Suspicious user identification method and computer equipment

Abstract

The invention belongs to the technical field of data processing, and discloses a suspicious user identification method and computer equipment, and the method comprises the steps: constructing a feature vector of a node based on transaction connection information and attribute information corresponding to the node; the similarity between the feature vectors of all the nodes is calculated, edge connection between each node and the most similar first k neighbor nodes is reserved, a k neighbor similarity graph is obtained, the k neighbor similarity graph reflects the feature similarity between all the nodes with direct transaction connection edges and all the nodes without transaction connection edges, the high-dimensional attributes of the nodes are fully utilized, and the similarity between all the nodes with direct transaction connection edges and all the nodes without transaction connection edges is obtained. Meanwhile, only the edge connections of the most similar first k neighbor nodes are reserved, so that the calculation can be simplified; a plurality of nodes in the k-nearest neighbor similarity graph are divided into a plurality of clusters by using a graph clustering algorithm, the cluster division result is more accurate, and the accuracy of suspicious user identification can be improved. Moreover, when the cluster is divided, migration evaluation is only carried out on nodes, with cluster change in the last round of iteration, of neighbors in the subsequent iteration, so that the suspicious user identification efficiency is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data processing, in particular to a suspicious user identification method and a computer device. BACKGROUND

[0002] In daily transaction monitoring, banks need to use clustering algorithms to automatically find abnormal groups, so as to identify suspicious users. Some clustering algorithms need to specify the number of clusters K. If the specified K value is not accurate, the quality of the clustering result will be significantly affected, ultimately leading to inaccurate suspicious user identification results.

[0003] In order to solve the above technical problems, Louvain algorithm is proposed. However, in the prior art, when using Louvain algorithm to find abnormal groups, the original transaction topology graph is directly used for clustering, and the high-dimensional attributes of the nodes cannot be utilized. Moreover, for bank users, there may be some commonalities between users who have no transaction edges in the original transaction topology graph. In addition, for bank users, normal users usually have transaction edges with normal users, and most users who have transaction edges with abnormal users are also normal users. Simply clustering based on the original transaction topology graph is easy to divide all users into normal users, resulting in the inability to accurately find abnormal users. Ultimately, the suspicious user identification result is unreliable.

[0004] Therefore, there is an urgent need to provide a new suspicious user identification method. SUMMARY

[0005] In order to improve the accuracy of suspicious user identification while taking into account the identification efficiency, the present application provides a suspicious user identification method and a computer device.

[0006] According to an aspect of an embodiment of the present application, a suspicious user identification method is disclosed, which comprises: obtaining a transaction topology graph reflecting historical transaction relationships, the transaction topology graph comprising transaction connection information between nodes and attribute information corresponding to each node; based on the transaction connection information in the transaction topology graph and the attribute information corresponding to the nodes, constructing a feature vector of each node; calculating the similarity between the feature vectors of the nodes in the transaction topology graph, and based on a k-nearest neighbor construction strategy, retaining the edge connection of each node with its first k most similar neighbor nodes, obtaining a k-nearest neighbor similarity graph, the k-nearest neighbor similarity graph representing the connection relationship between nodes based on feature similarity; A graph clustering algorithm is used to divide multiple nodes in the k-nearest neighbor similarity graph into multiple clusters, including: an initial iteration, in which each node in the k-nearest neighbor similarity graph is treated as an independent cluster, and the migration of each node to a neighboring cluster is evaluated to selectively accept the migration of the node; in subsequent iterations, migration evaluation is performed on nodes whose neighboring nodes have changed clusters in the previous iteration. If none of the neighboring nodes of a node have changed their clusters in the previous iteration, then no migration evaluation is performed on it. The migration evaluation includes evaluating the contribution of a node to a neighboring cluster to the density and selectively accepting the migration of the node. Suspicious users are identified based on the defined clusters.

[0007] In some embodiments, constructing the feature vector of each node based on the transaction connection information and the attribute information corresponding to the nodes in the transaction topology graph includes: for each node in the transaction topology graph, adding the initial feature vector of the node to the initial feature vectors of all neighboring nodes to generate a first feature vector; performing dimensionality reduction processing on the first feature vector to obtain a second feature vector; calculating the residual vector between the second feature vector and the initial feature vector; and concatenating the residual vector with the initial feature vector to obtain the feature vector of the node. The initial feature vector is obtained based on the attribute information corresponding to the node.

[0008] In some embodiments, the step of performing dimensionality reduction processing on the first feature vector to obtain a second feature vector includes: using a fully connected network to reduce the dimensionality of the first feature vector to obtain a second feature vector. The second feature vector has a dimension on the order of tens to hundreds of dimensions, while the first feature vector has a dimension on the order of hundreds to thousands of dimensions.

[0009] In some embodiments, the attribute information corresponding to the node includes the following: transaction amount, transaction frequency, transaction location, account type, and whether the node has been marked as suspicious. The transaction frequency includes at least one of daily, weekly, and monthly transaction frequencies. The account type includes personal accounts and corporate accounts.

