Grid multi-source linkage money laundering pit striking method, system and equipment and medium

Abstract

The invention relates to the field of telecommunication network fraud prevention, in particular to a rasterized multi-source linkage money laundering spot striking method, system and device and a medium. The method comprises the following steps: acquiring data of suspicious users, and inputting the data into a preset posting and posting short message feature library to obtain preliminarily screened suspected group samples; screening the internet access records of the primarily screened suspected group samples to obtain users who have high-frequency access to the four-party payment money laundering platform; querying a user who accesses the four-party payment money laundering platform at high frequency and accesses a fixed network account at the same time, and outputting a base station position through GeoHash rasterization clustering; and precise positioning is carried out by combining the base station position and the fixed network account. According to the method, a suspected money laundering pit clue is mined in a clustering manner based on the content of the short message received by the user and the dimension of the short message receiving frequency, the money laundering pit behavior is further confirmed for the mobile network internet access log behavior of the suspected money laundering pit, and the deterministic mothers and capture actions are realized.

Description

Technical Field

[0001] This disclosure relates to the field of combating telecommunications and online fraud, and in particular to methods, systems, equipment, and media for cracking down on money laundering dens through grid-based multi-source linkage. Background Technology

[0002] Current methods for combating money laundering dens involved in telecom and online fraud require uncovering suspected money laundering leads from existing cases, further determining the size of the group, the depth of involvement, and the location of activity by integrating information such as case trial records, before conducting on-site investigations. This approach is relatively weak in detecting money laundering activities and is time-consuming.

[0003] The existing procedures for cracking down on traditional money laundering dens are as follows: 1. Analysis of the case, including the URLs involved, bank cards involved, and individuals involved; 2. Determine the size of the money laundering operation, the depth of its involvement, and its active locations; 3. Dispatch police forces to investigate the hideouts; 4. Locate money laundering dens at the base station level and dispatch special positioning vehicles to pinpoint their locations; 5. Carry out the arrest.

[0004] Traditional technical methods have certain shortcomings in three aspects: discovering clues about money laundering dens, monitoring the activity of money laundering dens, and accurately locating money laundering dens. First, the methods for discovering clues about money laundering dens rely heavily on the content of existing cases, resulting in a narrow search scope. Second, they cannot grasp the latest money laundering activity of existing money laundering dens. Finally, they can only locate the base station location of mobile network users, and cannot achieve further last-kilometer or more precise location and arrest. Summary of the Invention

[0005] This disclosure provides a gridded, multi-source linkage method, system, equipment, and medium for combating money laundering dens. It designs a multi-source data fusion and linkage mechanism that deeply correlates big data computing to achieve the technology of combating money laundering dens for telecommunications network fraud crimes by using SMS as clues, analyzing Internet access records, and locating the last mile of home broadband.

[0006] According to a first aspect of this disclosure, a grid-based, multi-source coordinated method for combating money laundering dens is provided, the method comprising: Data on suspicious users is obtained and entered into a pre-defined database of incoming and outgoing SMS features to obtain an initial sample of suspected users. The internet access records of suspected groups were screened to identify users who frequently accessed the Sifang Payment money laundering platform. For users who frequently access the Sifang Payment money laundering platform, query their fixed network accounts that accessed the platform at the same time, and output the base station location through GeoHash raster clustering. Accurate positioning is achieved by combining base station location and fixed network account.

[0007] Optionally, the process of constructing the billing and debit SMS feature database is as follows: Collect SMS data and use the inverse document frequency algorithm to perform preliminary word segmentation of the SMS messages to obtain the segmented word sequence; Based on the segmentation results, the invoice and billing SMS messages are classified and labeled to establish feature word libraries for the two types of SMS messages, resulting in a structured feature library. The SMS recognition model is trained using a feature library, and the classification parameters are optimized to obtain a well-trained model. The newly accumulated SMS input models from various banks are categorized, and the feature database of incoming and outgoing SMS messages is updated after verifying their accuracy.

[0008] Optionally, the steps of obtaining data on suspicious users, entering it into a preset billing and payment SMS feature database, and obtaining a preliminary sample of suspected users are as follows: User SMS data is obtained from multiple channels, and suspicious data containing keywords related to financial transactions is filtered out to obtain the raw SMS set to be analyzed. The original SMS messages are matched with the preset feature database of incoming and outgoing SMS messages by keywords and patterns, and a preliminary matching result list is output. The probability of each text message being suspected is calculated based on the matching results. High-probability samples are then selected to obtain a preliminary sample of suspected individuals.

[0009] Optionally, the steps to filter the internet access records of suspected groups to identify users who frequently access the Sifangpay money laundering platform are as follows: Extract all accessed domain names and corresponding URLs from the internet access records of suspected groups in the initial screening, and output the domain name-URL dataset to be verified; The extracted domain names are matched with the known domain name database of the Sifang Payment money laundering platform, and a preliminary list of suspicious domain names that have been successfully matched is output. For domains that are successfully matched, further verify whether their URL paths and parameters match the characteristics of money laundering platforms, and output high-confidence suspicious access records; Count the frequency of each user's access to high-confidence URLs, filter high-frequency users, and output a list of users who frequently access the Sifang Payment money laundering platform.

[0010] Optionally, the steps for querying the fixed-line accounts accessed by users who frequently access the four-party payment money laundering platform are as follows: By associating the fixed-line accounts of users who frequently access the Sifang Payment money laundering platform, and based on the fixed-line access logs, an output account-suspicious access behavior mapping table is obtained; Statistically analyze the frequency of each fixed-line account accessing the Sifang Payment platform, filter frequently accessing accounts, and output the locations of high-risk fixed-line accounts.

