Anti-money laundering split transaction detection method and system, and medium

Abstract

The invention relates to an anti-money laundering split transaction detection method and system and a medium, and the method comprises the steps: constructing a graph transaction network based on a transaction data set; based on the graph transaction network, determining a basic risk value and a first feature vector of each account, and splicing the basic risk value and the first feature vector to obtain a second feature vector; inputting the second feature vector of each account into a tree model for training to obtain a transaction detection model; and inputting the second feature vector corresponding to the target account into the transaction detection model for prediction to obtain a transaction detection result of the target account, thereby improving the detection precision.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of artificial intelligence, in particular to a money laundering split transaction detection method, system and medium. BACKGROUND

[0002] Money laundering activities pose a serious threat to global financial security, economic order and social stability. Among them, split transaction is the mainstream money laundering method to evade supervision. Money launderers split large illegal funds into multiple small transactions below the regulatory threshold, transfer through multiple "money mules" (intermediate accounts), and finally collect in the target account. The core is to hide the illegal source of funds by "dispersing transaction subjects and splitting transaction amounts" to bypass the large transaction monitoring rules of financial institutions.

[0003] The current mainstream anti-money laundering detection technology has significant limitations and is difficult to cope with complex and variable split transaction patterns: traditional rule systems completely rely on artificial expert experience to set thresholds (such as "single-day single-transaction over 50,000 yuan warning"), rules are fixed and have poor interpretability, and money launderers can easily evade detection by adjusting transaction amounts and time intervals, so the detection accuracy is low and effective split transaction identification cannot be performed. The black box model method represented by graph neural network (GNN) and deep network embedding can learn the complex topological features of transaction networks, but most methods only support one of the "dispersion-aggregation" (funds flow from multiple accounts to a single account) or "aggregation-dispersion" (funds flow from a single account to multiple accounts) transaction patterns, cannot cover the multi-stage composite pattern of "dispersion-transit-aggregation" in split transactions, and also have the problem of low detection accuracy. SUMMARY

[0004] Therefore, it is necessary to provide a money laundering split transaction detection method, system and medium to solve the above technical problems.

[0005] In a first aspect, the embodiments of the present application provide a money laundering split transaction detection method, which comprises:

[0006] constructing a graph transaction network based on a transaction data set; wherein the transaction data set comprises transaction information of multiple accounts, and the graph transaction network takes the multiple accounts as nodes;

[0007] determining a basic risk value and a first feature vector of each account based on the graph transaction network, concatenating the basic risk value and the first feature vector to obtain a second feature vector;

[0008] inputting the second feature vector of each account into a tree model for training to obtain a transaction detection model;

[0009] inputting the second feature vector corresponding to the target account into the transaction detection model to obtain a transaction detection result of the target account.

[0010] In one of the embodiments, the determining of the base risk value and the first feature vector of each account based on the graph transaction network comprises:

[0011] performing community division on the graph transaction network by using a community discovery algorithm to obtain a plurality of independent sub-graph transaction networks;

[0012] determining the base risk value and the first feature vector of each account based on each sub-graph transaction network.

[0013] In one of the embodiments, the determining of the base risk value of each account based on each sub-graph transaction network comprises:

[0014] determining the first-order neighbors and the second-order neighbors of each account in each sub-graph transaction network;

[0015] constructing an adjacency matrix based on the first-order neighbors and the second-order neighbors of each account;

[0016] performing block division on the adjacency matrix to obtain a plurality of matrix blocks, and calculating the density values of the matrix blocks;

[0017] obtaining the base risk value of the corresponding account based on the density values of the matrix blocks.

[0018] In one of the embodiments, the constructing of the adjacency matrix based on the first-order neighbors and the second-order neighbors of each account comprises:

[0019] determining the network transaction attributes of each account; the network transaction attributes comprise a directed transaction network and an undirected transaction network;

[0020] performing structural sorting on the first-order neighbors and the second-order neighbors based on the network transaction attributes to construct the adjacency matrix.

[0021] In one of the embodiments, when the network transaction attributes of the account are the undirected transaction network, the performing of the structural sorting on the first-order neighbors and the second-order neighbors based on the network transaction attributes to construct the adjacency matrix comprises:

[0022] sequentially arranging the node accounts in the order of the account, the second-order neighbor and the first-order neighbor to construct the adjacency matrix.