[0010] In some embodiments, calculating the similarity between the feature vectors of each node in the transaction topology graph includes: for any two nodes in the transaction topology graph, calculating the cosine similarity between the feature vectors of the nodes to obtain the similarity between the feature vectors of the nodes.

[0011] In some embodiments, the step of retaining the edge connections between each node and its k most similar neighbor nodes based on the k-nearest neighbor construction strategy to obtain a k-nearest neighbor similarity graph includes: setting the ratio of the number of edges in the k-nearest neighbor similarity graph to the number of edges in the transaction topology graph to N, where N is greater than 1; and based on the ratio N, adopting the k-nearest neighbor construction strategy to retain the edge connections between each node and its k most similar neighbor nodes to obtain a k-nearest neighbor similarity graph.

[0012] In some embodiments, in the subsequent iterations, a subset of nodes are randomly selected from the current node's neighboring nodes as target nodes. The migration evaluation of nodes whose neighboring nodes underwent cluster changes in the previous iteration, where no migration evaluation is performed if none of a node's neighboring nodes changed their clusters in the previous iteration, includes: performing migration evaluation of the target nodes whose clusters underwent changes in the previous iteration; where no migration evaluation is performed if none of the target nodes corresponding to a given node changed their clusters in the previous iteration.

[0013] In some embodiments, multiple threads are configured, each maintaining an active node list. The active node list contains multiple active nodes, which are nodes whose neighboring nodes underwent cluster changes in the previous iteration. In subsequent iterations, each thread concurrently performs migration evaluation operations on the active nodes in its corresponding active node list. After all threads complete the migration evaluation for this round, the migration evaluation results are merged through a synchronization mechanism, and the global node cluster state is updated. For nodes that have undergone cluster changes, their neighboring nodes are marked as active nodes for the next round.

[0014] In some embodiments, the active nodes are recorded in the subsequent iterations using a shared state indication vector.

[0015] According to one aspect of the embodiments of this application, a computer device is disclosed, the computer device including one or more processors and a memory, the memory being used to store one or more computer programs, which, when executed by the one or more processors, cause the processors to implement the method described above.

[0016] The technical solutions provided by the embodiments of this application have at least the following beneficial effects: The scheme disclosed in this application first constructs a feature vector for each node based on the transaction connection information and the attribute information corresponding to the nodes in the transaction topology graph. Then, it calculates the similarity between the feature vectors of each node, and based on the k-nearest neighbor construction strategy, retains the edge connections between each node and its k most similar neighbor nodes, obtaining a k-nearest neighbor similarity graph. This k-nearest neighbor similarity graph reflects the feature similarity between nodes with and without direct transaction connections, fully utilizing the high-dimensional attributes of nodes. Simultaneously, retaining only the edge connections between each node and its k most similar neighbor nodes ensures the scalability of the system and avoids computational and memory overhead explosions. Based on this, a graph clustering algorithm is used to divide multiple nodes in the k-nearest neighbor similarity graph into multiple clusters. The cluster division results are more accurate, improving the accuracy of suspicious user identification. Furthermore, when using the graph clustering algorithm to divide the clusters, in subsequent iterations, only nodes whose neighbor nodes have undergone cluster changes in the previous iteration are evaluated for migration, avoiding overly complex calculations and improving the efficiency of suspicious user identification. In addition, this application does not require pre-setting the number of clusters and can adaptively achieve high-quality cluster division based on the k-nearest neighbor similarity graph. Attached Figure Description

[0017] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the specification, serve to explain the principles of this application.

[0018] Figure 1 A flowchart of a suspicious user identification method according to an embodiment of this application is shown.

[0019] Figure 2 An embodiment of this application is shown. Figure 1 Detailed flowchart of step S120.

[0020] Figure 3 An embodiment of this application is shown. Figure 1 Detailed flowchart of step S130.

[0021] Figure 4 An embodiment of this application is shown. Figure 1 Detailed flowchart of step S140.

[0022] Figure 5 A detailed flowchart of multi-threaded clustering execution according to an embodiment of this application is shown.

[0023] Figure 6 A flowchart illustrating a method for identifying suspicious users in an anti-money laundering scenario is shown.

[0024] Figure 7 A block diagram of a computer device according to an embodiment of this application is shown.

[0025] Figure 8 A computer system architecture block diagram is shown for implementing some embodiments of this application.

[0026] The annotations in the attached figures are explained as follows: 700. Computer equipment; 701. Processor; 702. Memory; 800. Computer system; 801. CPU; 802. ROM; 803. RAM; 804. Bus; 805. I / O interface; 806. Input section; 807. Output section; 808. Storage section; 809. Communication section; 810. Driver; 811. Removable media. Detailed Implementation

[0027] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, they are provided so that the description of this application will be more complete and fully convey the concept of the exemplary embodiments to those skilled in the art.

[0028] The terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include one or more features.

[0029] Furthermore, the described features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. Numerous specific details are provided in the following description to give a thorough understanding of embodiments of this application. However, those skilled in the art will recognize that the technical solutions of this application can be practiced without one or more of the specific details, or other methods, components, apparatuses, steps, etc., can be employed. In other instances, well-known methods, apparatuses, implementations, or operations are not shown or described in detail to avoid obscuring various aspects of this application.

