Abnormal fund transfer network identification method and device based on sequential network similarity

Abstract

The invention discloses an abnormal fund transfer network identification method and device based on time sequence network similarity, and relates to the field of financial science and technology or other related technical fields, and the method comprises the steps: obtaining a pre-constructed time sequence network model, converting the time sequence network model into an adjacent matrix, expanding the adjacent matrix according to rows to form a normalized time sequence character string; based on the time sequence character string, the sequence similarity between the to-be-detected network and the known abnormal fund transfer network model is calculated by adopting an editing distance algorithm; and determining whether the target network is an abnormal fund transfer network based on a comparison result between the sequence similarity and a preset similarity threshold. According to the method and the device, the technical problem that the false alarm rate and the missing report rate are relatively high because the abnormal fund transfer monitoring mostly depends on rule matching or static network analysis at a single time point in the prior art is solved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of financial technology or other related fields, in particular, to an abnormal fund transfer network identification method and device based on time sequence network similarity. BACKGROUND

[0002] With the popularity and development of digital finance, fund transaction network has become an indispensable part of modern economic activities, and at the same time, it also provides a new cover means for abnormal fund transfer activities. The method of abnormal fund transfer is becoming more and more complex and more hidden, especially in the era of Internet finance, using the anonymity and cross-regional characteristics of the network, the abnormal fund transfer activities become more difficult to track and identify. The traditional fund transfer monitoring system mostly relies on rule matching or single time point static network analysis. This method often has a high false positive rate and a high false negative rate when facing large-scale and dynamic changing fund transaction network, especially for small data set, the effectiveness of the supervised learning model is greatly reduced. In addition, although the unsupervised learning model can adapt to the dynamic changes of data, it is easy to produce a large number of false positives because it only focuses on the network structure at the current time, which increases the cost and burden of financial institutions.

[0003] At present, there is no effective solution to the above problems. SUMMARY

[0004] The embodiments of the present application provide an abnormal fund transfer network identification method and device based on time sequence network similarity, to at least solve the technical problem that in the related art, when monitoring abnormal fund transfer, mostly relying on rule matching or single time point static network analysis, there is a high false positive rate and a high false negative rate.

[0005] In order to achieve the above purpose, according to one aspect of the present application, an abnormal fund transfer network identification method based on time sequence network similarity is provided, comprising: acquiring a pre-constructed time sequence network model, wherein the fund transaction account is taken as the node of the graph, the fund flow direction is taken as the edge of the graph, and a directed graph structure with time sequence is formed; converting the time sequence network model into an adjacency matrix, and expanding the adjacency matrix by row to form a normalized time sequence string; based on the time sequence string, using the edit distance algorithm to calculate the sequence similarity of the to-be-detected network and the known abnormal fund transfer network model; based on the comparison result between the sequence similarity and the pre-set similarity threshold, determining whether the target network is an abnormal fund transfer network.

[0006] Optionally, the step of obtaining a pre-constructed construction timing network model comprises: collecting fund transaction data in a historical time period to obtain a historical transaction data set, wherein each piece of historical transaction data contained in the historical transaction data set at least includes: transaction serial number, fund transaction account of both parties, fund flow direction and timestamp; sorting each piece of historical transaction data according to the timestamp in the historical transaction data to obtain a sorting result; and constructing a timing directed graph structure based on the sorting result to obtain the timing network model.

[0007] Optionally, the step of converting the timing network model into an adjacency matrix comprises: initializing a zero matrix, wherein the rows and columns of the zero matrix correspond to fund transaction account nodes respectively; and traversing each piece of historical transaction data in the timing network model to assign a value of 1 to the corresponding position of the adjacency matrix to represent an existing transaction relationship, or otherwise keep a value of 0.

[0008] Optionally, the step of expanding the adjacency matrix by row to form a normalized timing string comprises: traversing each row of the adjacency matrix to record the sequence of values of 1 and values of 0 of each row; removing consecutive values of 0 in the string; performing standardization processing on the string after the removal processing to make the string length consistent, and performing hash processing on the string by using a hash function to obtain a hash value corresponding to each string; and splicing each string after the hash processing to form the timing string.

[0009] Optionally, the step of calculating the sequence similarity of the to-be-detected network and the known abnormal fund transfer network model based on the timing string by using an edit distance algorithm comprises: creating a dynamic programming table, wherein the rows in the dynamic programming table correspond to the target timing string of the known abnormal fund transfer network model, and the columns correspond to the source timing string of the to-be-detected network; gradually filling the cells in the dynamic programming table according to a dynamic programming algorithm, wherein the value of each cell represents the initial edit distance to the current position; determining the value of the last cell in the dynamic programming table as the minimum edit distance of the target timing string and the source timing string; and calculating the sequence similarity of the to-be-detected network and the known abnormal fund transfer network model based on the length of the source timing string, the length of the target timing string and the minimum edit distance.

[0010] Optionally, the calculation process of the edit distance algorithm further comprises: defining the weight in the edit cost function through the out-degree ratio of the node; and adjusting the distance represented by the replacement operation, the deletion operation and / or the insertion operation according to the out-degree ratio of the node.

[0011] Optionally, the step of determining whether the target network is an abnormal fund transfer network based on a comparison result between the sequence similarity and a pre-set similarity threshold comprises: determining that the target network is not an abnormal fund transfer network when the comparison result indicates that the sequence similarity is lower than the similarity threshold; and determining that the target network is an abnormal fund transfer network when the comparison result indicates that the sequence similarity is higher than or equal to the similarity threshold.

[0012] According to another aspect of the embodiments of the present application, an abnormal fund transfer network identification device based on time sequence network similarity is further provided, which comprises: a time sequence network model acquisition unit configured to acquire a pre-constructed time sequence network model, wherein a fund transaction account is taken as a node of a graph and a fund flow direction is taken as an edge of the graph in the time sequence network model, thereby forming a directed graph structure with time sequence; a model conversion unit configured to convert the time sequence network model into an adjacency matrix and expand the adjacency matrix by row to form a normalized time sequence string; a sequence similarity calculation unit configured to calculate a sequence similarity between a target network to be detected and a known abnormal fund transfer network model based on the time sequence string by using an edit distance algorithm; and a network identification unit configured to determine whether the target network is an abnormal fund transfer network based on a comparison result between the sequence similarity and a pre-set similarity threshold.