[0011] Optionally, the step of outputting the base station location through GeoHash raster clustering is as follows: Extract the original latitude and longitude coordinates of the base station recorded when receiving SMS messages, and output the structured base station location information; The latitude and longitude of the base station are converted using the GeoHash algorithm to generate raster code values ​​with corresponding precision, and the base station-GeoHash value mapping table is output. Spatial clustering analysis is performed on base stations based on GeoHash values, base stations in adjacent grids are merged, and a preliminary list of base station clusters is output. The system filters out areas in the base station cluster where the density exceeds a threshold, marks them as suspected hotspots, and outputs the final confirmed base station locations and clustering results.

[0012] Optionally, the steps for accurate positioning by combining base station location and fixed network account are as follows: By associating fixed-line accounts with base station locations, the delivery addresses for food delivery and express courier services in the area can be obtained, resulting in multi-source address data. Convert multi-source address data into structured coordinate data and output a standardized address coordinate library; By using geofencing to filter overlapping areas between fixed network accounts and base station locations within a preset range, high-confidence candidate coordinates of criminal activity sites are output.

[0013] According to a second aspect of this disclosure, a grid-based, multi-source, coordinated system for combating money laundering dens is provided, the system comprising: The acquisition module is configured to acquire data from suspicious users, input the data into a preset billing and debit SMS feature database, and obtain a preliminary sample of suspected users. The access module is configured to filter the internet access records of suspected groups in the initial screening to identify users who frequently access the Sifang Payment money laundering platform. The location module is configured to query the fixed network accounts accessed by users who frequently access the four-party payment money laundering platform during the same period, and output the base station location through GeoHash raster clustering; The positioning module is configured to perform precise positioning by combining base station location and fixed network account.

[0014] According to a third aspect of this disclosure, an electronic device is provided. The electronic device includes a memory and a processor, wherein the memory stores a computer program, and the processor executes the program to implement the method described above.

[0015] According to a fourth aspect of this disclosure, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the methods described above.

[0016] According to a fifth aspect of this disclosure, a computer program product is provided, comprising a computer program that, when executed by a processor, implements the methods described above.

[0017] This disclosure provides a gridded, multi-source, and interconnected method, system, device, and medium for combating money laundering dens. The method includes: acquiring data from suspicious users and inputting it into a preset database of incoming and outgoing SMS features to obtain a preliminary sample of suspected users; filtering the internet access records of the preliminary sample to identify users who frequently access the Sifang Payment money laundering platform; querying the fixed-line accounts of these users who frequently access the Sifang Payment money laundering platform and outputting base station locations through GeoHash gridded clustering; and performing precise location analysis by combining base station locations and fixed-line accounts. This invention uses the content and frequency of SMS messages received by users to cluster and mine clues of suspected money laundering dens. It further confirms money laundering den activities by analyzing mobile network internet access logs of suspected money laundering dens. After confirming a money laundering den, it can comprehensively analyze the broadband fixed-line networks of members' homes to achieve a granular strike capability down to the last kilometer or even the last meter, enabling deterministic investigation and arrest operations, and completing a rapid and accurate crackdown on money laundering dens from the discovery of clues to arrest and prosecution.

[0018] This invention addresses the shortcomings of traditional methods for uncovering money laundering rings by shifting the approach from waiting for case files or transcripts to proactively identifying such leads, thus broadening the scope and timeliness of lead discovery. It resolves the issue of not being able to accurately determine the size of a money laundering ring, the depth of its involvement, or its recent activity locations. Specifically, even after identifying a money laundering ring, it's difficult to determine the size of its personnel, daily money laundering transactions, or recent activity locations—a lack of depth for the case. Furthermore, it extends the reach of the crackdown to the last kilometer or even the last meter, enhancing the depth of the investigation. Through deep analysis of big data correlations with base station locations, SMS sending and receiving base stations, and home broadband information, the ability to precisely locate money laundering rings transcends spatial limitations. Attached Figure Description

[0019] Further details, features, and advantages of this disclosure are disclosed in the following description of exemplary embodiments in conjunction with the accompanying drawings, in which: Figure 1 A flowchart of the overall technical solution of a gridded multi-source linkage method for combating money laundering dens provided as an exemplary embodiment of this disclosure; Figure 2 A flowchart of a gridded multi-source linkage anti-money laundering den system provided as an exemplary embodiment of this disclosure; Figure 3 A structural block diagram of an electronic device provided as an exemplary embodiment of this disclosure; Figure 4 A block diagram of a computer system provided for an exemplary embodiment of this disclosure. Detailed Implementation

[0020] Embodiments of this disclosure will now be described in more detail with reference to the accompanying drawings. While some embodiments of this disclosure are shown in the drawings, it should be understood that this disclosure can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of this disclosure. It should be understood that the accompanying drawings and embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of protection of this disclosure.

[0021] It should be understood that the steps described in the method embodiments of this disclosure may be performed in different orders and / or in parallel. Furthermore, the method embodiments may include additional steps and / or omit the steps shown. The scope of this disclosure is not limited in this respect.

[0022] The term "comprising" and its variations as used herein are open-ended, meaning "including but not limited to". The term "based on" means "at least partially based on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". Definitions of other terms will be given in the description below. It should be noted that the concepts of "first", "second", etc., used in this disclosure are only used to distinguish different devices, modules, or units, and are not intended to limit the order of functions performed by these devices, modules, or units or their interdependencies.

[0023] It should be noted that the terms "a" and "a plurality of" used in this disclosure are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise expressly indicated in the context, they should be understood as "one or more".

[0024] The names of messages or information exchanged between multiple devices in the embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of such messages or information.

[0025] It is understood that before using the technical solutions disclosed in the various embodiments of this disclosure, users should be informed of the types, scope of use, and usage scenarios of the personal information involved in this disclosure in an appropriate manner in accordance with relevant laws and regulations, and user authorization should be obtained.