[0030] The flowcharts shown in the accompanying drawings are merely illustrative and do not necessarily include all content and operations / steps, nor do they necessarily have to be performed in the described order. For example, some operations / steps can be broken down, while others can be combined or partially combined; therefore, the actual execution order may change depending on the specific circumstances.

[0031] With banks handling hundreds of millions of transactions daily, money laundering activities are often hidden within complex networks of funds. Traditional rule-based anti-money laundering systems not only struggle to detect hidden groups in a timely manner, but also suffer from high rule maintenance costs and a persistently high false alarm rate.

[0032] In the field of attribute graph analysis, node clustering is a fundamental technique that divides nodes into groups with inherent consistency based on structural connectivity and attribute similarity. It is widely used in areas such as community detection, fraud analysis, and recommender systems.

[0033] Most traditional clustering algorithms (such as KMeans, spectral clustering, and DBSCAN) require pre-specifying the number of clusters (usually denoted as K). This requirement is impractical in dynamic or heterogeneous real-world networks, especially when the number of communities is unknown or highly variable. Furthermore, the clustering effect is highly sensitive to the choice of the number of clusters, K. Inaccurate estimation of K can significantly impact the quality of the clustering results. In real-world datasets, such as emerging communities in social networks or unknown functional modules in biological interaction networks, the optimal value of K can vary widely and is difficult to predict. Simultaneously, many existing clustering algorithms lack sufficient scalability and robustness when handling large-scale, high-dimensional graph data, limiting their application in production environments, particularly in scenarios requiring efficient automated processing.

[0034] The Louvain clustering algorithm can solve the above problems. However, the Louvain clustering algorithm also has the following technical problems: when applied to attribute graph analysis, it cannot utilize the high-dimensional attributes of nodes. Although the Louvain algorithm is an efficient unsupervised graph clustering method that can optimize modularity, it only relies on the topological structure information of the graph (i.e., directly based on the topological structure information of the original graph) and cannot directly utilize the high-dimensional attributes of nodes. If node attribute similarity is simply introduced into the clustering process, it will lead to the generation of fully connected similarity graphs, which have extremely high storage and computation costs, especially when dealing with large-scale graphs containing hundreds of thousands or even millions of nodes. In addition, most existing community detection optimization strategies cannot effectively cope with the problem of low algorithm efficiency caused by the increased density of similarity graphs derived from embeddings.

[0035] To address this, this application provides a method for identifying suspicious users. First, based on transaction connection information and node attribute information in the transaction topology graph, a feature vector for each node is constructed. Then, the similarity between the feature vectors of each node is calculated. Using a k-nearest neighbor (kNN) construction strategy, the edges connecting each node to its k most similar neighbors are retained, resulting in a kNN similarity graph. This kNN similarity graph reflects the feature similarity between nodes with and without direct transaction connections, fully utilizing the high-dimensional attributes of nodes. Simultaneously, retaining only the edges connecting each node to its k most similar neighbors ensures system scalability and avoids computational and memory overload. Based on this, a graph clustering algorithm is used to divide the nodes in the kNN similarity graph into multiple clusters. The cluster division results are more accurate, improving the accuracy of suspicious user identification. Furthermore, when using the graph clustering algorithm to divide the clusters, in subsequent iterations, only nodes whose neighbor nodes have undergone cluster changes in the previous iteration are evaluated for migration, avoiding overly complex calculations and improving the efficiency of suspicious user identification. Furthermore, this application does not require pre-setting the number of clusters and can adaptively achieve high-quality cluster partitioning based on the k-nearest neighbor similarity graph.

[0036] The implementation details of the technical solutions in the embodiments of this application are described in detail below.

[0037] Figure 1 A flowchart of a suspicious user identification method according to an embodiment of this application is shown. (See attached document.) Figure 1 As shown, the suspicious user identification method includes at least the following steps S110 to S150, which are described in detail below.

[0038] In step S110, a transaction topology map reflecting historical transaction relationships is obtained. This transaction topology map contains transaction connection information between nodes and attribute information corresponding to each node.

[0039] The transaction topology graph contains multiple nodes, each representing a user. Some nodes have transaction relationships (i.e., transaction edges); others do not. Transaction edges represent fund transfers.

[0040] The transaction connection information between nodes includes whether there is a transaction link between any two nodes and the direction of the transaction. The transaction direction refers to the flow of funds or the active / passive relationship of the transaction between nodes with a transaction link.

[0041] The attribute information corresponding to a node refers to a series of characteristics or descriptive information of each node in the transaction topology graph, which are used to characterize the node's attributes, behavioral characteristics, or risk characteristics.

[0042] In some embodiments, the attribute information corresponding to a node includes the following: transaction amount, transaction frequency, transaction location, account type, and whether the node has been flagged as suspicious. Transaction frequency includes at least one of daily, weekly, and monthly transaction frequencies. Account type includes personal accounts and corporate accounts.

[0043] Of course, the attribute information corresponding to a node can include more information than just the transaction amount, transaction frequency, transaction location, account type, and whether the node has been marked as suspicious. This could include factors such as age, gender, occupation, income, and credit score. In actual transaction scenarios, the attribute information corresponding to a node can reach hundreds or even more.