[0013] Optionally, the time sequence network model acquisition unit comprises: a historical transaction data collection module configured to collect fund transaction data in a historical time period to obtain a historical transaction data set, wherein each piece of historical transaction data contained in the historical transaction data set comprises at least a transaction serial number, fund transaction accounts of both parties, a fund flow direction and a timestamp; a transaction data sorting module configured to sort each piece of historical transaction data according to the timestamp in the historical transaction data to obtain a sorting result; and a time sequence network model construction module configured to construct a time sequence directed graph structure based on the sorting result to obtain the time sequence network model.

[0014] Optionally, the model conversion unit comprises: a matrix initialization module configured to initialize a zero matrix, wherein the rows and columns of the zero matrix correspond to fund transaction account nodes respectively; and a transaction data traversal module configured to traverse each piece of historical transaction data in the time sequence network model, and assign a value 1 to a corresponding position of the adjacency matrix to represent an existing transaction relationship, or otherwise keep a value 0.

[0015] Optionally, the model conversion unit further comprises: a matrix traversal module, configured to traverse each row of the adjacency matrix and record the sequence of 1 and 0 values of each row; a value removal module, configured to remove continuous 0 values in a string; a string standardization module, configured to standardize the string after removal processing, so that the length of the string is consistent, and hash the string by using a hash function to obtain a hash value corresponding to each string; and a string concatenation module, configured to concatenate each string after hash processing to form the time sequence string.

[0016] Optionally, the sequence similarity calculation unit comprises: a planning table creation module, configured to create a dynamic planning table, wherein the rows of the dynamic planning table correspond to target time sequence strings of known abnormal fund transfer network models, and the columns correspond to source time sequence strings of a network to be detected; a cell filling module, configured to fill cells in the dynamic planning table according to a dynamic planning algorithm, wherein the value of each cell represents the initial edit distance to the current position; a first determination module, configured to determine the value of the last cell in the dynamic planning table as the minimum edit distance between the target time sequence string and the source time sequence string; and a sequence similarity calculation module, configured to calculate the sequence similarity between the network to be detected and the known abnormal fund transfer network model based on the length of the source time sequence string, the length of the target time sequence string and the minimum edit distance.

[0017] Optionally, the abnormal fund transfer network identification device based on time sequence network similarity further comprises: an in-out degree definition unit, configured to define the weight in the edit cost function by the in-out degree ratio of a node; and adjust the distance represented by the replacement operation, the deletion operation and / or the insertion operation according to the in-out degree ratio of the node.

[0018] Optionally, the network identification unit comprises: a second determination module, configured to determine that the target network is not an abnormal fund transfer network when the comparison result indicates that the sequence similarity is lower than the similarity threshold; and a third determination module, configured to determine that the target network is an abnormal fund transfer network when the comparison result indicates that the sequence similarity is higher than or equal to the similarity threshold.

[0019] According to another aspect of the embodiments of the present application, a computer readable storage medium is also provided, which comprises a stored computer program, wherein the computer program controls the device where the computer readable storage medium is located to perform the abnormal fund transfer network identification method based on time sequence network similarity according to any one of the above embodiments when the computer program is running.

[0020] According to another aspect of the embodiments of the present application, an electronic device is also provided, including one or more processors and a memory, the memory being configured to store one or more programs, wherein the one or more programs, when executed by the one or more processors, cause the one or more processors to implement the abnormal fund transfer network identification method based on the timing network similarity of any one of the above.

[0021] According to another aspect of the embodiments of the present application, a computer program product is also provided, including a computer program, which, when executed by a processor, implements the steps of the abnormal fund transfer network identification method based on the timing network similarity of any one of the above.

[0022] In the present disclosure, a pre-constructed timing network model is acquired, wherein in the timing network model, a fund transaction account is taken as a node of a graph, a fund flow direction is taken as an edge of the graph, and a directed graph structure with time sequence is formed; the timing network model is converted into an adjacency matrix, and the adjacency matrix is expanded by row to form a normalized timing string; based on the timing string, an edit distance algorithm is used to calculate the sequence similarity of a to-be-detected network and a known abnormal fund transfer network model; and based on a comparison result between the sequence similarity and a pre-set similarity threshold, it is determined whether the target network is an abnormal fund transfer network.

[0023] According to the above disclosure, through the similarity analysis based on the timing network, a suspicious transaction mode can be more accurately detected, the false positive rate is reduced, the resources consumed by the financial institutions in processing false positives are reduced, the accuracy and efficiency of abnormal fund transfer monitoring are significantly improved, and the security of the financial system is strengthened, thereby solving the technical problem that in the related art, when abnormal fund transfer monitoring is performed, a high false positive rate and a high false negative rate exist because the abnormal fund transfer monitoring is mostly dependent on rule matching or static network analysis at a single time point. BRIEF DESCRIPTION OF DRAWINGS

[0024] The accompanying drawings, which are included to provide a further understanding of the application and are incorporated in and constitute a part of this application, illustrate embodiments of the application and together with the description serve to explain the application. In the drawings:

[0025] Figure 1 A hardware structure block diagram of a computer terminal (or a mobile device) for implementing the abnormal fund transfer network identification method based on the timing network similarity is shown;

[0026] Figure 2 is a flowchart of an optional abnormal fund transfer network identification method based on the timing network similarity according to an embodiment of the present application;

[0027] Figure 3is a flow chart of an optional abnormal fund transfer network identification method based on timing network similarity according to an embodiment of the present application;

[0028] Figure 4 is a schematic diagram of an optional timing network model according to an embodiment of the present application;

[0029] Figure 5 is a schematic diagram of an optional timing network graph formed after timing division of fund flow information according to an embodiment of the present application;

[0030] Figure 6 is a calculation schematic diagram of an edit distance algorithm according to an embodiment of the present application;

[0031] Figure 7 is a schematic diagram of an optional abnormal fund transfer network identification device based on timing network similarity according to an embodiment of the present application;

[0032] Figure 8 is a structural block diagram of an electronic device for performing an abnormal fund transfer network identification method based on timing network similarity according to an embodiment of the present application. DETAILED DESCRIPTION

[0033] In order to make the personnel in the art better understand the present application scheme, the technical solutions in the embodiments of the present application will be described clearly and completely below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor should belong to the scope of protection of the present application.

