Risk user identification method and device based on collection and distribution characteristics, and computer equipment

Abstract

The embodiment of the invention relates to the field of financial science and technology, in particular to a risk user identification method and device based on collection and distribution characteristics and computer equipment, and the method comprises the steps: obtaining transaction information of each user; determining a vector transaction net amount of each user based on the transaction information, wherein the vector transaction net amount comprises a transaction net amount of the user and each transaction opponent and a corresponding net amount flow direction; according to the vector transaction net amount, determining a collection and distribution feature of each user, the collection and distribution feature including a first transaction opponent number corresponding to a net amount inflow direction of the user and a second transaction opponent number corresponding to a net amount outflow direction of the user; and determining risk users according to the collection and distribution characteristics of the users. According to the embodiment of the invention, the problem of poor risk user identification effect in the existing transaction scene is solved.

Description

Technical Field

[0001] The embodiments in this specification relate to the field of financial technology, and in particular to a method, apparatus and computer equipment for identifying risky users based on clustered and distributed characteristics. Background Technology

[0002] Illegal transactions are characterized by their difficulty in identification, complexity, and high levels of technical sophistication and concealment, thus often operating in teams. Illegal transaction teams typically collaborate by dividing tasks, fully utilizing each member's expertise and resources to form a complete collaborative chain. As commercial banks become increasingly adept at identifying illegal activities, illegal transaction teams cunningly exploit existing identification mechanisms, often deliberately constructing fictitious transactions to conceal the illicit flow of funds, making it difficult to identify risky users engaging in illegal transactions from a massive volume of transactions. Summary of the Invention

[0003] This specification provides a method, apparatus, and computer device for identifying risky users based on aggregation and distribution characteristics, which is used to solve or at least partially solve the problem of poor risky user identification in existing transaction scenarios.

[0004] To address the aforementioned technical problems, a first aspect of the embodiments of this specification provides a risk user identification method based on distribution characteristics, the method comprising:

[0005] Obtain transaction information from each user;

[0006] Based on the transaction information, the vector transaction net amount for each user is determined. The vector transaction net amount includes the net transaction amount between the user and each trading counterparty and the corresponding net amount flow.

[0007] Based on the net amount of the vector transaction, the aggregation and distribution characteristics of each user are determined. The aggregation and distribution characteristics include the number of first trading counterparties corresponding to the net amount inflow direction and the number of second trading counterparties corresponding to the net amount outflow direction.

[0008] Based on the aggregation and dispersion characteristics of each user, risky users are identified.

[0009] Furthermore, based on the aggregation and distribution characteristics of each user, risky users are identified, including:

[0010] Calculate the first ratio of the number of the first trading counterparties to the number of the second trading counterparties, and identify users whose first ratio meets the first threshold range as risk users;

[0011] Calculate the second ratio of the number of the second trading counterparties to the number of the first trading counterparties, and identify the users whose second ratio meets the second threshold range as risk users.

[0012] Furthermore, after identifying high-risk users, the following also applies:

[0013] Retrieve user attributes for each user;

[0014] A knowledge graph is constructed based on the user attributes and the transaction information, and a connectivity algorithm is used to divide the knowledge graph into communities to obtain multiple team subgraphs.

[0015] The target team subgraph is filtered according to the preset filtering rules to obtain the risk team subgraph. The target team subgraph represents the team subgraph containing risky user nodes.

[0016] Based on the aforementioned risk team subgraph, other risky users are identified.

[0017] Furthermore, before filtering the target team subplot according to preset filtering rules, the following steps are taken:

[0018] Each of the risky user nodes in the target team subgraph is identified as a path source node;

[0019] Calculate the directional consistency index between the next path and the current path starting from each of the path source nodes, and determine the importance score of the next path based on the directional consistency index;

[0020] Based on the importance scores of each next path, the target team subgraph is pruned to obtain a target team subgraph with some user nodes removed.

[0021] Furthermore, before filtering the target team subplot according to preset filtering rules, the following steps are taken:

[0022] Each risk user node and its adjacent user nodes in the target team subgraph are identified as path source nodes;

[0023] Calculate the directional consistency index between the next path and the current path starting from each of the path source nodes, and determine the importance score of the next path based on the directional consistency index;

[0024] Based on the importance scores of each next path, the target team subgraph is pruned to obtain a target team subgraph with some user nodes removed.

[0025] Furthermore, the importance score of the next path is calculated according to the following formula:

[0026] ;

[0027] in, This represents the importance score of the next path i. This represents the consistency index between the direction of the next path i and the current path. A value of 1 indicates that the directions are the same. A value of 0 indicates that the directions are inconsistent. This represents the net similarity between the next path i and the current path. This indicates the similarity in transaction time between the next path i and the current path. This represents the distance between the next path i and the source node of the path. Indicate the centrality of the node corresponding to the next path i. , , , Indicates the weight.

[0028] Furthermore, ;

[0029] in, Indicates the next path Net transaction amount, Indicates the current path The net amount of transactions.

[0030] Furthermore, ;

[0031] in, Indicates the next path Transaction time and current path The absolute value of the difference in transaction time.