[0044] In step S120, a feature vector for each node is constructed based on the transaction connection information and the attribute information corresponding to the node in the transaction topology graph.

[0045] That is, the node's attribute information and transaction connection information are transformed into a compact feature vector rich in semantic features.

[0046] Based on the transaction connection information and the attribute information corresponding to the nodes in the transaction topology graph, a feature vector of each node is constructed, realizing the deep integration of node attributes and graph structure. This avoids the information loss caused by relying solely on the original high-dimensional attributes or topology structure, and generates a more compact and discriminative feature vector, thereby improving the construction quality of subsequent similar graphs and the semantic accuracy of clustering.

[0047] In some embodiments, such as Figure 2 As shown, based on the transaction connection information and the attribute information corresponding to the nodes in the transaction topology graph, a feature vector for each node is constructed, including the following steps S210-S240, which are described in detail below.

[0048] In step S210, for each node in the transaction topology graph, the node's initial feature vector is added to the initial feature vectors of all neighboring nodes to generate a first feature vector.

[0049] The initial feature vector is obtained based on the attribute information corresponding to the node, and contains this attribute information. Specifically, the node's attribute information can be transformed into one or more numerical vectors, which are then concatenated or merged into a vector of a set length, serving as the node's initial feature vector. The more attribute information a node has, the higher the dimensionality of the initial feature vector, thus fully utilizing the node's high-dimensional attributes.

[0050] In step S220, the first feature vector is subjected to dimensionality reduction processing to obtain the second feature vector.

[0051] In step S230, the residual vector between the second eigenvector and the initial eigenvector is calculated.

[0052] In step S240, the residual vector is concatenated with the initial feature vector to obtain the feature vector of the node.

[0053] Assuming nodes The initial feature vector is In step S210, the node initial feature vector Initial feature vectors of all neighboring nodes Adding, that is ,in This represents the first feature vector generated, which typically has thousands of dimensions to create a user profile from multiple dimensions. Represents nodes The set of neighboring nodes with transactional edges. In step S220, based on... For the first eigenvector Dimensionality reduction is performed to obtain the second feature vector. Where the dimension of W is d2×d1, and d1 represents The initial dimension is d1, and d2 represents the dimension after dimensionality reduction. The resulting second feature vector typically has tens of dimensions or 128 dimensions. In step S230, based on... Calculate the residual vector This step involves calculating the residual between a node's initial features and those of its neighbors after the node has acquired the feature information. If the user is normal, the feature vector resulting from the combination of these features will not change significantly, resulting in a smaller residual. Conversely, if the user is abnormal, the feature vector resulting from the combination of these features will change significantly, leading to a larger residual, since most of the user's neighbors are still normal. This process distinguishes the feature vectors of normal and abnormal nodes, facilitating subsequent calculations based on these feature vectors and improving the accuracy of subsequent calculations, thereby enhancing the accuracy of suspicious user identification.

[0054] In other embodiments, residuals may be disregarded. For example, the first feature vector obtained in step S210 above may be directly used as the feature vector of the node. However, this approach may cause the feature vector of the current node to be nearly identical to the feature vectors of its neighboring nodes, making it impossible to accurately detect abnormal users in subsequent steps.

[0055] In some embodiments, in step S220 above, a fully connected network is used to reduce the dimensionality of the first feature vector to obtain a second feature vector. The second feature vector has a dimension on the order of tens to hundreds of dimensions, while the first feature vector has a dimension on the order of hundreds to thousands of dimensions.

[0056] Using a fully connected network to reduce the dimensionality of the first feature vector allows for flexible control over the dimensionality reduction and feature representation, adapting to different task requirements. Furthermore, the fully connected network can capture non-linear feature relationships, extracting a more compact and discriminative first feature vector.

[0057] In step S130, the similarity between the feature vectors of each node in the transaction topology graph is calculated. Based on the k-nearest neighbor construction strategy, the edge connection between each node and its k most similar neighbor nodes is retained to obtain the k-nearest neighbor similarity graph.

[0058] Among them, the k-nearest neighbor similarity graph represents the connection relationship between nodes based on feature similarity.

[0059] In some embodiments, calculating the similarity between the feature vectors of each node in the transaction topology graph includes: for any two nodes in the transaction topology graph, calculating the cosine similarity between the feature vectors of the nodes to obtain the similarity between the feature vectors of the nodes.

[0060] Cosine similarity only involves dot product and norm calculations, which is computationally inexpensive and particularly suitable for similarity calculations in large-scale suspicious user identification. By calculating the cosine similarity between the feature vectors of nodes, the similarity between the feature vectors of nodes can be obtained, which can improve the efficiency of suspicious user identification.

[0061] Of course, the similarity between the feature vectors of nodes can also be obtained in other ways. For example, the Euclidean distance between the feature vectors of nodes can be calculated to obtain the similarity between the feature vectors of nodes; another example is to calculate the Manhattan distance between the feature vectors of nodes to obtain the similarity between the feature vectors of nodes.