[0026] Upon receiving a user's active request, a prompt message is sent to the user to explicitly inform them that the requested operation will require the acquisition and use of the user's personal information. This allows the user to independently choose whether to provide personal information to the software or hardware, such as the electronic device, application, server, or storage medium performing the operations of this disclosed technical solution, based on the prompt message.

[0027] As an optional but non-limiting implementation, in response to a user's active request, sending a prompt message to the user can be done via a pop-up window, where the prompt message can be presented in text format. Furthermore, the pop-up window can also include a selection control allowing the user to choose "agree" or "disagree" to provide personal information to the electronic device. It is understood that the above notification and user authorization process is merely illustrative and does not constitute a limitation on the implementation of this disclosure; other methods that comply with relevant laws and regulations may also be applied to the implementation of this disclosure.

[0028] Traditional methods for combating money laundering dens involved in telecom and online fraud require uncovering suspected money laundering leads from existing cases, further determining the size of the operation, the depth of involvement, and the location of activity by integrating information such as case trial records, before conducting on-site investigations. This approach is relatively weak in detecting money laundering activities and is time-consuming.

[0029] Existing traditional methods for combating money laundering operations generally involve the following steps, but their shortcomings are quite obvious: Step 1: Analyze the case, including the URLs involved, bank cards involved, and individuals involved; Drawbacks: It requires analyzing the case details and transcripts to identify potential money laundering dens, resulting in a limited scope and a long processing time.

[0030] Step 2: Determine the size of the money laundering operation, the depth of its involvement, and its active locations; Limitations: It is impossible to obtain accurate information on the size of money laundering dens, the depth of involvement, and recent activity locations.

[0031] Step 3: Dispatch police officers to investigate the hideout; Step 4: Locate money laundering dens at the base station level and dispatch special positioning vehicles to pinpoint their locations; Drawback: It cannot deliver a strike within the last kilometer or even the last meter, and the strike process requires additional resources.

[0032] This invention aims to solve the following technical problems: To address the shortcomings of existing traditional methods for uncovering money laundering leads, the approach shifts from waiting for case files or transcripts to obtain leads to proactively discovering and combating money laundering leads, thereby broadening the scope and timeliness of lead discovery.

[0033] Solve the problems of being unable to obtain relatively accurate information about the scale of money laundering dens, the depth involved in cases, and the recent active locations, etc. That is, after determining a money laundering den, it is impossible to determine the depth of cases such as the scale of personnel in the money laundering den, the daily money laundering turnover, and the recent active locations.

[0034] Solve the problem of empowering the combat ability to the last 1 kilometer or even the last 1 meter, strengthen the depth of case combat, and through in-depth analysis of the base station location, SMS sending and receiving base station location, and home broadband information by big data correlation, break through the spatial limitation of the ability to combat money laundering dens and achieve precise positioning.

[0035] In this invention, with the big data middleware as the data hub, from a large number of SMS messages, the content numbers of outgoing and incoming SMS messages received frequently are determined by the base station location through a clustering machine learning algorithm to identify the suspected user group of the money laundering den. The domain names in the Internet access records are screened and the content is crawled by a crawler to judge and confirm whether it is a four-party payment money laundering platform. For the users involved in accessing such four-party payment money laundering platforms, the amount of money laundering, active time, and group scale of the money laundering den gang are output according to the SMS content. The home broadband information of those who have accessed the above four-party payment money laundering platforms within the same time domain is deeply correlated to output the specific location of the money laundering den, that is, the specific floor and unit to which the account carried by the home broadband information belongs.

[0036] For the sake of clear description of the solution, the complete technical solution of the embodiments of the present disclosure will be elaborated in detail below. Among them, the complete technical solution of the present invention includes the training process and application process of the grid-based multi-source linkage money laundering den combat model.

[0037] As Figure 1 shown, the grid-based multi-source linkage money laundering den combat method provided by the embodiments of the present disclosure may include the following steps: Obtain data of suspicious users, input it into the preset incoming and outgoing SMS feature library, and obtain the initially screened suspected group samples; Screen the Internet access records of the initially screened suspected group samples to obtain users who frequently access the four-party payment money laundering platform; Query the fixed network accounts accessed during the same period for the users who frequently access the four-party payment money laundering platform, and output the base station location through GeoHash grid-based clustering; Perform precise positioning by combining the base station location and the fixed network account.

[0038] GeoHash is a technology for geographical location coding, which divides space into grids through a hierarchical data structure. It uses the characteristics of the Z-order curve to judge the relative positions of points through the common prefix of strings, and is often used for nearby point search in databases to improve query efficiency. In map applications, such as finding nearby restaurants, GeoHash can efficiently perform fuzzy queries on nearby GeoHash areas.

[0039] The technology of this invention lies in the GeoHash calculation of base station latitude and longitude. Members of a criminal gang may use mobile network cards from different operators, and the locations of base stations covering the same building may also differ between operators. Therefore, GeoHash gridding calculation based on base station latitude and longitude facilitates subsequent clustering of suspected criminal gangs. Nine GeoHash grids are used, with red, yellow, and green points representing base stations. Logically, red and green base stations are close to each other. However, in clustering calculations, red and yellow base stations are located within the same GeoHash grid WX4EQW. Therefore, the red and yellow base stations belong to the same criminal gang.

[0040] The financial industry has hundreds of banks and third-party payment channels, each with different templates for incoming and outgoing payments. It is necessary to identify incoming and outgoing SMS messages from a massive amount of SMS messages. This patent research adopts the inverse document frequency method to segment SMS messages into words and then establish an SMS message feature library for incoming and outgoing payments. It also establishes an SMS recognition model and accumulates SMS feature templates from various banks.

[0041] Based on the money laundering payment channels such as third-party payment platforms, newly emerging high-frequency access URLs can be analyzed by crawling their source code to determine whether they are new third-party payment platform channels.

