Anti-money laundering detection method and system based on community and loop joint detection

Abstract

The invention relates to an anti-money laundering detection method and system based on community and loop joint detection. The method comprises the following steps: acquiring transaction data among a plurality of accounts, and constructing a transaction network diagram; dividing the transaction network diagram into a plurality of communities by using a community division algorithm; filtering communities based on a first preset rule to obtain a target community; detecting transaction data in the target community by adopting a directed loop detection algorithm, and identifying a fund loop path with a loop mode; filtering the fund circulation path based on a second preset rule; and carrying out risk scoring and grade marking on the suspicious transaction chain in the suspicious fund circulation path. By adopting the method, the money laundering behavior lower than the supervision threshold can be effectively identified, the missing report rate and the false report rate are reduced, and the accuracy and efficiency of anti-money laundering detection are improved.

Description

Technical Field

[0001] This application relates to the field of data analysis technology, and in particular to an anti-money laundering detection method and system based on community and cycle joint detection. Background Technology

[0002] Anti-Money Laundering (AML) regulation is a core component of maintaining the stability and security of the global financial system. It is estimated that the banking industry suffers losses of hundreds of billions of dollars annually due to money laundering activities; therefore, developing efficient and accurate AML detection technologies has significant economic and security implications. Currently, AML detection systems widely deployed by financial institutions mainly rely on two types of technical solutions: one is threshold-based rule systems, which flag suspicious transactions according to regulatory requirements, such as triggering a report if a single transaction exceeds a certain threshold. The other is supervised machine learning models, which use historical flagged data to train classification algorithms to identify suspicious transactions. However, traditional AML detection technologies have significant technical shortcomings when dealing with complex transaction networks. Threshold-based rule systems suffer from high false positive and false negative rates; criminal organizations can use structured transactions to split large sums of money into multiple smaller transactions below the threshold to evade regulatory reporting obligations. Methods based on supervised machine learning models are highly dependent on data, and their generalization ability is limited by the data distribution of a specific institution, making it difficult to adapt to new money laundering patterns and resulting in weak detection capabilities for unmarked high-risk accounts.

[0003] In recent years, to overcome the shortcomings of supervised learning, research trends have shifted towards unsupervised learning. However, most solutions remain limited to cluster analysis of transaction features, failing to delve into the inherent networked characteristics of money laundering activities. Money laundering activities typically follow a three-stage model of "Placement – ​​Layering – Integration," where the layering stage involves transferring funds through complex transaction networks to conceal their origin, creating a critical detection blind spot. Existing technologies still face significant challenges in dealing with professional and networked money laundering operations. Therefore, it is necessary to further explore how to more effectively integrate transaction network topology features into the detection process to supplement existing methods and improve the identification of money laundering activities in the "layering" stage. Summary of the Invention

[0004] Therefore, it is necessary to provide an anti-money laundering detection method and system based on community and circular joint detection to address the above-mentioned technical problems.

[0005] Firstly, this application provides an anti-money laundering detection method based on community and circular joint detection, including:

[0006] Obtain transaction data between multiple accounts, and construct a transaction network graph based on the transaction data. Each node in the transaction network graph corresponds to an account, and the directed edges between nodes correspond to the transaction relationships between the accounts.

[0007] The transaction network graph is divided into multiple communities using a community partitioning algorithm.

[0008] Based on the first preset rule, the multiple communities are filtered to retain multiple target communities that meet the conditions;

[0009] A directed cycle detection algorithm is used to detect the transaction data within the target community and identify fund circulation paths with cyclical patterns.

[0010] Based on the second preset rule, the fund circulation path is filtered, and suspicious fund circulation paths that meet the conditions are retained.

[0011] Risk scores are assigned to suspicious transaction chains within the suspicious fund circulation path, and risk level labels are assigned to the suspicious transaction chains based on the risk scores.

[0012] In one embodiment, constructing a transaction network graph based on the transaction data includes:

[0013] In the transaction data, multiple transactions of the same group of accounts within a certain time period are aggregated into a directed edge;

[0014] Calculate the aggregate attributes of each directed edge, including total transaction amount, number of transactions, earliest transaction time, latest transaction time, time span, and edge weight;

[0015] Construct a transaction network graph using all accounts as nodes, the directed edges as edges, and the aggregated attributes as edge attributes.

[0016] In one embodiment, the edge weights are calculated according to the following formula:

[0017] ;

[0018] Where total_amount is the total transaction amount, and count is the number of transactions. For the time span, This is an adjustable time decay parameter.

[0019] In one embodiment, based on a first preset rule, the plurality of communities are filtered, and the target communities that meet the conditions are retained, including:

[0020] Obtain the time span of all transactions within each of the multiple communities, and retain the first community set whose transaction time span is less than or equal to a preset time threshold;

[0021] Obtain the average transaction amount within each community in the first community set, and retain the second community set whose average amount is less than or equal to a preset amount threshold;

[0022] Obtain the number of nodes in each community of the second community set, and retain the target communities whose number of nodes is greater than or equal to a preset scale threshold.