[0062] In step S130, a k-nearest neighbor (kNN) construction strategy is introduced, whereby each node retains only the edge connections with its k most similar neighbor nodes, thereby generating a semantically rich k-nearest neighbor similarity graph. The k-nearest neighbor similarity graph combines transaction connection information and high-dimensional attributes from the transaction topology graph. This helps reduce the computational load of subsequent steps and improves the efficiency of suspicious user identification; simultaneously, the k-nearest neighbor similarity graph retains only important similarity relationships, reducing noise.

[0063] In some embodiments, such as Figure 3 As shown, based on the k-nearest neighbor construction strategy, each node retains the edge connections with its k most similar neighbor nodes to obtain the k-nearest neighbor similarity graph, including the following steps S310-S320, which are described in detail below.

[0064] In step S310, the ratio of the number of edges in the k-nearest neighbor similarity graph to the number of edges in the transaction topology graph is set to N.

[0065] Where N is greater than 1. The specific value of N can be flexibly set according to actual needs.

[0066] In step S320, based on the ratio N, a k-nearest neighbor construction strategy is adopted to retain the edge connections between each node and its k most similar neighbor nodes to obtain a k-nearest neighbor similarity graph.

[0067] In other words, the density of the k-nearest neighbor similarity graph is determined by setting the ratio of the number of edges in the k-nearest neighbor similarity graph to the number of edges in the transaction topology graph; that is, the value of k is determined. For example, setting N to 10 results in a k-nearest neighbor similarity graph with ten times the number of edges in the transaction topology graph, constructing a dense but semantically rich k-nearest neighbor similarity graph. Even if there is no transaction connection between two users, as long as their feature vectors are similar (e.g., both like sports products), they will still establish a connection in the similarity graph.

[0068] k-nearest neighbor similarity graphs can accurately reflect the potential clustering relationships in a transaction topology graph, helping to identify potential abnormal user groups, even if they have no transactional connections in the graph. This improves the accuracy of subsequent clustering results and, consequently, the accuracy of suspicious user identification. Simultaneously, the k-nearest neighbor construction strategy effectively reduces the computational and memory overhead required for subsequent clustering processing and enhances the stability and robustness of the graph structure, making it particularly suitable for noisy or heterogeneous graph data.

[0069] The k-nearest neighbor similarity graph obtained through step S130 is usually very dense, meaning each node has many neighbors. Directly using existing clustering algorithms would result in low clustering efficiency, thus affecting the efficiency of identifying suspicious users. Therefore, this application employs an optimization strategy to accelerate computation, enabling the clustering algorithm to perform efficient clustering analysis based on the k-nearest neighbor similarity graph, thereby dividing the data into clusters. See step S140 below for details.

[0070] In step S140, a graph clustering algorithm is used to divide multiple nodes in the k-nearest neighbor similarity graph into multiple clusters, including: initial iteration, treating each node in the k-nearest neighbor similarity graph as an independent cluster, and selectively accepting node migrations by evaluating the contribution of each node's migration to an adjacent cluster to the density; subsequent iterations, performing migration evaluation on nodes whose neighboring nodes have changed clusters in the previous iteration. If none of a node's neighboring nodes have changed their clusters in the previous iteration, then no migration evaluation is performed on it. The migration evaluation includes evaluating the contribution of a node's migration to an adjacent cluster to the density and selectively accepting node migrations.

[0071] In other words, the first iteration begins by setting each node in the k-nearest neighbor similarity graph as an independent cluster. Then, each node is examined, and attempts are made to migrate it to the cluster of its neighbors. If the migration significantly improves the overall cluster density, the migration is adopted; otherwise, it is not. These initially formed clusters are then aggregated into new nodes, thus constructing a more concise graph. From the second iteration onwards, a pruning mechanism is used. A node's migration decision is only re-evaluated if at least one of its neighbors changed clusters in the previous iteration. This is because in the first iteration, each node's migration potential to a neighbor's cluster was already assessed. From the second iteration onwards, if the neighbor's cluster remains unchanged, no further evaluation is required. This approach significantly reduces redundant judgments and accelerates convergence, especially when the graph is stable or locally sparse.

[0072] In some embodiments, such as Figure 4 As shown, the graph clustering algorithm is used to divide multiple nodes in the k-nearest neighbor similarity graph into multiple clusters, including the following steps S410-S440, which are described in detail below.

[0073] In step S410, the first iteration: each node in the k-nearest neighbor similarity graph is treated as an independent cluster. By evaluating the contribution of each node's migration to the adjacent cluster to the density, the migration of nodes is selectively accepted to obtain the first cluster topology graph.

[0074] In step S420, the second iteration: the migration evaluation is performed on the nodes in the first cluster topology graph whose neighboring nodes have undergone cluster changes in the first iteration. If the neighboring nodes of a certain node have not changed their clusters in the first iteration, then no migration evaluation is performed on it, and a more concise second cluster topology graph is obtained.

[0075] In step S430, the third iteration: the migration evaluation is performed on the neighbor nodes in the second cluster topology graph that have undergone cluster changes in the second iteration. If the neighbor nodes of a certain node have not changed their clusters in the second iteration, then no migration evaluation is performed on it, and a more concise third cluster topology graph is obtained.