[0023] In one of the embodiments, when the network transaction attributes of the account are the directed transaction network, the performing of the structural sorting on the first-order neighbors and the second-order neighbors based on the network transaction attributes to construct the adjacency matrix comprises:

[0024] determining a sending layer, a transfer layer and a receiving layer in the directed transaction network; the sending layer includes the account, a set of nodes that constitute weak second-order neighbors with the account and only initiate fund outflow, do not receive funds; the transfer layer is the first-order neighbor; the receiving layer is the second-order neighbor;

[0025] arranging the node accounts in order based on the sending layer, the transfer layer and the receiving layer, and constructing an adjacency matrix.

[0026] In one of the embodiments, determining the first feature vector of each account based on each sub-graph transaction network includes:

[0027] obtaining a basic structure feature based on the number of transactions of the account and the statistical information of the number of transactions of the corresponding first-order neighbor;

[0028] obtaining a neighbor statistical feature based on the statistical information of the basic risk value of the first-order neighbor;

[0029] obtaining a transaction behavior feature based on the transaction frequency, the average transaction amount, the transaction amount standard deviation and the proportion of night transactions of the account within a preset period;

[0030] obtaining the first feature vector of the account based on the basic structure feature, the neighbor statistical feature and the transaction behavior feature.

[0031] In one of the embodiments, after obtaining the transaction detection result of the target account, the method includes:

[0032] if the risk value of the transaction detection result of the target account is greater than a risk threshold, generating a transaction report for the target account and performing early warning.

[0033] In a second aspect, the embodiments of the present application also provide an anti-money laundering split transaction detection system, which includes:

[0034] a graph transaction network construction module, configured to construct a graph transaction network based on a transaction data set; wherein the transaction data set includes transaction information of a plurality of accounts, and the graph transaction network takes the plurality of accounts as nodes;

[0035] a feature extraction module, configured to determine a basic risk value and a first feature vector of each account based on the graph transaction network, and obtain a second feature vector based on the basic risk value and the first feature vector;

[0036] a model training module, configured to input the second feature vector of each account into a tree model for training to obtain a transaction detection model;

[0037] A model prediction module is configured to input the second feature vector corresponding to the target account into the transaction detection model for prediction to obtain a transaction detection result of the target account.

[0038] In a third aspect, the embodiments of the present application further provide a computer readable storage medium, wherein the storage medium stores a computer program, and the computer program is executed by a processor to implement the method in the first aspect.

[0039] The anti-money laundering split transaction detection method, system and medium improve the detection accuracy.

[0040] The details of one or more embodiments of the present application are presented in the following drawings and description to make other features, objects and advantages of the present application more apparent. BRIEF DESCRIPTION OF DRAWINGS

[0041] The accompanying drawings, which are included to provide a further understanding of the present application, constitute a part of the present application and illustrate the illustrative embodiments of the present application and specific examples thereof, which serve to explain the present application, and do not limit the present application. In the drawings:

[0042] Figure 1 FIG. 1 is a hardware structure block diagram of a terminal device for an anti-money laundering split transaction detection method in an embodiment;

[0043] Figure 2 FIG. 1 is a hardware structure block diagram of a terminal device for an anti-money laundering split transaction detection method in an embodiment;

[0044] Figure 3 FIG. 1 is a hardware structure block diagram of a terminal device for an anti-money laundering split transaction detection method in an embodiment;

[0045] Figure 4 FIG. 1 is a hardware structure block diagram of a terminal device for an anti-money laundering split transaction detection method in an embodiment;

[0046] Figure 5 FIG. 1 is a hardware structure block diagram of a terminal device for an anti-money laundering split transaction detection method in an embodiment; DETAILED DESCRIPTION

[0047] To make the objectives, technical solutions, and advantages of this application clearer, the application is described and illustrated below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of this application and are not intended to limit this application.

