Abnormal account determination method and device, storage medium and electronic equipment

Abstract

The invention discloses an abnormal account determination method and device, a storage medium and electronic equipment, and the method comprises the steps: receiving a target query request used for querying a target account, the target query request being a request obtained by encrypting a query request through a first encryption channel, the first encryption channel is used for transmitting a query request sent by the target node to the central node; based on the target query request, obtaining features of a target account from a plurality of other nodes, and obtaining a plurality of target features; decrypting the plurality of target features to obtain account features, and determining a target score of the target account based on the account features; and sending the target score to the target node through the first encryption channel to instruct the target node to determine whether the target account is abnormal based on the target score. According to the method and the device, the problem that the security and the accuracy cannot be considered in the abnormal account determination process can be solved, and the effect of considering the security and the accuracy in the abnormal account determination process is achieved.

Description

TECHNICAL FIELD

[0001] Embodiments of the present application relate to the computer field, in particular, to a method and apparatus for determining an abnormal account, a storage medium and an electronic device. BACKGROUND

[0002] In the related art, in order to meet the "data does not leave the domain" requirement of regulations, data islands are formed between various financial institutions, and original data cannot be shared, which makes it difficult to draw a complete fund flow map, and the accuracy of the traditional method of determining an abnormal account based on a rule engine and internal data of an institution is low.

[0003] Therefore, there is a technical problem that security and accuracy cannot be considered in the process of determining an abnormal account in the related art.

[0004] At present, there is no effective solution to the above problems in the related art. SUMMARY

[0005] Embodiments of the present application provide a method and apparatus for determining an abnormal account, a storage medium and an electronic device to at least solve the technical problem that security and accuracy cannot be considered in the process of determining an abnormal account in the related art.

[0006] According to an aspect of an embodiment of the present application, a method for determining an abnormal account is provided, including: receiving a target query request for querying a target account, wherein the target query request is a request obtained by encrypting a query request through a first encryption channel, and the first encryption channel is used to transmit the query request sent by a target node to a central node; obtaining a plurality of target features of the target account based on features of the target account obtained from a plurality of other nodes, wherein the target feature is a feature obtained by encrypting an account feature through a second encryption channel, and the account feature is an encrypted feature; decrypting a plurality of target features to obtain the account feature, and determining a target score of the target account based on the account feature; and sending the target score to the target node through the first encryption channel to instruct the target node to determine whether the target account is abnormal based on the target score.

[0007] In one example embodiment, determining a target score of the target account based on the account feature includes: performing weighted summation on a plurality of account features to obtain an aggregated feature; and inputting the aggregated feature into a target model to obtain the target score.

[0008] In an example embodiment, before inputting the aggregated features into the target model to obtain the target score, the method further comprises: repeatedly performing the following operations until the target model is determined: sending an initial model to a branch node to instruct the branch node to train the initial model to obtain the target model, wherein the branch node includes the target node and a plurality of other nodes.

[0009] In an example embodiment, after sending the initial model to the branch node, the method further comprises: receiving update parameters sent by a plurality of sub-branch nodes included in the branch node, wherein one of the sub-branch nodes sends one of the update parameters, and the update parameter is obtained by the sub-branch node by: receiving the initial model; training the initial model using local data to obtain the update parameter; performing weighted summation on a plurality of the update parameters to obtain a target parameter; training the initial model using the target parameter to obtain an update model; and in the case that the update model meets a predetermined condition, determining the update model as the target model.

[0010] In an example embodiment, the method further comprises: in the case that the target account is an abnormal account, sending account information of the target account to a supervision node to instruct the supervision node to split the account information to obtain a plurality of slice information, and sending the slice information to different sub-supervision nodes for encrypted storage by the sub-supervision nodes, wherein the slice information stored in different sub-supervision nodes is different.

[0011] In an example embodiment, the method further comprises: receiving a query instruction of an abnormal account; sending an abnormal account query request to a supervision node based on the query instruction, to instruct the supervision node to send the abnormal account query request to a sub-supervision node for storing information of the abnormal account, and receive a target instruction sent by the sub-supervision node; receiving the target instruction sent by the supervision node; determining a target number of instructions for allowing access included in the target instruction; in a case where the target number exceeds a preset number, sending an information acquisition instruction to the supervision node, to instruct the supervision node to send the information acquisition instruction to the sub-supervision node, and receive a target key and slice abnormal information sent by the sub-supervision node based on the information acquisition instruction, wherein one target key and one slice abnormal information are stored in one sub-supervision node, one target key decrypts one slice abnormal information, and each target key is different; receiving the target key and the slice abnormal information sent by the supervision node; decrypting the slice abnormal information by using the target key to obtain a plurality of decrypted abnormal information; and combining the plurality of decrypted abnormal information to obtain account information of the abnormal account.

[0012] In an example embodiment, the method further comprises: the first encryption channel and the second encryption channel are quantum channels.

[0013] In an example embodiment, the method further comprises: the account feature is a feature obtained after homomorphic encryption.