[0034] It should be noted that the terms "first", "second", and the like in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and do not necessarily indicate a specific order or sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device including a series of steps or units does not necessarily limit to those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0035] In order to facilitate those skilled in the art to understand the present application, the following explains some terms or names involved in each embodiment of the present application:

[0036] The edit distance algorithm, Minimum Edit Distance Algorithm, MED for short, is an algorithm for evaluating the degree of difference between two sequences, mainly used for text similarity analysis, and is applied to the comparison of time series network structures in this application. The similarity between two sequences is measured by calculating the minimum number of operations (such as inserting, deleting, or replacing characters) required to change one sequence to equal the other. In this application, the edit distance algorithm is used to compare the time series string similarity between the network to be detected and the known abnormal fund transfer network model.

[0037] The time series network is a network model that reflects the change of fund flow information over time, treating accounts as nodes and fund flows at a specific time point as edges. It not only contains static information of fund transactions, but also reflects the dynamic change process of transactions, which helps to identify patterns and abnormalities.

[0038] It should be noted that the abnormal fund transfer network identification method and device based on time series network similarity in the present disclosure can be used in the field of financial technology for abnormal fund transfer network identification based on time series network similarity. In addition to the field of financial technology, the abnormal fund transfer network identification method and device based on time series network similarity in the present disclosure can also be used in any field for abnormal fund transfer network identification based on time series network similarity. The application field of the abnormal fund transfer network identification method and device based on time series network similarity in the present disclosure is not limited.

[0039] It should be noted that the information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) collected in the present disclosure are authorized by the user or authorized by all parties. The collection, storage, use, processing, transmission, provision, disclosure, and application of related data comply with relevant laws, regulations, and standards in the relevant region, take necessary security measures, do not violate public order and good customs, and provide corresponding operation portals for users to choose authorization or refusal. For example, the system and related users or institutions have an interface, which needs to send a request to the aforementioned user or institution through the interface before obtaining relevant information, and obtain relevant information after receiving the consent information feedback from the aforementioned user or institution.

[0040] It should be noted that in the present disclosure, customer information is collected, analyzed, and appropriate operation portals are provided for users to choose to agree or refuse automatic decision results; if the user chooses to refuse, the expert decision process is entered.

[0041] The following embodiments of the present invention can be applied to various systems / applications / devices for identifying abnormal fund transfer networks based on temporal network similarity. The present invention is applicable to abnormal fund transfer monitoring systems in the financial field, with specific application scenarios including but not limited to transaction monitoring and compliance reviews by financial institutions such as commercial banks, investment banks, insurance companies, and payment platforms. The present invention can effectively identify potential abnormal fund transfer networks by analyzing the temporal network structure of fund transactions, and is particularly suitable for handling the challenge of network model identification with small datasets.

[0042] This invention significantly improves the accuracy and efficiency of monitoring abnormal fund transfers. Through similarity analysis based on time-series networks, it can more accurately detect suspicious transaction patterns, reduce false alarm rates, and decrease the resources financial institutions expend in processing false alarms. Simultaneously, this invention optimizes the calculation process of the edit distance algorithm through dynamic programming, effectively reducing computational complexity and enabling real-time analysis of large-scale network models. Furthermore, the use of a time-series network model increases the dimensionality of identification information, enhancing the security of the financial system.

[0043] The present invention will now be described in detail with reference to various embodiments.

[0044] Example 1

[0045] According to an embodiment of the present invention, an embodiment of an abnormal fund transfer network identification method based on temporal network similarity is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0046] The abnormal fund transfer network identification method based on temporal network similarity provided in Embodiment 1 of this application can be executed on a mobile terminal, computer terminal, or similar computing device. Figure 1 A hardware block diagram of a computer terminal (or mobile device) for implementing an anomaly fund transfer network identification method based on temporal network similarity is shown. Figure 1 As shown, computer terminal 10 (or mobile device) may include one or more ( Figure 1The computer terminal 10 can include a processor 102 (which can include, but is not limited to, a microcontroller unit (MCU) or a field programmable gate array (FPGA) or other processing device), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, the computer terminal 10 can include a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which can be included as one of the ports of the BUS), a network interface, a power supply, and / or a camera. Those skilled in the art can understand that Figure 1 The structure shown is only schematic and does not limit the structure of the electronic device described above. For example, the computer terminal 10 can include more or fewer components than those shown in the figure, or have a different configuration than that shown in the figure. Figure 1 Figure 1 The structure shown is only schematic and does not limit the structure of the electronic device described above. For example, the computer terminal 10 can include more or fewer components than those shown in the figure, or have a different configuration than that shown in the figure.

[0047] It should be noted that the one or more processors 102 and / or other data processing circuits described above can be referred to herein generally as "data processing circuits". The data processing circuits can be embodied in whole or in part as software, hardware, firmware, or any combination thereof. In addition, the data processing circuits can be a single independent processing module, or any one of the other elements incorporated into the computer terminal 10 (or mobile device) in whole or in part. As referred to in the embodiments of the present application, the data processing circuits serve as a processor to control, for example, the selection of the variable resistance terminal path connected to the interface.

[0048] The memory 104 can be used to store software programs and modules of application software, such as program instructions / data storage means corresponding to the abnormal fund transfer network identification method based on timing network similarity in the embodiments of the present application. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, i.e. implements the abnormal fund transfer network identification method based on timing network similarity described above. The memory 104 can include a high-speed random access memory, and can also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 can further include a memory remotely located with respect to the processor 102, which can be connected to the computer terminal 10 through a network. Examples of the network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0049] ​The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 10. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0050] The display can be, for example, a touchscreen liquid crystal display (LCD), which allows the user to interact with the user interface of the computer terminal 10 (or mobile device).

[0051] Under the aforementioned operating environment, this application provides the following: Figure 2 The method for identifying abnormal fund transfer networks based on temporal network similarity is shown. Figure 2 This is a flowchart of an optional method for identifying abnormal fund transfer networks based on temporal network similarity according to an embodiment of the present invention, such as... Figure 2 As shown, the method includes the following steps S201 to S204, which will be explained in detail below.