[0032] A second aspect of the embodiments of this specification provides a risk user identification device based on distributed characteristics, the device comprising:

[0033] The acquisition module is used to acquire transaction information from each user.

[0034] The first determining module is used to determine the vector transaction net amount of each user based on the transaction information. The vector transaction net amount includes the transaction net amount between the user and each trading counterparty and the corresponding net amount flow.

[0035] The second determining module is used to determine the aggregation and distribution characteristics of each user based on the net vector transaction amount. The aggregation and distribution characteristics include the number of first trading counterparties corresponding to the net inflow direction and the number of second trading counterparties corresponding to the net outflow direction.

[0036] The third determination module is used to determine risky users based on the aggregation and dispersion characteristics of each user.

[0037] A third aspect of the embodiments of this specification provides a computer device including a memory, a processor, and a computer program stored on the memory, wherein the computer program, when run by the processor, executes instructions of the risk user identification method based on distributed characteristics as described in any of the foregoing embodiments.

[0038] A fourth aspect of the embodiments of this specification provides a computer storage medium having a computer program stored thereon, wherein the computer program, when run by a processor of a computer device, executes instructions for the risk user identification method based on distributed characteristics described in any of the foregoing embodiments.

[0039] A fifth aspect of the embodiments of this specification provides a computer program product, the computer program product including a computer program, which, when run by a processor of a computer device, executes instructions for the risk user identification method based on distributed characteristics described in any of the foregoing embodiments.

[0040] The risk user identification method, apparatus, and computer equipment based on aggregation and dispersion characteristics provided in the embodiments of this specification determine the net transaction amount and net flow direction based on the user's transaction information. The vector net transaction amount composed of the net transaction amount and net flow direction can reliably reflect the transaction relationship and net fund flow direction between users, thereby effectively reducing the concealment of fraudulent transactions. By determining the number of trading counterparties in the net flow direction of users and trading counterparties, the number of trading counterparties in the net flow direction is determined, and the aggregation and dispersion characteristics of users are determined based on the number of trading counterparties in the two directions, thereby effectively identifying risk users based on aggregation and dispersion characteristics.

[0041] To make the above and other objects, features and advantages of the embodiments of this specification more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0042] To more clearly illustrate the technical solutions in the embodiments or prior art of this specification, the drawings used in the description of the embodiments or prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0043] Figure 1 A flowchart of a risk user identification method based on distributed characteristics, as illustrated in this specification, is shown.

[0044] Figure 2 This specification illustrates a flowchart of an embodiment for determining high-risk users based on the aggregation and distribution characteristics of each user.

[0045] Figure 3 This specification illustrates a flowchart after identifying risky users in an embodiment.

[0046] Figure 4 This specification shows a first flowchart before the target team subgraph is filtered according to preset filtering rules in an embodiment of the present specification;

[0047] Figure 5This specification shows a second flowchart before the target team subgraph is filtered according to preset filtering rules in an embodiment of the present specification;

[0048] Figure 6 This document illustrates a schematic diagram of distributed inbound and centralized outbound processes according to embodiments of this specification.

[0049] Figure 7 This document illustrates a schematic diagram of centralized import and decentralized export in embodiments of this specification.

[0050] Figure 8 A schematic diagram of node merging in an embodiment of this specification is shown;

[0051] Figure 9 A schematic diagram of the target team sub-diagram of an embodiment of this specification is shown;

[0052] Figure 10 A structural diagram of a risk user identification device based on distributed characteristics, as shown in an embodiment of this specification, is presented.

[0053] Figure 11 A structural diagram of a computer device according to an embodiment of this specification is shown.

[0054] Explanation of symbols in the attached drawings:

[0055] 1010. Acquisition Module;

[0056] 1020. First Determined Module;

[0057] 1030. Second Determination Module;

[0058] 1040. The third determination module;

[0059] 1102. Computer equipment;

[0060] 1104. Processor;

[0061] 1106. Memory;

[0062] 1108. Drive mechanism;

[0063] 1110. Input / output module;

[0064] 1112. Input devices;

[0065] 1114. Output devices;

[0066] 1116. Presentation device;

[0067] 1118. Graphical User Interface;

[0068] 1120. Network interface;

[0069] 1122. Communication link;

[0070] 1124. Communication bus. Detailed Implementation

[0071] The technical solutions in the embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this specification, and not all embodiments. Based on the embodiments in this specification, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the embodiments of this specification.

[0072] It should be noted that the terms "first," "second," etc., used in this specification, claims, and the foregoing drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, apparatus, product, or device that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or devices.

[0073] This specification provides the operational steps of the methods described in the embodiments or flowcharts, but based on conventional or non-inventive labor, more or fewer operational steps may be included. The order of steps listed in the embodiments is merely one possible execution order among many and does not represent the only possible execution order. In actual system or device products, the methods shown in the embodiments or drawings can be executed sequentially or in parallel.

[0074] It should be noted that the acquisition, storage, use, and processing of data in the technical solutions of the embodiments of this specification all comply with the relevant provisions of national laws and regulations.

[0075] It should be noted that in the embodiments of this specification, certain software, components, models and other existing solutions in the industry may be mentioned. These should be regarded as exemplary and are only intended to illustrate the feasibility of implementing the technical solutions of the embodiments of this specification. However, it does not mean that the applicant has used or necessarily used such solutions.