[0014] According to another aspect of the embodiments of the present application, an abnormal account determination apparatus is also provided, comprising: a receiving module configured to receive a target query request for querying a target account, wherein the target query request is a request obtained by encrypting a query request by using a first encryption channel, and the first encryption channel is used for transmitting the query request sent by a target node to a central node; an obtaining module configured to obtain a plurality of target features of the target account based on the target query request, wherein the target feature is a feature obtained by encrypting an account feature by using a second encryption channel, and the account feature is an encrypted feature; a decryption module configured to decrypt the plurality of target features to obtain the account feature, and determine a target score of the target account based on the account feature; and a sending module configured to send the target score to the target node by using the first encryption channel, to instruct the target node to determine whether the target account is abnormal based on the target score.

[0015] According to a further aspect of the embodiments of the present application, a computer readable storage medium is also provided, and the computer readable storage medium stores a computer program. The computer program is configured to be executed by a processor to perform the steps in any of the method embodiments.

[0016] According to a further aspect of the embodiments of the present application, a computer program product or computer program is provided, and the computer program product or computer program includes computer instructions stored in a computer readable storage medium. A processor of a computer device reads the computer instructions from the computer readable storage medium, and the processor executes the computer instructions to cause the computer device to perform the steps in any of the method embodiments.

[0017] According to a further aspect of the embodiments of the present application, an electronic device is also provided, and the electronic device includes a memory and a processor. The memory stores a computer program, and the processor is configured to execute the computer program to perform the steps in any of the method embodiments.

[0018] According to the present application, when a target query request for querying a target account is received from a target node through a first encryption channel, the target query request is used to obtain target features of the target account from a plurality of other nodes, and a plurality of target features are obtained. The first encryption channel is used to transmit and encrypt a query request sent by the target node to the central node. The target feature is obtained by encrypting the account feature through a second encryption channel. The account feature is an encrypted feature of the target account determined by the plurality of other nodes. When the central node obtains the plurality of target features, the plurality of target features can be decrypted to obtain still encrypted account features, and then the target score of the target account can be determined based on the account features. Finally, the target score can be sent to the target node through the first encryption channel, and the target node can be instructed to determine whether the target account is abnormal based on the target score. Since the central node can integrate the account features of the target account obtained from the plurality of other nodes, rather than directly transmitting data, data sharing can be achieved without the data in the other nodes leaving the domain. In addition, the target features obtained from the other nodes are encrypted through double encryption (encryption channel and encryption of account features), and the central node can integrate the account features by only decrypting the encryption channel without decrypting the account features, that is, the central node cannot directly decrypt and view the original data, which can further improve the security of the data. Therefore, the problem that security and accuracy cannot be considered in the abnormal account determination process can be solved, and the effect of considering security and accuracy in the abnormal account determination process is achieved. BRIEF DESCRIPTION OF DRAWINGS

[0019] Figure 1 is an application scenario diagram of a determination method of an abnormal account according to an embodiment of the present application;

[0020] Figure 2 This is a flowchart illustrating an optional method for determining abnormal accounts according to an embodiment of this application;

[0021] Figure 3 This is a schematic diagram of a layered and decoupled microservice architecture in this optional example;

[0022] Figure 4 This is a structural block diagram of an optional device for determining abnormal accounts according to an embodiment of this application;

[0023] Figure 5 This is a computer system architecture block diagram of an optional electronic device according to an embodiment of this application. Detailed Implementation

[0024] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0025] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0026] According to one aspect of the embodiments of this application, a method for determining abnormal accounts is provided. Optionally, in this embodiment, the above-described method for determining abnormal accounts may be applied, but is not limited to, to applications such as... Figure 1 The hardware environment shown includes terminal device 102 and server 104. Server 104 can be connected to terminal device 102 via a network and can be used to provide services (e.g., application services, etc.) to terminal device 102 or clients installed on terminal device 102. A database can be set up on server 104 or independently of server 104 to provide data storage services for server 104.

[0027] The aforementioned network may include, but is not limited to, at least one of the following: wired network and wireless network. The aforementioned wired network may include, but is not limited to, at least one of the following: wide area network (WAN), metropolitan area network (MAN), and local area network (LAN). The aforementioned wireless network may include, but is not limited to, at least one of the following: Wireless Fidelity (WIFI) and Bluetooth. Terminal device 102 may be, but is not limited to, a personal computer (PC), mobile phone, tablet computer, etc. Server 104 may be, but is not limited to, a cloud server, server cluster, or other server types.

[0028] The method for determining abnormal accounts in this application embodiment can be executed by server 104, by terminal device 102, or by both server 104 and terminal device 102. Alternatively, the method for determining abnormal accounts in this application embodiment can be executed by a client installed on terminal device 102.

[0029] Figure 2 This is a flowchart illustrating an optional method for determining abnormal accounts according to an embodiment of this application, as shown below. Figure 2 As shown, the process of this method may include the following steps:

[0030] Step S202: Receive a target query request for querying a target account, wherein the target query request is a request obtained by encrypting the query request through a first encryption channel, and the first encryption channel is used to transmit the query request sent by the target node to the central node.