[0076] In step S440, the Nth iteration: For the cluster topology obtained in the (N-1)th iteration, the migration evaluation is performed on the neighbor nodes of the nodes whose clusters have changed in the (N-1)th iteration. If the neighbor nodes of a certain node have not changed their clusters in the (N-1)th iteration, then no migration evaluation is performed on it, and a more concise cluster topology is obtained.

[0077] This process continues until the modularity of the cluster topology graph no longer increases, or the increase is less than the target value, at which point the clustering is terminated, and the cluster partitioning result corresponding to the k-nearest neighbor similarity graph is obtained.

[0078] In some embodiments, further, in subsequent iterations, a subset of nodes are randomly selected from the neighboring nodes of the current node as target nodes; migration evaluation is performed on nodes whose neighboring nodes have undergone cluster changes in the previous iteration. If none of the neighboring nodes of a certain node have changed their respective clusters in the previous iteration, then no migration evaluation is performed on them. This includes: migration evaluation is performed on target nodes whose clusters have undergone changes in the previous iteration. If none of the target nodes corresponding to a certain node have changed their respective clusters in the previous iteration, then no migration evaluation is performed on them.

[0079] In other words, in subsequent iterations, a sampling mechanism is used. Instead of traversing all neighbors during cluster affiliation decisions, one or more neighboring clusters are randomly selected for evaluation. This approach significantly improves computational efficiency and is particularly suitable for early iterations in clustering and large-scale transaction topologies.

[0080] That is, in the above embodiments, starting from the second iteration, from the perspective of reducing the amount of computation, a pruning mechanism and a sampling mechanism are adopted to exchange a small loss of accuracy for a significant performance improvement, so as to improve the running speed of the clustering algorithm.

[0081] Traditional graph clustering algorithms are single-threaded. Even with the aforementioned pruning and sampling optimization strategies, they still require significant computation time when dealing with large-scale graph data. To further accelerate clustering, some embodiments use multiple threads, each maintaining a list of active nodes. These active nodes are those whose neighboring nodes underwent cluster changes in the previous iteration. For example... Figure 5 As shown, multi-threaded clustering includes the following steps S510-S530, which are explained in detail below.

[0082] In step S510, in subsequent iterations, each thread concurrently performs the migration evaluation operation for the active nodes in its corresponding list of active nodes.

[0083] In step S520, after all threads have completed this round of migration evaluation, the migration evaluation results are merged through a synchronization mechanism, and the global node cluster status is updated.

[0084] In step S530, for a node that has undergone cluster changes, its neighboring nodes are marked as active nodes in the next round.

[0085] In some embodiments, active nodes are recorded in subsequent iterations via a shared state indicator vector.

[0086] That is, each thread concurrently operates on different subsets of nodes in the graph, and records which nodes are in an "active" state (i.e., can be migrated) through a shared state indicator vector 𝑅. To avoid thread conflicts, each thread maintains an independent list of active nodes RN[t] in the above steps, where RN is a list and t represents the thread ID.

[0087] In suspicious user identification scenarios, especially in anti-money laundering identification scenarios, the above-mentioned parallel multi-threaded mechanism supports efficient operation in a multi-core environment, can scalably process large-scale graph data containing millions of nodes and edges, and can meet the needs of real-time monitoring and anomaly detection.

[0088] In step S150, suspicious users are identified based on the partitioned clusters.

[0089] Identifying suspicious users based on cluster divisions can be achieved in two ways: For each cluster, analyze its overall behavioral characteristics, such as transaction frequency, amount, active time, and number of accounts. Compare these characteristics with global statistical features or normal group distributions to identify statistically abnormal clusters; users in these clusters are considered suspicious. Alternatively, among all the clusters, identify those with very few nodes (e.g., only 2-5 nodes) or very few connections to other clusters; users in these clusters are considered suspicious.

[0090] In some embodiments, clusters with high cohesion and abnormally high frequency of cross-border transactions are automatically labeled as suspicious groups.

[0091] The following example, using an anti-money laundering scenario, illustrates the suspicious user identification method of this application.

[0092] In an anti-money laundering scenario, a large commercial bank needs to monitor tens of millions of accounts (users) and hundreds of millions of transactions daily. Each account node has the following attributes: transaction amount distribution, daily / weekly / monthly transaction frequency, transaction geographical distribution, account type (individual / corporate), and historical suspicious tags. Meanwhile, the transfer relationships between accounts form the edges of a transaction topology graph. The bank aims to automatically identify potential money laundering groups and suspicious fund flow paths to assist its risk control system in achieving real-time early warning and investigation. Due to the large number of accounts, high attribute dimensionality, and the concealed and complex nature of money laundering networks, traditional rules and purely statistical methods are insufficient to meet the requirements of real-time performance and accuracy.

[0093] Figure 6 A flowchart illustrating a suspicious user identification method in an anti-money laundering scenario is shown. (See attached document.) Figure 6 As shown, the suspicious user identification method includes at least the following steps S610 to S640, which are described in detail below.