[0052] Step S201: Obtain a pre-built temporal network model, wherein the fund transaction account is used as the node of the graph and the fund flow is used as the edge of the graph, forming a directed graph structure with time sequence.

[0053] This embodiment constructs a temporal network model to accurately identify abnormal fund transfer networks. Specifically, this embodiment obtains a pre-constructed temporal network model, regards fund transaction accounts as nodes of a graph, fund flows as edges of a graph, and the formation of these edges is based on time sequence, thereby constructing a directed graph structure with dynamic time characteristics.

[0054] Optionally, step S201 includes: collecting fund transaction data in historical time periods to obtain a historical transaction dataset, wherein each historical transaction data in the historical transaction dataset includes at least: transaction number, fund transaction accounts of both parties, fund flow direction and timestamp; sorting each historical transaction data according to the timestamp in the historical transaction data to obtain a sorting result; and constructing a temporal directed graph structure based on the sorting result to obtain a temporal network model.

[0055] First, the embodiment extracts historical fund transaction records (including but not limited to transaction serial number, transaction account information of both parties, fund flow direction and specific timestamp of transaction occurrence) from the database of the financial institution, ensuring the comprehensiveness and accuracy of subsequent analysis. Then by sorting the historical transaction data by timestamp, the embodiment can ensure that the network model constructed reflects the time sequence of fund flow, capturing the time sequence characteristics in the abnormal fund transfer strategy that may exist. After sorting the historical transaction data, the embodiment converts the data into a graph model form. Each account is a node in the network, and the flow of funds from one account to another is represented by a directed edge, which carries time information. This edge not only intuitively presents the fund transfer relationship between accounts, but also reflects the time sequence of each transaction, forming a time sequence network model that can reflect the dynamic characteristics of historical fund transactions.

[0056] Step S202, converting the time sequence network model into an adjacency matrix, and expanding the adjacency matrix by row to form a normalized time sequence string.

[0057] Optionally, the step of converting the time sequence network model into an adjacency matrix includes: initializing a zero matrix, wherein the rows and columns of the zero matrix correspond to the fund transaction account nodes respectively; traversing each piece of historical transaction data in the time sequence network model, assigning a value of 1 to the corresponding position of the adjacency matrix to represent the existence of a transaction relationship, or otherwise keeping the value of 0.

[0058] First, a zero matrix is initialized, and the size of the zero matrix can match the number of fund transaction account nodes, ensuring that the rows and columns correspond to each account respectively.

[0059] Then, each piece of historical transaction data in the time sequence network model constructed based on step S201 is traversed, and the corresponding position of the adjacency matrix is updated: if a transaction flows from node A to node B, the value of 1 is assigned to the position of A row and B column in the matrix, indicating that there is a transaction relationship between A and B; if there is no direct transaction relationship, the value of 0 is kept in the position. In this way, each piece of historical transaction information is encoded into the adjacency matrix, forming a complete mapping of fund transactions.

[0060] Optionally, the step of expanding the adjacency matrix by row to form a normalized time sequence string includes: traversing each row of the adjacency matrix, recording the sequence of values 1 and 0 of each row; removing consecutive values 0 in the string; standardizing the string after the removal processing to make the string length consistent, and hashing the string using a hash function to obtain the hash value corresponding to each string; and concatenating the hashed strings to form a time sequence string.

[0061] First, each row of the adjacency matrix is traversed, and the sequence of 1 and 0 in each row is recorded, which essentially reflects the transaction association between accounts and other accounts. Second, in order to reduce data redundancy and improve the readability of the sequence and the efficiency of the subsequent algorithm, all continuous 0 in the processed string are removed (since in the fund transaction network, continuous non-transaction accounts have little effect on the structure and pattern of the network, and removing this part of the information will not affect the overall similarity analysis of the model).

[0062] Next, the processed string is standardized to ensure that all strings are of the same length. Standardization usually involves padding or truncation so that all account transaction relationships can be represented by strings of equal length. Finally, the standardized string is hashed using a hash function to generate a hash value corresponding to the original string, further reducing the dimensionality of the string while maintaining its uniqueness and discriminability. The hashed string is then concatenated to form a complete normalized time series string (the string contains processed transaction network information, which facilitates subsequent similarity analysis).

[0063] By converting the time series network model into an adjacency matrix and processing the adjacency matrix to form a normalized time series string, this embodiment not only simplifies and encodes the complex network structure, but also ensures the uniformity of the string and the condensed expression of the information through standardization and hashing, greatly improving the efficiency and accuracy of subsequent similarity analysis, especially when dealing with large-scale transaction data. By reducing redundant information, the bottleneck of data processing is avoided.

[0064] Step S203, based on the time series string, the edit distance algorithm is used to calculate the sequence similarity between the network to be detected and the known abnormal fund transfer network model.

[0065] This embodiment uses the edit distance algorithm to calculate and analyze the sequence similarity between the network to be detected and the known abnormal fund transfer network model based on the network model converted into a time series string, effectively quantifying the structural differences between the two through dynamic programming, laying the foundation for the identification of abnormal fund flow.

[0066] Optionally, the step S203 comprises: creating a dynamic programming table, wherein rows in the dynamic programming table correspond to target time sequence strings of known abnormal fund transfer network models, and columns correspond to source time sequence strings of the network to be detected; filling cells in the dynamic programming table according to a dynamic programming algorithm, wherein a value of each cell represents an initial edit distance to a current position; determining a value of a last cell in the dynamic programming table as a minimum edit distance of the target time sequence string and the source time sequence string; and calculating a sequence similarity between the network to be detected and the known abnormal fund transfer network model based on a length of the source time sequence string, a length of the target time sequence string, and the minimum edit distance.

[0067] First, a two-dimensional table is initialized, wherein rows correspond to target time sequence strings of known abnormal fund transfer network models, and columns correspond to source time sequence strings of the network to be detected. The size of the dynamic programming table is related to the lengths of the two strings, and the purpose is to store the edit distance from the starting position of the source time sequence string to any position of the target time sequence string.

[0068] According to the basic principle of dynamic programming, the value of each cell is calculated and filled in step by step. The value of each cell represents the minimum edit distance of the current source string and the target string part. When calculating, the value of each cell in the dynamic programming table depends on the cost of three operations: replacement, deletion, and insertion. In this embodiment, the cost of these operations is set to the same unit cost (for example, 1).