[0031] The method for identifying anomalous accounts in this embodiment can be applied to the financial sector, specifically to cross-institutional transaction risk analysis, encrypted transaction monitoring, and preventing illicit funds from being converted into legitimate assets during financial transactions. With increasingly stringent regulatory requirements (such as FATF (Financial Action Task Force) recommendations and the Data Security Act), the deepening of data privacy protection regulations (GDPR), and the continuous evolution of methods for converting illicit funds into legitimate assets, cross-institutional data collaboration for anomalous account analysis has become crucial. However, traditional cross-institutional data sharing methods, in order to meet the "data not leaving the domain" requirements of data security laws and GDPR, create data silos between financial institutions. The inability to share raw data makes it difficult to draw complete fund flow maps, rendering it infeasible to build high-precision anomalous account models using traditional centralized machine learning methods. This makes it impossible to effectively identify a large number of cross-institutional activities that convert illicit funds into legitimate assets (especially complex forms of rapid fund splitting and transfer through multiple institutions). Furthermore, existing inter-institutional communication and federated learning parameter transmission largely rely on public-key cryptography systems based on asymmetric encryption algorithms such as RSA (Rivest-Shamir-Adleman) and ECC (Elliptic Curve Cryptography). With the development of quantum computing technology, algorithms like Shor's algorithm may be able to break these encryption systems in polynomial time at a certain scale, potentially exposing model parameters and ciphertext data during transmission to the risk of being compromised, posing a long-term security threat. In addition, a single federated learning model can only perform shallow correlations at the feature level, making it difficult to capture the complex topological relationships and temporal dynamics of inter-institutional fund flows. Simultaneously, the high false positive rate (>90%) places a heavy burden on manual review, increasing operating costs while reducing risk response speed.

[0032] To at least partially solve the above-mentioned technical problems, this embodiment constructs a method for determining cross-institutional anomalous accounts based on quantum key distribution and federated learning, which is formed by multiple participating bank nodes and a central coordination and aggregation node. When a target node, Bank A, discovers a large transfer from account X to account Y of Bank B (i.e., the aforementioned target account), it can trigger a risk verification request. Bank A can also trigger a risk verification request if it discovers suspicious account transactions and needs to query the relevant historical transaction information of the suspicious account in other banking institutions. That is, the target node, Bank A, can send a query request to the federated aggregation server of the central coordination and aggregation node (i.e., the aforementioned central node) through the real-time inference interface to query the risk embedding vector of the target account Y in the entire network. The query request can be transmitted through a quantum channel (i.e., the aforementioned first encrypted channel). The first encrypted channel is a fiber optic channel established between Bank A and the central node, where the quantum key distributor (QKD) in Bank A uses the decoy state BB84 protocol and is compatible with hardware from manufacturers such as QuantumCTek. In addition, the quantum key distributor also generates an unconditionally secure symmetric key, which is sent to the central node through the fiber optic channel. The symmetric key can encrypt and protect the data when it passes through the first channel. Therefore, the central node can receive the target query request after the query request has been encrypted through the first channel.

[0033] Step S204: Based on the characteristics of the target account obtained from multiple other nodes by the target query request, multiple target features are obtained, wherein the target features are features obtained by encrypting the account features through a second encryption channel, and the account features are encrypted features;

[0034] In the above embodiment, after receiving a target query request from a target node, the federated aggregation server in the central node can send requests for relevant information about the target account Y to other nodes. Each other node can use its internally trained global model to calculate its local feature vector, thus obtaining the features of the target account. The local feature encryption module in each other node can perform feature processing on the raw transaction data obtained from the AML database at each bank's local location to obtain a local feature vector. Furthermore, the local feature encryption module can also encrypt the features calculated by the global model, thereby obtaining the account features. The account features can be transmitted to the central node through a second encryption channel between the other nodes and the central node. Therefore, the central node can receive target features transmitted from multiple second encryption channels and encrypted by these channels; that is, the target features are encrypted twice (by the local encryption module (forming the account features) and by the second encryption channel). For example, if Bank A, Bank B, Bank C, Bank D, and Bank E establish connections with the central node respectively, when Bank A (the target node) requests information about the target account Y from the central node, the central node can receive the target features of the target account Y generated after being encrypted twice from Bank B, Bank C, Bank D, and Bank E respectively.

[0035] Step S206: Decrypt the multiple target features to obtain the account features, and determine the target score of the target account based on the account features;

[0036] In the above embodiment, after receiving the target features sent by other nodes, the federated aggregation server in the central node can first decrypt the target features to obtain the account features. Since the object key of the encrypted channel is also transmitted to the central node from the encrypted channel, the quantum key service manager in the central node can manage the original key pool generated by QKD in all nodes (target node and multiple other nodes), and can also customize dynamic key update strategies, adaptively adjust the key replacement frequency according to transaction traffic, and provide API (Application Programming Interface) for upper-layer applications. Therefore, the central node can use the keys of multiple second encrypted channels managed in the quantum key management server to decrypt multiple target features, thereby obtaining multiple account features. However, since the central node does not have the key for encrypting the account features, it cannot decrypt the account features. But since the encryption of the account features is homomorphic, the central node can process the account features without decrypting them. Therefore, the central node can use the global model of the federated aggregation server to process multiple account features, thereby determining the target score of the target account.

[0037] Step S208: The target score is sent to the target node through the first encrypted channel to instruct the target node to determine whether the target account is abnormal based on the target score.

[0038] In the above embodiment, after calculating the encryption risk score (i.e. the target score mentioned above), the central node's federated aggregation server can return the encryption risk score to the target node Bank A through the first encryption channel. The target node Bank A can decrypt the target score by combining it with local information. If the risk is extremely high (i.e. the target score exceeds the threshold), it can determine that the target user is an abnormal account, and then it can call the smart contract to automatically broadcast an alert to the entire network and suspend the transaction.