[0042] The approach has evolved from passively discovering money laundering dens to proactively discovering them, broadening the scope of detection. The positioning accuracy has been improved from 0.6-2 kilometers with traditional base station positioning to a strike mode that can achieve precise door-to-door detection. Both the depth and breadth of the crackdown on money laundering dens have been qualitatively improved.

[0043] By acquiring suspicious user data and entering it into a pre-defined database of incoming and outgoing SMS transaction characteristics, a preliminary sample of suspected users can be quickly screened from a large pool of users. This step leverages the correlation between SMS characteristics and money laundering activities, automatically excluding a large number of legitimate users, significantly narrowing the scope of subsequent analysis, saving manpower and time costs, and enabling anti-money laundering efforts to focus more quickly on key targets.

[0044] The internet access records of suspected individuals in the initial screening were reviewed to identify users who frequently accessed the Sifang Payment money laundering platform. Sifang Payment platforms are often used by money launderers for fund transfers and laundering. By monitoring high-frequency users of these platforms, potential money laundering participants can be more accurately identified, further improving the targeting and efficiency of the crackdown.

[0045] This invention designs a multi-data source fusion and linkage, deeply correlates big data calculations across various dimensions, and completes the technology of proactively discovering suspected dens using SMS as clues, identifying the four-party payment money laundering platform used by den members through internet access record analysis, and locating the last mile of dens through domain names accessed by family broadband during the same period. This technology has a qualitative improvement in terms of den discovery methods, crackdown efficiency, and accuracy.

[0046] In some embodiments, please refer to Figure 1 The process of constructing the feature database for incoming and outgoing billing SMS messages is as follows: Collect SMS data and use the inverse document frequency algorithm to perform preliminary word segmentation of the SMS messages to obtain the segmented word sequence; Based on the segmentation results, the invoice and billing SMS messages are classified and labeled to establish feature word libraries for the two types of SMS messages, resulting in a structured feature library. The SMS recognition model is trained using a feature library, and the classification parameters are optimized to obtain a well-trained model. The newly accumulated SMS input models from various banks are categorized, and the feature database of incoming and outgoing SMS messages is updated after verifying their accuracy.

[0047] A feature database of frequent incoming and outgoing SMS messages was established, and user groups within this database were clustered according to base station grid GeoHash values ​​to identify suspected money laundering dens, thus generating a sample of suspected money laundering dens. The database includes user phone numbers, SMS incoming and outgoing transaction information, the location information of the base station at the time of receiving the SMS, and the base station's gridded GeoHash value, as shown in Table 1. Clustering users within the same GeoHash grid area from the frequent incoming and outgoing SMS messages yields a preliminary sample of suspected money laundering dens, as shown in Table 2.

[0048] Table 1

[0049] Table 2

[0050] The frequent deposit and withdrawal SMS feature database specifically collects user information with high-frequency fund flow characteristics. Money laundering activities are often accompanied by the rapid transfer of large amounts of funds. By screening users who frequently make deposit and withdrawal transactions, it is possible to accurately target groups that may be involved in money laundering activities, avoid unnecessary screening of normal users, and improve the targeting and effectiveness of anti-money laundering efforts.

[0051] The feature database contains the location information of the base station at the time of receiving SMS messages and the base station's gridded GeoHash value. This allows users to be grouped according to their geographical location during cluster analysis. Users within the same GeoHash grid area are geographically close. If these users exhibit frequent incoming and outgoing transactions, the likelihood of a money laundering operation in that area increases significantly. This method enables more precise identification of suspected money laundering operations, providing clear targets for subsequent investigations and crackdowns.

[0052] Establishing a feature library and utilizing GeoHash clustering methods enables automated data processing and analysis. Compared to traditional manual screening methods, automated processes can quickly process large amounts of SMS data and user information, significantly shortening screening time and improving work efficiency. Simultaneously, automated analysis reduces human error, improving the accuracy and consistency of screening results.

[0053] In some embodiments, please refer to Figure 1 The steps for obtaining data on suspicious users, entering it into a preset billing and payment SMS feature database, and obtaining a preliminary sample of suspected users are as follows: User SMS data is obtained from multiple channels, and suspicious data containing keywords related to financial transactions is filtered out to obtain the raw SMS set to be analyzed. The original SMS messages are matched with the preset feature database of incoming and outgoing SMS messages by keywords and patterns, and a preliminary matching result list is output. The probability of each text message being suspected is calculated based on the matching results. High-probability samples are then selected to obtain a preliminary sample of suspected individuals.

[0054] The financial industry employs hundreds of banks and third-party payment channels, each with different templates for incoming and outgoing payments. Commonly used high-frequency terms include "expenditure," "incoming payment," "withdrawal," and "received funds." Identifying incoming and outgoing payment SMS messages from massive amounts of data is crucial. This research employs inverse document frequency (IVF) to segment SMS messages into words, establishing a feature library for incoming and outgoing payment SMS messages. An SMS recognition model is then built, and SMS messages from various banks are collected. This study obtains the content of incoming and outgoing payment SMS messages from various banks from a massive amount of SMS data, labels them as training samples, and trains and tests the model. Subsequently, when extracting SMS messages suspected of being from money laundering operations, the model can directly filter and save incoming and outgoing payment SMS messages. The resulting SMS messages can reveal the scale, transaction volume, and activity time of money laundering operations.

[0055] After acquiring user SMS data from multiple channels, the first step is to filter out suspicious data containing keywords related to financial transactions, forming the raw SMS set to be analyzed. This step quickly focuses on SMS messages that may be related to financial transactions, eliminating a large amount of irrelevant information and laying the foundation for subsequent accurate analysis. By filtering for frequently used high-frequency words such as "expenditure," "deposit," "withdrawal," and "receipt," SMS messages related to deposit and withdrawal operations can be accurately identified, reducing the possibility of misjudgment.