[0069] The specific calculation logic follows the recursive formula of Levenshtein distance: if the current character of the source time sequence string is the same as the current character of the target time sequence string, the value of the current cell is equal to the value of the cell above and to the left (i.e. no additional operation is needed, and the edit distance remains unchanged); if they are different, the value of the current cell is the minimum value of the left, top, and top-left adjacent cells plus 1 (representing the replacement, deletion, or insertion operation). Determine the minimum edit distance: after filling the dynamic programming table, the value of the last cell is the minimum edit distance required to completely convert the source time sequence string into the target time sequence string, which directly reflects the difference between the two.

[0070] By comprehensively considering the length of the source time sequence string, the length of the target time sequence string, and the minimum edit distance, this embodiment can obtain the sequence similarity between the network to be detected and the known abnormal fund transfer network model. Generally, the smaller the minimum edit distance, the higher the sequence similarity; otherwise, it indicates that the two sequences are quite different. The similarity calculation formula can be based on the ratio of the minimum edit distance, the source sequence length, and the target sequence length, or by converting the minimum edit distance into an intuitive similarity score through a preset function. Through the similarity score, a threshold can be set to automatically distinguish between abnormal fund transfer networks and normal transaction networks.

[0071] Optionally, in the calculation process of the edit distance algorithm, the weight in the edit cost function is defined by the out-in degree ratio of the node, and the distance represented by the replacement operation, the deletion operation and / or the insertion operation is adjusted according to the out-in degree ratio of the node.

[0072] In the time sequence network model, the out-in degree ratio of each node (i.e., the fund transaction account) represents the ratio of the frequency or importance of the account as a fund source to a fund destination. The out-in degree ratio can be determined by dividing the out degree of the account by the in degree, or a comprehensive ratio of the two, which reflects the transaction activity and the dominant direction of the fund flow of the account in the network.

[0073] In the edit distance algorithm, the replacement, deletion and insertion operations are usually assigned the same unit cost (e.g., 1). However, in this embodiment, by introducing the out-in degree ratio of the node as the weight, the cost of these operations will no longer be fixed. The size of the weight depends on the out-in degree ratio of the node, which means that the transaction activity and directionality of the account will directly affect the cost of the edit operation when calculating the edit distance.

[0074] Further, the edit operation distance is adjusted according to the out-in degree ratio of the node. Specifically, for the replacement operation: if the out-in degree ratios of the two accounts are similar, i.e., the roles of the two in the network structure are similar, the cost of the replacement operation will be assigned a lower weight. Conversely, if the out-in degree ratios are quite different, the cost of the replacement operation will be correspondingly increased, indicating that replacing two accounts playing different roles in the transaction network will have a greater impact on the network structure. For the deletion operation: the cost of the deletion operation is determined according to the out-in degree ratio of the deleted node. For nodes with high out-in degree ratios, the cost of the deletion operation will increase, because these nodes have high connectivity and influence in the network, and deleting them will significantly change the structure of the network. For the insertion operation: the cost of the insertion operation is also affected by the out-in degree ratio of the newly inserted node. If the out-in degree ratio of the new node matches that of other nodes in the network, the cost of the insertion operation will be reduced, and vice versa.

[0075] Step S204, based on the comparison result between the sequence similarity and the pre-set similarity threshold, determines whether the target network is an abnormal fund transfer network.

[0076] Optionally, the step of determining whether the target network is an abnormal fund transfer network based on the comparison result between the sequence similarity and the pre-set similarity threshold includes: in the case that the comparison result indicates that the sequence similarity is lower than the similarity threshold, determining that the target network is not an abnormal fund transfer network; and in the case that the comparison result indicates that the sequence similarity is higher than or equal to the similarity threshold, determining that the target network is an abnormal fund transfer network.

[0077] When the calculated sequence similarity value is lower than the pre-set similarity threshold, the embodiment determines that the target network does not belong to the abnormal fund transfer network, although there is a certain transaction pattern similarity, but the difference between it and the known illegal network model is large enough, which is not enough to constitute the suspicion of abnormal fund transfer, which helps to reduce the risk of normal transactions being wrongly marked. On the contrary, if the sequence similarity value is higher than or equal to the pre-set similarity threshold, the embodiment determines that the target network is most likely to be an abnormal fund transfer network, and the high similarity implies that the structure and transaction pattern of the target network are significantly consistent with the known illegal network model. At this time, the system should trigger further investigation or warning mechanism, so that financial institutions and regulatory agencies can intervene in time.

[0078] Through the above comparison and determination process, the embodiment can not only quickly and accurately identify potential abnormal fund transfer networks, but also effectively reduce the misjudgment rate, improve the efficiency and accuracy of abnormal fund transfer monitoring strategies.

[0079] Through the above steps, a pre-constructed time sequence network model can be obtained, wherein the fund transaction account is taken as a node of the graph, the fund flow direction is taken as an edge of the graph, and a directed graph structure with time sequence is formed; the time sequence network model is converted into an adjacency matrix, and the adjacency matrix is expanded by row to form a normalized time sequence string; based on the time sequence string, an edit distance algorithm is used to calculate the sequence similarity of the to-be-detected network and the known abnormal fund transfer network model; based on the comparison result between the sequence similarity and the pre-set similarity threshold, it is determined whether the target network is an abnormal fund transfer network. In this embodiment, through similarity analysis based on the time sequence network, suspicious transaction patterns can be detected more accurately, the false positive rate is reduced, the resources consumed by financial institutions in handling false positives are reduced, the accuracy and efficiency of abnormal fund transfer monitoring are significantly improved, and the security of the financial system is strengthened, thereby solving the technical problems of high false positive rate and false negative rate in the related art when performing abnormal fund transfer monitoring, which mostly relies on rule matching or static network analysis at a single time point.

[0080] The following will be described in detail in conjunction with another alternative specific embodiment.

[0081] The application provides a time sequence network model, which takes the fund outflow and inflow accounts in the fund transaction network as graph node information, and takes the fund flow direction as edge information, constructs a time sequence network structure with fund flow direction, and compares the similarity with the existing abnormal fund transfer network model to identify possible abnormal fund transfer transactions. The identification accuracy of the bank abnormal fund transfer network is increased, which helps to prevent abnormal fund transfer behavior.