[0039] This application allows for the acquisition of multiple target features when a target node sends a target query request for a target account via a first encrypted channel. The first encrypted channel transmits and encrypts the query request sent by the target node to the central node. The target features are obtained by encrypting account features via a second encrypted channel. These account features are encrypted characteristics of the target account determined by multiple other nodes. Once the central node obtains these multiple target features, it can decrypt them to obtain the still-encrypted account features, which can then be used to determine the target account's target score. Finally, the target score can be sent to the target node via the first encrypted channel, instructing the target node to determine whether the target account is abnormal based on the score. Because the central node can integrate account features obtained from multiple other nodes, rather than directly transmitting data, data sharing can be achieved without data leaving the domain. Furthermore, the target features obtained from other nodes are encrypted using a double-layer encryption (encrypting the channel and encrypting the account features). The central node can integrate the account features by decrypting only the encrypted channel without decrypting the account features themselves. This means the central node cannot directly decrypt the data to view the original data, further enhancing data security. Therefore, this method solves the problem of balancing security and accuracy in anomaly account identification, achieving a balance between both.

[0040] Optionally, the entity performing the above steps may be a central node or other devices with similar processing capabilities, but is not limited to these.

[0041] In one exemplary embodiment, determining the target score of the target account based on the account features includes: performing a weighted summation on multiple account features to obtain aggregate features; and inputting the aggregate features into a target model to obtain the target score.

[0042] In the above embodiments, after decrypting the multiple target scores obtained, the federated aggregation server in the central node can integrate the multiple account features obtained from the decryption. The aggregated features can be determined by weighted summation. Then, a lightweight federated inference model (i.e., the aforementioned target model) can be run to calculate the aggregated features, thus obtaining the target score. For example, if Bank A, Bank B, Bank C, Bank D, and Bank E establish connections with the central node, when Bank A (the target node) requests information about target account Y from the central node, the central node can receive and integrate the encrypted features (i.e., account features) of Y from Bank B, Bank C, Bank D, and Bank E respectively, determine the weights of Bank B, Bank C, Bank D, and Bank E respectively, and finally determine the aggregated features by weighted summation. Furthermore, multiple account features can be integrated through the target model to calculate the final target score.

[0043] In this embodiment, since aggregated features typically carry enough information for risk scoring but not enough to reconstruct complete account information, the direct exposure of sensitive information can be prevented to some extent. Moreover, weighted summation can comprehensively consider the contribution of different features to risk assessment, ensuring that those features with greater predictive value occupy a more important position in the scoring, thereby improving the accuracy and effectiveness of the scoring.

[0044] In an exemplary embodiment, before inputting the aggregated features into the target model to obtain the target score, the method further includes: repeatedly performing the following operations until the target model is determined: sending an initial model to a branch node to instruct the branch node to train the initial model to obtain the target model, wherein the branch node includes the target node and a plurality of the other nodes.

[0045] In the above embodiments, the target model needs to be continuously iterated and updated before it can be deployed. Specifically, during the target model training process, the federated aggregation server in the central node can distribute an initialized global model (i.e., the initial model mentioned above) to the branch nodes (including the target node and all other nodes), instructing the branch nodes to train the initial model to obtain the target model. This process is repeated continuously. After training the initial model, the branch nodes obtain updated model parameters and send them to the central node through an encrypted channel. The central node uses the updated model parameters to update the global model in the federated aggregation server and then distributes the updated model to all branch nodes. This process is repeated until the iteration conditions are met, at which point the iteration exits, and the final trained model becomes the target model.

[0046] This embodiment ensures that the target model can fully absorb and integrate diverse data features and risk control experience from different financial institutions, thereby achieving higher accuracy and robustness, and more effectively identifying complex and evolving activities that convert illicit funds into legitimate assets. Secondly, by training and updating parameters locally at each node, rather than directly sharing raw data, data security and privacy protection are significantly enhanced. Even during the transmission of model parameters, advanced encryption technologies such as quantum key distribution are used to further strengthen data security barriers and prevent potential eavesdropping and data leakage risks.

[0047] In an exemplary embodiment, after sending the initial model to the branch node, the method further includes: receiving update parameters sent by a plurality of sub-branch nodes included in the branch node, wherein each sub-branch node sends one update parameter, and the update parameter is obtained by the sub-branch node through: receiving the initial model; training the initial model using local data to obtain the update parameters; performing a weighted summation of the plurality of update parameters to obtain target parameters; training the initial model using the target parameters to obtain an updated model; and determining the updated model as the target model if the updated model meets predetermined conditions.

[0048] In the above embodiment, after the initial model is sent to the branch node, each sub-branch node can train the initial model locally using local data to obtain the updated parameters of the initial model. These updated parameters can be the gradient ΔW, feature vectors, intermediate results, etc. Each sub-branch node performs homomorphic encryption on its updated parameters using Paillier, and then sends the encrypted updated parameters to the central node through its respective QKD encrypted channel.

[0049] In the above embodiment, after receiving the encrypted update parameters sent by each sub-branch node, the federated aggregation server in the central node can perform aggregation processing on the encrypted update parameters, such as weighted summation, to obtain the target parameters. The federated aggregation server can use the target parameters to train and update the initial model, obtaining an updated model. This updated model is then distributed to all sub-branch nodes, which continue to train the updated model using their local data, obtaining secondary update parameters, which are then sent to the central node. The central node continues to train the updated model using these secondary update parameters, and this iterative process is repeated. When the updated model after multiple iterations meets predetermined conditions, the iteration is considered complete, meaning the updated model from this iteration is the target model. These predetermined conditions may include reaching a certain preset number of iterations, or the difference between the updated parameters obtained in this training and the updated parameters after the previous training being less than a predetermined threshold, but are not limited to these.