[0076] Against the backdrop of global economic integration and international capital flows, the financial system is becoming increasingly complex. Simultaneously, illegal transactions utilizing the financial system are exhibiting unprecedented complexity and concealment, making their identification and crackdown increasingly difficult. These illegal transactions often display a typical team-based pattern. Members of these teams have clear divisions of labor, each performing their specific duties, collectively building one or more complete chains of cooperation. From the initial acquisition and laundering of funds to the final transfer or use, each step is interconnected. Furthermore, as commercial banks become increasingly adept at identifying illegal activities, these teams cleverly exploit existing identification mechanisms, often deliberately constructing fictitious transactions to conceal the illicit flow of funds, making it difficult to identify risky users engaging in illegal transactions from a massive volume of transactions.

[0077] Therefore, in one embodiment of this specification, a risk user identification method based on aggregation and distribution characteristics is provided to solve the problem of poor risk user identification performance in existing transaction scenarios.

[0078] Specifically, such as Figure 1 As shown, risk user identification methods based on aggregation and distribution characteristics include:

[0079] Step 110: Obtain transaction information for each user;

[0080] Step 120: Determine the vector transaction net amount for each user based on the transaction information. The vector transaction net amount includes the transaction net amount between the user and each trading counterparty and the corresponding net amount flow.

[0081] Step 130: Determine the aggregation and distribution characteristics of each user based on the net vector transaction amount. The aggregation and distribution characteristics include the number of first trading counterparties corresponding to the net inflow direction and the number of second trading counterparties corresponding to the net outflow direction.

[0082] Step 140: Determine risky users based on the aggregation and distribution characteristics of each user.

[0083] This embodiment determines the net transaction amount and net flow direction based on the user's transaction information. The vector net transaction amount formed by the net transaction amount and net flow direction can reliably reflect the transaction relationship and net fund flow between users, thereby effectively reducing the concealment of fraudulent transactions. By determining the net flow direction relationship between users and their counterparties, the number of counterparties in the net flow direction and the number of counterparties in the net flow direction are determined. Based on the number of counterparties in the two directions, the user's aggregation and dispersion characteristics are determined, thereby effectively identifying risky users based on the aggregation and dispersion characteristics.

[0084] A user's transaction information includes the transaction amount, number of transactions, number of transaction days, transaction frequency, counterparty, transaction IP address, etc. Through the user's transaction information, the vector transaction net amount between the user and each counterparty can be determined. The vector transaction net amount includes the net amount of the user's transactions with each counterparty and the corresponding net amount flow. The transaction net amount can be understood as follows: if the total funds flowing from user A to user B is 1 million, and the total funds flowing from user B to user A are 800,000, then the net amount of user A's transaction with counterparty B is 200,000, and the net amount flow is from A to B, so the vector transaction net amount is 200,000. If the net amount of user B's transaction with counterparty A is 200,000, and the net amount flow is from A to B, then the vector transaction net amount is -200,000.

[0085] In some embodiments of this specification, the net amount of vector transactions between users may be 0. In this case, the direction of the net amount flow cannot be determined. Since the transaction relationship between these users still contains certain information, in order to retain this information, the direction of the last transaction during the period can be taken as the direction of the net amount flow, or the direction of the first transaction can be taken as the direction of the net amount flow. This specification does not limit the embodiments.

[0086] By determining the net amount of vector transactions, the flow of funds can be reflected. No matter how many fake transactions are constructed between illegal users (i.e., using legitimate behaviors such as shopping, paying rent, borrowing, and repaying loans to cover up illegal transactions), the true nature of the flow of funds will not be concealed. Therefore, using the net amount of vector transactions to determine the flow of funds is very suitable for uncovering potential illegal transaction teams.

[0087] In the embodiments of this specification, through the study of the historical performance of illegal trading teams, it was found that there are some typical characteristic users within these teams. These typical characteristic users exhibit a clustering and dispersing characteristic with all trading counterparties. This clustering and dispersing characteristic is manifested in the relationship between the number of first trading counterparties corresponding to net inflows and the number of second trading counterparties corresponding to net outflows. When the number of first trading counterparties is greater than the number of second trading counterparties, it can be understood that the typical characteristic user has a clustering and dispersing characteristic of dispersed inflows and concentrated outflows, such as... Figure 6 As shown, user D has 4 first-order counterparties, including E1, E2, E3, and E4, and 2 second-order counterparties, including C2 and C5. When the number of second-order counterparties is greater than the number of first-order counterparties, it can be understood that this typical user has a concentrated inflow and dispersed outflow characteristic, such as... Figure 7 As shown, user B has 2 first trading counterparties, including A1 and A2, and 4 second trading counterparties, including C1, C2, C3 and C4.

[0088] By calculating the aggregation and dispersion characteristics of each user, it is possible to quickly determine whether the current user is a typical user, thereby identifying high-risk users. In one embodiment of this specification, as shown... Figure 2 As shown, based on the aggregation and distribution characteristics of each user, high-risk users are identified, including:

[0089] Step 210: Calculate the first ratio of the number of the first trading counterparties to the number of the second trading counterparties, and identify the users corresponding to the first ratio that meets the first threshold range as risk users;

[0090] Step 220: Calculate the second ratio of the number of the second trading counterparties to the number of the first trading counterparties, and identify the users corresponding to the second ratio that meet the second threshold range as risk users.