[0082] Figure 3This is a flowchart of an optional method for identifying abnormal fund transfer networks based on temporal network similarity according to an embodiment of the present invention, such as... Figure 3 As shown, the method includes:

[0083] The first step is to build a temporal network model.

[0084] The temporal network model uses a directed graph network model, consisting of nodes and edges. Nodes represent the objects under study, i.e., user accounts, and edges represent the relationships between objects, i.e., fund flows. The graph model can be represented as a set of nodes and edges, denoted as G = (V, E, D), where a line connecting node v... i v j The edge is denoted as (v i ,v j ) or e ij The node connected to node v i The number of edges of node v i The in-degree is denoted as node v i The number of edges connecting node v to other nodes is given by the number of edges connecting node v to other nodes. i The outgoing degree is recorded as

[0085] Figure 4 This is a schematic diagram of an optional temporal network model according to an embodiment of the present invention, such as... Figure 4 As shown, this diagram illustrates the fund flow relationships between five accounts: V1, V2, V3, V4, and V5. The starting point of the arrow indicates the fund transferor, and the ending point of the arrow indicates the fund recipient.

[0086] The second step is to serialize the adjacency matrix.

[0087] The graph network information summarized in this embodiment can be stored using an adjacency matrix. Assuming a graph G = (V, E, W), the adjacency matrix R represents the connection relationships between graph nodes, i.e., if (v... i ,v j If R belongs to E, then R ij =1, otherwise R ij =0. Figure 5 This is a schematic diagram of a time-series network diagram formed by time-series segmentation of fund flow information according to an embodiment of the present invention, and it can also be represented by an adjacency matrix.

[0088] The third step is to compare the similarity of network sequences.

[0089] Network structure similarity analysis employs the Minimum Edit Distance (MED) algorithm, which measures the minimum number of single-character edit operations (n) required to transform one sequence A into another sequence B. Since the algorithm uses a sequence structure as input, this invention expands the adjacency matrix row-wise into a 0-1 string as the algorithm input. It should be noted that the edit distance here represents n; the smaller n is, the smaller it is compared to the maximum length of the two sequences; the larger the value of 1 minus this value, the higher the similarity.

[0090] There are only three single-character editing operations: replace, delete, and insert; sequence A is defined as the adjacency matrix of graph G1 expanded by rows, and sequence B is defined as the adjacency matrix of graph G2 expanded by columns; the length of sequence A is defined as L1, and the length of sequence B is defined as L2; ​​the similarity is defined as K = 1 - n / max(L1, L2).

[0091] Figure 6 This is a schematic diagram illustrating the calculation of an edit distance algorithm according to an embodiment of the present invention, as shown below. Figure 6 The MED definition example is shown below: A = {0, 1, 0, 0}, B = {0, 1, 0, 0, 0, 1, 0, 0, 0}, L1 = 4, L2 = 9.

[0092] Since there are multiple paths to transform the transformation sequence into the target sequence, and different transformation paths will eventually lead to the same termination state as the target sequence, dynamic programming is used to record the shortest path for each state. That is, a complex problem is transformed into multiple subproblems to be solved, and then backtracking is performed from the final path to find the shortest path.

[0093] To reach the termination state as quickly as possible and thus reduce the algorithm's complexity, this invention divides the transformation sequence and the target sequence into three parts based on the in-degree and out-degree of the nodes (the three parts represent a way to quickly increase the speed of finding the minimum N), where nodes only have out-degrees. The first part consists of nodes with only in-degree. The second part consists of nodes that have both out-degree and in-degree. This is the third part. Each part is sorted according to the number of nodes. For example... Figure 4 The network model shown has nodes divided into {v1,v4,v3,v2,v5}.

[0094] The edit distance algorithm defines D(i,j) as the minimum edit distance n from A[1...i] to B[1...j], where A[1...i] represents that there are i characters before A, and B[1...j] represents that there are j characters before B. D(n,m) is the minimum edit distance from sequence A to sequence B.

[0095] In this invention, `del` represents the cost of the deletion operation, `ins` represents the cost of the insertion operation, `sub` represents the cost of the replacement operation, `S` represents the transformation sequence, and `T` represents the target sequence. If the cost of the insertion, deletion, and replacement methods is defined as 1, the calculation method is as follows:

[0096]

[0097] It should be noted that when a sequence is replaced, deleted, or inserted, N+1 is always added, and the maximum N will not exceed the maximum length of the two sequences.

[0098] like Figure 6 The system flowchart shown is shown below, where P is the similarity threshold. When K is greater than or equal to P, the network is an abnormal fund transfer network; otherwise, it is not an abnormal fund transfer network.

[0099] This invention provides a system and method for identifying abnormal fund transfer network models based on temporal network structures. By serializing known abnormal fund transfer network temporal models and a target temporal network, the similarity between the two sequences is compared to determine whether the target network is an abnormal fund transfer network. This improves the security of banking and financial systems, enhances the ability to identify abnormal fund transfers, effectively solves the problem of abnormal fund transfer network identification in small datasets, and significantly improves the low recognition rate of current identification systems when identifying individual nodes. Furthermore, the use of temporal networks enhances the diversity of identification information.

[0100] The following is a detailed description with reference to another embodiment.

[0101] Example 2

[0102] The abnormal fund transfer network identification device based on time-series network similarity provided in this embodiment includes multiple implementation units, each of which corresponds to the implementation steps in the above embodiment one. Its specific implementation method and beneficial effects can be referred to the foregoing method embodiment, and will not be repeated here.

[0103] Figure 7 This is a schematic diagram of an optional abnormal fund transfer network identification device based on temporal network similarity according to an embodiment of the present invention, such as... Figure 7 As shown, the abnormal fund transfer network identification device based on temporal network similarity may include: a temporal network model acquisition unit 71, a model conversion unit 72, a sequence similarity calculation unit 73, and a network identification unit 74.

[0104] The temporal network model acquisition unit 71 is used to acquire a pre-built temporal network model, wherein the fund transaction account is used as the node of the graph and the fund flow is used as the edge of the graph, forming a directed graph structure with time order.

