Group abnormal transaction behavior identification method and device, medium and electronic equipment

Abstract

This application discloses a method, apparatus, medium, and electronic device for identifying abnormal group transaction behavior. The method includes: constructing a transaction entity topology based on transaction description data of a target transaction entity and related transaction entities; binning transaction features of each transaction entity in the transaction entity topology based on the transaction description data of each transaction entity in the transaction entity topology, and determining a binning embedding vector for each transaction entity in the transaction entity topology; determining the group transaction characteristics of the transaction entity topology based on the set of transaction entities corresponding to the transaction entity topology, the transaction relationship between any two transaction entities in the transaction entity topology, and the binning embedding vectors corresponding to each transaction entity in the transaction entity topology; and determining the abnormal risk score of the target transaction entity based on the risk characteristics of the target transaction entity and the group transaction characteristics of the transaction entity topology. Implementing the technical solution of this application can achieve a more accurate and comprehensive assessment of abnormal transaction risks.

Description

Technical Field

[0001] This application relates to the technical field at the intersection of financial technology and artificial intelligence, and in particular to a method, device, medium and electronic device for identifying abnormal group trading behavior. Background Technology

[0002] With the accelerated digitalization of financial transactions and the widespread application of technologies such as credit cards, electronic payments, and blockchain, the scale and complexity of transactions have surged, making the risk of organized and concealed fraud increasingly prominent. Such risky behaviors typically involve multiple entities collaborating through complex transaction relationships, such as using frequent small-amount, cross-border transactions to conceal the flow of illicit funds, posing a serious challenge to financial security and regulation.

[0003] Currently, mainstream risk identification methods mainly focus on isolated analysis of transaction description data of individual transaction entities, or rely on simple rules and static models. These existing technologies are unable to effectively model the complex network of relationships between transaction entities, and therefore cannot accurately capture the characteristics of group transactions involving coordinated fraud, resulting in a high false negative rate. Static models cannot adapt to the rapidly evolving nature of fraud patterns, and their accuracy declines significantly over time. Furthermore, when faced with massive amounts of transaction data, existing methods are inefficient in terms of transaction feature extraction and computation, making it difficult to meet real-time risk control requirements. Finally, their feature extraction capabilities are insufficient, making it difficult to extract deep, structured risk information from the transaction entity topology. Summary of the Invention

[0004] This application provides a method, apparatus, medium, and electronic device for identifying abnormal group transaction behavior. By integrating the individual risk characteristics of the target transaction entity and the group behavior characteristics of its associated transaction network, it achieves a more accurate and comprehensive assessment of abnormal transaction risks.

[0005] According to a first aspect of this application, a method for identifying abnormal group transaction behavior is provided, the method comprising:

[0006] A transaction entity topology is constructed based on the transaction description data of the target transaction entity and related transaction entities; wherein, the related transaction entities are transaction entities that have a transaction relationship with the target transaction entity;

[0007] Based on the transaction description data of each transaction entity in the transaction entity topology, transaction feature binning is performed on each transaction entity in the transaction entity topology, and a binning embedding vector is determined for each transaction entity in the transaction entity topology.

[0008] Based on the set of transaction entities corresponding to the transaction entity topology, the transaction relationship between any two transaction entities in the transaction entity topology, and the binning embedding vector corresponding to each transaction entity in the transaction entity topology, the group transaction characteristics of the transaction entity topology are determined.

[0009] Based on the risk characteristics of the target trading entity and the group trading characteristics of the trading entity topology, the abnormal risk score of the target trading entity is determined; the risk characteristics of the target trading entity are obtained by feature extraction from the trading description data of the target trading entity from a preset risk dimension.

[0010] According to a second aspect of this application, a device for identifying abnormal group transaction behavior is provided, the device comprising:

[0011] The topology construction module is used to construct a transaction entity topology based on the transaction description data of the target transaction entity and related transaction entities; wherein, the related transaction entities are transaction entities that have a transaction relationship with the target transaction entity;

[0012] The vector determination module is used to perform transaction feature binning on each transaction entity in the transaction entity topology based on the transaction description data of each transaction entity in the transaction entity topology, and determine the binning embedding vector for each transaction entity in the transaction entity topology.

[0013] The feature determination module is used to determine the group transaction features of the transaction entity topology based on the set of transaction entities corresponding to the transaction entity topology, the transaction relationship between any two transaction entities in the transaction entity topology, and the binning embedding vector corresponding to each transaction entity in the transaction entity topology.

[0014] The risk scoring module is used to determine the abnormal risk score of the target trading entity based on the risk characteristics of the target trading entity and the group trading characteristics of the trading entity topology; the risk characteristics of the target trading entity are obtained by feature extraction from the trading description data of the target trading entity from a preset risk dimension.

[0015] According to a third aspect of the present invention, embodiments of this application provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method for identifying abnormal group transaction behavior as described in embodiments of this application.

[0016] According to a fourth aspect of the present invention, an electronic device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the method for identifying abnormal group transaction behavior as described in the embodiments of the present application.

[0017] According to a fifth aspect of this application, an embodiment of this application provides a computer program product, including a computer program that, when executed by a processor, implements the method for identifying abnormal group transaction behavior as described in the embodiment of this application.

[0018] The technical solution of this application extends risk analysis from the level of a single entity to the level of the related transaction network group by constructing a transaction entity topology with the target transaction entity as the core, thereby achieving a more comprehensive and accurate risk assessment. First, by constructing the transaction entity topology, the transaction relationship network between the target entity and related entities can be systematically revealed, laying the foundation for risk mining from the perspective of group interaction. Second, feature binning is performed on the transaction description data of each entity in the topology, and binning embedding vectors are generated. This not only transforms the complex raw transaction data into a standardized, structured low-dimensional feature representation, effectively reducing data sparsity and computational complexity, but also preserves key transaction behavior patterns. Based on this, by integrating the transaction entity set, the transaction relationships between entities, and the binning embedding vectors of each entity, group transaction features representing the common behavior patterns of the entire transaction community can be extracted, helping to identify hidden collaborative anomaly patterns that are difficult to detect from the perspective of a single entity. Ultimately, by integrating the multi-dimensional risk characteristics of the target entity itself with the group transaction characteristics of its topology, a comprehensive assessment of individual characteristics and contextual environment characteristics is achieved. This results in an abnormal risk score that not only reflects the suspiciousness of the target entity itself, but also contains the risk transmission and aggregation effect of its associated network as a whole, significantly improving the accuracy and robustness of identifying complex disguises and gang-related abnormal transaction activities.

[0019] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of this application, nor is it intended to limit the scope of this application. Other features of this application will become readily apparent from the following description. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 This is a flowchart of the method for identifying abnormal group transaction behavior provided in Embodiment 1;

[0022] Figure 2 This is a flowchart of the method for identifying abnormal group trading behavior provided in Embodiment 2;

[0023] Figure 3This is a schematic diagram of the structure of the abnormal group transaction behavior identification device provided in Embodiment 3 of this application;

[0024] Figure 4 This is a schematic diagram of the structure of an electronic device provided in Embodiment 4 of this application. Detailed Implementation

[0025] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0026] It should be noted that the terms "first," "second," "target," and "candidate," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0027] Example 1

[0028] Figure 1 This is a flowchart of the group abnormal transaction behavior identification method provided in Embodiment 1. This embodiment is applicable to situations where abnormal group transaction behaviors such as financial gang behavior are identified in financial scenarios such as banks, payment platforms and cryptocurrency exchanges. The method can be executed by a group abnormal transaction behavior identification device, which is implemented in hardware and / or software and can be integrated into an electronic device running this system.