[0050] By decomposing the model training task into multiple sub-branch nodes, each node updates the model parameters using its local, unique dataset, enabling the model to learn the diversity and complexity of different data sources, thereby improving the model's generalization performance on unknown data. Furthermore, the sub-branch nodes only update and transmit the model parameters back, without sharing specific customer transaction details. Combined with secure communication technologies such as quantum key distribution, this ensures absolute security during data transmission, avoiding potential privacy violations and legal risks caused by data leaks.

[0051] In an exemplary embodiment, the method further includes: if the target account is an abnormal account, sending the account information of the target account to a monitoring node to instruct the monitoring node to segment the account information to obtain multiple slice information, and sending the slice information to different sub-monitoring nodes to encrypt and store the slice information through the sub-monitoring nodes, wherein the slice information stored in different sub-monitoring nodes is different.

[0052] In the above embodiments, when the target account is determined to be an abnormal account, the target account can be identified as a high-risk case, and the complete information of the high-risk case (i.e. the account information of the target account) can be sent to the regulatory node. The regulatory node can segment the account information to obtain multiple slice information, and send the slice information to different sub-regulatory nodes. That is, one slice information is encrypted and stored in one sub-regulatory node.

[0053] This embodiment, by dividing sensitive account information into multiple slices and storing them in a distributed manner, makes it difficult for attackers to obtain complete account information even if a sub-monitoring node is attacked or data is leaked, significantly reducing data security risks. This distributed storage strategy follows the "principle of least privilege," ensuring that even within the monitoring system, only authorized sub-monitoring nodes can access certain information.

[0054] In an exemplary embodiment, the method further includes: receiving a query instruction for an abnormal account; sending an abnormal account query request to a supervisory node based on the query instruction, to instruct the supervisory node to send the abnormal account query request to a sub-supervisory node used to store information of the abnormal account, and receiving a target instruction sent by the sub-supervisory node; receiving the target instruction sent by the supervisory node; determining a target number of allowed access instructions included in the target instruction; if the target number exceeds a preset number, sending an information retrieval instruction to the supervisory node, to instruct the supervisory node to send the information retrieval instruction to the sub-supervisory node, and receiving a target key and slice abnormal information sent by the sub-supervisory node based on the information retrieval instruction, wherein each sub-supervisory node stores one target key and one slice abnormal information, one target key decrypts one slice abnormal information, and each target key is different; receiving the target key and the slice abnormal information sent by the supervisory node; decrypting the slice abnormal information using the target key to obtain multiple decrypted abnormal information; combining the multiple decrypted abnormal information to obtain the account information of the abnormal account.

[0055] In the above embodiments, for the authorization decryption module, the complete information of high-risk cases is encrypted and stored in a distributed manner. Decryption requires authorization from at least N sub-supervisory nodes out of M sub-supervisory nodes (N-of-M). That is, when a query instruction for an abnormal account is received, an abnormal account query request can be sent to the supervisory node. After receiving the abnormal account query request, the supervisory node can send the abnormal account query request to each sub-supervisory node that stores the abnormal account information. Each sub-supervisory node will generate a corresponding target instruction based on the abnormal account query request. Each target instruction can indicate whether authorization is granted. Therefore, the number of targets that grant authorization (i.e., allow access) among all received target instructions can be counted. When the number of targets exceeds a preset number, an information retrieval instruction can be sent to the supervisory node. After receiving the information retrieval instruction, the supervisory node can forward this instruction to the sub-supervisory nodes. Then, the sub-supervisory nodes can send the target key and slice abnormal information to the supervisory node according to the information retrieval instruction. The target key is used to decrypt the slice abnormal information, and the target key and slice abnormal information stored in each sub-supervisory node are different.

[0056] In the above embodiments, after receiving multiple target keys and multiple slice anomaly information sent by multiple sub-supervisory nodes, the supervisory node can send the multiple target keys and multiple slice anomaly information to the central node. Then, the central node can decrypt each corresponding slice anomaly information according to all the received target keys, that is, it can obtain multiple decrypted anomaly information. Combining the multiple decrypted anomaly information can obtain the complete anomaly information of the abnormal account.

[0057] In this embodiment, the regulator is embedded as a special node in the system architecture. Through threshold signature or smart contract technology, a regulatory mechanism of "unauthorized access is not allowed, and the authorized party can be traced" is realized. This not only meets the privacy protection needs in daily business operations, but also ensures the transparency of supervision at critical moments.

[0058] In one exemplary embodiment, the method further includes: the first encryption channel and the second encryption channel are quantum channels.

[0059] In the above embodiments, the first encrypted channel and the multiple second encrypted channels are quantum key distributors (QKDs) included in their respective nodes, which adopt the decoy state BB84 protocol and are compatible with hardware from manufacturers such as QuantumCTek, serving as quantum channels between the nodes and the central node.