[0023] In one embodiment, the fund circulation paths are filtered based on a second preset rule, and suspicious fund circulation paths that meet the conditions are retained, including:

[0024] Calculate the deviation rate between the total outflow and inflow of funds for the starting account of each fund circulation path, and retain the first path set whose deviation rate is less than a preset deviation threshold;

[0025] For each directed fund circulation path in the first path set, calculate the coefficient of variation of the transaction amount, and retain the second path set whose coefficient of variation is less than a preset consistency threshold;

[0026] For each directed fund circulation path in the second path set, calculate the transaction time span, and retain the suspicious fund circulation paths whose time span is less than a preset time threshold.

[0027] In one embodiment, risk scoring is performed on suspicious transaction chains within the suspicious fund circulation path, and risk level labels are assigned to the suspicious transaction chains based on the risk scores, including:

[0028] Calculate the comprehensive risk score of the suspicious transaction chain based on the transaction amount, transaction frequency, and path length;

[0029] The comprehensive risk score is mapped to multiple preset risk ranges to obtain the corresponding risk level;

[0030] Assign a risk label corresponding to the risk level to the suspicious transaction chain.

[0031] In one embodiment, a directed cycle detection algorithm is used to detect the transaction data within the target community, identifying fund circulation paths with cyclical patterns, including:

[0032] Based on the nodes and directed edges in the target community, construct a target community subgraph, and extract strongly connected components from each target community subgraph;

[0033] Traverse each of the strongly connected components and identify the directed cyclic path that meets the preset length condition, which is then used as the fund circulation path.

[0034] In one embodiment, the method further includes, before constructing the transaction network graph:

[0035] Remove invalid data from the transaction data, including self-circulating transaction data and invalid transaction data.

[0036] The transaction data after removing invalid data is filtered by time window, and the transaction data within the preset time window is retained.

[0037] Secondly, this application also provides an anti-money laundering detection system based on community and circular joint detection, including:

[0038] The network construction module is used to acquire transaction data between multiple accounts and construct a transaction network graph based on the transaction data. Each node in the transaction network graph corresponds to an account, and the directed edges between nodes correspond to the transaction relationships between the accounts.

[0039] The community detection module is used to divide the transaction network graph into multiple communities using a community partitioning algorithm;

[0040] The community filtering module is used to filter the multiple communities based on a first preset rule and retain multiple target communities that meet the conditions.

[0041] The loop pattern recognition module is used to detect the transaction data within the target community using a directed loop detection algorithm, and identify the fund circulation path with a loop pattern.

[0042] The fund circulation path filtering module is used to filter the fund circulation path based on a second preset rule and retain suspicious fund circulation paths that meet the conditions.

[0043] The risk decision module is used to score the risk of suspicious transaction chains in the suspicious fund circulation path and assign risk level labels to the suspicious transaction chains based on the risk scores.

[0044] In one embodiment, the community detection module is provided with a first pluggable interface, which is used to load different community detection algorithms to achieve optimal community division, and the cycle pattern recognition module is provided with a second pluggable interface, which is used to load different directed cycle detection algorithms.

[0045] The aforementioned anti-money laundering detection method and system based on joint detection of communities and cycles quantifies transaction characteristics into graph attributes by constructing a transaction network graph. It employs a community partitioning algorithm to divide the network into internally connected communities, thus transforming the global anomaly pattern detection problem into a refined analysis problem within multiple local communities, focusing on the internal workings of each community. A directed cycle detection algorithm is used to identify directed fund cycles exhibiting typical characteristics of money laundering "layering" stages. Through filtering and detection, it further captures coordinated money laundering behaviors below regulatory thresholds that are difficult to detect using traditional methods. This method overcomes the limitations of static thresholds, eliminates strong dependence on historical labeled data, and can identify complex money laundering networks involving multiple accounts, achieving accurate detection of concealed small-value transactions. Attached Figure Description

[0046] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0047] Figure 1 This is an application environment diagram of an anti-money laundering detection method based on community and loop joint detection in one embodiment;

[0048] Figure 2 This is a flowchart illustrating an anti-money laundering detection method based on joint community and circular detection in one embodiment.

[0049] Figure 3 This is a graphical representation of an anti-money laundering detection method based on joint community and loop detection in one embodiment;

[0050] Figure 4 This is a flowchart illustrating the steps of constructing a transaction network graph based on transaction data in one embodiment.

[0051] Figure 5 This is a flowchart illustrating the steps for risk scoring and tagging of suspicious transaction chains in one embodiment;

[0052] Figure 6 This is a block diagram of an anti-money laundering detection system based on joint community and loop detection in one embodiment.