[0048] The method embodiments provided in this example can be executed on a terminal, computer, or similar computing device. For example, it can run on a terminal. Figure 1 This is a hardware structure block diagram of the terminal for the anti-money laundering transaction splitting detection method in this embodiment. For example... Figure 1 As shown, a terminal may include one or more ( Figure 1 Only one is shown in the diagram. A processor 102 and a memory 104 for storing data are also included. The processor 102 may be, but is not limited to, a microprocessor (MCU) or a programmable logic device (FPGA). The terminal may also include a transmission device 106 for communication functions and an input / output device 108. Those skilled in the art will understand that… Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the terminal described above. For example, the terminal may also include components that are larger than... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown are illustrated.

[0049] The memory 104 can be used to store computer programs, such as application software programs and modules, like the computer program corresponding to the anti-money laundering transaction splitting detection method in this embodiment. The processor 102 executes various functional applications and data processing by running the computer programs stored in the memory 104, thereby implementing the aforementioned method. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0050] The transmission device 106 is used to receive or send data via a network. This network includes a wireless network provided by the terminal's communication provider. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 can be a Radio Frequency (RF) module for wireless communication with the Internet.

[0051] The embodiment of the application provides a method for detecting split transaction of money laundering, which is applied to Figure 1 The method is described by taking a terminal in Figure 2 as an example, and the method comprises the following steps:

[0052] Step 201, constructing a graph transaction network based on a transaction data set; wherein the transaction data set comprises transaction information of a plurality of accounts, and the graph transaction network takes the plurality of accounts as nodes.

[0053] Obtain a transaction data set in a financial scenario, and the transaction data set comprises a large amount of account transaction information (including but not limited to account ID, transaction amount, transaction timestamp, fund flow direction, transaction type and the like). Based on the transaction information, a global graph transaction network taking an account as a node and a transaction as an edge is constructed, and is denoted as G=(V,E), wherein V represents a node, each node corresponds to an account, and node attributes include account type (personal / enterprise), account opening time, historical transaction frequency and the like; E represents an edge, each edge corresponds to a transaction, and the direction of the edge in a directed graph transaction network represents a fund flow direction (for example, from an account A to an account B, indicating that the account A transfers money to the account B), and the edge in an undirected graph transaction network only represents that there is a transaction association between accounts; and the attributes of the edge include transaction amount, transaction timestamp, transaction channel (such as a counter, APP software, API interface and the like) and transaction frequency and the like.

[0054] Step 202, determining a basic risk value and a first feature vector of each account based on the graph transaction network, splicing the basic risk value and the first feature vector, and obtaining a second feature vector.

[0055] This step quantifies the similarity between the graph transaction network structure and the split transaction money laundering mode, and outputs an interpretable risk score (namely, the basic risk value), so that the risk score is directly associated with the graph transaction network structure feature. The basic risk value is a core feature of whether the account has a split transaction risk, and further through the graph transaction network, other features of the account are extracted, such as a basic structure feature, a neighbor statistical feature and a transaction behavior feature, to obtain the first feature vector.

[0056] Step 203, inputting the second feature vector of each account into a tree model for training, to obtain a transaction detection model.

[0057] Through step 202, the second feature vectors of a large number of accounts in the graph transaction network are extracted, and a data set of the model is constructed according to the second feature vectors and the labeled data of the corresponding accounts. The labeled data includes positive samples and negative samples, the positive samples are confirmed split transaction accounts (risk transaction accounts), and the negative samples are normal transaction accounts (such as personal daily consumption accounts and enterprise normal operation accounts). The data set is divided into a training set and a test set in a ratio of 7:3. In step 203, a decision tree or a gradient boosting classifier is selected as the model, because the tree-based model can process high-dimensional features, suppress abnormal value interference, and output feature importance to enhance interpretability. In the model training process, the second feature vectors of the account nodes are used as input, and whether it is a split transaction account is used as a label. The model hyperparameters (such as learning rate, tree depth, and leaf node number) are optimized through 5-fold cross-validation. The model result output is the risk transaction probability (0-1) of the node. When the risk transaction probability is greater than or equal to a preset threshold (such as 0.7), it is determined as a risk transaction account. The higher the probability is, the higher the split transaction risk is.

[0058] In step 204, the second feature vector corresponding to the target account is input into the transaction detection model for prediction to obtain the transaction detection result of the target account.