[0091] In this embodiment, a first ratio and a second ratio are constructed by the number of first trading counterparties and the number of second trading counterparties, respectively. The first ratio and the second ratio are judged by the first threshold range and the second threshold range. Users whose first ratio meets the first threshold range or whose second ratio meets the second threshold range are identified as risk users, thereby improving the accuracy of risk user identification.

[0092] When a user's first ratio is greater than 1, it indicates that the user exhibits a dispersed inflow and concentrated outflow characteristic. When a user's second ratio is greater than 1, it indicates that the user exhibits a concentrated inflow and dispersed outflow characteristic. When either the first or second ratio exceeds a certain threshold, it indicates that the user has a significant dispersed characteristic and can therefore be considered a risky user. However, when either the first or second ratio is too large, the user loses its risky user characteristics. This is because users with larger ratios are generally government agencies, institutions, schools, etc., while risky users are often concealed. When the ratio is too large, their exposure risk increases significantly. Furthermore, users with large first or second ratios have a large number of trading counterparties, and including them in calculations or investigations would incur excessive identification costs. Therefore, such users should not be considered risky users. Thus, the first and second ratios should be within the threshold range. The specific first and second threshold ranges can be set based on experience, and this specification does not limit them in the embodiments.

[0093] Considering that government agencies, banks, schools, and other similar entities have lower risk profiles, users of this type can be excluded before calculating the net vector transaction amount for each user, in order to reduce subsequent screening costs.

[0094] In some embodiments of this specification, after identifying users who meet the threshold range, a second round of verification is performed by calculating the user's transaction interval to further improve the accuracy of identifying risky users. The value when Users are considered at risk only when the value is less than a preset value. The preset value can be set according to different application scenarios, such as 1 day or 1 hour. This specification does not limit the implementation of the example.

[0095] After two rounds of verification, the accuracy of identifying risky users has increased significantly. To further reduce identification errors, this specification also provides a three-round verification method, which calculates the ratio of the amount a user remits to the amount they remit. Only when the ratio meets the third threshold range is the user considered a risky user. The third threshold range is the range with 1 as the midpoint and the left and right endpoints close to each other, to ensure that the ratio is close to 1 when the three-round verification is passed.

[0096] In another embodiment of this specification, such as Figure 3 As shown, after identifying high-risk users, the following steps are also included:

[0097] Step 310: Obtain the user attributes of each user;

[0098] Step 320: Construct a knowledge graph based on the user attributes and the transaction information, and use a connectivity algorithm to divide the knowledge graph into communities to obtain multiple team subgraphs;

[0099] Step 330: Filter the target team subgraph according to the preset filtering rules to obtain the risk team subgraph, wherein the target team subgraph represents the team subgraph containing risky user nodes;

[0100] Step 340: Based on the risk team subgraph, identify other risk users.

[0101] This embodiment constructs a knowledge graph based on user attributes and transaction information, and uses a connectivity algorithm to divide the knowledge graph into multiple team subgraphs. Then, the team subgraph containing risk user nodes is identified as the target team subgraph, and is filtered according to preset filtering rules to obtain risk team subgraphs. Finally, other risk users are identified based on the risk team subgraphs, which improves the identification range and efficiency of risk users.

[0102] User attributes include username, user type, user account, user source, industry, address, etc., which can be used as entity attributes. Transaction information serves as relational attributes. A knowledge graph is constructed using user attributes and transaction information, linking all users together. A connectivity algorithm is then used to divide the knowledge graph, resulting in multiple team subgraphs with inter-transactional relationships. When a team subgraph contains a risky user node, that team subgraph can be designated as the target team subgraph. Figure 9 As shown, white dots represent user nodes, black dots represent risky user nodes, and team subgraphs containing risky user nodes are identified as target team subgraphs. Since illegal transactions are mostly team-based, further identification of these target team subgraphs using preset filtering rules can determine risky team subgraphs and find other related risky users, thereby reducing the omission of risky users.

[0103] Although the target team subgraph contains risky users, it is still a maximal subgraph. Directly identifying risky users within the target team subgraph requires significant time and computational resources. Therefore, in one embodiment of this specification, as follows... Figure 4 As shown, before filtering the target team sub-graph according to the preset filtering rules, the following steps are taken:

[0104] Step 410: Determine each of the risk user nodes in the target team subgraph as the path source node;

[0105] Step 420: Calculate the directional consistency index between the next path and the current path starting from each of the path source nodes, and determine the importance score of the next path based on the directional consistency index.

[0106] Step 430: Based on the importance scores of each next path, prune the target team subgraph to obtain a target team subgraph with some user nodes removed.

[0107] In this embodiment, risk nodes are identified as path source nodes, and importance scores for each path are calculated based on the path source nodes. The target team subgraph is pruned according to the importance scores, thereby reducing the structure of the target team subgraph and improving the identification efficiency of risky users.