[0053] Figure 7 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0054] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0055] The anti-money laundering detection method based on community and circular joint detection provided in this application can be applied to, for example... Figure 1 In the application environment shown, terminal 102 communicates with server 104 via a network. The data storage system can store the data that server 104 needs to process, including basic account information, inter-account transaction data, constructed transaction network graph data, community division results, and fund circulation path data. The data storage system can be integrated on server 104 or placed on the cloud or other network servers. Terminal 102 can serve as a transaction data collection terminal or a detection result interaction terminal, specifically including but not limited to bank counter service terminals, personal computers, laptops, smartphones, tablets used by staff, and IoT devices used for transaction monitoring within the bank; among them, IoT devices can also include smart POS terminals and smart ATM devices used for offline transaction data collection. Server 104 is the core data processing terminal. The server 104, used to execute the anti-money laundering detection method based on community and circulation joint detection, can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services.

[0056] In one exemplary embodiment, such as Figure 2 As shown, an anti-money laundering detection method based on community and circularity joint detection is provided, and this method is applied to Figure 1 Taking server 104 as an example, the explanation includes the following steps S201 to S206. Wherein:

[0057] S201: Obtain transaction data between multiple accounts and construct a transaction network graph based on the transaction data. Each node in the graph corresponds to an account, and the directed edges between nodes correspond to the transaction relationships between accounts.

[0058] Accounts can include personal accounts, joint accounts, and corporate accounts. Transaction data refers to information on fund transfers between multiple accounts within a certain time period, including but not limited to the receiving and sending accounts, transaction amounts, transaction times, and other basic data. A combination of accounts with a fund transfer relationship, consisting of a sending account and a receiving account, is called an account pair.

[0059] After acquiring the transaction data, you can first perform noise removal on the raw transaction data, including but not limited to: excluding self-circulating transactions, such as fund transfers in and out of the same account; excluding invalid amounts, such as canceled transfers. Filter out the data window that needs to be analyzed, retaining the valid transaction data within the window.

[0060] It is understandable that transaction information often exists as discrete, structured data, reflecting only the isolated attributes of a single transaction, while money laundering often involves the coordinated actions of multiple accounts. Transforming transaction information into a transaction network graph allows for the structured modeling of account relationships and fund flow characteristics within discrete transaction data, leveraging the mathematical properties of graph structures.

[0061] Specifically, the transaction network graph's topology is a directed weighted graph. A directed graph is a graph structure consisting of a set of nodes and directed edges connecting these nodes. Each directed edge points from one node to another, representing a unidirectional relationship between nodes. In the transaction network graph, each node corresponds to one account, and the directed edges between nodes correspond to the transaction relationships between accounts. Multiple transactions from the same account over a period of time are aggregated into a single directed edge. If the transaction network graph is defined as G=(V, E, W), then its node set is... Where N is the total number of accounts, and the edge set is , where M is the number of transaction pairs contained in each account pair.

[0062] S202 uses a community partitioning algorithm to divide the transaction network graph into multiple communities.

[0063] "Rapid stratification" is the core element of money laundering activities in the three stages of "placement-stratification-integration." Its characteristics include multi-account collaboration, rapid fund transfer speed, complex transaction networks, and structured transaction amounts. To identify rapid stratification characteristics, a community segmentation algorithm is first used to address the issues of account collaboration and transaction complexity, thus identifying suspicious groups. Specifically, the community segmentation algorithm divides the transaction network graph into multiple account clusters with tight internal connections and sparse external connections; these account clusters are called communities.

[0064] The community partitioning algorithm can be chosen based on directed weighted graphs, such as a variant of the Louvain algorithm based on modularity optimization, or the Infomap algorithm. The algorithm takes the transaction network graph as input and outputs the partitioned communities. Each of these communities Includes child node set Sub-margin set It should be noted that, in order to ensure that the transaction associations of an account are not split into different communities, the community partitioning algorithm must ensure that the nodes between communities do not overlap after partitioning.

[0065] From a risk control perspective, communities with frequent transactions are likely to correspond to a suspicious criminal gang. Narrowing the detection scope from the global transaction network graph to the community level can significantly reduce computational complexity and more clearly identify local anomalies.

[0066] S203, based on the first preset rule, filter multiple communities and retain multiple target communities that meet the conditions.

[0067] To more accurately focus on short-term, small-value transactions and make the tiered money laundering model more prominent, after obtaining the aforementioned multiple communities, it is necessary to further inject anti-money laundering business rules to reduce the data scale. Therefore, for each community, it is necessary to verify whether it meets the first preset rule.

[0068] The first preset rule is a set of rules designed based on anti-money laundering logic, including different dimensions such as time, amount, and community size. For example, to capture the rapid stratification of time characteristics in money laundering activities, a time filtering rule can be set to retain transactions with shorter time spans; to focus on transactions below the regulatory reporting threshold and detect unreported fund transactions, an amount filtering rule can be set to retain transactions whose amounts meet certain conditions; to identify small-scale communities and reduce the number of communities requiring further detection, a community size filtering rule can be set. The first preset rule can be selected according to specific needs, and this embodiment does not impose any restrictions on it.