[0059] The anti-money laundering split transaction detection method of the embodiments of the present application constructs a graph transaction network based on a transaction data set. Based on the graph transaction network, the base risk value and the first feature vector of each account are determined, the base risk value and the first feature vector are spliced to obtain the second feature vector. The second feature vectors of the accounts are input into a tree model for training to obtain a transaction detection model. The second feature vector corresponding to the target account is input into the transaction detection model for prediction to obtain the transaction detection result of the target account, which improves the detection accuracy.

[0060] In the existing method, complete topology analysis of the global transaction network is required, and the calculation complexity is high (such as the matrix operation time increases in a square level with the number of nodes). In the financial scenario of a large-scale transaction network of a financial institution with millions or even tens of millions of accounts, memory overflow and calculation timeout problems are easy to occur, and it is difficult to meet the real-time monitoring demand.

[0061] In one of the embodiments, the determination of the base risk value and the first feature vector of each account based on the graph transaction network includes the following: a community discovery algorithm is used to divide the graph transaction network into multiple independent sub-graph transaction networks; and the base risk value and the first feature vector of each account are determined based on each sub-graph transaction network.

[0062] Specifically, Louvain, Leiden, SLPA, KL, etc. Community discovery algorithm (set resolution parameter = 10, balance community division granularity and calculation efficiency) can be used to divide the global graph transaction network G into communities: through iterative optimization of the modularity index (measure the difference between the correlation strength of nodes within the community and the correlation strength between communities), accounts with strong transaction correlation (such as frequent mutual conversion and high concentration of fund flow) are divided into the same community; and delete the transaction edges between different communities (only keep the intra-community transaction edges), form multiple independent sub-networks G1, G2, …, Gk. This operation can compress the calculation scale of the global graph transaction network G by more than 80%, while retaining the core association structure of the split transaction.

[0063] The embodiment of the application divides the graph transaction network into communities by using a community discovery algorithm to obtain multiple independent sub-graph transaction networks, and performs subsequent calculations based on the sub-graph transaction networks, thereby reducing the complexity of the calculations.

[0064] In one embodiment, determining the basic risk value of each account based on each sub-graph transaction network includes the following steps:

[0065] Step 301: Determine the first-order neighbors and second-order neighbors of each account in each sub-graph transaction network.

[0066] This step extracts the local transaction network environment (first-order neighbors and second-order neighbors) of each account node v in each sub-graph transaction network, wherein the first-order neighbors are the node set that has direct transactions with the account node v (direct transaction counterparties), and the scale is denoted as ; the second-order neighbors are the account set that is indirectly associated with the node account through the first-order neighbors (trading counterparties of trading counterparties), and the scale is denoted as , (m is the total number of account nodes v+second-order neighbor nodes).

[0067] Step 302: Construct an adjacency matrix based on the first-order neighbors and second-order neighbors of each account.

[0068] This step converts the abstract account association relationship into a matrix block structure that can be quantitatively analyzed by constructing an adjacency matrix.

[0069] Step 303: Perform block division on the adjacency matrix to obtain multiple matrix blocks; and calculate the density value of each matrix block.

[0070] Step 304: Obtain the basic risk value of the corresponding account based on the density value of each matrix block.

[0071] This application embodiment obtains the basic risk value of an account through quantitative analysis of the density of adjacency matrix blocks. The basic risk value is directly related to the characteristics of the local transaction network, and the neighbor connection patterns of high-risk nodes can be intuitively traced, meeting the requirements of financial supervision for reporting transparency. It relies only on the first-order and second-order neighbor data of the nodes and completes the analysis based solely on the local network structure, significantly reducing computational complexity. It supports real-time detection of large-scale networks and parallel computing, maintaining high efficiency even in networks with millions of nodes, with computation time increasing slowly with network size. By capturing the "dispersion-aggregation" and "aggregation-dispersion" structural characteristics of split transactions, its performance on both synthetic and real open-source datasets is superior to existing methods, demonstrating high detection accuracy.