[0108] By calculating the net flow of funds in the current path of the source node and the net flow of funds in the next path of the current path, the direction consistency index can be determined. When the directions are consistent, the direction consistency index can be 1, indicating that the next path and the current path may belong to the same funding chain. When the directions are inconsistent, the direction consistency index can be 0, thereby cutting off the current path.

[0109] Additionally, an importance score threshold can be set to prune paths with scores below the threshold, or a number of paths can be set to retain to prune paths with scores below the number of paths to retain.

[0110] Since user nodes directly adjacent to high-risk user nodes also possess high risk, therefore, in one embodiment of this specification, as... Figure 5 As shown, before filtering the target team sub-graph according to the preset filtering rules, the following steps are taken:

[0111] Step 510: Determine each risk user node and its adjacent user nodes in the target team subgraph as the path source node;

[0112] Step 520: Calculate the directional consistency index between the next path and the current path starting from each of the path source nodes, and determine the importance score of the next path based on the directional consistency index.

[0113] Step 530: Based on the importance scores of each next path, prune the target team subgraph to obtain a target team subgraph with some user nodes removed.

[0114] In this embodiment, risk nodes and their adjacent user nodes are all identified as path source nodes. The importance score of each path is calculated based on the path source nodes. The target team subgraph is pruned according to the importance score, thereby reducing the structure of the target team subgraph and improving the identification efficiency of risk users.

[0115] by Figure 6 For example, when user node D is a risky user node, the adjacent nodes E1, E2, E3, E4, C2, and C5 can all be used as path source nodes. Taking E1 as an example, the current path of E1 is the path from E1 to D. The other path connected to E1 can be used as the next path, and the direction consistency index between the next path and the current path can be calculated.

[0116] To avoid duplicate calculation of some path source nodes, in some embodiments of this specification, risky user nodes with the same adjacent nodes are merged, such as... Figure 6 and Figure 7 As shown, risky user node D and risky user node B have the same adjacent node C2. Therefore, it can be... Figure 6 and Figure 7 Merge, and obtain Figure 8 In this case, when calculating the adjacent nodes of node B, nodes D, C5, E1, E2, E3, and E4 can be added together as path source nodes. Alternatively, when calculating the adjacent nodes of node D, nodes B, C1, C3, C4, A1, and A2 can be added together as path source nodes, thereby removing computational redundancy and improving computational efficiency.

[0117] In another embodiment of this specification, the importance score of the next path can be calculated according to the following formula:

[0118] ;

[0119] in, This represents the importance score of the next path i. This represents the consistency index between the direction of the next path i and the current path. A value of 1 indicates that the directions are the same. A value of 0 indicates that the directions are inconsistent. This represents the net similarity between the next path i and the current path. This indicates the similarity in transaction time between the next path i and the current path. This represents the distance between the next path i and the source node of the path. Indicate the centrality of the node corresponding to the next path i. , , , This represents the weight, which can be determined according to actual needs.

[0120] The above formula uses the directional consistency index. Net similarity Transaction time similarity ,distance and centrality The importance score of the next path is calculated jointly, thereby improving the effectiveness of the score calculation through multiple evaluation dimensions. Among these, The value can be determined based on the number of paths between the current node and the source node or the number of nodes between them.

[0121] In some embodiments, net similarity ;

[0122] in, Indicates the next path Net transaction amount, Indicates the current path The net amount of transactions.

[0123] ;

[0124] in, Indicates the next path Transaction time and current path The absolute value of the difference in transaction time.

[0125] In one specific embodiment of this specification, a one-month user transaction history is used as the basis, with users as entities and net transaction amount as the basis for constructing a directed knowledge graph. Entity attributes include: uid (primary key), bank number, user number, user name, user type, first-level branch name, branch number, date of birth (registration), province of birth (registration), user creation date, user's reserved mobile phone number, user's reserved address, user source, user gender (individual), account, enterprise credit code (company user), user manager number, occupation (individual) / industry (company), number of times the user has reported to regulators in the past, number of times the user has triggered rule warnings in the past, number of times the user has been involved in risk events in the past, user's machine learning model risk score, user's anti-money laundering system risk rating, user's total transaction amount, and user's total number of transactions. Relationship attributes include: relationship primary key, starting entity user number, ending entity user number, starting entity name, ending entity name, starting entity type, ending entity type, net transaction amount (in RMB), last transaction timestamp, number of transaction days, transaction frequency, transaction IP address, transaction MAC address, etc.

[0126] Simultaneously, transactions containing the following terms will be removed: "Housing Provident Fund Center", "Public Security Bureau", "Finance Bureau", "China Sports Lottery", "China Welfare Lottery", "China Unicom", "China Mobile", "China Telecom", "PetroChina", "Sinopec", "Bank", "Insurance", "Securities", "Futures", "Trust", "Wealth Management", "Natural Gas Company", "State Grid", "Hospital", "Public Transportation", "Enterprise Annuity", "Water Affairs", "Expressway", "Fund Management", "University", and "Tap Water". Unsustainable transactions will also be removed: transactions involving salary payments, loan repayments, wealth management dividends, wealth management maturity, redemption, wealth management transfer, wealth management order cancellation, liquidation, and overdraft completion will be removed; transactions involving second-hand housing, demolition compensation, reimbursements, and bonuses will be removed; and non-active transactions such as bulk interest settlement, account closure, and maturity rollover will be removed. Finally, "dirty" data will be removed: data with empty counterparty or user numbers, empty transaction amounts, and empty loan / borrowing identifiers will be removed.