[0069] S204 employs a directed cycle detection algorithm to detect transaction data within the target community and identify fund circulation paths with cyclical patterns.

[0070] It is understandable that the essence of money laundering is to conceal the source, destination and ownership of illicit funds through complex operations. It requires transferring funds from multiple accounts through multiple stages to achieve the final return of funds. Therefore, the path of funds will present a closed loop.

[0071] In this method, a directed cycle detection algorithm is used to detect the filtered communities and identify topological patterns suspected of money laundering. For directed graphs, the directed cycle detection algorithm is an algorithm that searches for the existence of cyclic paths in the directed graph. The search result is a closed-loop path with the same starting and ending node and matching the direction of fund flow. Specifically, the directed cycle detection algorithm has various implementations, such as path search based on strongly connected components and depth-first traversal cycle search algorithms. Different algorithms have different application scenarios and advantages, and no limitation is made in this embodiment.

[0072] Specifically, initialize an empty loop set L={}, traverse each community obtained from S203, call the directed cycle detection algorithm to search all paths within the community, and add each path l that meets the conditions output by the algorithm to the loop set L as a fund circulation path with a cyclic pattern.

[0073] S205, based on the second preset rule, filter the fund circulation path and retain the suspicious fund circulation path that meets the conditions.

[0074] Because the fund circulation logic in money laundering differs significantly from that of normal business cycles (such as short-term cash flow for enterprises), the fund circulation paths obtained in S204 are filtered to further narrow down the scope of suspicious transaction chains. Specifically, each path l in the above loop set can be further analyzed through fund return verification, path consistency detection, and time compactness analysis.

[0075] For example, for fund repatriation verification, the deviation rate between the total amount flowing out from the starting point of the path and the total amount flowing back to the starting point is calculated. When the deviation rate reaches a certain preset value, it can be identified as suspicious money laundering fund repatriation. Path consistency detection assesses the dispersion of all transaction amounts on the loop path by calculating the statistical characteristics of the transaction amounts on each edge of the path. When the dispersion of transaction amounts is lower than a preset threshold, it indicates that the difference in transaction amounts is small, and it can be identified as a suspicious path. Time compactness analysis calculates the total time span of the loop path. When the transaction time span is less than a preset threshold, it can be determined that it meets the "rapid turnover" characteristic of money laundering behavior. Through the filtering of the above preset rules, suspicious fund loop paths with money laundering behavior are retained.

[0076] S206, risk scoring is performed on suspicious transaction chains in suspicious fund circulation paths, and risk level labels are assigned to suspicious transaction chains based on the risk scores.

[0077] Figure 3 This is a graphical representation of the anti-money laundering method based on community and cycle joint detection, executed according to the steps in the above embodiments. The spatiotemporal filtering rule refers to filtering based on a first preset rule. It can be seen that this method can progressively narrow down the scope from the transaction network graph and ultimately detect suspicious transaction chains.

[0078] The aforementioned anti-money laundering detection method based on community and loop joint detection decomposes the global detection problem into the analysis of multiple local communities by constructing a directed weighted transaction network graph and using a community partitioning algorithm. This reduces computational complexity and leverages the tight connections within communities to identify potential suspicious groups, thereby improving the signal-to-noise ratio. By filtering communities using a first preset rule and employing a directed loop detection algorithm to identify fund circulation paths within target communities, this method effectively captures coordinated money laundering activities below the regulatory reporting threshold that traditional threshold rules cannot detect, reducing the false positive rate. Furthermore, by performing multi-rule verification and comprehensive risk scoring on the identified circulation paths and filtering out non-suspicious normal fund flows based on a second preset rule, the false positive rate is reduced.

[0079] It is understandable that in real-world applications, transaction data often exhibits high frequency and small amounts. Multiple transactions may occur between the same pair of accounts within a short period. If each transaction is treated as an independent edge in the network construction, the graph structure becomes redundant and fails to reflect the overall relationship between accounts. Therefore, when constructing a transaction network graph, transaction aggregation can optimize the effectiveness of the graph structure. In an exemplary embodiment, such as... Figure 4 As shown, step S201 is implemented in the following way:

[0080] First, noise removal is performed on the original transaction dataset, including eliminating self-looping transactions, invalid transactions, and time window filtering. In the remaining valid transaction data, multiple transactions from the same account pair within a certain time period are aggregated into a single directed edge. For example, if account A makes 5 transfers to account B within 3 days, these 5 transactions are aggregated into a single directed edge from A to B, replacing the original 5 independent edges.

[0081] Calculate the aggregate attributes for each directed edge, which include total transaction amount, number of transactions, earliest transaction time, latest transaction time, time span, and edge weight.