[0094] In step S610, the attribute information of each account and the current day's and historical transfer relationships are input into the graph neural network to generate a low-dimensional feature vector for each node. Then, step S620 is executed.

[0095] In step S620, based on the cosine similarity between the low-dimensional feature vectors of each node, a guided similarity graph is constructed using the k-nearest neighbor construction strategy, and then fused with the original transaction topology graph to form a candidate graph of suspicious networks.

[0096] In step S630, an unsupervised clustering algorithm is applied to the suspicious network candidate graph to automatically label highly cohesive clusters with abnormal cross-border transaction frequency as high-risk groups, thereby obtaining the suspicious user identification results.

[0097] In step S640, the results are pushed to the anti-money laundering monitoring platform to achieve visualization of the chain and linkage with compliance processes.

[0098] In summary, this application eliminates the need to pre-define the number of clusters and can adaptively achieve high-quality cluster partitioning based on the k-nearest neighbor similarity graph, significantly reducing the cost of manual rule maintenance. By employing a graph neural network (e.g., GCN) to encode the attribute graph and learn feature vectors, it effectively integrates the attribute features of nodes with the structural information of neighboring nodes. Through end-to-end unsupervised training, the resulting feature vectors more accurately reflect potential node similarity relationships, which is beneficial for subsequent similarity graph construction and clustering tasks. This fundamentally solves the limitation of traditional graph clustering algorithms that only consider graph structure and cannot utilize high-dimensional attributes. Based on feature similarity, an information-rich k-nearest neighbor similarity graph is constructed, retaining only the k most similar neighbors of each node. A bootstrap strategy is introduced to weightedly fuse the transaction topology graph structure with the similarity graph, further enhancing structural stability and expressive power. This not only reduces computational complexity but also lowers the risk of noise propagation, while maintaining the local and global information required for clustering, providing higher-quality input for subsequent clustering. During clustering, pruning and sampling mechanisms are employed: in iterations, only nodes whose neighbors have undergone cluster changes are updated, avoiding meaningless duplicate checks and significantly reducing the number of node visits; candidate neighbors are randomly sampled, evaluating only a subset of potential migration targets, sacrificing minimal accuracy for greater speed improvements. A parallel thread scheduling mechanism is used, with each thread processing a group of active nodes. Data contention is avoided between threads through local update queues, and the state is synchronized uniformly after each iteration. This mechanism ensures the correctness and convergence of the algorithm in a parallel environment, while fully utilizing multi-core computing resources to achieve linear or sublinear speedup, meeting the high-performance requirements of core banking systems.

[0099] See next. Figure 7This embodiment provides a computer device 700, which includes one or more processors 701 and a memory 702. The memory 702 is used to store one or more programs. When one or more programs are executed by one or more processors 701, the computer device 700 implements the suspicious user identification method of this application.

[0100] Figure 8 The diagram shows a computer system architecture block diagram for implementing some embodiments of this application. It should be noted that... Figure 8 The computer system shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of this application.

[0101] like Figure 8 As shown, the computer system 800 includes a CPU (Central Processing Unit) 801, which can perform various appropriate actions and processes based on programs stored in ROM (Read-Only Memory) 802 or programs loaded from storage portion 808 into RAM (Random Access Memory) 803, such as executing the suspicious user identification method in the above embodiments. Various programs and data required for system operation are also stored in RAM 803. The CPU 801, ROM 802, and RAM 803 are interconnected via bus 804. An I / O (Input / Output) interface 805 is also connected to bus 804.

[0102] The following components are connected to I / O interface 805: an input section 806 including a keyboard, mouse, etc.; an output section 807 including CRT (Cathode Ray Tube), LCD (Liquid Crystal Display), etc., and speakers, etc.; a storage section 808 including a hard disk, etc.; and a communication section 809 including a network interface card such as a LAN (Local Area Network) card, modem, etc. The communication section 809 performs communication processing via a network such as the Internet. A drive 810 is also connected to I / O interface 805 as needed. A removable medium 811, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on drive 810 as needed so that computer programs read from it can be installed into storage section 808 as needed.

[0103] Specifically, according to embodiments of this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program including a computer program for performing all or part of the steps shown in the flowcharts of the suspicious user identification method. In such embodiments, the computer program can be downloaded and installed from a network via communication section 809, and / or installed from removable medium 811. When the computer program is executed by central processing unit (CPU) 801, it performs various functions defined in the system of this application.

[0104] It should be noted that the computer-readable medium shown in the embodiments of this application can be a computer-readable signal medium or a computer-readable storage medium, or any combination of the two. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), flash memory, optical fiber, portable compact disc read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this application, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this application, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying a computer-readable computer program. The transmitted data signal can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. The computer-readable signal medium can also be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The computer program contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to wireless, wired, etc., or any suitable combination thereof.

[0105] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. Each block in a flowchart or block diagram may represent a module, segment, or portion of code, which contains one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0106] The units described in the embodiments of this application can be implemented in software or hardware, and the described units can also be located in a processor. The names of these units do not necessarily limit the specific unit itself.