[0127] Thus, based on one month's transaction volume and approximately 3 billion basic data points, after removing nodes with more than 100 related nodes, 27 million entities and 16 million relationships were processed. The final statistical results are shown in Table 1.

[0128] Table 1

[0129]

[0130] Subsequently, 1687 target team subgraphs were mined using the methods described in the embodiments of this specification, and group evaluation was used to calculate the scores of the target team subgraphs. The designed group evaluation index is as follows:

[0131] Number of group entities, number of users within the group, number of users who have reported in the group in the past, percentage of users who have reported in the group in the past, number of users who have received warnings in the group in the past, percentage of users who have received warnings in the group in the past, total transaction amount of the group, total number of transactions in the group, total number of transaction days in the group, number of low-to-medium risk users in the group, percentage of low-to-medium risk users in the group, average machine learning score of the group, minimum machine learning score of the group, maximum machine learning score of the group, number of users with a machine learning score >0.9 in the group, percentage of users with a machine learning score >0.9 in the group, group reporting rate, and group novelty detection rate.

[0132] Table 2 shows the group evaluation metrics for a specific target team subgraph obtained based on group evaluation:

[0133] Table 2

[0134]

[0135] The group reporting rate refers to the percentage of risky users identified by this invention within a group who have confirmed anomalies and reported them, reflecting the accuracy of the group's risk assessment. The group novelty identification rate refers to the percentage of newly identified anomaly users within a group who are also identified by this invention. Screening personnel can process discovered cases based on actual work situations to filter information from groups of interest. For example, focusing on "more than one user in the group with a machine learning score exceeding 0.9" or "more than one user in the group who has reported historically" indicates the presence of risky users within the group who have direct or indirect financial transaction relationships with other users. Using the visualization function of the graph, these risky users can be directly located and investigated. Alternatively, focusing on "the number of low-to-medium risk users in the group" or the "group novelty identification rate" reflects the number of previously undiscovered suspicious users within the group, meaning the graph model supplements the risk identification capability.

[0136] It should be noted that the risk user identification method provided in the embodiments of this specification has the following advantages:

[0137] (1) The improved intuitiveness and timeliness of investigation brought about by graphical visualization:

[0138] The identification method provided in this manual utilizes the visualization properties of graphs to clearly identify how funds flow within a team and which nodes have clear financial relationships. Existing conventional methods typically require personnel to analyze structured data using Excel or SQL. In the example provided, there are over 400 unprocessed transaction records. Such a data scale would be disastrous and uncheckable for case identification personnel, requiring them to query user information, transaction status, and construct transaction graphs, necessitating several days of continuous analysis. However, the identification method provided in this manual allows risk control personnel without any technical background to identify risky users in a short time, thus significantly improving timeliness. Furthermore, the identification method provided in this manual can also help identification personnel uncover potential risky users, providing a foundation for analyzing complex trading teams.

[0139] (2) Explainable generation of illicit trading teams:

[0140] In the methodology of graph mining, a significant drawback of traditional shallow graph computation based on connectivity algorithms is its inability to address the poor interpretability of graph mining. Specifically, it struggles to determine why users are grouped into a particular team, and why users with other connections are not grouped together – information crucial for screening personnel. However, the identification method provided in this manual easily reveals the reasons why users are grouped into a trading team. Based on the graph, the flow of funds between them, or the dispersion and aggregation of funds, can be traced.

[0141] Therefore, the identification method provided in this manual can intuitively reflect the reasons why a user is classified as a trading team, achieving what you see is what you get. This breaks through the limitations of poor interpretability in traditional shallow graph calculations, enhances the understanding and confidence of non-technical personnel in advanced science and technology, and promotes digital development.

[0142] (3) The possibility of providing complex team case studies:

[0143] The reason why traditional methods are difficult to identify illegal trading teams is mainly because

[0144] First, the underlying data is too vast for manual analysis. Commercial banks handle billions or more transactions per month, making it extremely difficult to directly identify the transactions involved by a specific trading team.

[0145] Second, risky users are cunning, deliberately creating transactions to conceal their risky behavior. Illegal transactions are highly difficult to detect and conceal. With current payment methods, risky users are very familiar with the characteristics of existing identification methods and thus circumvent them. Team members continuously lay the groundwork in actual operation, using existing early warning and detection mechanisms to disguise their illegal transaction behavior, making them extremely difficult to identify.

[0146] Third, the funding chain breaks down, making further investigation impossible. Risky users may use external contacts to disrupt commercial banks' ability to trace funds, thus making investigation impossible.

[0147] Fourth, the limitations of a single perspective make it difficult to cover organized trading teams. Typically, screening personnel begin by identifying individual users, then use the relationships between these users and other users to uncover risky trading teams. This approach is clearly limited, failing to capture the team behavior of indirectly identified or unidentified problematic users.