[0082] Specifically, the total transaction amount is , This refers to the number of transactions between account pairs, representing the total amount of funds flowing between those account pairs within a given time period; the number of transactions. This indicates the frequency of transactions; the earliest transaction time is min_ts, and the latest transaction time is max_ts; the time span is... This reflects the duration of the transaction relationship.

[0083] Preferably, in some embodiments, the edge weights are calculated as follows:

[0084] ;

[0085] in, It is the average amount per transaction. It is a frequency enhancement factor. It is the time decay coefficient. This is an adjustable time decay parameter. It should be noted that the edge weights are used to comprehensively measure the suspiciousness of a transaction relationship between a pair of accounts. Since suspicious transactions are characterized by frequent transactions and concentrated timeframes, the frequency enhancement factor can amplify the impact of the number of transactions, while the time decay factor penalizes transaction relationships with longer time spans. The final calculated weights can amplify the characteristics of suspicious transaction behavior while suppressing the impact of normal business dealings and other behaviors.

[0086] Finally, using all accounts as nodes and the aggregated directed edges with rich attributes as edges, the final transaction network graph G = (V, E, W) is constructed. Its node set is as follows: , where N is the total number of accounts; the edge set is , where M is the number of aggregated transaction pairs, and the aggregation attributes on the edges are defined as shown in Table 1.

[0087] Table 1

[0088] Attribute Name type describe total_amount float Total transaction amount min_ts datetime Earliest trading time max_ts datetime Latest trading time count int Number of transactions weight float Weight

[0089] In this embodiment, data aggregation solves the problems of large volume of original transaction data, high noise, and low efficiency of direct processing. By designing a reasonable edge weight calculation formula, the characteristics of suspicious transaction behavior can be amplified, and accounts with similar behavior patterns can be clustered together more accurately, thereby improving the accuracy and efficiency of the detection process.

[0090] After obtaining multiple communities through a community segmentation algorithm, in order to accurately select the groups that best fit the "rapid stratification" behavior characteristics of money laundering from these communities, it is necessary to filter the communities based on a first preset rule. In some exemplary embodiments, filtering the multiple communities based on the first preset rule and retaining the target communities that meet the conditions includes the following three filtering methods:

[0091] (1) Time filtering: Obtain the time span of all transactions in each community in multiple communities, and retain the first community set whose transaction time span is less than or equal to the preset time threshold.

[0092] Time filtering can capture the "rapid stratification" of money laundering activities, excluding long-term, normal fund flows. For example, a maximum time window threshold can be preset. =1 year, for each community in the community results list C its community gathers , Given the total number of edges within the community, calculate the latest transaction time. With the earliest transaction time Time span between:

[0093] ;

[0094] Eliminate The edges and their associated nodes are preserved, and the time span satisfies the condition. By considering the edges and associated nodes, we obtain the first community set. 1.

[0095] (2) Amount filtering: Obtain the average transaction amount in each community of the first community set, and retain the second community set whose average amount is less than or equal to the preset amount threshold.

[0096] The amount filtering focuses on transactions below the regulatory reporting threshold, detecting unreported fund transactions. For example, a preset upper limit is set for the amount of a single transaction. =10000, for the first community set Each community subgraph in 1 its community gathers ,calculate Remove The edges and their associated nodes are used to retain the average transaction amount that meets the conditions. From the edge, we obtain the second community set C2.

[0097] (3) Obtain the number of nodes in each community in the second community set, and retain the target community with a number of nodes greater than or equal to the preset scale threshold.

[0098] To eliminate small-scale communities and reduce the number of community sets, a lower limit on the size can be set, for example. =3, for each community in the second community set C2 2. Gathering within the community Calculate the number of nodes within the community The number of nodes retained within the community meets the conditions. The community, obtain the new community set C3.

[0099] After identifying suspicious target communities, it is necessary to mine for evidence of money laundering "layering" within these communities, i.e., whether there are directed money loops. In an exemplary embodiment, a directed loop detection algorithm is used to detect the transaction data within the target community, and the steps are as follows:

[0100] First, based on the nodes and directed edges in the target community C3, construct a target community subgraph and extract strongly connected components from each target community subgraph.

[0101] It's understandable that for a directed graph, if there exists a set of nodes where every two nodes in that set have a bidirectional path, then that set of nodes is called a strongly connected graph. If a strongly connected graph cannot be made strongly connected by adding more nodes, then that strongly connected graph is called a strongly connected component of the directed graph. There are various algorithms for extracting strongly connected components of a directed graph, such as the Kosaraju algorithm and the Tarjan algorithm. Using the above strongly connected component detection algorithm, the strongly connected components of all target community subgraphs are extracted.

[0102] Next, each strongly connected component is traversed to identify directed cyclic paths that meet the preset length condition, which are then used as the fund circulation paths.

[0103] In this step, all strongly connected components obtained in the previous step are traversed, and a depth-first search is performed within each component. It should be noted that, to avoid meaningless short loops, such as Account A → Account B → Account A, and overly complex and impractical long loops, a range for loop length needs to be preset, allowing the loop path detection algorithm to find paths with a number of nodes within this range. Finally, the algorithm's output path is recorded as the directed fund loop path.