[0072] In one embodiment, constructing an adjacency matrix based on the first-order and second-order neighbors of each account includes: determining the network transaction attributes of each account; the network transaction attributes include directed transaction networks and undirected transaction networks; and performing a structured sorting of the first-order and second-order neighbors based on the network transaction attributes to construct the adjacency matrix.

[0073] According to the network transaction attributes of the account, the embodiments of this application construct an adjacency matrix using different node sorting rules to ensure that the "dispersion-clustering" characteristics of split transactions are presented as "high-density blocks-low-density blocks" in the matrix.

[0074] Specifically, when the network transaction attribute of the account is an undirected transaction network, the step of structurally sorting the first-order neighbors and the second-order neighbors based on the network transaction attribute to construct an adjacency matrix includes: arranging the node accounts in the order of the account, the second-order neighbors of the account, and the first-order neighbors of the account to construct the adjacency matrix.

[0075] According to account node v Second-order neighbors First-order neighbors Arrange the nodes in order to build Adjacency matrix X (where The matrix is ​​divided into 3 core blocks.

[0076] For example, such as Figure 3 As shown, the network transaction attribute of account node (A) is an undirected transaction network, where nodes (B, C, D) are first-order neighbors of node (A). (A) and (E) are second-order neighbors of node (A). (A)

[0077] According to account node (A) Node (E) Arrange the nodes (B, C, D) in order and construct an adjacency matrix as follows:

[0078]

[0079] The adjacency matrix X is divided into 3 core blocks:

[0080] Matrix block 1: Corresponding to the second order neighbor inside and account node Connection relationship with the second order neighbor (upper left).

[0081] Matrix block 2: Corresponding to the account node And the connection relationship between the second order neighbor and the first order neighbor (upper right).

[0082] Matrix block 3: Corresponding to the connection relationship inside the first order neighbor (lower right).

[0083] Wherein, the basic risk value of the account node (A) is calculated as follows:

[0084] Matrix block 1 density : Measure the connection density inside the second order neighbor, the calculation formula is , the denominator is the number of effective calculation units, is the sum of the elements in matrix block 1.

[0085] Matrix block 2 density : Measure the connection density of the account node / second order neighbor and first order neighbor (normal transaction should be sparse), the calculation formula is , the numerator , excluding the inevitable connection between the account node and the first order neighbor (normal transaction also exists), and the denominator is the number of effective units.

[0086] Matrix block 3 density : Measure the connection density inside the first order neighbor (normal transaction should be sparse), the calculation formula is , the denominator excludes self-loop.

[0087] Basic risk value : Calculated by high-risk block density-low-risk block weighted density, the formula is , wherein is the block size weight, which ensures that the densities of blocks of different sizes can be compared.

[0088] When the network transaction attribute of the account is a directed transaction network, the step of structurally sorting the first-order neighbors and the second-order neighbors based on the network transaction attribute to construct an adjacency matrix includes: determining the sending layer, relay layer, and receiving layer in the directed transaction network; the sending layer includes the account and a set of nodes that form weak second-order neighbors with the account and only initiate fund outflows and do not receive funds; the relay layer consists of the first-order neighbors; the receiving layer consists of the second-order neighbors; and the adjacency matrix is ​​constructed by arranging the node accounts according to the order of the sending layer, the relay layer, and the receiving layer.

[0089] The directed transaction network divides nodes into three levels:

[0090] Sending Layer Level 0: Account Node And only initiates fund outflows, does not receive (or receives very little) funds, and is related to the aforementioned account node. The set of nodes constituting weak second-order neighbors is the set of fund-sending nodes, with a size of l; Level 1 of the relay layer: the account nodes. The first-order neighbors, the intermediate money mule node set, with a size of n; Receiving layer Level 2: the account nodes The second-order neighbors, the set of fund-receiving nodes, have a size of m.

[0091] According to the sending layer level 0 Intermediate Layer Level 1 The nodes are arranged sequentially in the receiving layer level 2 to construct... The adjacency matrix X is divided into 9 blocks.

[0092] For example, such as Figure 4 As shown, the transaction network of the account node (A) is a directed transaction network, where nodes (C,D,E) are first-order neighbors of the account node (A) and form the fund transfer layer; nodes (F,G) are second-order neighbors of the account node (A) and form the fund receiving layer; the sending layer includes the account node (A) itself and a set of nodes (B) that form weak second-order neighbors with the account node (A) and only initiate fund outflows and do not receive funds.