[0105] Model conversion unit 72 is used to convert the temporal network model into an adjacency matrix and expand the adjacency matrix row by row to form a normalized temporal string;

[0106] The sequence similarity calculation unit 73 is used to calculate the sequence similarity between the network to be detected and the known abnormal fund transfer network model based on the time-series string and the edit distance algorithm.

[0107] The network identification unit 74 is used to determine whether the target network is an abnormal fund transfer network based on the comparison results between sequence similarity and a pre-set similarity threshold.

[0108] The aforementioned abnormal fund transfer network identification device based on temporal network similarity can acquire a pre-constructed temporal network model through the temporal network model acquisition unit 71. In the temporal network model, fund transaction accounts are used as nodes of the graph, and fund flows are used as edges of the graph, forming a directed graph structure with temporal order. The model conversion unit 72 converts the temporal network model into an adjacency matrix, and expands the adjacency matrix row by row to form a normalized temporal string. The sequence similarity calculation unit 73 calculates the sequence similarity between the network to be detected and the known abnormal fund transfer network model based on the temporal string using the edit distance algorithm. The network identification unit 74 determines whether the target network is an abnormal fund transfer network based on the comparison result between the sequence similarity and the pre-set similarity threshold. In this embodiment, by using similarity analysis based on time-series networks, suspicious transaction patterns can be detected more accurately, reducing the false alarm rate and the resources consumed by financial institutions in processing false alarms. This significantly improves the accuracy and efficiency of abnormal fund transfer monitoring, strengthens the security of the financial system, and solves the technical problem that most related technologies rely on rule matching or static network analysis at a single time point when monitoring abnormal fund transfers, resulting in high false alarm and false negative rates.

[0109] Optionally, the time-series network model acquisition unit includes: a historical transaction data collection module, used to collect fund transaction data in historical time periods to obtain a historical transaction dataset, wherein each historical transaction data in the historical transaction dataset includes at least: transaction sequence number, fund transaction accounts of both parties, fund flow direction, and timestamp; a transaction data sorting module, used to sort each historical transaction data according to the timestamp in the historical transaction data to obtain a sorting result; and a time-series network model construction module, used to construct a time-series directed graph structure based on the sorting result to obtain a time-series network model.

[0110] Optionally, the model transformation unit includes: a matrix initialization module, used to initialize a zero matrix, wherein the rows and columns of the zero matrix correspond to the fund transaction account nodes respectively; and a transaction data traversal module, used to traverse each historical transaction data in the time series network model, assigning a value of 1 to the corresponding position of the adjacency matrix to indicate the existence of a transaction relationship, otherwise keeping the value 0.

[0111] Optionally, the model conversion unit further includes: a matrix traversal module, used to traverse each row of the adjacency matrix and record the sequence of values ​​1 and 0 in each row; a value removal module, used to remove consecutive values ​​0 from the string; a string normalization module, used to normalize the removed strings to make the string length consistent, and to perform hash processing on the strings using a hash function to obtain the hash value corresponding to each string; and a string concatenation module, used to concatenate the hashed strings to form a time-series string.

[0112] Optionally, the sequence similarity calculation unit includes: a planning table creation module, used to create a dynamic programming table, wherein the rows in the dynamic programming table correspond to the target time series strings of the known abnormal fund transfer network model, and the list corresponds to the source time series strings of the network to be detected; a cell filling module, used to gradually fill the cells in the dynamic programming table according to the dynamic programming algorithm, wherein the value of each cell represents the initial edit distance to the current position; a first determination module, used to determine that the value of the last cell in the dynamic programming table is the minimum edit distance between the target time series string and the source time series string; and a sequence similarity calculation module, used to calculate the sequence similarity between the network to be detected and the known abnormal fund transfer network model based on the length of the source time series string, the length of the target time series string, and the minimum edit distance.

[0113] Optionally, the abnormal fund transfer network identification device based on temporal network similarity further includes: an in-degree definition unit, used to define the weights in the editing cost function by the in-degree ratio of the nodes; and to adjust the distance represented by the replacement operation, deletion operation and / or insertion operation according to the in-degree ratio of the nodes.

[0114] Optionally, the network identification unit includes: a second determining module, used to determine that the target network is not an abnormal fund transfer network when the sequence similarity indicated by the comparison result is lower than the similarity threshold; and a third determining module, used to determine that the target network is an abnormal fund transfer network when the sequence similarity indicated by the comparison result is higher than or equal to the similarity threshold.

[0115] The above-mentioned abnormal fund transfer network identification device based on temporal network similarity may also include a processor and a memory. The temporal network model acquisition unit 71, model conversion unit 72, sequence similarity calculation unit 73, network identification unit 74, etc. are all stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to realize the corresponding functions.

[0116] The aforementioned processor contains a kernel, which retrieves the corresponding program units from memory. One or more kernels can be configured, and adjusting kernel parameters can achieve the identification of abnormal fund transfers based on temporal network similarity.

[0117] The aforementioned memory may include non-permanent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0118] Example 3

[0119] Embodiments of this application may provide an electronic device. Figure 8 This is a structural block diagram of an electronic device that performs an abnormal fund transfer network identification method based on temporal network similarity, according to an embodiment of this application. Figure 8 As shown, the electronic device may include: one or more ( Figure 8 Only one of the components is shown: processor 802, memory 804, memory controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module, and display.

[0120] The memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the abnormal fund transfer network identification method and device based on time-series network similarity in this application embodiment. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, thereby realizing the above-mentioned abnormal fund transfer network identification method based on time-series network similarity. The memory may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include memory remotely located relative to the processor, and these remote memories can be connected to the terminal via a network. Examples of the above-mentioned networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0121] The processor can access information and applications stored in memory via a transmission device to execute the following steps: acquiring a pre-built temporal network model, where transaction accounts are used as nodes in the graph and fund flows are used as edges, forming a directed graph structure with temporal order; converting the temporal network model into an adjacency matrix and expanding the adjacency matrix row-wise to form a normalized temporal string; calculating the sequence similarity between the network to be detected and known abnormal fund transfer network models using an edit distance algorithm based on the temporal string; and determining whether the target network is an abnormal fund transfer network based on the comparison between the sequence similarity and a pre-set similarity threshold.