[0056] By matching the original SMS messages with a pre-defined feature database of incoming and outgoing SMS messages using keywords and patterns, the rich keyword and pattern information in the database allows for more detailed classification and identification of the messages. The keywords and patterns in the feature database are derived from extensive data analysis and summarization, ensuring high accuracy and representativeness. Matching with the feature database accurately determines whether an SMS message is an incoming or outgoing message, as well as its specific transaction type and characteristics.

[0057] The probability of each SMS message being suspected is calculated based on the matching results, and high-probability samples are selected as the initial screening sample for suspected messages. This probability-based calculation method comprehensively considers multiple factors, such as keyword matching degree and pattern matching, to quantitatively assess the suspiciousness of SMS messages. Compared to simple binary classification methods, probability calculation can more accurately reflect the suspiciousness of SMS messages, improving the accuracy and reliability of screening.

[0058] In some embodiments, please refer to Figure 1 The steps for filtering the internet access records of suspected early adopters to identify users who frequently access the Sifangpay money laundering platform are as follows: Extract all accessed domain names and corresponding URLs from the internet access records of suspected groups in the initial screening, and output the domain name-URL dataset to be verified; The extracted domain names are matched with the known domain name database of the Sifang Payment money laundering platform, and a preliminary list of suspicious domain names that have been successfully matched is output. For domains that are successfully matched, further verify whether their URL paths and parameters match the characteristics of money laundering platforms, and output high-confidence suspicious access records; Count the frequency of each user's access to high-confidence URLs, filter high-frequency users, and output a list of users who frequently access the Sifang Payment money laundering platform.

[0059] For users meeting the conditions in step 1, query the domain names in their internet access records and crawl the content to determine whether they are from the Sifang Payment money laundering platform. For users confirmed in step 2 to have frequently accessed the Sifang Payment money laundering platform, output the amount of money involved, the active time, and the size of each money laundering den group based on the GeoHash raster clustering according to the SMS content, as shown in Table 3 below; Table 3

[0060] Some existing fourth-party payment platform channels are listed in Table 4 below. In addition, newly emerging high-frequency access URLs can be identified by crawling their source code to determine whether they are newly added fourth-party payment platform channels.

[0061] Table 4

[0062] First, domain names and corresponding URLs are extracted from internet access records to form a dataset to be verified. Then, this dataset is matched against a database of known money laundering platforms using third-party payment platforms. Next, the URL paths and parameters of successfully matched domains are further verified to ensure they match the characteristics of money laundering platforms. This multi-dimensional, progressive matching and verification method more accurately identifies access records truly related to money laundering activities, reduces the possibility of false positives, and improves the accuracy of identifying money laundering behavior.

[0063] For users who meet the initial criteria, their internet access records are queried, and content is crawled to determine whether they belong to the Sifang Payment money laundering platform. The crawler can obtain detailed page information for the domain, and by analyzing page content, structure, transaction patterns, and other characteristics, it can more deeply determine whether the domain belongs to a money laundering platform, further enhancing the accuracy of identifying money laundering activities.

[0064] The entire process can utilize automated tools and scripts to perform data extraction, matching, verification, and statistical analysis. Scripts written in programming languages ​​extract domain names and URLs from access records, use database query functions for domain name matching, and verify URL characteristics using regular expressions. This automated process can quickly process large amounts of data, significantly shortening investigation time, improving efficiency, and allowing investigators to focus their efforts on key suspicious individuals.

[0065] By analyzing the frequency of each user's visits to high-confidence URLs and filtering for high-frequency users, it's possible to quickly identify suspicious users who frequently interact with money laundering platforms. High-frequency visits often indicate a close connection between the user and the money laundering platform; focusing these users on key investigation targets narrows the scope of the investigation and improves its relevance and efficiency.

[0066] For users confirmed to frequently access the Sifang Payment money laundering platform, GeoHash raster clustering is used to output the flow of funds involved, activity time, and group size for each money laundering ring. This multi-dimensional information comprehensively reflects the operational characteristics and activity patterns of money laundering rings, providing strong support for a deeper understanding of the overall picture of money laundering activities. The flow of funds involved can reveal the direction and scale of fund flows, the activity time can reveal the time pattern of money laundering activities, and the group size can assess the strength and influence of the money laundering group.

[0067] In some embodiments, please refer to Figure 1 The steps for querying the fixed-line accounts accessed by users who frequently access the four-party payment money laundering platform during the same period are as follows: By associating the fixed-line accounts of users who frequently access the Sifang Payment money laundering platform, and based on the fixed-line access logs, an output account-suspicious access behavior mapping table is obtained; Statistically analyze the frequency of each fixed-line account accessing the Sifang Payment platform, filter frequently accessing accounts, and output the locations of high-risk fixed-line accounts.

[0068] In the home broadband fixed network access log, the domain name access records that were identified as the Sifang Payment money laundering platform in step 2 were screened to obtain the fixed network accounts that accessed such domain names within the same time period, as shown in Table 5 below; Table 5

[0069] This method for combating money laundering dens involves deep correlation and linkage across various data sources, linking SMS messages to accessed URLs and then to fixed-line broadband connections. Frequently received and sent SMS messages are clustered for initial identification and classification as money laundering dens. Further analysis is conducted on the frequently accessed URLs of users associated with these money laundering dens. Verifying whether these URLs belong to money laundering payment platforms is an indispensable step and a crucial step in confirming money laundering activities, significantly impacting the accuracy of the crackdown. For users frequently accessing specific websites, web crawlers can be used to obtain the webpage source code. Analysis of specific webpage elements, structure, and keywords is then performed. For example, in this invention, the management backend webpage of the Sifang Payment money laundering platform exhibits characteristics such as the keywords "LOGIN.pay." and "invitation_text".