[0029] like Figure 1 As shown, the method includes:

[0030] S110. Construct a transaction entity topology based on the transaction description data of the target transaction entity and related transaction entities; wherein, the related transaction entities are transaction entities that have a transaction relationship with the target transaction entity.

[0031] S120. Based on the transaction description data of each transaction entity in the transaction entity topology, perform transaction feature binning on each transaction entity in the transaction entity topology, and determine the binning embedding vector for each transaction entity in the transaction entity topology.

[0032] S130. Based on the set of transaction entities corresponding to the transaction entity topology, the transaction relationship between any two transaction entities in the transaction entity topology, and the binning embedding vector corresponding to each transaction entity in the transaction entity topology, determine the group transaction characteristics of the transaction entity topology.

[0033] S140. Based on the risk characteristics of the target transaction entity and the group transaction characteristics of the transaction entity topology, determine the abnormal risk score of the target transaction entity; the risk characteristics of the target transaction entity are obtained by feature extraction from the transaction description data of the target transaction entity from a preset risk dimension.

[0034] The target transaction entity refers to the specific transaction subject that needs to be risk-scored, such as a bank account or merchant to be evaluated. Related transaction entities refer to other transaction subjects that have a direct transaction relationship with the target transaction entity. Transaction description data refers to the raw data that records the details of the transaction.

[0035] Constructing a transaction entity topology based on transaction description data of the target and related transaction entities involves abstracting the target and related transaction entities as nodes and their transaction relationships as edges, thereby forming a network graph representing the flow of funds. This step is necessary because traditional risk analysis only focuses on the characteristics of a single entity, while this application argues that risky behaviors such as fraud are often accomplished through complex collaboration among multiple entities. Constructing a topology can visualize hidden group connections and behavioral patterns, laying the foundation for subsequent graph analysis.

[0036] Subsequently, transaction feature binning is performed on the transaction description data of each transaction entity in the transaction entity topology. Transaction feature binning refers to the process of dividing continuous numerical features, such as transaction amount, into several discrete intervals, i.e., bins, according to business rules or data distribution. Then, a bin embedding vector is assigned to each bin, which is a dense, low-dimensional numerical vector representation. The bin embedding vector is determined for each transaction entity, that is, according to the bin to which each feature value of the transaction entity belongs, the corresponding vector is obtained and combined. This overcomes the noise interference and nonlinear fitting difficulties that may be caused by directly inputting continuous features into the model, while avoiding the high-dimensional sparsity of traditional one-hot encoding. By mapping discrete bins into dense vectors containing semantic relationships through embedding technology, the efficiency of feature expression and the learning ability of the model are greatly improved.

[0037] Next, the group transaction characteristics of the transaction entity topology are determined. The transaction entity set is the set of all nodes in the topology; transaction relationships are defined by the edges in the topology. Group transaction characteristics refer to the comprehensive high-dimensional feature vectors learned from the global perspective of the entire transaction entity topology, through the aggregation and encoding of node embedding vectors (i.e., binning embedding vectors) and edge relationships using models such as graph neural networks. This is because individual risk signals are often weak and hidden in complex networks, but through the information propagation and aggregation mechanisms of graph models, the behavioral characteristics of associated entities can be fused and enhanced, thereby extracting high-order pattern features representing group behavior that cannot be discovered using individual data alone.

[0038] Finally, based on the risk characteristics of the target trading entity and the group trading characteristics, its abnormal risk score is determined. Risk characteristics refer to the features extracted from the transaction description data of individual target trading entities from preset risk dimensions such as transaction anomalies and customer background. The abnormal risk score is a comprehensive quantitative value used to indicate the probability or level of abnormal risks such as fraud involved in the target trading entity.

[0039] Optionally, a downstream model can be used based on the target transaction entity. Calculate the target trading entity based on the group trading characteristics and risk characteristics. The abnormal risk score is calculated. The downstream model used to calculate the abnormal sharing score is trained using a tree model such as XGBoost.

[0040] The technical solution of this application extends risk analysis from the level of a single entity to the level of the related transaction network group by constructing a transaction entity topology with the target transaction entity as the core, thereby achieving a more comprehensive and accurate risk assessment. First, by constructing the transaction entity topology, the transaction relationship network between the target entity and related entities can be systematically revealed, laying the foundation for risk mining from the perspective of group interaction. Second, feature binning is performed on the transaction description data of each entity in the topology, and binning embedding vectors are generated. This not only transforms the complex raw transaction data into a standardized, structured low-dimensional feature representation, effectively reducing data sparsity and computational complexity, but also preserves key transaction behavior patterns. Based on this, by integrating the transaction entity set, the transaction relationships between entities, and the binning embedding vectors of each entity, group transaction features representing the common behavior patterns of the entire transaction community can be extracted, helping to identify hidden collaborative anomaly patterns that are difficult to detect from the perspective of a single entity. Ultimately, by integrating the multi-dimensional risk characteristics of the target entity itself with the group transaction characteristics of its topology, a comprehensive assessment of individual characteristics and contextual environment characteristics is achieved. This results in an abnormal risk score that not only reflects the suspiciousness of the target entity itself, but also contains the risk transmission and aggregation effect of its associated network as a whole, significantly improving the accuracy and robustness of identifying complex disguises and gang-related abnormal transaction activities.

[0041] In an optional embodiment, the step of binning transaction features for each transaction entity in the transaction entity topology based on the transaction description data of each transaction entity in the transaction entity topology, and determining a binning embedding vector for each transaction entity in the transaction entity topology, includes: extracting features from the transaction description data of each transaction entity in the transaction entity topology using at least two preset feature dimensions to determine at least two transaction features for each transaction entity in the transaction entity topology; determining matching target feature bins for each transaction entity in the transaction entity topology based on the feature dimensions and data content corresponding to the at least two transaction features, and the feature dimensions and data range corresponding to the preset feature bins; and vectorizing the binning identifier of the target feature bins to determine a binning embedding vector for each transaction entity in the transaction entity topology.

[0042] Among them, the preset feature dimensions refer to pre-defined feature categories used to characterize a certain aspect of trading behavior, such as asset size, transaction amount, transaction frequency, short-term transaction frequency, number of counterparties, and asset class. Using feature categories defined by at least two preset feature dimensions, feature extraction is performed on the transaction description data of each trading entity in the transaction entity topology, determining at least two transaction features for each trading entity in the transaction entity topology. Feature extraction refers to the process of calculating specific, quantifiable feature values ​​from the raw, unstructured transaction description data according to the definition of the preset feature dimensions.

[0043] The feature dimension corresponding to a transaction feature refers to the category to which the feature belongs. At least two transaction features are determined for each transaction entity in the transaction entity topology, and their corresponding feature dimensions correspond one-to-one with the preset feature dimensions. The data content corresponding to a transaction feature refers to the specific value of the feature.