[0060] This embodiment represents the first deep integration of quantum key distribution capabilities with federated learning capabilities, directly addressing the three simultaneous challenges of "data silos," "quantum computing threats," and "complex pattern recognition that converts illicit funds into legitimate assets," providing an integrated solution. Furthermore, utilizing quantum channels for key distribution ensures key security, while using internet channels to transmit encrypted model data balances efficiency and security.

[0061] In one exemplary embodiment, the method further includes: the account feature is a feature obtained after homomorphic encryption.

[0062] In the above embodiments, both the account features to be uploaded and the update parameters are encrypted using the local feature encryption module within the node, employing the PySyft / FATE framework and Paillier homomorphic encryption. This ensures that even the central node cannot decrypt and view the original values. In other words, to ensure that data is not leaked when transmitted to the central node, a homomorphic encryption algorithm can be used to encrypt the account features or update parameters to be uploaded. This allows the central node to perform specific types of mathematical operations while the account features or update parameters are encrypted, and the calculated results remain correct after decryption.

[0063] Through this embodiment, by using the local feature encryption module, each institutional node can participate in the federated learning process while protecting its own data privacy, jointly training and optimizing the global model. This not only enhances the model's generalization ability and prediction accuracy but also promotes trust and collaboration among financial institutions.

[0064] The method for determining abnormal accounts in this application will be explained below with reference to specific embodiments.

[0065] Figure 3 This is a schematic diagram of a layered and decoupled microservice architecture in this optional example, such as... Figure 3As shown, the architecture can include the following modules: a quantum key distributor (QKD), a quantum key management server, a local feature encryption module, a federated aggregation server, a blockchain audit and evidence storage module, and a regulatory node. The QKD uses the decoy state BB84 protocol, is compatible with hardware from vendors such as QuantumCTek, establishes a fiber optic channel between participating institutions (target nodes and other nodes) and the central node, and generates unconditionally secure symmetric keys. The quantum key management server can customize dynamic key update strategies, manage the original key pool generated by the QKD, adaptively adjust the key replacement frequency based on transaction traffic, and provide APIs for upper-layer applications. The local feature encryption module can use the PySyft / FATE framework and Paillier partial homomorphic encryption to process the original transaction data locally on branch nodes, generate feature vectors, and homomorphically encrypt the features or intermediate results that need to be uploaded, ensuring that the central node cannot decrypt and see the original values. The federated aggregation server, i.e., the central aggregation server, can receive the encryption model gradients or embedding vectors (i.e., update parameters) uploaded by each participant, perform weighted averaging or more advanced aggregation operations, and update the global model (target model). The blockchain audit and evidence storage module can adopt the FISCO BCOS (Financial Blockchain Shenzhen Consortium BCOS) national cryptographic algorithm. All high-risk alerts, model version updates, and decryption audit operations' hash values ​​are stored on the blockchain, ensuring the operations are tamper-proof and traceable. The regulatory node uses an independent server and console. Sub-regulatory nodes under the regulatory node can store exclusive key pairs for the regulatory agency. For the authorized decryption module, the complete information of high-risk cases is encrypted and distributed, requiring authorization from at least N of the M sub-regulatory nodes for decryption (M-of-N). The quantum key distributor (QKD) and quantum key management server belong to the quantum-secure communication layer; the local feature encryption module and federated aggregation server belong to the privacy-preserving computation layer; and the regulatory node and blockchain audit and evidence storage module belong to the regulatory and audit layer. For the quantum-secure communication layer, Bank A can generate a shared key K with the Central Node's QKD device via a quantum channel. The key management service injects K into a symmetric encryption algorithm (such as AES-256), and all subsequent gradient and parameter transmissions in the federated learning process are encrypted using K.

[0066] In the aforementioned embodiments, by introducing quantum key distribution (QKD), its security is based on the fundamental principles of quantum mechanics, achieving a fundamental security upgrade. Employing a federated graph neural network (FedGNN), the detection accuracy can be increased from less than 70% in traditional methods to over 98%, provided that data from different institutions remains within their domains. Furthermore, the built-in regulatory nodes and smart contract mechanisms allow regulatory agencies to obtain a real-time global risk view (after anonymization) for macro-level monitoring. A hybrid approach is adopted: QKD is used to address transport layer security, with efficiency far exceeding fully homomorphic encryption; federated learning addresses computational privacy, with communication overhead far lower than MPC. Through model and communication protocol optimization (such as gradient compression and asynchronous updates), the latency of cross-institutional risk queries is controlled within 300 milliseconds, meeting the real-time requirements of financial operations. In addition, native quantum security capabilities are built-in, eliminating the need for later patching. The system was designed from the outset to be immune to quantum computing threats, providing financial institutions with a long-term security investment for the future and avoiding disruptive risks caused by the collapse of the cryptographic system.

[0067] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this application. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to this application.

[0068] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as read-only memory (ROM) / random access memory (RAM), magnetic disk, optical disk), and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0069] According to another aspect of the embodiments of this application, an apparatus for determining abnormal accounts is also provided. This apparatus can be used to implement the method for determining abnormal accounts provided in the above embodiments, and will not be repeated hereafter. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the apparatus described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0070] Figure 4 This is a structural block diagram of an optional abnormal account determination device according to an embodiment of this application, such as... Figure 4 As shown, the device for determining the abnormal account includes:

[0071] The receiving module 42 is used to receive a target query request for querying a target account, wherein the target query request is a request obtained by encrypting the query request through a first encryption channel, and the first encryption channel is used to transmit the query request sent by the target node to the central node.