[0093] According to nodes (A, B) Nodes (C, D, E) Arrange the nodes (F, G) in order and construct an adjacency matrix as follows:

[0094]

[0095] The adjacency matrix X is divided into two key blocks and seven auxiliary blocks.

[0096] Key block: (level 0 connected to level 1), (level 1 connected to level 2), corresponding to the “fund-sending-transit-receiving core” link of the split mode.

[0097] auxiliary block: , , , , , , , corresponding to the sparse connection of normal transactions.

[0098] ;

[0099] ;

[0100] ;

[0101] ;

[0102] ;

[0103] ;

[0104] ;

[0105] ;

[0106] ;

[0107] wherein the base risk value of the account node v is calculated as follows:

[0108] Density of matrix block 1 , the denominator excludes self-loop;

[0109] Density of matrix block 2 , the denominator is the total number of elements;

[0110] Density of matrix block 3 , the denominator excludes the element of the first row corresponding to the account node v, the element of the first row (corresponding to the account node v) of block is always 0;

[0111] Density of matrix block 4 , the denominator is the total number of elements;

[0112] Density of matrix block 5 , the denominator excludes self-loop;

[0113] Density of matrix block 6 , denominator is the total number of elements;

[0114] Density of matrix block 7 , denominator excludes the first column element corresponding to account node v, block The first column (corresponding to account node v) element of the block is always 0;

[0115] Matrix block 8: , denominator is the total number of elements;

[0116] Matrix block 9: , denominator excludes self-loop;

[0117] Mean density of key block: calculate and Mean density of , reflecting the core link density of the split pattern; calculate the mean density of the remaining 7 auxiliary blocks , reflecting the sparse connection of normal transactions; the basic risk value of this account node v is equal to the mean density of the key block minus the mean density of the auxiliary block.

[0118] In the embodiments of the present application, the core matrix block is defined for different network transaction attributes (undirected and directed network), and the abstract split transaction pattern is converted into an interpretable mathematical index through a standardized density calculation formula, thereby improving the detection accuracy of split transactions. The split transaction detection supports undirected network (traditional bank transaction, without emphasizing the direction of funds) and directed network (cryptocurrency, cross-border payment, which needs to track the direction of funds), covers traditional finance and emerging finance scenarios, and can adapt to multi-stage complex modes such as “dispersion-aggregation”, “aggregation-dispersion” and “dispersion-transit-aggregation”.

[0119] In one of the embodiments, based on each of the subgraph transaction networks, determining the first feature vector of each of the accounts includes the following: obtaining a basic structure feature based on the number of transactions of the account and the statistical information of the number of transactions of the corresponding first-order neighbor. The statistical information includes the mean / standard deviation / maximum / minimum of the number of transactions of the corresponding first-order neighbor. Obtain a neighbor statistical feature based on the statistical information of the basic risk value of the first-order neighbor; the statistical information of the basic risk value of the first-order neighbor includes the mean, standard deviation, maximum, and minimum of the basic risk value of the first-order neighbor. Obtain a transaction behavior feature based on the transaction frequency, average transaction amount, transaction amount standard deviation, and night transaction proportion (22:00-6:00) of the account within a preset period (e.g., 30 days). Concatenate the basic structure feature, the neighbor statistical feature, and the transaction behavior feature to obtain the first feature vector of the account.

[0120] The embodiment of the application extracts the multi-dimensional features of the account node through the sub-graph transaction network to obtain a second feature vector, and the second feature vector specifically includes a basic risk value of the account node and basic structure features, neighbor statistical features, and transaction behavior features. The basic risk value is a core feature of the account. By combining the above multi-dimensional features of the account node with the integrated detection framework of the tree model, the detection accuracy is optimized by the tree-based model to reduce false positives and improve the detection accuracy.

[0121] In one of the embodiments, after obtaining the transaction detection result of the target account, the method includes: if the risk value of the transaction detection result of the target account is greater than a risk threshold, generating a transaction report for the target account and performing early warning.