[0044] By combining the feature dimensions and data content corresponding to transaction features with the feature dimensions and data ranges corresponding to preset feature bins, a matching target feature bin can be determined for each transaction entity in the transaction entity topology. Preset feature bins refer to bins and their data ranges predefined for each feature dimension. The feature dimensions corresponding to preset feature bins correspond one-to-one with the preset feature dimensions. The data range corresponding to a preset feature bin refers to the numerical range covered by the bin. In other words, for each feature dimension in the preset feature dimensions, a set of bins covering different numerical ranges is predefined. A target feature bin is a discrete classification interval uniquely determined for a given transaction feature of a transaction entity, based on its feature dimension type and specific value, by matching it with a predefined set of rules. The bin identifier for the target feature bin is a standardized identifier with a clear data range and risk semantics, transformed from continuous or discrete original feature values ​​according to business logic and statistical laws.

[0045] Optionally, for a specific feature dimension corresponding to a specific transaction feature, a preset feature binning set matching the transaction feature is obtained based on a preset storage structure. This set contains all predefined bins and their data ranges under that feature dimension. Then, the data content of the transaction feature is matched against the data range of each bin in the preset feature binning set to determine which bin's data range the data content falls into. This matching process is completed according to binning rules. For example, for a feature value of a transaction amount dimension, it is sequentially determined whether it meets the boundary conditions of preset ranges such as "0-10,000 yuan" or "100,000-100,000 yuan". A bin is determined as the target feature bin matching the transaction feature only when a unique bin whose data range completely contains the current feature data content is found.

[0046] The pre-defined storage structure refers to a data organization form that is predefined and configured in the system implementation to organize and store pre-defined feature binning rules. Specifically, it refers to a data structure or storage scheme designed within the software system, such as in memory or a database, to achieve efficient matching of feature values ​​and binning rules. This data structure associates each pre-defined feature dimension, such as "transaction amount," with its corresponding series of "pre-defined feature bins," such as "0-10,000," "100,000-100,000," and "above 100,000," and their numerical ranges, forming a mapping relationship that can be quickly queried by the program. Common implementation methods can be a dictionary, a database table, a configuration file, or a collection of key-value pairs. For example, the system may have the following logical storage structure: Key (feature dimension): "transaction amount"; Value (binning list): [Binning 1: {lower limit: 0, upper limit: 10000}, Binning 2: {lower limit: 10001, upper limit: 100000}, Binning 3: {lower limit: 100001, upper limit: null}].

[0047] The bin identifier for a target feature bin is typically a unique number or code for that bin; it is a discrete symbol without mathematical meaning. Optionally, the bin identifier is passed as input to a pre-trained or initialized embedding mapper. The core of this embedding mapper is an embedding lookup table, which stores a set of parameters beforehand or learns them during training. This lookup table establishes a one-to-one mapping between each possible bin identifier and a fixed-length dense vector. Specifically, using the bin identifier as the key, a lookup is performed in the embedding lookup table to retrieve and output the corresponding vector as the embedding representation of that bin identifier. For an entity with multiple transaction features, this process is performed independently for the bin identifier of the target feature bins in each feature dimension, resulting in a set of bin embedding vectors.

[0048] The aforementioned technical solution extracts at least two transaction features from transaction description data using at least two preset feature dimensions, achieving a comprehensive characterization of the multi-faceted behavioral patterns of transaction entities and laying a more complete data foundation for subsequent analysis. Subsequently, based on the feature dimensions and data content of each transaction feature, preset feature binning is matched to determine the target feature bins for each transaction entity. This process automates and standardizes the discrete regularization of the original data, effectively improving the robustness and business interpretability of the features. Finally, by vectorizing the binning identifiers of the target feature bins, binning embedding vectors are generated, transforming the discrete identifiers into low-dimensional dense numerical representations. This solves the high-dimensional sparsity problem and provides downstream models with high-quality input that can be directly computed and contains semantic meaning. Overall, this significantly enhances the training efficiency, representational ability, and final judgment accuracy of the subsequent risk identification model.

[0049] In an optional embodiment, determining the group transaction features of the transaction entity topology based on the set of transaction entities corresponding to the transaction entity topology, the transaction relationship between any two transaction entities in the transaction entity topology, and the bin embedding vectors corresponding to each transaction entity in the transaction entity topology includes: determining the original adjacency matrix and degree matrix of the transaction entity topology based on the transaction relationship between any two transaction entities in the transaction entity topology, and performing self-loop enhancement processing on the original adjacency matrix to obtain an enhanced adjacency matrix; processing the enhanced adjacency matrix, the degree matrix, and the bin embedding vectors corresponding to each transaction entity in the transaction entity topology using a pre-trained first parameter matrix through a first encoder of a graph convolutional network to obtain a first encoding result; feeding the first encoding result, the enhanced adjacency matrix, and the degree matrix into a second encoder of the graph convolutional network; and processing the first encoding result, the enhanced adjacency matrix, and the degree matrix using a pre-trained second parameter matrix through the second encoder of the graph convolutional network to obtain the group transaction features of the transaction entity topology.

[0050] The transaction entity topology uses each transaction entity as a node and the fund transfer relationships between entities as edges. The transaction relationship specifically refers to concrete fund flow connections such as transfers and payments, forming the basis of the edges. Based on the transaction relationships between any two transaction entities in the transaction entity topology, the original adjacency matrix is ​​determined. The original adjacency matrix is ​​a... A binary matrix, where N is the total number of nodes in the transaction entity topology, and its i-th... Line 1 A column's element value is 1 if and only if the node With nodes A transaction relationship exists between the elements; otherwise, the value is 0. The degree matrix is ​​an N×N diagonal matrix, where the first element on the diagonal is the first element. The nth element is equal to the nth element in the original adjacency matrix. The sum of all elements in a row, which is the total number of connections for that node, represents the node's direct transaction activity.

[0051] Next, the original adjacency matrix undergoes self-loop enhancement, which involves adding an N×N identity matrix (a matrix with 1s on the diagonal and 0s elsewhere) to the original adjacency matrix. This adds an edge to each node pointing to itself, ensuring that each node retains its own characteristics during subsequent information aggregation. The resulting matrix is ​​the enhanced adjacency matrix.

[0052] Subsequently, the first encoder of the graph convolutional network is input with the binning embedding vectors corresponding to each transaction entity in the transaction entity topology, which enhances the adjacency matrix, degree matrix, and transaction entity topology. The first encoder outputs the first encoding result.

[0053] Graph convolutional networks (GCNNs) are neural networks specifically designed to process graph-structured data. Their first encoder, the first layer, is responsible for performing initial neighborhood information aggregation. The pre-trained first parameter matrix is ​​a learnable weight matrix in the encoder, optimized during initial training. The first encoder's processing follows the core operations of graph convolution: First, the augmented adjacency matrix is ​​normalized using the degree matrix to stabilize the training process; then, the normalized adjacency matrix is ​​multiplied by the binning embedding vectors of all nodes, aggregating the features of each neighboring node to the current node; finally, the aggregated features are multiplied by the first parameter matrix, typically through a non-linear activation function such as ReLU, outputting the first encoding result. The first encoding result is a new node feature matrix, where the representation of each node has incorporated the preliminary information from its first-order neighbors.