[0104] Preferably, in one embodiment, an improved Johnson algorithm is used to perform the above-mentioned directed funding loop path detection. Specifically, first, an empty loop set L={} is initialized, then each community c in the target community is traversed, and the edge set within community c is loaded and constructed. Then, based on the vertex set in community c and the already constructed edge set... Construct the community subgraph of this community The Tarjan algorithm was used to extract... Given a set of strongly connected components SCC, for each strongly connected component, a depth-first search (DFS) algorithm is used to traverse the strongly connected component SCC. The algorithm proceeds only if the path length from the target vertex reached to the starting vertex is greater than or equal to the minimum value. and less than the maximum value If the target vertex is the starting vertex, then return the path. Paths that meet the criteria Add it to the loop set L.

[0105] In this embodiment, by filtering strongly connected components and setting a preset cycle length condition, effective paths that better match the characteristics of money laundering behavior are retained, thereby improving the targeting and detection efficiency of anti-money laundering detection.

[0106] After identifying the fund circulation path using the directed cycle detection algorithm, since the path may contain closed loops of funds from normal business activities, it is necessary to further filter out paths that are truly suspected of money laundering using a second preset rule. In a specific embodiment, the step of filtering fund circulation paths based on the second preset rule includes:

[0107] (1) Verification of fund return: Calculate the deviation rate between the total amount of fund outflow and the total amount of fund inflow of the starting account of each fund circulation path, and retain the first path set whose deviation rate is less than the preset deviation threshold.

[0108] For example, for the starting point of each loop path Calculate from The total amount flowing out (OutDegree(v).total_amount) and the final amount flowing back. Deviation rate of the total amount InDegree(v).total_amount: ;

[0109] The preset deviation threshold is ,when If it meets the characteristics of fund repatriation, then it may be a non-pure money laundering fund repatriation. If it does, then it is filtered out to obtain the first path set L1.

[0110] (2) Path consistency check: For each directed fund circulation path in the first path set, calculate the coefficient of variation of the transaction amount and retain the second path set whose coefficient of variation is less than the preset consistency threshold.

[0111] For example, the coefficient of variation (CV) is used to measure the dispersion of all transaction amounts along a cyclic path to capture the characteristic of "approximately equal" transfers in money laundering activities. For each cyclic path within the first path set, a dataset of transaction amounts along the edges is extracted. The average amount of all edges along the calculation path k is the total number of transactions and the standard deviation. Seeking The preset threshold is 0.25. If the CV value of the amount exceeds the preset threshold, it indicates that the amount difference is too large, so it is filtered out to obtain the second path set.

[0112] (3) Time compactness analysis: For each directed fund circulation path in the second path set, calculate the transaction time span and retain suspicious fund circulation paths with a time span less than the preset time threshold.

[0113] For example, for a cyclic path within the second path set, the total time span of transactions in each cyclic path is calculated, which is the difference between the latest transaction time and the earliest transaction time. The preset time span threshold is 90 days. If the amount is less than the threshold, it meets the "rapid turnover" characteristic of money laundering; otherwise, it indicates that the funds are flowing too slowly and is filtered out. Ultimately, suspicious fund circulation paths that meet the criteria are obtained.

[0114] In this embodiment, by verifying fund return, checking path consistency, and analyzing time compactness, the scope of suspicious fund circulation paths is gradually narrowed, which can effectively reduce the false positive rate of anti-money laundering detection.

[0115] After identifying suspicious fund circulation paths through filtering, further risk decisions require risk quantification and classification of the final output suspicious transaction chains. In an exemplary embodiment, such as... Figure 5 As shown, the process of risk scoring for suspicious transaction chains within a suspicious fund circulation path and assigning risk level labels to these chains based on the risk scores includes the following steps:

[0116] S301. Calculate the comprehensive risk score of a suspicious transaction chain based on the transaction amount, transaction frequency, and path length.

[0117] Extract the characteristic parameters of suspicious transaction chains, including transaction amount A, transaction frequency F, and path length L. Calculate the comprehensive risk score based on these characteristics:

[0118] ,

[0119] in, , , These are standardized functions for transaction amount A, transaction frequency F, and path length L, respectively, which map the original value features to a unified scoring scale. , , The weights of each feature are preset, and satisfy the following conditions: .

[0120] S302 maps the comprehensive risk score to multiple preset risk ranges to obtain the corresponding risk level.

[0121] To map consecutive risk scores to rules of different levels, risk intervals need to be pre-configured, for example, Corresponding to low risk, Corresponding to medium risk, This corresponds to high risk. Next, the calculated comprehensive risk score is compared with these preset ranges to determine the risk level of the suspicious transaction chain.

[0122] S303 assigns a risk label corresponding to the risk level to a suspicious transaction chain.