[0070] The system associates the fixed-line accounts of users who frequently access the Sifang Payment money laundering platform with their accounts and generates an account-suspicious access behavior mapping table based on the fixed-line access logs. This process comprehensively analyzes the behavioral patterns of these suspicious users in different network environments, focusing not only on their activities on the Sifang Payment platform but also extending to their fixed-line access, thereby more accurately locating fixed-line accounts closely related to money laundering activities and avoiding overlooking potential money laundering-related clues.

[0071] By analyzing the frequency of visits to the 4PX payment platform by various fixed-line accounts, high-frequency access accounts can be filtered out. These accounts may appear normal on the surface but actually have frequent interactions with money laundering activities. These accounts could be important tools used by money laundering groups to conceal fund flows, divert attention, or conduct other illegal operations. This filtering method can uncover key connections hidden behind large amounts of data.

[0072] By screening access records of domains identified as money laundering platforms like Sifangpay in home broadband fixed-line network access logs, the scope of the investigation can be expanded from specific high-frequency users to a broader group of home broadband users. This helps to comprehensively understand the extent to which money laundering activities penetrate the home network environment, identify the home network resources that money laundering groups may utilize, and thus more comprehensively depict the geographical distribution and network coverage of money laundering activities.

[0073] In some embodiments, please refer to Figure 1 The steps for outputting base station locations through GeoHash raster clustering are as follows: Extract the original latitude and longitude coordinates of the base station recorded when receiving SMS messages, and output the structured base station location information; The latitude and longitude of the base station are converted using the GeoHash algorithm to generate raster code values ​​with corresponding precision, and the base station-GeoHash value mapping table is output. Spatial clustering analysis is performed on base stations based on GeoHash values, base stations in adjacent grids are merged, and a preliminary list of base station clusters is output. The system filters out areas in the base station cluster where the density exceeds a threshold, marks them as suspected hotspots, and outputs the final confirmed base station locations and clustering results.

[0074] The system extracts the raw latitude and longitude coordinates of the base station recorded when receiving SMS messages and outputs them as structured base station location information. The structured data format is uniform and standardized, facilitating subsequent storage, retrieval, and processing. Compared to unstructured data, structured information reduces data parsing and conversion time, improving data processing efficiency.

[0075] The geolocation of base stations is converted using the GeoHash algorithm to generate raster-coded values ​​with corresponding precision. The GeoHash algorithm encodes two-dimensional latitude and longitude coordinates into one-dimensional strings, exhibiting spatial locality and hierarchy. During spatial clustering analysis, the raster-coded values ​​can be directly compared and calculated, avoiding complex latitude and longitude distance calculations and significantly improving computational speed.

[0076] The GeoHash algorithm can select different precision levels to generate raster code values ​​of varying lengths based on actual needs. Choosing an appropriate precision ensures the accuracy of spatial analysis while avoiding problems such as excessively scattered data due to excessive precision or inaccurate analysis results due to excessively low precision. In urban environments, a higher precision can be selected to accurately distinguish base stations in different areas; while in vast rural areas, the precision can be appropriately reduced to improve computational efficiency.

[0077] GeoHash-based spatial clustering of base stations merges base stations within adjacent grids. This method considers the spatial adjacency between base stations, grouping geographically close base stations together to form base station clusters. Compared to simple distance-based clustering methods, GeoHash gridded clustering more accurately reflects the spatial distribution characteristics of base stations and reduces clustering errors caused by data noise or outliers.

[0078] In some embodiments, please refer to Figure 1 The steps for accurate positioning by combining base station location and fixed network account are as follows: By associating fixed-line accounts with base station locations, the delivery addresses for food delivery and express courier services in the area can be obtained, resulting in multi-source address data. Convert multi-source address data into structured coordinate data and output a standardized address coordinate library; By using geofencing to filter overlapping areas between fixed network accounts and base station locations within a preset range, high-confidence candidate coordinates of criminal activity sites are output.

[0079] By combining the above steps, the complete money laundering operation is produced by deeply linking various data sources, extending the crackdown to the last mile. The data output from the linkage of multiple data sources is shown in Table 6 below.

[0080] Table 6

[0081] To further improve the real-time dynamics of combating money laundering dens, the precise location of the dens can be confirmed by combining relevant food delivery and express delivery logistics information with fixed-line broadband data. This process is optional.

[0082] By linking fixed-line accounts and base station locations, and obtaining delivery addresses for food delivery and parcels in the area, multi-source address data is generated. Different data sources reflect activity information in the target area from different perspectives. For example, fixed-line accounts may reflect the user's network activity area, base station locations can determine the user's mobile communication coverage, and delivery addresses for food delivery and parcels directly point to specific physical locations. By comprehensively analyzing this data, cross-referencing and supplementing each other can reduce the errors and biases that may exist in a single data source, thereby improving the accuracy of location tracking.

[0083] After converting multi-source address data into structured coordinate data, geofencing technology is used to filter overlapping areas between fixed-line accounts and base station locations within a preset range. Geofencing can be configured with different ranges and shapes according to actual needs, accurately delineating areas where money laundering dens may exist. This precise filtering method avoids the problems of excessively large or small ranges in traditional positioning methods, making the output of high-confidence candidate coordinates for money laundering dens more accurate and reliable.

[0084] This disclosure provides a grid-based, multi-source, coordinated system for combating money laundering dens, such as... Figure 2 As shown, the system includes: The acquisition module 100 is configured to acquire data of suspicious users, enter the preset billing and billing SMS feature database, and obtain a preliminary sample of suspected groups. Access module 200 is configured to filter the internet access records of suspected groups in the initial screening to obtain users who frequently access the Sifang Payment money laundering platform. Location module 300 is configured to query the fixed network accounts accessed by users who frequently access the four-party payment money laundering platform during the same period, and output the base station location through GeoHash raster clustering. The positioning module 400 is configured to perform precise positioning by combining base station location and fixed network account.