[0054] Then, the first encoding result, the enhanced adjacency matrix, and the degree matrix are input together into the second encoder of the graph convolutional network. The second encoder is a deeper layer of the graph convolutional network, responsible for higher-order and more abstract information aggregation. The second encoder uses a pre-trained second parameter matrix for processing. Its implementation details are similar to those of the first encoder, but the input features are the first encoding result. It further aggregates the features of each node's first-order neighbors by performing the multiplication and linear transformation of the normalized adjacency matrix and the node feature matrix again. At this point, these neighbor features themselves already contain the information of their respective neighbors. This means that after the second layer, the representation of each node incorporates the information of all its neighbor nodes within two hops, enabling the capture of a wider range of graph structure patterns. After this deep aggregation, the final output of the second encoder is the group transaction feature. The group transaction feature is a high-dimensional feature matrix or vector set, in which the vector representation of each node not only contains its own attributes but also deeply encodes the transaction patterns and structures of its local network, thereby characterizing the complex collaborative behavior between transaction entities and providing key feature inputs for accurately identifying group risks.

[0055] The aforementioned technical solution constructs an original adjacency matrix and a degree matrix, and then performs self-loop enhancement processing on the original adjacency matrix to obtain an enhanced adjacency matrix. This accurately describes the structural characteristics of the transaction entity topology, and the self-loop enhancement processing ensures the effective preservation of node information. A first encoder processes the enhanced adjacency matrix, degree matrix, and bin embedding vector using a pre-trained first parameter matrix to obtain a first encoding result that integrates first-order neighborhood information. This first encoding result, along with the enhanced adjacency matrix and degree matrix, is then fed into a second encoder, where a pre-trained second parameter matrix is ​​used for deep processing. This allows the node representation to aggregate a wider range of neighborhood information, ultimately resulting in a group transaction feature that deeply encodes the complex interactions and global topological patterns between transaction entities. This two-level encoding process enhances the discriminative power of the extracted group transaction features, providing a more effective feature input for downstream risk identification.

[0056] In an optional embodiment, the loss function used to train the graph convolutional network is obtained by weighting a reconstruction loss term, a smoothing loss term, and a mutual information loss term. The reconstruction loss term is determined based on the reconstructed adjacency matrix and the original adjacency matrix of the sample entity topology. The reconstructed adjacency matrix is ​​obtained by decoding the group transaction features output by the second encoder using the inner product decoder of the graph convolutional network. The original adjacency matrix is ​​determined based on the transaction relationship between any two sample entities in the sample entity topology. The smoothing loss term is determined based on the feature change magnitude of the group transaction features between the previous iteration and the current iteration. The mutual information loss is determined based on the group transaction features corresponding to the current iteration. The group transaction features are determined by the second encoder based on the first encoding result output by the first encoder, the enhanced adjacency matrix, and the degree matrix of the sample entity topology. The first encoding result is determined by the first encoder based on the enhanced adjacency matrix and the degree matrix of the sample entity topology, as well as the bin embedding vectors corresponding to each transaction entity in the sample entity topology. The enhanced adjacency matrix is ​​obtained by performing self-loop enhancement processing on the original adjacency matrix.

[0057] The loss function is a mathematical function used to measure the difference between the model's predicted output and the target, guiding the optimization of model parameters. The loss function used in training graphical convolutional networks is a composite loss function, composed of a weighted combination of three key components: a reconstruction loss term, a smoothing loss term, and a mutual information loss term. Optionally, a different loss function can be used. Determine the loss function. Wherein, , and These represent the reconstruction loss term, the smoothing loss term, and the mutual information loss term, respectively. and These are the weighting coefficients.

[0058] The reconstruction loss term measures the graph convolutional network's ability to reconstruct the original graph structure, specifically determined by the difference between the reconstructed adjacency matrix and the original adjacency matrix of the sample entity topology. The sample entity topology is the network structure used for training, consisting of sample transaction entities and their inter-entity transaction relationships. The original adjacency matrix is ​​a binary matrix defined based on whether a transaction relationship exists between any two sample entities in the sample entity topology. The reconstructed adjacency matrix is ​​obtained by decoding the group transaction features output by the deep module (second encoder) of the graph convolutional network using the inner product decoder. The inner product decoder predicts the connection probability between nodes by calculating the inner product of node feature vectors. The reconstruction loss term forces the graph convolutional network to learn group transaction features that contain sufficient information to recover the connectivity of the original transaction network, thus ensuring that the extracted features faithfully encode the network's topology.

[0059] Optional, adopt ; represents the reconstruction loss. Where, ; ; ; To enhance the adjacency matrix, This is the original adjacency matrix. It is an identity matrix. It is a degree matrix; This is the first parameter matrix corresponding to the first encoder; This is the second parameter matrix corresponding to the second encoder; This refers to the binning embedding vector; This represents the first encoding result; This indicates the characteristics of group transactions. This indicates the reconstruction of the adjacency matrix. .

[0060] The smoothing loss term is determined based on the magnitude of feature change between the group transaction features output by the model in two adjacent training iterations (i.e., the previous iteration and the current iteration). Optionally, Euclidean distance or cosine distance can be used to measure the magnitude of feature change. The smoothing loss term can constrain the update step size of feature representations during training, avoid drastic jumps in features between adjacent iterations, thereby improving the stability and convergence of model training, and making the learned features more robust to small perturbations in the training data.

[0061] Optional, adopt ; represents the smoothing loss term. Wherein, This represents the group transaction characteristics output in the previous iteration; where, For the updated set of transaction entities; This represents the group transaction characteristics output in the current iteration. It is represented as a set of transaction entities.

[0062] The mutual information loss term is determined based on the group transaction features corresponding to the current training iteration. Its core is to maximize the mutual information between this feature and the global statistical information or features from other views extracted from it. Essentially, by maximizing the mutual information between local features and the global context, it enables graph convolutional networks to learn those feature representations that are most discriminative to the overall graph structure, more compact, and more generalizable, avoiding the model learning irrelevant or redundant information.

[0063] Optional, adopt ; indicates the mutual information loss term. Among them, ; represents the global node mean calculated based on the statistical characteristics of group transactions. This represents the total number of entities in the transaction entity set.

[0064] The continuously optimized group transaction features during training are calculated by the second encoder based on the first encoding result output by the first encoder (the previous layer module), the enhanced adjacency matrix of the sample entity topology, and the degree matrix. The first encoding result is generated by the first encoder after processing the input bin embedding vector, the enhanced adjacency matrix, and the degree matrix. The enhanced adjacency matrix is ​​obtained by performing self-loop enhancement on the original adjacency matrix; that is, adding a connection pointing to itself to each node in the original adjacency matrix. The purpose is to ensure that nodes retain their own feature information during information transmission.