[0122] Those skilled in the art will understand that Figure 8 The structure shown is for illustrative purposes only. Electronic devices can also be smartphones, tablets, handheld computers, mobile internet devices (MIDs), PADs, and other terminal devices. Figure 8 This does not limit the structure of the aforementioned electronic device. For example, electronic devices may also include components that are more... Figure 8 The more or fewer components shown (such as network interfaces, display devices, etc.), or having the same Figure 8 The different configurations shown.

[0123] Those skilled in the art will understand that all or part of the steps in the various methods for identifying abnormal fund transfer networks based on temporal network similarity in the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a computer-readable storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0124] Example 4

[0125] Embodiments of this application also provide a storage medium. Optionally, in this embodiment, the storage medium can be used to store the program code executed by the abnormal fund transfer network identification method based on temporal network similarity provided in Embodiment 1.

[0126] According to another aspect of the present invention, a computer-readable storage medium is also provided, the computer-readable storage medium including a stored computer program, wherein, when the computer program is running, it controls the device where the computer-readable storage medium is located to execute any one of the above-described methods for identifying abnormal fund transfer networks based on temporal network similarity.

[0127] Optionally, in this embodiment, the storage medium may be located in any computer terminal in a group of computer terminals in a computer network, or in any mobile terminal in a group of mobile terminals.

[0128] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the abnormal fund transfer network identification method based on temporal network similarity described in various embodiments of this application.

[0129] This application also provides a computer program product, including a non-volatile computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the abnormal fund transfer network identification method based on temporal network similarity described in various embodiments of this application.

[0130] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0131] In the above embodiments of the present invention, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0132] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For instance, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0133] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0134] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0135] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0136] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for identifying abnormal fund transfer networks based on temporal network similarity, characterized in that, include: Obtain a pre-built temporal network model, wherein the fund transaction account is used as the node of the graph and the fund flow is used as the edge of the graph, forming a directed graph structure with temporal order. The temporal network model is converted into an adjacency matrix, and the adjacency matrix is ​​expanded row by row to form a normalized temporal string; Based on the aforementioned time-series string, the edit distance algorithm is used to calculate the sequence similarity between the network to be detected and the known abnormal fund transfer network model; Based on the comparison between the sequence similarity and a pre-set similarity threshold, it is determined whether the target network is an abnormal fund transfer network.

2. The method for identifying abnormal fund transfer networks according to claim 1, characterized in that, The steps to obtain a pre-built construction-time network model include: Collect fund transaction data from historical time periods to obtain a historical transaction dataset. Each historical transaction data entry in the historical transaction dataset includes at least: transaction number, fund transaction accounts of both parties, fund flow direction, and timestamp. The historical transaction data is sorted according to the timestamps in the historical transaction data to obtain the sorting result; Based on the sorting results, a temporal directed graph structure is constructed to obtain the temporal network model.

3. The method for identifying abnormal fund transfer networks according to claim 1, characterized in that, The steps of converting the temporal network model into an adjacency matrix include: Initialize a zero matrix, wherein the rows and columns of the zero matrix correspond to the fund transaction account nodes, respectively; For each historical transaction in the time-series network model, assign a value of 1 to the corresponding position in the adjacency matrix to indicate the existence of a transaction relationship; otherwise, keep the value of 0.

4. The method for identifying abnormal fund transfer networks according to claim 1, characterized in that, The steps of expanding the adjacency matrix row-wise to form a normalized time series string include: Traverse each row of the adjacency matrix and record the sequence of 1s and 0s in each row; Remove consecutive zeros from a string; The strings after removal are standardized to ensure uniform string length, and a hash function is used to hash the strings to obtain hash values ​​corresponding to each string. The hashed strings are concatenated to form the time sequence string.

5. The method for identifying abnormal fund transfer networks according to claim 1, characterized in that, Based on the time-series string, the steps for calculating the sequence similarity between the network to be detected and the known abnormal fund transfer network model using the edit distance algorithm include: Create a dynamic programming table, where the rows in the dynamic programming table correspond to the target time series strings of the known abnormal fund transfer network model, and the list corresponds to the source time series strings of the network to be detected; According to the dynamic programming algorithm, the cells in the dynamic programming table are gradually filled, wherein the value of each cell represents the initial edit distance to the current position; The value of the last cell in the dynamic programming table is determined to be the minimum edit distance between the target time series string and the source time series string; Based on the length of the source time series string, the length of the target time series string, and the minimum edit distance, the sequence similarity between the network to be detected and the known abnormal fund transfer network model is calculated.

6. The method for identifying abnormal fund transfer networks according to claim 1, characterized in that, The calculation process of the edit distance algorithm also includes: The weights in the edit cost function are defined by the in-degree ratio of the nodes; Adjust the distance represented by replacement, deletion, and / or insertion operations based on the in-degree ratio of the nodes.

7. The method for identifying abnormal fund transfer networks according to claim 1, characterized in that, The step of determining whether the target network is an abnormal fund transfer network based on the comparison result between the sequence similarity and a pre-set similarity threshold includes: If the comparison result indicates that the sequence similarity is lower than the similarity threshold, the target network is determined not to be an abnormal fund transfer network. If the comparison result indicates that the sequence similarity is higher than or equal to the similarity threshold, the target network is determined to be an abnormal fund transfer network.

8. An abnormal fund transfer network identification device based on temporal network similarity, characterized in that, include: The temporal network model acquisition unit is used to acquire a pre-built temporal network model, wherein the temporal network model uses fund transaction accounts as nodes of the graph and fund flows as edges of the graph, forming a directed graph structure with time order. The model conversion unit is used to convert the temporal network model into an adjacency matrix and expand the adjacency matrix row by row to form a normalized temporal string; The sequence similarity calculation unit is used to calculate the sequence similarity between the network to be detected and the known abnormal fund transfer network model based on the time sequence string using the edit distance algorithm; The network identification unit is used to determine whether the target network is an abnormal fund transfer network based on the comparison result between the sequence similarity and a pre-set similarity threshold.

9. An electronic device, characterized in that, The device includes one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the abnormal fund transfer network identification method based on temporal network similarity as described in any one of claims 1 to 7.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the steps of the abnormal fund transfer network identification method based on temporal network similarity as described in any one of claims 1 to 7.

Images