that:

[0103] The phrase "an embodiment" or "an embodiment" used in this specification means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the invention. Therefore, the phrase "an embodiment" or "an embodiment" appearing in various places throughout the specification does not necessarily refer to the same embodiment.

[0104] Furthermore, it should be noted that the shapes and names of the parts and components described in the specific embodiments described in this specification may differ. All equivalent or simple variations made to the structure, features, and principles described in this patent concept are included within the protection scope of this patent. Those skilled in the art to which this invention pertains may make various modifications or additions to the described specific embodiments or use similar methods to replace them, as long as they do not depart from the structure of this invention or exceed the scope defined in these claims, they should all fall within the protection scope of this invention.

Claims

1. A method for detecting abnormal accounts based on a feature graph model, characterized in that, Includes the following steps: Obtain transaction accounts, transaction records, and transaction amounts. Treat transaction accounts as nodes, the interests between transaction records and transaction accounts as edges, and transaction amounts as edge weights to form a feature graph model. Each node has node attributes. Each node's node attributes are input into the rating prediction model to obtain the predicted credit score for each node. The node with the lowest predicted credit score is then identified as a neighbor node, and the predicted credit score is added as a node attribute to the neighbor node. Determine if a trading account is abnormal; if so, mark it as an alert account and form a directed subgraph model based on the alert account. Based on the predicted credit score of each node in the directed subgraph model, calculate the balanced credit score of each node. Traverse all nodes in the directed subgraph model. If the balanced credit score is lower than the preset credit score threshold, mark the corresponding node as a warning node. The community discovery algorithm determines the community where the warning node is located. Each community is traversed. If there are multiple warning nodes in the community, all warning accounts in the current community are marked as abnormal accounts.

2. The abnormal account monitoring method based on feature graph model according to claim 1, characterized in that, The process of finding the node with the lowest predicted credit score as a neighbor node and adding the predicted credit score as a node attribute to the neighbor node includes the following steps: Take the node represented by each transaction account as the current node, find all the first neighbor nodes belonging to the current node in the feature graph model, and select several first neighbor nodes with the lowest credit scores as neighbor nodes. If there is only one edge connecting each pair of nodes in the feature graph model, then each pair of nodes is a neighbor node. Obtain the order and credit score of neighboring nodes, get the average credit score of all neighboring nodes, and add the average credit score as the estimated credit score attribute to the node represented by the corresponding entity.

3. The abnormal account monitoring method based on feature graph model according to claim 1, characterized in that, The method of forming a directed subgraph model based on the early warning account specifically involves: obtaining the transaction records and associated accounts of the early warning account, forming a directed subgraph model of the early warning account based on the early warning account and associated accounts as nodes, and using the interest relationships between the transaction records and transaction accounts as edges.

4. The abnormal account monitoring method based on feature graph model according to claim 1, characterized in that, Traverse all nodes. If a node's balanced credit score is lower than a preset credit score threshold, mark it as a warning node, including the following steps: Based on the directed subgraph model, the estimated credit score of each node is used as the initial value of the credit score, and the balanced credit score is calculated based on the balanced credit score model. Traverse all nodes, find all nodes whose balanced credit score is lower than the preset credit score threshold, and mark them as warning nodes; The balanced credit score model is expressed as follows: ; in, This represents the balanced credit score, and n represents the subgraph node number. Indicates the first Each node corresponds to an initial credit score. This represents the adjacency matrix of a directed subgraph model.

5. The abnormal account monitoring method based on feature graph model according to claim 1, characterized in that, The process of determining the community where the early warning node is located based on the community discovery algorithm, traversing each community, and if there are multiple early warning nodes within the community, then marking all early warning accounts in the current community as abnormal accounts includes the following steps: Get all nodes of the directed subgraph model, and select the first node and the first edge that are related to the node within four steps. The community discovery algorithm determines the community to which the first node belongs. Specifically, it obtains the weight of each first edge and the weight of each first node, obtains the sum of the weights of the first edges within the community and the sum of the weights of the first edges connected to all the first nodes contained in the community, and then obtains the total degree of modularity. When the total degree of modularity reaches the maximum value, the community division is complete. Iterate through each community. If there are at least n warning nodes in the same community, mark all warning accounts in the community as abnormal accounts.

6. The abnormal account monitoring method based on feature graph model according to claim 1, characterized in that, The rating prediction model is learned and constructed through the following steps: Based on the real credit score, the predicted credit score, and the complexity of the decision tree, an objective function is constructed. The splitting process is as follows: In each iteration, all node attributes of the nodes in the initial decision tree are traversed, the improvement value of the node attributes is calculated based on the objective function, and when the improvement value is the largest, the corresponding node is taken as the splitting node, the splitting node is split into multiple child nodes, and the node attributes are assigned to the corresponding child nodes. Repeat the splitting process until the splitting stop condition is met, and a complete decision tree will be constructed.

7. The abnormal account monitoring method based on feature graph model according to claim 1, characterized in that, It also includes the following steps: Obtain the node attributes, transaction records, and transaction amount of the corresponding transaction account for each abnormal account, and compare them one by one with the existing transaction accounts in the feature database to obtain the feature database matching score; When the feature library matching score is greater than the preset threshold, the abnormal account will be marked as a key abnormal account. The process of obtaining the feature database matching score is as follows: the node attributes of the abnormal account are compared with the node attributes in the feature database using cosine similarity to obtain the attribute similarity; the number of transactions and transaction amount of the abnormal account are aggregated at the time unit to obtain the transaction feature sequence; the DTW value of the transaction feature sequence and the feature sequence corresponding to the abnormal account in the feature database is calculated; the attribute similarity and DTW value are weighted and summed, and the highest value is taken as the feature database matching score.

8. An abnormal account monitoring system based on a feature graph model, characterized in that, include: The data acquisition module acquires transaction accounts, transaction records, and transaction amounts. It uses transaction accounts as nodes, the relationships between transaction records and transaction accounts as edges, and the transaction amount as the weight of the edges to form a feature graph model. Each node has node attributes. The credit score addition module inputs the node attributes of each node into the scoring prediction model to obtain the predicted credit score of each node, and finds the node with the lowest predicted credit score as a neighbor node, adding the predicted credit score as a node attribute to the neighbor node. The judgment module determines whether a trading account has any abnormalities. If an abnormality is found, it is marked as an alert account, and a directed subgraph model is formed based on the alert account. The judgment and marking module calculates the balanced credit score of each node based on the predicted credit score of each node in the directed subgraph model. It iterates through all nodes in the directed subgraph model. If the balanced credit score is lower than the preset credit score threshold, the corresponding node is marked as a warning node. The result determination module determines the community where the warning node is located based on the community discovery algorithm. It traverses each community, and if there are multiple warning nodes in the community, it marks all warning accounts in the current community as abnormal accounts.

9. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the method as described in any one of claims 1 to 6.

10. An abnormal account monitoring device based on a feature map model, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the method as described in any one of claims 1 to 6.

Images