[0148] In summary, illegal trading teams utilize tacit division of labor and cunning strategies to evade existing detection mechanisms. The identification method provided in this manual offers a solution to these difficulties, taking a holistic perspective to avoid the limitations of a single viewpoint; it uses net cash flow as a key piece of information to meticulously analyze the situation, overcoming the impact of false information and massive amounts of data on the analysis; and it enables the tracking of broken cash flows across branch locations and institutions.

[0149] (4) Accurately identify complex trading teams

[0150] In the process methodology of graph mining, traditional graph computation methods, after community segmentation, cannot qualitatively analyze teams, i.e., they cannot determine whether the teams identified by the algorithm are suspicious. A common solution is to determine thresholds based on designed group indicators after team segmentation, and then use these thresholds to define whether a team is suspicious. This approach essentially nests a layer of rules within graph mining, resulting in a one-size-fits-all approach to the samples and poor accuracy. This is because connectivity-based algorithms are not designed to identify risky teams, but rather to segment communities, relying on the closeness of members within a community and the differences between members and those outside the community. A community, by its very nature, is a community and does not possess risky business attributes; therefore, the results of such algorithms are not suitable for direct application to risk assessment.

[0151] The identification method provided in this manual is built from risk business points and is based on the abnormal capital structure summarized from actual cases. What you see is what you get, and it does not rely on the threshold limitation of group indicators. It is more suitable for risk control scenarios and has a higher identification accuracy.

[0152] Based on the same inventive concept, this specification also provides a risk user identification device based on clustered characteristics, as described in the following embodiments. Since the principle of the risk user identification device based on clustered characteristics is similar to that of the risk user identification method based on clustered characteristics, the implementation of the risk user identification device based on clustered characteristics can refer to the risk user identification method based on clustered characteristics; repeated details will not be elaborated further.

[0153] Specifically, such as Figure 10 As shown, the risk user identification device based on clustered and distributed characteristics includes:

[0154] Module 1010 is used to obtain transaction information from each user;

[0155] The first determining module 1020 is used to determine the vector transaction net amount of each user based on the transaction information. The vector transaction net amount includes the transaction net amount between the user and each trading counterparty and the corresponding net amount flow direction.

[0156] The second determining module 1030 is used to determine the aggregation and distribution characteristics of each user based on the vector transaction net amount. The aggregation and distribution characteristics include the number of first trading counterparties corresponding to the net amount inflow direction and the number of second trading counterparties corresponding to the net amount outflow direction.

[0157] The third determination module 1040 is used to determine risky users based on the aggregation and dispersion characteristics of each user.

[0158] The risk user identification method, apparatus, and computer equipment based on aggregation and dispersion characteristics provided in the embodiments of this specification determine the net transaction amount and net flow direction based on the user's transaction information. The vector net transaction amount composed of the net transaction amount and net flow direction can reliably reflect the transaction relationship and net fund flow direction between users, thereby effectively reducing the concealment of fraudulent transactions. By determining the number of trading counterparties in the net flow direction of users and trading counterparties, the number of trading counterparties in the net flow direction is determined, and the aggregation and dispersion characteristics of users are determined based on the number of trading counterparties in the two directions, thereby effectively identifying risk users based on aggregation and dispersion characteristics.

[0159] In one embodiment of this specification, a computer device is also provided for implementing the methods described in any of the above embodiments, such as... Figure 11 The diagram illustrates the structure of a computer device according to an embodiment of this specification. The computer device 1102 may include one or more processors 1104, such as one or more central processing units (CPUs), each of which may implement one or more hardware threads. The computer device 1102 may also include any memory 1106 for storing information of any kind, such as code, settings, data, etc. Without limitation, for example, the memory 1106 may include any type of RAM, any type of ROM, flash memory, hard disk, optical disk, etc. More generally, any memory can use any technology to store information. Furthermore, any memory may provide volatile or non-volatile retention of information. Furthermore, any memory may represent a fixed or removable component of the computer device 1102. In one case, when the processor 1104 executes associated instructions stored in any memory or combination of memories, the computer device 1102 may perform any operation of the associated instructions. The computer device 1102 also includes one or more drive mechanisms 1108 for interacting with any memory, such as hard disk drive mechanisms, optical disk drive mechanisms, etc.

[0160] Computer device 1102 may also include an input / output module 1110 (I / O) for receiving various inputs (via input device 1112) and providing various outputs (via output device 1114). A specific output mechanism may include a presentation device 1116 and an associated graphical user interface (GUI) 1118. In other embodiments, the input / output module 1110 (I / O), input device 1112, and output device 1114 may be omitted, and the device may function solely as a computer device within a network. Computer device 1102 may also include one or more network interfaces 1120 for exchanging data with other devices via one or more communication links 1122. One or more communication buses 1124 couple the components described above together.

[0161] Communication link 1122 can be implemented in any way, such as via a local area network, a wide area network (e.g., the Internet), a point-to-point connection, or any combination thereof. Communication link 1122 may include any combination of hardwired links, wireless links, routers, gateway functions, name servers, etc., governed by any protocol or combination of protocols.

[0162] Corresponding to Figures 1 to 5 In addition to the methods described above, embodiments of this specification also provide a computer-readable storage medium storing a computer program that, when executed by a processor, performs the steps of the methods described above.