[0107] In another aspect, this application also provides a computer-readable medium, which may be included in the computer device described in the above embodiments; or it may exist independently and not assembled into the computer device. The computer-readable medium carries one or more programs that, when executed by the computer device, cause the computer device to implement the methods described in the above embodiments.

[0108] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to the embodiments of this application, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0109] Through the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, touch terminal, or network device, etc.) to execute the methods according to the embodiments of this application.

[0110] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this application are indicated by the appended claims.

Claims

1. A method for identifying suspicious users, characterized in that, The method includes: Obtain a transaction topology map that reflects historical transaction relationships, wherein the transaction topology map contains transaction connection information between nodes and attribute information corresponding to each node; Based on the transaction connection information and the attribute information corresponding to the nodes in the transaction topology graph, a feature vector of each node is constructed. Calculate the similarity between the feature vectors of each node in the transaction topology graph. Based on the k-nearest neighbor construction strategy, retain the edge connections between each node and its k most similar neighbor nodes to obtain the k-nearest neighbor similarity graph. The k-nearest neighbor similarity graph represents the connection relationship between nodes based on feature similarity. A graph clustering algorithm is used to divide multiple nodes in the k-nearest neighbor similarity graph into multiple clusters, including: an initial iteration, in which each node in the k-nearest neighbor similarity graph is treated as an independent cluster, and the migration of each node to a neighboring cluster is evaluated to selectively accept the migration of the node; in subsequent iterations, migration evaluation is performed on nodes whose neighboring nodes have changed clusters in the previous iteration. If none of the neighboring nodes of a node have changed their clusters in the previous iteration, then no migration evaluation is performed on it. The migration evaluation includes evaluating the contribution of a node to a neighboring cluster to the density and selectively accepting the migration of the node. Suspicious users are identified based on the defined clusters.

2. The method according to claim 1, characterized in that, The step of constructing a feature vector for each node based on the transaction connection information and the attribute information corresponding to the nodes in the transaction topology graph includes: For each node in the transaction topology graph, the initial feature vector of the node is added to the initial feature vectors of all its neighboring nodes to generate a first feature vector; The first feature vector is subjected to dimensionality reduction processing to obtain the second feature vector; Calculate the residual vector between the second feature vector and the initial feature vector; The residual vector is concatenated with the initial feature vector to obtain the feature vector of the node; The initial feature vector is obtained based on the attribute information corresponding to the node.

3. The method according to claim 2, characterized in that, The step of performing dimensionality reduction on the first feature vector to obtain the second feature vector includes: The first feature vector is reduced in dimensionality using a fully connected network to obtain the second feature vector. The second feature vector has a dimension of tens to hundreds of dimensions, while the first feature vector has a dimension of hundreds to thousands of dimensions.

4. The method according to claim 2, characterized in that, The attribute information corresponding to the node includes the following: transaction amount, transaction frequency, transaction location, account type, and whether the node has been marked as suspicious. The trading frequency includes at least one of daily trading frequency, weekly trading frequency, and monthly trading frequency; The account types include personal accounts and corporate accounts.

5. The method according to claim 1, characterized in that, The calculation of the similarity between the feature vectors of each node in the transaction topology graph includes: For any two nodes in the transaction topology graph, calculate the cosine similarity between the feature vectors of the nodes to obtain the similarity between the feature vectors of the nodes.

6. The method according to claim 1, characterized in that, The k-nearest neighbor construction strategy retains the edge connections between each node and its k most similar neighbor nodes to obtain a k-nearest neighbor similarity graph, including: Set the ratio of the number of edges in the k-nearest neighbor similarity graph to the number of edges in the transaction topology graph to N, where N is greater than 1; Based on the ratio N, a k-nearest neighbor construction strategy is adopted to retain the edge connections between each node and its k most similar neighbor nodes to obtain a k-nearest neighbor similarity graph.

7. The method according to claim 1, characterized in that, In the subsequent iterations, a subset of nodes are randomly selected from the current node's neighboring nodes as the target node; The migration evaluation of nodes whose neighboring nodes underwent cluster changes in the previous iteration includes the following: If none of a node's neighboring nodes changed their clusters in the previous iteration, then no migration evaluation is performed on it. Migration evaluation is performed on the target nodes that have undergone cluster changes in the previous iteration. If the target nodes corresponding to a certain node have not changed their clusters in the previous iteration, then no migration evaluation is performed on them.

8. The method according to claim 1, characterized in that, Multiple threads are set up, and each thread maintains an active node list. The active node list contains multiple active nodes, which are nodes whose neighboring nodes have undergone cluster changes in the previous iteration. In the subsequent iterations, each thread concurrently performs a migration evaluation operation on the active nodes in its corresponding list of active nodes; After all threads have completed this round of migration evaluation, the migration evaluation results are merged through a synchronization mechanism, and the global node cluster status is updated. For nodes that undergo cluster changes, mark their neighboring nodes as active nodes in the next round.

9. The method according to claim 8, characterized in that, In the subsequent iterations, the active nodes are recorded using a shared state indicator vector.

10. A computer device, characterized in that, include: One or more processors; A memory for storing one or more computer programs, which, when executed by one or more processors, cause the processors to perform the method as described in any one of claims 1 to 9.

Images