[0072] The acquisition module 44 is used to obtain multiple target features based on the features of the target account obtained from multiple other nodes based on the target query request, wherein the target features are features obtained by encrypting the account features through a second encryption channel, and the account features are encrypted features;

[0073] The decryption module 46 is used to decrypt multiple target features to obtain the account features, and determine the target score of the target account based on the account features;

[0074] The sending module 48 is used to send the target score to the target node through the first encrypted channel, so as to instruct the target node to determine whether the target account is abnormal based on the target score.

[0075] The receiving module 42, the acquiring module 44, the decryption module 46, and the sending module 48 correspond to the aforementioned federated aggregation server.

[0076] In an exemplary embodiment, the decryption module 46 can determine the target score of the target account based on the account features by: performing a weighted summation on multiple account features to obtain aggregate features; and inputting the aggregate features into the target model to obtain the target score.

[0077] In an exemplary embodiment, the apparatus may be used to, before inputting the aggregated features into the target model to obtain the target score, repeatedly perform the following operations until the target model is determined: send an initial model to a branch node to instruct the branch node to train the initial model to obtain the target model, wherein the branch node includes the target node and a plurality of the other nodes.

[0078] In an exemplary embodiment, the apparatus can further be used to, after sending the initial model to the branch node, receive update parameters sent by a plurality of sub-branch nodes included in the branch node, wherein each sub-branch node sends one update parameter, the update parameter being obtained by the sub-branch node through: receiving the initial model; training the initial model using local data to obtain the update parameters; performing a weighted summation of the plurality of update parameters to obtain target parameters; training the initial model using the target parameters to obtain an updated model; and determining the updated model as the target model if the updated model satisfies predetermined conditions.

[0079] In an exemplary embodiment, the apparatus can also be used to: when the target account is an abnormal account, send the account information of the target account to a monitoring node to instruct the monitoring node to segment the account information to obtain multiple slice information, and send the slice information to different sub-monitoring nodes to encrypt and store the slice information through the sub-monitoring nodes, wherein the slice information stored in different sub-monitoring nodes is different.

[0080] In an exemplary embodiment, the apparatus may further be used to: receive a query instruction for an abnormal account; send an abnormal account query request to a supervisory node based on the query instruction, instructing the supervisory node to send the abnormal account query request to a sub-supervisory node for storing information of the abnormal account, and receive a target instruction sent by the sub-supervisory node; receive the target instruction sent by the supervisory node; determine a target number of allowed access instructions included in the target instruction; if the target number exceeds a preset number, send an information retrieval instruction to the supervisory node, instructing the supervisory node to send the information retrieval instruction to the sub-supervisory node, and receive a target key and slice abnormal information sent by the sub-supervisory node based on the information retrieval instruction, wherein each sub-supervisory node stores one target key and one slice abnormal information, one target key decrypts one slice abnormal information, and each target key is different; receive the target key and the slice abnormal information sent by the supervisory node; decrypt the slice abnormal information using the target key to obtain multiple decrypted abnormal information; combine the multiple decrypted abnormal information to obtain the account information of the abnormal account.

[0081] In one exemplary embodiment, the first encryption channel and the second encryption channel in the device are quantum channels.

[0082] In one exemplary embodiment, the account feature in the device is a feature obtained after homomorphic encryption.

[0083] It should be noted that the above modules can be implemented by software or hardware. For the latter, they can be implemented in the following ways, but are not limited to: all the above modules are located in the same processor; or, the above modules are located in different processors in any combination.

[0084] According to another aspect of the embodiments of this application, a computer-readable storage medium is provided, the computer-readable storage medium including a stored program, wherein the program executes the steps in any of the above method embodiments when it is run.

[0085] In one exemplary embodiment, the aforementioned computer-readable storage medium may include, but is not limited to, various media capable of storing computer programs, such as USB flash drives, ROMs, RAMs, portable hard drives, magnetic disks, or optical disks.

[0086] According to another aspect of the embodiments of this application, an electronic device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor. The processor is configured to perform the steps of any of the method embodiments described above via the computer program. In an exemplary embodiment, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0087] Specific examples in this embodiment can be found in the examples described in the above embodiments and exemplary implementations, and will not be repeated here.

[0088] According to another aspect of the embodiments of this application, a computer program product is also provided, comprising a computer program / instructions containing program code for performing the methods shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network via communication section 509, and / or installed from removable medium 511. When the computer program is executed by central processing unit 501, it performs various functions provided in the embodiments of this application. The sequence numbers of the embodiments of this application above are merely descriptive and do not represent the superiority or inferiority of the embodiments.

[0089] Figure 5 A schematic block diagram of a computer system architecture for implementing embodiments of the present application is shown. Figure 5 As shown, the computer system 500 includes a Central Processing Unit (CPU) 501, which can perform various appropriate actions and processes based on programs stored in ROM 502 or programs loaded into RAM 503 from storage section 508. Random access memory 503 also stores various programs and data required for system operation. The CPU 501, ROM 502, and RAM 503 are interconnected via bus 504. Input / output (I / O) interface 505 is also connected to bus 504.