[0122] Specifically, a risk threshold is set, and according to the risk value of the transaction detection result of the target account, the target account is divided into three levels of risk: high risk: risk value (risk probability) ≥ 0.7, which needs to start artificial checking immediately; medium risk: 0.3 ≤ risk value (risk probability) < 0.7, which needs to continuously monitor subsequent transactions; low risk: risk value (risk probability) < 0.3, which does not need to be intervened.

[0123] At the same time, suspicious transaction report generation is performed, and for the high-risk node, a suspicious transaction report containing the following contents is automatically generated, including basic information: target node ID, account type, opening institution, risk probability, risk level; structure features: second-order neighbor topology graph (annotating target node, first-order / second-order neighbor nodes and correlation strength), core matrix block visualization (showing high-density block position by heat map); transaction behavior: transaction flow summary in the past 30 days (specific time, amount, and counterparty account of high-frequency transaction and large-sum split transaction); risk cause: feature importance ranking (such as first-order neighbor high-risk node accounting for 30%, and night transaction accounting for 60% as the main risk factor).

[0124] And real-time early warning and workflow integration are performed, the early warning information of the high-risk node is pushed to the risk control system of the financial institution through the API interface to trigger blocking (such as suspending the account transfer function) or artificial checking task; workflow integration: supporting connection with related compliance systems, automatically uploading the suspicious transaction report to the supervision platform to reduce manual operation cost; historical backtracking: storing the risk scores and transaction records of all nodes to support historical compliance check and risk pattern backtracking analysis of the supervisory authority.

[0125] The embodiment of the application converts the risk result output by the model into business insights that can be directly used by the financial institution, integrates into the existing risk control workflow, generates a suspicious report containing "risk cause, topology structure, and transaction flow", and meets the explainability and transparency requirements of financial supervision on anti-money laundering detection.

[0126] The embodiments of the present application also provide a system for detecting split transactions of money laundering, as shown in the following. Figure 5 The system comprises:

[0127] a graph transaction network construction module 10, configured to construct a graph transaction network based on a transaction dataset, wherein the transaction dataset comprises transaction information of a plurality of accounts, and the graph transaction network takes the plurality of accounts as nodes.

[0128] a feature extraction module 20, configured to determine a basic risk value and a first feature vector of each account based on the graph transaction network, and obtain a second feature vector based on the basic risk value and the first feature vector.

[0129] a model training module 30, configured to input the second feature vector of each account into a tree model for training, to obtain a transaction detection model.

[0130] a model prediction module 40, configured to input a second feature vector corresponding to a target account into the transaction detection model for prediction, to obtain a transaction detection result of the target account.

[0131] It should be noted that the information interaction, execution process and the like between the above modules are based on the same concept as the method embodiments of the present application, and are a system corresponding to the above method for detecting split transactions of money laundering. All implementation manners in the above method embodiments are applicable to the embodiments of the device, and the specific functions and technical effects brought by the implementation manners can be referred to the method embodiments part, and will not be described here.

[0132] In one embodiment, a computer readable storage medium is provided, and the computer readable storage medium stores a computer program. The computer program is executed by a processor to implement the steps in any of the above method embodiments for detecting split transactions of money laundering.

[0133] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer readable storage medium, and when executed, can include the processes of the above-mentioned embodiment methods. Any reference to memory, storage, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory or optical memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration but not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM).

[0134] Any combination of the technical features of the above-mentioned embodiments can be combined. In order to make the description simple, all possible combinations of the technical features in the above-mentioned embodiments are not described, but as long as the combination of the technical features does not exist, it should be considered as the scope of the present application.

[0135] The above-mentioned embodiments only express several embodiments of the present application, and the description is more specific and detailed, but it should not be understood as a limitation on the scope of the patent. It should be pointed out that for those skilled in the art, without departing from the concept of the present application, some modifications and improvements can be made, which are all within the scope of the present application. Therefore, the scope of the patent of the present application should be subject to the appended claims.