[0123] Based on risk level, suspicious transaction chains are labeled with risk tags, such as High_Risk, Medium_Risk, and Low_Risk. Suspicious transaction chains, their risk tags, and detailed information are then written into the system database to prioritize subsequent audits.

[0124] This embodiment selects features strongly correlated with money laundering risk through a risk scoring and grading mechanism, transforms multi-dimensional link features into a single risk feature quantification result, and maps this result to a risk level label to achieve accurate risk grading, providing a quantitative basis for anti-money laundering supervision and audit tracking.

[0125] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0126] Based on the same inventive concept, this application also provides a system for implementing the aforementioned anti-money laundering detection method based on community and loop detection. The solution provided by this system is similar to the implementation described in the above method. Therefore, the specific limitations of one or more embodiments of the anti-money laundering detection system based on community and loop detection provided below can be found in the limitations of the anti-money laundering detection method based on community and loop detection described above, and will not be repeated here.

[0127] In one exemplary embodiment, such as Figure 6 As shown, an anti-money laundering detection system 400 based on joint detection of community and circular flow patterns is provided, including: a network construction module 401, a community detection module 402, a community filtering module 403, a circular flow pattern recognition module 404, a fund circulation path filtering module 405, and a risk decision module 406, wherein:

[0128] The network construction module 401 is used to obtain transaction data between multiple accounts and construct a transaction network graph. The nodes in the transaction network graph correspond to accounts, and the directed edges between nodes correspond to the transaction relationships between accounts.

[0129] The community detection module 402 is used to divide the transaction network graph into multiple communities using a community partitioning algorithm;

[0130] The community filtering module 403 is used to filter multiple communities based on a first preset rule and retain multiple target communities that meet the conditions.

[0131] The loop pattern recognition module 404 is used to detect transaction data within the target community using a directed loop detection algorithm and identify fund circulation paths with loop patterns.

[0132] The fund circulation path filtering module 405 is used to filter fund circulation paths based on a second preset rule and retain suspicious fund circulation paths that meet the conditions.

[0133] Risk decision module 406 is used to score the risk of suspicious transaction chains in suspicious fund circulation paths and assign risk level labels to suspicious transaction chains based on the risk scores.

[0134] In some exemplary embodiments, the community detection module is provided with a first pluggable interface, which is used to load different community detection algorithms to achieve optimal community partitioning, and the cycle pattern recognition module is provided with a second pluggable interface, which is used to load different directed cycle detection algorithms.

[0135] The community detection module, as a core component responsible for partitioning the trading network cluster, integrates a first pluggable interface. Preferably, this interface defines a unified algorithm interaction specification, including input parameter formats (such as the node set, edge set, and edge weight matrix of the trading network graph), output result standards (such as the community ID to node mapping table and modularity score), and call triggering mechanisms (such as initialization calls and timed update calls). Through this first pluggable interface, the system can load various community detection algorithms, such as the Louvain algorithm, the Leiden algorithm, and the Infomap algorithm. In practical applications, the optimal algorithm can be selected from the algorithm library based on the characteristic parameters of the current trading network and loaded through the first pluggable interface.

[0136] The cycle pattern recognition module, as a core component for detecting closed-loop funding paths, integrates a second pluggable interface. Preferably, this interface also defines a standardized interaction protocol, including input parameters (strongly connected component subgraphs, path length constraints) and output parameters (set of cycle paths, path confidence). Through this second pluggable interface, the system can load various directed cycle detection algorithms, such as the Johnson algorithm and the Tarjan algorithm combined with DFS search.

[0137] In some application scenarios, when dealing with large-scale sparse transaction networks, the system can quickly switch to the more computationally efficient Louvain algorithm via the first pluggable interface; when dealing with small-scale dense communities, it can switch to the Leiden algorithm, which has better community quality. Similarly, when it is necessary to detect short cycle paths, a DFS-based detection algorithm can be selected via the second pluggable interface; when it is necessary to detect longer cycle paths, it switches to the Johnson algorithm.

[0138] This embodiment improves the system's adaptability and flexibility through a pluggable interface design. The optimal algorithm can be selected according to different data characteristics and scenario requirements. The integration of new algorithms only requires the implementation of standard interfaces without modifying the core framework, thus reducing the system's maintenance costs.

[0139] In one exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 7 As shown, this computer device includes a processor, memory, input / output (I / O) interfaces, and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operating system and computer programs stored in the non-volatile storage media. The database stores data including basic account information, inter-account transaction data, constructed transaction network diagram data, community division results, and fund circulation paths. The I / O interfaces are used for information exchange between the processor and external devices. The communication interface is used for communication with external terminals via a network connection. When executed by the processor, the computer program can implement an anti-money laundering detection method based on community and circulation joint detection.