[0085] This invention comprises a GeoHash clustering module for frequent incoming and outgoing SMS messages, a high-frequency access URL analysis result library, and a fixed-line broadband high-frequency access URL data module for the same period and region. It also includes two sub-modules: an incoming and outgoing SMS message feature recognition and modeling module, and a web crawler-based analysis and identification modeling module for money laundering platforms using third-party payment platforms. These modules are interconnected, and data sources are integrated and linked. It accurately locates money laundering dens in telecommunications fraud down to the building unit level, further improving the accuracy of traditional base station-level positioning to building-level positioning, reducing spatial distance from 1 kilometer to 1 meter. Compared to traditional passive identification of money laundering dens in telecommunications fraud, this invention proactively uncovers dens based on big data mining and analysis, achieving "early detection and broad coverage." The efficiency of autonomous discovery is improved by 30%. In the early stages of data mining, cleaning and analyzing SMS data reveals the scale of personnel involved in money laundering dens, daily money laundering transactions, and recent active locations, thus revealing the depth of the case.

[0086] The daily output of money laundering dens and the effectiveness of pushing deployment data are shown in Table 7: Table 7

[0087] This disclosure also provides an electronic device, including: at least one processor; a memory for storing processor-executable instructions; wherein the at least one processor is configured to execute the instructions to implement the methods disclosed in this disclosure.

[0088] Figure 3 This is a schematic diagram of the structure of an electronic device provided as an exemplary embodiment of this disclosure. For example... Figure 3 As shown, the electronic device 300 includes at least one processor 301 and a memory 302 coupled to the processor 301, which can perform the corresponding steps in the methods disclosed in the embodiments of this disclosure.

[0089] The processor 301 described above can also be called a central processing unit (CPU), which can be an integrated circuit chip with signal processing capabilities. Each step in the method disclosed in this embodiment can be implemented by the integrated logic circuitry in the processor 301 or by software instructions. The processor 301 can be a general-purpose processor, a digital signal processor (DSP), an ASIC (Application Specific Integrated Circuit), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this embodiment can be directly implemented by a hardware decoding processor, or by a combination of hardware and software modules in the decoding processor. The software modules can be located in the memory 302, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. The processor 301 reads information from the memory 302 and, in conjunction with its hardware, completes the steps of the method described above.

[0090] Furthermore, various operations / processes according to this disclosure, implemented via software and / or firmware, can be transmitted from a storage medium or network to a computer system with a dedicated hardware architecture, such as... Figure 4 The computer system 1900 shown is equipped with the programs that constitute the software. When various programs are installed, the computer system is able to perform various functions, including those described above. Figure 4 A block diagram of a computer system provided for an exemplary embodiment of this disclosure.

[0091] Computer System 1900 is intended to represent various forms of digital electronic computer devices, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. Electronic devices can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0092] like Figure 4As shown, the computer system 1900 includes a computing unit 1901, which can perform various appropriate actions and processes based on a computer program stored in a read-only memory (ROM) 1902 or a computer program loaded from a storage unit 1908 into a random access memory (RAM) 1903. The RAM 1903 may also store various programs and data required for the operation of the computer system 1900. The computing unit 1901, ROM 1902, and RAM 1903 are interconnected via a bus 1904. An input / output (I / O) interface 1905 is also connected to the bus 1904.

[0093] Multiple components in computer system 1900 are connected to I / O interface 1905, including: input unit 1906, output unit 1907, storage unit 1908, and communication unit 1909. Input unit 1906 can be any type of device capable of inputting information into computer system 1900. Input unit 1906 can receive input digital or character information and generate key signal inputs related to user settings and / or function control of the electronic device. Output unit 1907 can be any type of device capable of presenting information and may include, but is not limited to, a monitor, speaker, video / audio output terminal, vibrator, and / or printer. Storage unit 1908 may include, but is not limited to, hard disks and optical disks. Communication unit 1909 allows computer system 1900 to exchange information / data with other devices via a network such as the Internet, and may include, but is not limited to, modems, network cards, infrared communication devices, wireless communication transceivers, and / or chipsets, such as Bluetooth™ devices, WiFi devices, WiMax devices, cellular communication devices, and / or the like.

[0094] The computing unit 1901 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 1901 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 1901 performs the various methods and processes described above. In some embodiments, the methods disclosed in this disclosure can be implemented as a computer software program tangibly contained in a machine-readable medium, such as storage unit 1908. In some embodiments, part or all of the computer program can be loaded and / or installed on an electronic device via ROM 1902 and / or communication unit 1909. In some embodiments, the computing unit 1901 can be configured by any other suitable means (by means of firmware) to perform the methods disclosed in this disclosure.

[0095] This disclosure also provides a computer-readable storage medium, wherein when the instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is able to perform the methods disclosed in this disclosure.

[0096] The computer-readable storage medium in this disclosure can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. The aforementioned computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specifically, the aforementioned computer-readable storage medium may include electrical connections based on one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0097] The aforementioned computer-readable medium may be included in the aforementioned electronic device; or it may exist independently and not assembled into the electronic device.

[0098] This disclosure also provides a computer program product, including a computer program, wherein the computer program, when executed by a processor, implements the methods disclosed in the embodiments of this disclosure.

[0099] In embodiments of this disclosure, computer program code for performing the operations of this disclosure can be written in one or more programming languages ​​or a combination thereof. These programming languages ​​include, but are not limited to, object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network (including a local area network (LAN) or a wide area network (WAN)), or it can be connected to an external computer.

[0100] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. Two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0101] The modules, components, or units described in the embodiments of this disclosure can be implemented in software or hardware. The names of the modules, components, or units do not necessarily constitute a limitation on the module, component, or unit itself.