[0065] The above technical solution achieves multi-objective collaborative optimization of graph convolutional networks by training them with a composite loss function obtained through weighted processing of reconstruction loss, smoothing loss, and mutual information loss. Specifically, the reconstruction loss ensures high fidelity of the learned group transaction features to the original topology. The smoothing loss effectively constrains the smoothness of feature updates during training, improving the model's training stability and convergence efficiency. The mutual information loss drives the model to learn more discriminative and compact feature representations. Overall, this composite loss function, through collaborative optimization of the above objectives, guides the first and second encoders, combining enhanced adjacency matrices and degree matrices to process binning embedding vectors. Ultimately, the group transaction features extracted by the network possess structural fidelity, learning stability, and strong discriminative power, thus providing higher-quality feature input for downstream risk identification tasks and significantly improving the overall model's performance and reliability.

[0066] Example 2

[0067] Figure 2This is a flowchart of the method for identifying abnormal group trading behavior provided in Embodiment 2. This embodiment further optimizes the above embodiment. Specifically, the method used to determine the preset risk dimension is further defined.

[0068] like Figure 2 As shown, the method includes:

[0069] S210. At least two preset feature dimensions are used to extract features from the transaction description data of the transaction entity sample to obtain at least two transaction features of the transaction entity sample; the transaction entity sample is associated with a sample label, and the sample label is used to determine whether the transaction entity sample is a risky entity or a normal entity.

[0070] Here, a transaction entity sample refers to a representative transaction entity selected from historical data for training or analysis. Feature extraction is performed on the transaction description data of the transaction entity sample using at least two preset feature dimensions to obtain at least two transaction features of the transaction entity sample.

[0071] Each transaction entity sample is associated with a sample label, which is a pre-defined classification identifier used to explicitly specify the true category of the transaction entity sample in the training set, i.e., whether it is a risky entity or a normal entity. Risky entities are those labeled as having high risks such as fraud or violations; normal entities are those labeled as compliant and low-risk. The sample labels provide supervisory signals for subsequent analysis.

[0072] S220. Based on the feature dimension to which the transaction feature belongs, perform equal-frequency binning on at least two transaction features of the transaction entity sample to obtain at least two preset feature bins.

[0073] Equal-frequency binning is a data discretization method that sorts the feature values ​​of all transaction entity samples under a certain feature dimension and divides them into several intervals containing approximately equal numbers of samples. This operation is performed on each feature based on its feature dimension, and each resulting interval is a pre-defined feature bin. This transforms continuous numerical values ​​into ordered discrete categories, reduces outlier interference, and facilitates subsequent distribution statistics.

[0074] S230. Based on the sample labels of the transaction entity samples, determine the proportion of risky entities and the proportion of normal entities in each of the preset feature bins.

[0075] Based on sample labels, the sample category to which a trading entity sample falling into a preset feature bin belongs can be determined, thereby determining the proportion of risky entities and the proportion of normal entities within that preset feature bin. The proportion of risky entities refers to the ratio of the number of risky entities in a given preset feature bin to the total number of risky entities. The proportion of normal entities refers to the ratio of the number of normal entities in that preset feature bin to the total number of normal entities. These two ratios quantify the risk concentration of each bin.

[0076] S240. Based on the proportion of risky entities and the proportion of normal entities in each of the preset feature bins, determine the dimensional information value of each preset feature dimension, and determine the preset risk dimension among the at least two preset feature dimensions based on the dimensional information value of each preset feature dimension.

[0077] Based on the proportion of risky entities and normal entities in each preset feature bin, the evidence weight of each preset feature bin is calculated. The evidence weight is a logarithmic ratio reflecting the risk discrimination ability of that bin. Then, by combining the evidence weights of all bins and their sample distribution, the overall dimensional information value of that feature dimension is calculated. The dimensional information value is a scalar used to quantify the ability of that feature dimension to distinguish between risky and normal entities; the higher the value, the stronger the discrimination. Finally, by comparing the dimensional information values ​​of each feature dimension, one or more of the strongest discriminative abilities are selected from at least two initial preset feature dimensions as preset risk dimensions.

[0078] Optional, for feature dimensions The weight of evidence is expressed by the following formula: ;

[0079] The value of dimensional information is expressed using the following formula:

[0080] ;in, For feature dimensions The weight of evidence.

[0081] The technical solution of this application extracts features from transaction description data using at least two preset feature dimensions, obtaining multiple transaction features that comprehensively characterize entity behavior. Based on the feature dimensions to which the transaction features belong, equal-frequency binning is performed to obtain preset feature bins, effectively normalizing data distribution and enhancing analytical robustness. The proportion of risky entities and the proportion of normal entities in each preset feature bin are determined using sample labels, transforming supervised information into quantitative indicators. Furthermore, based on these proportions, the dimensional information value of each preset feature dimension is calculated, objectively quantifying the risk discrimination capability of each dimension. Finally, a preset risk dimension is determined from at least two preset feature dimensions based on the dimensional information value. This process achieves automated, data-driven screening of key risk dimensions, overcoming the limitations of subjective experience and ensuring the objectivity and scientific rigor of the screening results. This allows downstream risk identification models to focus on the feature information with the strongest discriminative power, significantly improving model accuracy, efficiency, and generalization performance.

[0082] In an optional embodiment, determining a preset risk dimension based on the dimensional information value of each preset feature dimension among the at least two preset feature dimensions includes: if the dimensional information value of the preset feature dimension is greater than a first preset value, then the preset feature dimension is determined as a preset risk dimension; if the dimensional information value of the preset feature dimension is less than a second preset value, then the preset feature dimension is determined as a preset general dimension; wherein, the first preset value is greater than the second preset value.

[0083] The dimensional information value is a pre-calculated statistical indicator used to quantify the ability of a given feature dimension to distinguish between risky and normal entities; a higher value indicates a stronger risk-discriminating ability for that dimension. The first preset value is a pre-set, relatively high numerical threshold used to define the lower limit of strong distinguishing ability. The second preset value is a pre-set, relatively low numerical threshold used to define the upper limit of weak distinguishing ability, and its value is less than the first preset value.

[0084] The dimensional information value calculated for each preset feature dimension is compared with two thresholds: a first preset value and a second preset value. If the dimensional information value of a preset feature dimension is greater than the first preset value, it indicates that the feature dimension has a very strong ability to identify risky entities, and therefore it is identified as a preset risk dimension. Conversely, if the dimensional information value of a preset feature dimension is less than the second preset value, it indicates that the feature dimension has a weak ability to identify risky entities and lacks specificity, and therefore it is classified as a preset general dimension. These types of feature dimensions typically represent the common and fundamental behavioral attributes of trading entities.

[0085] The aforementioned technical solution achieves objective and accurate categorization of feature dimensions by comparing the dimensional information value of each preset feature dimension with a first preset value and a second preset value. Specifically, dimensions with dimensional information value greater than the first preset value are identified as preset risk dimensions. These feature dimensions, due to their strong risk differentiation capabilities, can be directly used as core features for risk identification, ensuring the keen capture of key risk signals. Simultaneously, dimensions with dimensional information value less than the second preset value are categorized as preset general dimensions. While these feature dimensions have weaker differentiation capabilities, they represent common behavioral attributes of entities and can be used for auxiliary analysis. This classification mechanism achieves optimized allocation of feature resources. Its judgment logic based on clearly quantified thresholds is completely objective, eliminating the subjectivity and arbitrariness of manual selection. This makes the feature selection process standardized and repeatable, greatly improving the automation level, interpretability, and reliability of subsequent model construction and engineering implementation.