[0140] Those skilled in the art will understand that Figure 6 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0141] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0142] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0143] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0144] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. An anti-money laundering detection method based on community and circular joint detection, characterized in that, The method includes: Obtain transaction data between multiple accounts, and construct a transaction network graph based on the transaction data. Each node in the transaction network graph corresponds to an account, and the directed edges between nodes correspond to the transaction relationships between the accounts. The transaction network graph is divided into multiple communities using a community partitioning algorithm. Based on the first preset rule, the multiple communities are filtered to retain multiple target communities that meet the conditions; A directed cycle detection algorithm is used to detect the transaction data within the target community and identify fund circulation paths with cyclical patterns. Based on the second preset rule, the fund circulation path is filtered, and suspicious fund circulation paths that meet the conditions are retained. Risk scores are assigned to suspicious transaction chains within the suspicious fund circulation path, and risk level labels are assigned to the suspicious transaction chains based on the risk scores.

2. The method according to claim 1, characterized in that, The construction of the transaction network graph based on the transaction data includes: In the transaction data, multiple transactions of the same group of accounts within a certain time period are aggregated into a directed edge; Calculate the aggregate attributes of each directed edge, including total transaction amount, number of transactions, earliest transaction time, latest transaction time, time span, and edge weight; Construct a transaction network graph using all accounts as nodes, the directed edges as edges, and the aggregated attributes as edge attributes.

3. The method according to claim 2, characterized in that, The edge weights are calculated according to the following formula: ; Where total_amount is the total transaction amount, and count is the number of transactions. For the time span, This is an adjustable time decay parameter.

4. The method according to claim 1, characterized in that, The filtering of the multiple communities based on the first preset rule, retaining the target communities that meet the conditions, includes: Obtain the time span of all transactions within each of the multiple communities, and retain the first community set whose transaction time span is less than or equal to a preset time threshold; Obtain the average transaction amount within each community in the first community set, and retain the second community set whose average amount is less than or equal to a preset amount threshold; Obtain the number of nodes in each community of the second community set, and retain the target communities whose number of nodes is greater than or equal to a preset scale threshold.

5. The method according to claim 1, characterized in that, The filtering of the fund circulation paths based on the second preset rule, retaining suspicious fund circulation paths that meet the conditions, includes: Calculate the deviation rate between the total outflow and inflow of funds for the starting account of each fund circulation path, and retain the first path set whose deviation rate is less than a preset deviation threshold; For each directed fund circulation path in the first path set, calculate the coefficient of variation of the transaction amount, and retain the second path set whose coefficient of variation is less than a preset consistency threshold; For each directed fund circulation path in the second path set, calculate the transaction time span, and retain the suspicious fund circulation paths whose time span is less than a preset time threshold.

6. The method according to claim 1, characterized in that, The step of risk scoring of suspicious transaction chains in the suspicious fund circulation path and assigning risk level labels to the suspicious transaction chains based on the risk scores includes: Calculate the comprehensive risk score of the suspicious transaction chain based on the transaction amount, transaction frequency, and path length; The comprehensive risk score is mapped to multiple preset risk ranges to obtain the corresponding risk level; Assign a risk label corresponding to the risk level to the suspicious transaction chain.

7. The method according to claim 1, characterized in that, The step of using a directed cycle detection algorithm to detect transaction data within the target community and identifying fund circulation paths with cyclical patterns includes: Based on the nodes and directed edges in the target community, construct a target community subgraph, and extract strongly connected components from each target community subgraph; Traverse each of the strongly connected components and identify the directed cyclic path that meets the preset length condition, which is then used as the fund circulation path.

8. The method according to claim 1, characterized in that, Before constructing the transaction network graph, the method also includes: Remove invalid data from the transaction data, including self-circulating transaction data and invalid transaction data. The transaction data after removing invalid data is filtered by time window, and the transaction data within the preset time window is retained.

9. An anti-money laundering detection system based on community and circular joint detection, characterized in that, The system includes: The network construction module is used to acquire transaction data between multiple accounts and construct a transaction network graph based on the transaction data. Each node in the transaction network graph corresponds to an account, and the directed edges between nodes correspond to the transaction relationships between the accounts. The community detection module is used to divide the transaction network graph into multiple communities using a community partitioning algorithm; The community filtering module is used to filter the multiple communities based on a first preset rule and retain multiple target communities that meet the conditions. The loop pattern recognition module is used to detect the transaction data within the target community using a directed loop detection algorithm, and identify the fund circulation path with a loop pattern. The fund circulation path filtering module is used to filter the fund circulation path based on a second preset rule and retain suspicious fund circulation paths that meet the conditions. The risk decision module is used to score the risk of suspicious transaction chains in the suspicious fund circulation path and assign risk level labels to the suspicious transaction chains based on the risk scores.

10. The system according to claim 9, characterized in that, The community detection module is provided with a first pluggable interface, which is used to load different community detection algorithms to achieve optimal community division. The cyclic pattern recognition module is provided with a second pluggable interface, which is used to load different directed cyclic detection algorithms.

Images