[0102] The functions described above in this document can be performed, at least in part, by one or more hardware logic components. Exemplary hardware logic components that may be used, without limitation, include: Field Programmable Gate Arrays (FPGAs), Application-Specific Integrated Circuits (ASICs), Application Standard Products (ASSPs), System-on-Chip (SoCs), Complex Programmable Logic Devices (CPLDs), and so on.

[0103] The above description is merely an embodiment of this disclosure and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of this disclosure is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-described concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features disclosed in this disclosure that have similar functions.

[0104] While specific embodiments of this disclosure have been described in detail by way of example, those skilled in the art should understand that the examples are for illustrative purposes only and not intended to limit the scope of this disclosure. Those skilled in the art should understand that modifications can be made to the above embodiments without departing from the scope and spirit of this disclosure. The scope of this disclosure is defined by the appended claims.

Claims

1. A grid-based, multi-source coordinated method for combating money laundering dens, characterized in that: The method includes: Data on suspicious users is obtained and entered into a pre-defined database of incoming and outgoing SMS features to obtain an initial sample of suspected users. The internet access records of suspected groups were screened to identify users who frequently accessed the Sifang Payment money laundering platform. For users who frequently access the Sifang Payment money laundering platform, query their fixed network accounts that accessed the platform at the same time, and output the base station location through GeoHash raster clustering. Accurate positioning is achieved by combining base station location and fixed network account.

2. The method according to claim 1, characterized in that, The process of constructing the billing and payment SMS feature database is as follows: Collect SMS data and use the inverse document frequency algorithm to perform preliminary word segmentation of the SMS messages to obtain the segmented word sequence; Based on the segmentation results, the invoice and billing SMS messages are classified and labeled to establish feature word libraries for the two types of SMS messages, resulting in a structured feature library. The SMS recognition model is trained using a feature library, and the classification parameters are optimized to obtain a well-trained model. The newly accumulated SMS input models from various banks are categorized, and the feature database of incoming and outgoing SMS messages is updated after verifying their accuracy.

3. The method according to claim 1, characterized in that, The steps for obtaining data on suspicious users, entering it into a preset billing and payment SMS feature database, and obtaining an initial screening sample of suspected users are as follows: User SMS data is obtained from multiple channels, and suspicious data containing keywords related to financial transactions is filtered out to obtain the raw SMS set to be analyzed. The original SMS messages are matched with the preset feature database of incoming and outgoing SMS messages by keywords and patterns, and a preliminary matching result list is output. The probability of each text message being suspected is calculated based on the matching results. High-probability samples are then selected to obtain a preliminary sample of suspected individuals.

4. The method according to claim 1, characterized in that, The steps for filtering the internet access records of suspected early adopters to identify users who frequently access the Sifangpay money laundering platform are as follows: Extract all accessed domain names and corresponding URLs from the internet access records of suspected groups in the initial screening, and output the domain name-URL dataset to be verified; The extracted domain names are matched with the known domain name database of the Sifang Payment money laundering platform, and a preliminary list of suspicious domain names that have been successfully matched is output. For domains that are successfully matched, further verify whether their URL paths and parameters match the characteristics of money laundering platforms, and output high-confidence suspicious access records; Count the frequency of each user's access to high-confidence URLs, filter high-frequency users, and output a list of users who frequently access the Sifang Payment money laundering platform.

5. The method according to claim 1, characterized in that, The steps for querying the fixed-line accounts of users who frequently access the four-party payment money laundering platform during the same period are as follows: By associating the fixed-line accounts of users who frequently access the Sifang Payment money laundering platform, and based on the fixed-line access logs, an output account-suspicious access behavior mapping table is obtained; Statistically analyze the frequency of each fixed-line account accessing the Sifang Payment platform, filter frequently accessing accounts, and output the locations of high-risk fixed-line accounts.

6. The method according to claim 1, characterized in that, The steps for outputting base station locations via GeoHash raster clustering are as follows: Extract the original latitude and longitude coordinates of the base station recorded when receiving SMS messages, and output the structured base station location information; The latitude and longitude of the base station are converted using the GeoHash algorithm to generate raster code values ​​with corresponding precision, and the base station-GeoHash value mapping table is output. Spatial clustering analysis is performed on base stations based on GeoHash values, base stations in adjacent grids are merged, and a preliminary list of base station clusters is output. The system filters out areas in the base station cluster where the density exceeds a threshold, marks them as suspected hotspots, and outputs the final confirmed base station locations and clustering results.

7. The method according to claim 1, characterized in that, The steps for accurate positioning by combining base station location and fixed network account are as follows: By associating fixed-line accounts with base station locations, the delivery addresses for food delivery and express courier services in the area can be obtained, resulting in multi-source address data. Convert multi-source address data into structured coordinate data and output a standardized address coordinate library; By using geofencing to filter overlapping areas between fixed network accounts and base station locations within a preset range, high-confidence candidate coordinates of criminal activity sites are output.

8. A grid-based, multi-source coordinated system for combating money laundering dens, characterized in that: The system includes: The acquisition module is configured to acquire data from suspicious users, input the data into a preset billing and payment SMS feature database, and obtain a preliminary sample of suspected users. The access module is configured to filter the internet access records of suspected groups in the initial screening to identify users who frequently access the Sifang Payment money laundering platform. The location module is configured to query the fixed network accounts accessed by users who frequently access the four-party payment money laundering platform during the same period, and output the base station location through GeoHash raster clustering; The positioning module is configured to perform precise positioning by combining base station location and fixed network account.

9. An electronic device, characterized in that, include: At least one processor; Memory for storing the at least one processor-executable instruction; The at least one processor is configured to execute the instructions to implement the method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, When the instructions in the computer-readable storage medium are executed by the processor of the electronic device, the electronic device is enabled to perform the method as described in any one of claims 1 to 7.

Images