[0086] In an optional embodiment, determining a preset risk dimension based on the dimensional information value of each preset feature dimension among at least two preset feature dimensions includes: if the dimensional information value of the preset feature dimension is between a first preset value and a second preset value, then the preset feature dimension is determined as a target feature dimension; merging the preset feature bins corresponding to the target feature dimension using chi-square binning until a merging termination condition is met, to obtain a new feature bin corresponding to the target feature dimension; determining the dimensional information value of the target feature dimension based on the proportion of risk entities and the proportion of normal entities in the new feature bin; if the dimensional information value of the target feature dimension is greater than a third preset value, then the target feature dimension is determined as the preset risk dimension; wherein the third preset value is between the first preset value and the second preset value, and the first preset value is greater than the second preset value; if the dimensional information value of the target feature dimension is less than or equal to the third preset value, then the target feature dimension is determined as a preset general dimension, and the new feature bin corresponding to the target feature dimension is restored to the preset feature bin obtained through equal-frequency binning.

[0087] Specifically, when the dimensional information value of a certain preset feature dimension falls between the first and second preset values, it indicates that the current discriminative ability of that feature dimension is in an ambiguous gray area—neither strong enough to be directly adopted nor weak enough to be directly discarded. In this case, the feature dimension is temporarily marked as the target feature dimension, becoming an object to be optimized and re-evaluated.

[0088] Given a defined target feature dimension, chi-square binning is used to process a series of predefined feature bins obtained from the initial equal-frequency binning within that dimension. Chi-square binning is a discretization method based on statistical significance testing. Its principle is to sequentially evaluate whether adjacent bins have statistically significant differences in sample label distribution, where the sample label distribution refers to the distribution of risk entities and normal entities. Adjacent bins with no statistically significant differences are continuously merged until a predefined merging termination condition is met. For example, the chi-square test value between adjacent bins is below a certain threshold, or the number of bins reaches a predefined lower limit. This process aims to eliminate potentially overly fine divisions or noise interference from the initial binning, thereby obtaining a new set of feature bins that are fewer in number, more homogeneous internally, and have more significant differences between bins.

[0089] Subsequently, based on the new feature binning, the proportions of risky entities and normal entities are recalculated, and the optimized new dimensional information value of the target feature dimension is calculated accordingly. Next, a third preset value, between the first and second preset values, is introduced as a new evaluation criterion. If the optimized dimensional information value is greater than the third preset value, it proves that the binning optimization has successfully improved the discriminative ability of this feature dimension, and therefore it is ultimately determined as the preset risk dimension. Conversely, if its value is less than or equal to the third preset value, it indicates that even after optimization, the discriminative ability of this feature dimension is still insufficient, and therefore it is downgraded to the preset general dimension. Simultaneously, for data consistency, its corresponding binning structure is restored to the original preset feature binning obtained through equal-frequency binning.

[0090] The above technical solution first identifies the target feature dimension as a preset feature dimension whose dimensional information value lies between a first preset value and a second preset value, thus accurately locking in intermediate potential features. Then, chi-square binning is used to merge the preset feature bins corresponding to the target feature dimension until the merging termination condition is met, resulting in new feature bins with better discriminative power. Based on the new feature bins, the proportion of risky entities and the proportion of normal entities are recalculated, and the optimized dimensional information value of the target feature dimension is determined accordingly. By introducing a third preset value as a new evaluation threshold, the optimization result is rigorously judged: if the value is greater than the third preset value, the target feature dimension is determined as a preset risk dimension, successfully mining and improving the discriminative power of potential features; if it is less than or equal to the third preset value, it is determined as a preset general dimension, and the new feature bins are restored to the preset feature bins obtained through equal-frequency binning, ensuring the consistency of the feature system. The above technical solution improves the precision and reliability of feature selection by optimizing chi-square binning and using dual thresholds, avoids the erroneous rejection of effective features, and ensures that the preset risk dimensions selected in the end all have proven strong discriminative ability, thereby enhancing the accuracy and robustness of the subsequent risk identification model.

[0091] Example 3

[0092] Figure 3 This is a schematic diagram of the structure of the abnormal group transaction behavior identification device provided in Embodiment 3 of this application. This embodiment can be applied to situations where abnormal group transaction behaviors such as financial gang behavior can be identified in financial scenarios such as banks, payment platforms and cryptocurrency exchanges. The device can be implemented by software and / or hardware and can be integrated into electronic devices such as smart terminals.

[0093] like Figure 3 As shown, the device may include:

[0094] The topology construction module 310 is used to construct a transaction entity topology based on the transaction description data of the target transaction entity and related transaction entities; wherein, the related transaction entities are transaction entities that have a transaction relationship with the target transaction entity;

[0095] The vector determination module 320 is used to perform transaction feature binning on each transaction entity in the transaction entity topology based on the transaction description data of each transaction entity in the transaction entity topology, and determine the binning embedding vector for each transaction entity in the transaction entity topology.

[0096] The feature determination module 330 is used to determine the group transaction features of the transaction entity topology based on the set of transaction entities corresponding to the transaction entity topology, the transaction relationship between any two transaction entities in the transaction entity topology, and the binning embedding vector corresponding to each transaction entity in the transaction entity topology.

[0097] The risk scoring module 340 is used to determine the abnormal risk score of the target trading entity based on the risk characteristics of the target trading entity and the group trading characteristics of the trading entity topology; the risk characteristics of the target trading entity are obtained by feature extraction from the transaction description data of the target trading entity from a preset risk dimension.

[0098] The technical solution of this application extends risk analysis from the level of a single entity to the level of the related transaction network group by constructing a transaction entity topology with the target transaction entity as the core, thereby achieving a more comprehensive and accurate risk assessment. First, by constructing the transaction entity topology, the transaction relationship network between the target entity and related entities can be systematically revealed, laying the foundation for risk mining from the perspective of group interaction. Second, feature binning is performed on the transaction description data of each entity in the topology, and binning embedding vectors are generated. This not only transforms the complex raw transaction data into a standardized, structured low-dimensional feature representation, effectively reducing data sparsity and computational complexity, but also preserves key transaction behavior patterns. Based on this, by integrating the transaction entity set, the transaction relationships between entities, and the binning embedding vectors of each entity, group transaction features representing the common behavior patterns of the entire transaction community can be extracted, helping to identify hidden collaborative anomaly patterns that are difficult to detect from the perspective of a single entity. Ultimately, by integrating the multi-dimensional risk characteristics of the target entity itself with the group transaction characteristics of its topology, a comprehensive assessment of individual characteristics and contextual environment characteristics is achieved. This results in an abnormal risk score that not only reflects the suspiciousness of the target entity itself, but also contains the risk transmission and aggregation effect of its associated network as a whole, significantly improving the accuracy and robustness of identifying complex disguises and gang-related abnormal transaction activities.