[0163] This specification also provides computer-readable instructions, wherein when a processor executes the instructions, the program therein causes the processor to perform the following... Figures 1 to 5 The method shown.

[0164] It should be understood that in the various embodiments of this specification, the sequence number of each process does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this specification.

[0165] It should also be understood that, in the embodiments of this specification, the term "and / or" is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Additionally, the character " / " in this specification generally indicates that the preceding and following related objects have an "or" relationship.

[0166] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed in this specification can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of each example have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of the embodiments in this specification.

[0167] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0168] In the several embodiments provided in this specification, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the couplings or direct couplings or communication connections shown or discussed may be indirect couplings or communication connections through some interfaces, devices, or units, or they may be electrical, mechanical, or other forms of connection.

[0169] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of the embodiments described in this specification, depending on actual needs.

[0170] Furthermore, the functional units in the various embodiments of this specification can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0171] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the embodiments of this specification, in essence, or the parts that contribute to the prior art, or all or part of the technical solutions, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this specification. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0172] This specification uses specific embodiments to illustrate the principles and implementation methods of this specification. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of the embodiments in this specification. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the embodiments in this specification. Therefore, the content of this specification should not be construed as a limitation on the embodiments in this specification.

Claims

1. A risk user identification method based on a scatter feature, characterized in that, The method comprises: obtaining transaction information of each user; determining a vector transaction net amount of each user based on the transaction information, the vector transaction net amount comprising a transaction net amount of the user with each counterparty and a corresponding net amount flow direction; determining a concentration and dispersion feature of each user according to the vector transaction net amount, the concentration and dispersion feature comprising a first number of counterparty corresponding to a net amount inflow direction of the user and a second number of counterparty corresponding to a net amount outflow direction of the user; determining a risk user according to the concentration and dispersion feature of each user.

2. The method of claim 1, wherein, Determining a risk user according to the concentration and dispersion feature of each user comprises: calculating a first ratio of the first number of counterparty to the second number of counterparty, and determining a user corresponding to a first ratio meeting a first threshold range as a risk user; calculating a second ratio of the second number of counterparty to the first number of counterparty, and determining a user corresponding to a second ratio meeting a second threshold range as a risk user.

3. The method of claim 1, wherein, After determining a risk user, the method further comprises: obtaining user attributes of each user; constructing a knowledge graph according to the user attributes and the transaction information, and performing community division on the knowledge graph by using a connectivity algorithm to obtain a plurality of team subgraphs; screening a target team subgraph according to a preset screening rule to obtain a risk team subgraph, the target team subgraph representing a team subgraph containing a risk user node; determining other risk users based on the risk team subgraph.

4. The method of claim 3, wherein, Before screening a target team subgraph according to a preset screening rule, the method comprises: determining each risk user node in the target team subgraph as a path source node; calculating a direction consistency index of a next path and a current path from each path source node, and determining an importance score of the next path according to the direction consistency index; pruning the target team subgraph according to the importance score of each next path to obtain a target team subgraph from which part of user nodes are removed.

5. The method of claim 3, wherein, Before screening a target team subgraph according to a preset screening rule, the method comprises: determining each risk user node and its adjacent user node in the target team subgraph as a path source node; calculating a direction consistency index of a next path and a current path from each path source node, and determining an importance score of the next path according to the direction consistency index; pruning the target team subgraph according to the importance score of each next path to obtain a target team subgraph from which part of user nodes are removed.

6. The method of claim 4 or 5, wherein, The importance score of the next path is calculated according to the following formula: ； wherein, denotes the importance score of the next path i, denotes the direction consistency indicator of the next path i with the current path, with a value of 1 indicating direction consistency, with a value of 0 indicating direction inconsistency, denotes the net amount similarity of the next path i with the current path, denotes the transaction time similarity of the next path i with the current path, denotes the distance of the next path i from the path source node, denotes the centrality of the next path i corresponding node, , , , denotes the weight.

7. The method of claim 6, wherein, ； wherein, represents the transaction net amount of the next path , represents the transaction net amount of the current path .

8. The method of claim 6, wherein, ； wherein, represents the absolute value of the difference between the transaction time of the next path and the transaction time of the current path .

9. A risk user identification device based on a scatter feature, characterized by, The device comprises: an acquisition module configured to obtain transaction information of each user; a first determination module configured to determine a vector transaction net amount of each user based on the transaction information, the vector transaction net amount comprising a transaction net amount of the user with each counterparty and a corresponding net amount flow direction; a second determination module configured to determine a concentration and dispersion feature of each user according to the vector transaction net amount, the concentration and dispersion feature comprising a first number of counterparty corresponding to a net amount inflow direction of the user and a second number of counterparty corresponding to a net amount outflow direction of the user; a third determination module configured to determine a risk user according to the concentration and dispersion feature of each user.

10. A computer device, comprising: The computer device comprises a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the method in any one of claims 1 to 8 when executing the computer program.

11. A computer readable storage medium, characterized in that, The computer readable storage medium stores a computer program, and the computer program is executed by the processor of the computer device to implement the method in any one of claims 1 to 8.

12. A computer program product, characterised in that, The computer program product comprises a computer program, and the computer program is executed by the processor of the computer device to implement the method in any one of claims 1 to 8.

Images