[0090] The following components are connected to I / O interface 505: input section 506 including keyboard, mouse, etc.; output section 507 including cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; storage section 508 including hard disk, etc.; and communication section 509 including network interface card, modem, etc. Communication section 509 performs communication processing via a network such as the Internet. Drive 510 is also connected to I / O interface 505 as needed. Removable media 511, such as disk, optical disk, magneto-optical disk, semiconductor memory, etc., are installed on drive 510 as needed so that computer programs read from them can be installed into storage section 508 as needed.

[0091] Specifically, according to embodiments of this application, the processes described in the various method flowcharts can be implemented as computer software programs. For example, embodiments of this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 509, and / or installed from removable medium 511. When the computer program is executed by central processing unit 501, it performs various functions defined in the system of this application.

[0092] It should be noted that, Figure 5 The computer system 500 of the electronic device shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of this application.

[0093] Obviously, those skilled in the art should understand that the modules or steps of this application described above can be implemented using general-purpose computing devices. They can be centralized on a single computing device or distributed across a network of multiple computing devices. They can be implemented using computer-executable program code, and thus can be stored in a storage device for execution by a computing device. In some cases, the steps shown or described can be performed in a different order than those described herein, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, this application is not limited to any particular combination of hardware and software.

[0094] The above are merely preferred embodiments of this application and are not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the principles of this application should be included within the protection scope of this application.

Claims

1. A method for identifying abnormal accounts, characterized in that, include: Receive a target query request for querying a target account, wherein the target query request is a request obtained by encrypting the query request through a first encryption channel, and the first encryption channel is used to transmit the query request sent by the target node to the central node. Based on the characteristics of the target account obtained from multiple other nodes in the target query request, multiple target features are obtained, wherein the target features are features obtained by encrypting the account features through a second encryption channel, and the account features are encrypted features; The target features are decrypted to obtain the account features, and the target score of the target account is determined based on the account features; The target score is sent to the target node through the first encrypted channel to instruct the target node to determine whether the target account is abnormal based on the target score.

2. The method according to claim 1, characterized in that, Determining the target score for the target account based on the account characteristics includes: The aggregated features are obtained by weighted summation of multiple account features. The aggregated features are input into the target model to obtain the target score.

3. The method according to claim 2, characterized in that, Before inputting the aggregated features into the target model to obtain the target score, the method further includes: Repeat the following operations until the target model is determined: The initial model is sent to a branch node to instruct the branch node to train the initial model to obtain the target model, wherein the branch node includes the target node and multiple other nodes.

4. The method according to claim 3, characterized in that, After sending the initial model to the branch node, the method further includes: The branch node receives update parameters sent by multiple sub-branch nodes, wherein each sub-branch node sends one update parameter, and the update parameter is obtained by the sub-branch node through the following method: receiving the initial model; training the initial model using local data to obtain the update parameter; The target parameter is obtained by performing a weighted summation on multiple updated parameters. The initial model is trained using the target parameters to obtain an updated model; If the updated model meets predetermined conditions, the updated model is determined as the target model.

5. The method according to claim 1, characterized in that, The method further includes: If the target account is an abnormal account, the account information of the target account is sent to the monitoring node to instruct the monitoring node to segment the account information into multiple slices, and the slices are sent to different sub-monitoring nodes for encrypted storage. The slices stored in different sub-monitoring nodes are different.

6. The method according to claim 1, characterized in that, The method further includes: Receive query instructions for abnormal accounts; Based on the query instruction, an abnormal account query request is sent to the regulatory node to instruct the regulatory node to send the abnormal account query request to the sub-regulatory node used to store the information of the abnormal account, and to receive the target instruction sent by the sub-regulatory node. Receive the target instruction sent by the monitoring node; Determine the target number of allowed instructions included in the target instructions; If the number of targets exceeds a preset number, an information acquisition instruction is sent to the monitoring node to instruct the monitoring node to send the information acquisition instruction to the sub-monitoring node, and to receive the target key and slice anomaly information sent by the sub-monitoring node based on the information acquisition instruction. Each sub-monitoring node stores one target key and one slice anomaly information, and one target key decrypts one slice anomaly information. Each target key is different. Receive the target key and the slice anomaly information sent by the monitoring node; The slice anomaly information is decrypted using the target key to obtain multiple decrypted anomaly information; By combining multiple decryption anomaly messages, the account information of the abnormal account is obtained.

7. The method according to any one of claims 1 to 6, characterized in that, The method further includes: The first encryption channel and the second encryption channel are quantum channels.

8. The method according to any one of claims 1 to 6, characterized in that, The method further includes: The account features are obtained after homomorphic encryption.

9. A device for determining abnormal accounts, characterized in that, include: The receiving module is used to receive a target query request for querying a target account, wherein the target query request is a request obtained by encrypting the query request through a first encryption channel, and the first encryption channel is used to transmit the query request sent by the target node to the central node. The acquisition module is used to obtain multiple target features based on the features of the target account obtained from multiple other nodes based on the target query request, wherein the target features are features obtained by encrypting the account features through a second encryption channel, and the account features are encrypted features; The decryption module is used to decrypt multiple target features to obtain the account features, and determine the target score of the target account based on the account features; The sending module is used to send the target score to the target node through the first encrypted channel, so as to instruct the target node to determine whether the target account is abnormal based on the target score.

10. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instructions are executed by the processor, they implement the steps of the method according to any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, wherein the computer program, when executed by a processor, implements the steps of the method according to any one of claims 1 to 8.

12. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 8.

Images