[0099] Optionally, the vector determination module 320 includes: a feature extraction submodule, used to extract features from the transaction description data of each transaction entity in the transaction entity topology using at least two preset feature dimensions, and determine at least two transaction features for each transaction entity in the transaction entity topology; a binning matching submodule, used to determine a matching target feature bin for each transaction entity in the transaction entity topology based on the feature dimensions and data content corresponding to the at least two transaction features, and the feature dimensions and data range corresponding to the preset feature bins; and an identifier processing submodule, used to perform vectorization processing on the bin identifier of the target feature bin, and determine a binning embedding vector for each transaction entity in the transaction entity topology.

[0100] Optionally, the feature determination module 330 includes: a matrix determination submodule, used to determine the original adjacency matrix and degree matrix of the transaction entity topology based on the transaction relationship between any two transaction entities in the transaction entity topology, and to perform self-loop enhancement processing on the original adjacency matrix to obtain an enhanced adjacency matrix; a vector processing submodule, used to process the enhanced adjacency matrix, the degree matrix, and the bin embedding vectors corresponding to each transaction entity in the transaction entity topology using a pre-trained first parameter matrix through a first encoder of a graph convolutional network to obtain a first encoding result; a data input submodule, used to input the first encoding result, the enhanced adjacency matrix, and the degree matrix into a second encoder of the graph convolutional network; and a feature determination submodule, used to process the first encoding result, the enhanced adjacency matrix, and the degree matrix using a pre-trained second parameter matrix through the second encoder of the graph convolutional network to obtain the group transaction features of the transaction entity topology.

[0101] Optionally, the loss function used to train the graph convolutional network is obtained by weighting the reconstruction loss term, the smoothing loss term, and the mutual information loss term; wherein, the reconstruction loss term is determined based on the reconstructed adjacency matrix and the original adjacency matrix of the sample entity topology; the reconstructed adjacency matrix is ​​obtained by decoding the group transaction features output by the second encoder by the inner product decoder of the graph convolutional network; the original adjacency matrix is ​​determined based on the transaction relationship between any two sample entities in the sample entity topology; the smoothing loss term is determined based on the feature change magnitude of the group transaction features between the previous iteration and the current iteration; the mutual information loss is determined based on the group transaction features corresponding to the current iteration; wherein, the group transaction features are determined by the second encoder based on the first encoding result output by the first encoder, the enhanced adjacency matrix and the degree matrix of the sample entity topology; the first encoding result is determined by the first encoder based on the enhanced adjacency matrix and the degree matrix of the sample entity topology and the bin embedding vectors corresponding to each transaction entity in the sample entity topology; the enhanced adjacency matrix is ​​obtained by performing self-loop enhancement processing on the original adjacency matrix.

[0102] Optionally, the device further includes: a dimension determination module, used to determine the preset risk dimension; the dimension determination module includes: a transaction feature determination submodule, used to extract features from the transaction description data of the transaction entity sample using at least two preset feature dimensions to obtain at least two transaction features of the transaction entity sample; the transaction entity sample is associated with a sample label, the sample label being used to determine whether the transaction entity sample is a risk entity or a normal entity; a transaction feature binning module, used to perform equal-frequency binning on the at least two transaction features of the transaction entity sample based on the feature dimension to which the transaction feature belongs, to obtain at least two preset feature bins; an entity proportion determination submodule, used to determine the risk entity proportion and normal entity proportion of each preset feature bin based on the sample label of the transaction entity sample; and an information value determination submodule, used to determine the dimensional information value of each preset feature dimension based on the risk entity proportion and normal entity proportion of each preset feature bin, and to determine the preset risk dimension from the at least two preset feature dimensions based on the dimensional information value of each preset feature dimension.

[0103] Optionally, the information value determination submodule includes: a first dimension determination unit, configured to determine the preset feature dimension as a preset risk dimension if the dimension information value of the preset feature dimension is greater than a first preset value; and a second dimension determination unit, configured to determine the preset feature dimension as a preset general dimension if the dimension information value of the preset feature dimension is less than a second preset value; wherein the first preset value is greater than the second preset value.

[0104] Optionally, the information value determination submodule includes: a target dimension determination unit, configured to determine the preset feature dimension as a target feature dimension if the dimensional information value of the preset feature dimension is between a first preset value and a second preset value; a new binning determination unit, configured to merge the preset feature bins corresponding to the target feature dimension using chi-square binning until the merging termination condition is met, to obtain a new feature bin corresponding to the target feature dimension; an information value determination unit, configured to determine the dimensional information value of the target feature dimension based on the proportion of risk entities and the proportion of normal entities in the new feature bin; a risk dimension determination unit, configured to determine the target feature dimension as the preset risk dimension if the dimensional information value of the target feature dimension is greater than a third preset value; wherein the third preset value is between the first preset value and the second preset value, and the first preset value is greater than the second preset value; and a general dimension determination unit, configured to determine the target feature dimension as a preset general dimension if the dimensional information value of the target feature dimension is less than or equal to the third preset value, and restore the new feature bin corresponding to the target feature dimension to the preset feature bin obtained by equal-frequency binning.

[0105] The group abnormal transaction behavior identification device provided in the embodiments of the invention can execute the group abnormal transaction behavior identification method provided in any embodiment of this application, and has the corresponding performance modules and beneficial effects for executing the group abnormal transaction behavior identification method.

[0106] Example 4

[0107] According to embodiments of this application, this application also provides an electronic device, a readable storage medium, and a computer program product.

[0108] Figure 4 A schematic diagram of an electronic device 410, which can be implemented using an embodiment, is shown. The electronic device 410 includes at least one processor 411 and a memory, such as a read-only memory (ROM) 412, a random access memory (RAM) 413, etc., communicatively connected to the at least one processor 411. The memory stores computer programs executable by the at least one processor. The processor 411 can perform various appropriate actions and processes based on the computer program stored in the ROM 412 or loaded from storage unit 418 into the RAM 413. The RAM 413 may also store various programs and data required for the operation of the electronic device 410. The processor 411, ROM 412, and RAM 413 are interconnected via a bus 414. An input / output (I / O) interface 415 is also connected to the bus 414.

[0109] Multiple components in electronic device 410 are connected to I / O interface 415, including: input unit 416, such as keyboard, mouse, etc.; output unit 417, such as various types of displays, speakers, etc.; storage unit 418, such as disk, optical disk, etc.; and communication unit 419, such as network card, modem, wireless transceiver, etc. Communication unit 419 allows electronic device 410 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0110] Processor 411 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 411 include, but are not limited to, central processing unit (CPU), graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any suitable processor, controller, microcontroller, etc. Processor 411 performs the various methods and processes described above, such as methods for identifying abnormal group trading behavior.

[0111] In some embodiments, the method for identifying abnormal group transaction behavior can be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 418. In some embodiments, part or all of the computer program can be loaded and / or installed on electronic device 410 via ROM 412 and / or communication unit 419. When the computer program is loaded into RAM 413 and executed by processor 411, one or more steps of the method for identifying abnormal group transaction behavior described above can be performed. Alternatively, in other embodiments, processor 411 can be configured to perform the method for identifying abnormal group transaction behavior by any other suitable means (e.g., by means of firmware).