Claims

1. A method for detecting money laundering-related split transactions, characterized in that, The method includes: A graph transaction network is constructed based on a transaction dataset; wherein the transaction dataset includes transaction information of multiple accounts, and the graph transaction network uses the multiple accounts as nodes; Based on the graph transaction network, the basic risk value and the first feature vector of each account are determined, and the basic risk value and the first feature vector are concatenated to obtain the second feature vector; The second feature vector of each account is input into the tree model for training to obtain the transaction detection model; The second feature vector corresponding to the target account is input into the transaction detection model for prediction, and the transaction detection result of the target account is obtained.

2. The method according to claim 1, characterized in that, The determination of the basic risk value and the first feature vector of each account based on the graph transaction network includes: A community detection algorithm is used to divide the graph transaction network into communities, resulting in multiple independent sub-graph transaction networks. Based on the subgraph transaction networks, the basic risk value and the first feature vector of each account are determined.

3. The method according to claim 2, characterized in that, Based on the respective subgraph transaction networks, the underlying risk value for each account is determined as follows: Determine the first-order and second-order neighbors of each account in each of the subgraph transaction networks; Construct an adjacency matrix based on the first-order and second-order neighbors of each account; The adjacency matrix is ​​divided into blocks to obtain multiple matrix blocks; and the density value of each matrix block is calculated. Based on the density value of each matrix block, the basic risk value of the corresponding account is obtained.

4. The method according to claim 3, characterized in that, The construction of the adjacency matrix based on the first-order and second-order neighbors of each account includes: Determine the network transaction attributes of each account; the network transaction attributes include directed transaction networks and undirected transaction networks. Based on the network transaction attributes, the first-order neighbors and the second-order neighbors are sorted in a structured manner to construct an adjacency matrix.

5. The method according to claim 4, characterized in that, When the network transaction attribute of the account is an undirected transaction network, the step of performing a structured sorting of the first-order neighbors and the second-order neighbors based on the network transaction attribute to construct an adjacency matrix includes: Arrange the node accounts in the order of the account, the second-order neighbor, and the first-order neighbor to construct an adjacency matrix.

6. The method according to claim 4, characterized in that, When the network transaction attribute of the account is a directed transaction network, the step of performing a structured sorting of the first-order neighbors and the second-order neighbors based on the network transaction attribute to construct an adjacency matrix includes: The sending layer, relay layer, and receiving layer in the directed transaction network are determined; the sending layer includes the account and a set of nodes that form weak second-order neighbors with the account and only initiate fund outflows without receiving funds; the relay layer consists of the first-order neighbors; and the receiving layer consists of the second-order neighbors. An adjacency matrix is ​​constructed based on the node accounts arranged in the order of the sending layer, the relay layer, and the receiving layer.

7. The method according to claim 2, characterized in that, Based on the subgraph transaction networks, the first feature vector of each account is determined as follows: Based on the statistical information of the number of transactions of the account and the number of transactions of the corresponding first-order neighbors, the basic structural features are obtained; Based on the statistical information of the basic risk values ​​of the first-order neighbors, the statistical characteristics of the neighbors are obtained; Based on the account’s transaction frequency, average transaction amount, standard deviation of transaction amount, and proportion of nighttime transactions within a preset time period, transaction behavior characteristics are obtained. Based on the basic structural features, the neighbor statistical features, and the transaction behavior features, the first feature vector of the account is obtained.

8. The method according to claim 1, characterized in that, After obtaining the transaction detection results of the target account, the method includes: If the risk value of the transaction detection result of the target account is greater than the risk threshold, a transaction report will be generated for the target account and an early warning will be issued.

9. A system for detecting money laundering split transactions, characterized in that, The system includes: A graph transaction network construction module is used to construct a graph transaction network based on a transaction dataset; wherein the transaction dataset includes transaction information of multiple accounts, and the graph transaction network uses the multiple accounts as nodes; The feature extraction module is used to determine the basic risk value and the first feature vector of each account based on the graph transaction network, and to obtain the second feature vector based on the basic risk value and the first feature vector. The model training module is used to input the second feature vector of each account into the tree model for training, so as to obtain the transaction detection model. The model prediction module is used to input the second feature vector corresponding to the target account into the transaction detection model for prediction, so as to obtain the transaction detection result of the target account.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method as described in any one of claims 1 to 8.

Images