[0112] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations may include: implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0113] Computer programs used to implement the methods of this application may be written in any combination of one or more programming languages. These computer programs may be provided to the processor of a general-purpose computer, a special-purpose computer, or other programmable group abnormal transaction behavior identification device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0114] In the context of this application, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium can be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0115] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0116] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as a server for identifying abnormal group transaction behavior), or computing systems that include middleware components (e.g., an application server), or computing systems that include frontend components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., a communication network). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0117] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0118] This application also discloses a computer program product, which includes a computer program that, when executed by a processor, implements the method for identifying abnormal group transaction behavior provided in any embodiment of this application. This program product shares the same inventive concept as the methods for identifying abnormal group transaction behavior disclosed in the embodiments of this application, and therefore will not be described in detail here.

[0119] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this application can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this application can be achieved, and this is not limited herein.

[0120] The specific embodiments described above do not constitute a limitation on the scope of protection of this application. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A method for identifying abnormal group transaction behavior, characterized in that, The method includes: A transaction entity topology is constructed based on the transaction description data of the target transaction entity and related transaction entities; wherein, the related transaction entities are transaction entities that have a transaction relationship with the target transaction entity; Based on the transaction description data of each transaction entity in the transaction entity topology, transaction feature binning is performed on each transaction entity in the transaction entity topology, and a binning embedding vector is determined for each transaction entity in the transaction entity topology. Based on the transaction relationship between any two transaction entities in the transaction entity topology, the original adjacency matrix and degree matrix of the transaction entity topology are determined, and the original adjacency matrix is ​​subjected to self-loop enhancement processing to obtain an enhanced adjacency matrix. The enhanced adjacency matrix, the degree matrix, and the bin embedding vectors corresponding to each transaction entity in the transaction entity topology are processed by the first encoder of the graph convolutional network using a pre-trained first parameter matrix to obtain a first encoding result. In the first encoding result, the representation of each node incorporates the features of its first-order neighbors. The first encoding result, the enhanced adjacency matrix, and the degree matrix are then fed into the... The second encoder of the graph convolutional network; the second encoder of the graph convolutional network uses a pre-trained second parameter matrix to process the first encoding result, the enhanced adjacency matrix and the degree matrix to obtain the group transaction features of the transaction entity topology; wherein, the representation of each node in the group transaction features integrates the features of all its neighboring nodes within two hops, and is used to characterize the collaborative behavior between transaction entities; wherein, the group transaction features are feature vectors used to characterize the group collaborative behavior pattern obtained by aggregating and encoding the binning embedding vector and the transaction relationship from the global perspective of the transaction entity topology; Based on the risk characteristics of the target trading entity and the group trading characteristics of the trading entity topology, the abnormal risk score of the target trading entity is determined; the risk characteristics of the target trading entity are obtained by feature extraction from the transaction description data of the target trading entity from a preset risk dimension; The step of binning transaction features for each transaction entity in the transaction entity topology based on the transaction description data of each transaction entity in the transaction entity topology, and determining a binning embedding vector for each transaction entity in the transaction entity topology, includes: extracting features from the transaction description data of each transaction entity in the transaction entity topology using at least two preset feature dimensions to determine at least two transaction features for each transaction entity in the transaction entity topology; determining matching target feature bins for each transaction entity in the transaction entity topology based on the feature dimensions and data content corresponding to the at least two transaction features, and the feature dimensions and data range corresponding to the preset feature bins; and vectorizing the binning identifier of the target feature bins to determine a binning embedding vector for each transaction entity in the transaction entity topology. The preset risk dimension is determined as follows: At least two preset feature dimensions are used to extract features from the transaction description data of the transaction entity sample, resulting in at least two transaction features of the transaction entity sample; the transaction entity sample is associated with a sample label, which is used to determine whether the transaction entity sample is a risky entity or a normal entity; based on the feature dimension to which the transaction feature belongs, the at least two transaction features of the transaction entity sample are binned at equal frequencies, resulting in at least two preset feature bins; based on the sample label of the transaction entity sample, the proportion of risky entities and the proportion of normal entities in each preset feature bin are determined; based on the proportion of risky entities and the proportion of normal entities in each preset feature bin, the dimensional information value of each preset feature dimension is determined, and based on the dimensional information value of each preset feature dimension, a preset risk dimension is determined from the at least two preset feature dimensions.

2. The method according to claim 1, characterized in that, The loss function used to train the graph convolutional network is obtained by weighting the reconstruction loss term, the smoothing loss term, and the mutual information loss term. The reconstruction loss term is determined based on the reconstructed adjacency matrix and the original adjacency matrix of the sample entity topology; the reconstructed adjacency matrix is ​​obtained by decoding the group transaction features output by the second encoder by the inner product decoder of the graph convolutional network; the original adjacency matrix is ​​determined based on the transaction relationship between any two sample entities in the sample entity topology. The smoothing loss term is determined based on the magnitude of the feature change in the group transaction characteristics between the previous iteration and the current iteration; The mutual information loss is determined based on the group transaction characteristics corresponding to the current iteration; The group transaction features are determined by the second encoder based on the first encoding result output by the first encoder, the enhanced adjacency matrix and degree matrix of the sample entity topology; the first encoding result is determined by the first encoder based on the enhanced adjacency matrix and degree matrix of the sample entity topology and the bin embedding vector corresponding to each transaction entity in the sample entity topology; the enhanced adjacency matrix is ​​obtained by performing self-loop enhancement processing on the original adjacency matrix.

3. The method according to claim 1, characterized in that, The determination of the preset risk dimension based on the dimensional information value of each preset feature dimension among the at least two preset feature dimensions includes: If the dimensional information value of the preset feature dimension is greater than the first preset value, then the preset feature dimension is determined as a preset risk dimension; if the dimensional information value of the preset feature dimension is less than the second preset value, then the preset feature dimension is determined as a preset general dimension; wherein, the first preset value is greater than the second preset value.

4. The method according to claim 1, characterized in that, The determination of the preset risk dimension based on the dimensional information value of each preset feature dimension among the at least two preset feature dimensions includes: If the dimensional information value of the preset feature dimension is between the first preset value and the second preset value, then the preset feature dimension is determined as the target feature dimension. Chi-square binning is used to merge the preset feature bins corresponding to the target feature dimension until the merging termination condition is met, resulting in a new feature bin corresponding to the target feature dimension. Based on the proportion of risky entities and the proportion of normal entities in the new feature binning, the dimensional information value of the target feature dimension is determined. If the dimensional information value of the target feature dimension is greater than the third preset value, then the target feature dimension is determined as the preset risk dimension; wherein, the third preset value is between the first preset value and the second preset value, and the first preset value is greater than the second preset value; If the dimensional information value of the target feature dimension is less than or equal to the third preset value, then the target feature dimension is determined as a preset general dimension, and the new feature binning corresponding to the target feature dimension is restored to the preset feature binning obtained by equal-frequency binning.

5. A device for identifying abnormal group transaction behavior, characterized in that, The device includes: The topology construction module is used to construct a transaction entity topology based on the transaction description data of the target transaction entity and related transaction entities; wherein, the related transaction entities are transaction entities that have a transaction relationship with the target transaction entity; The vector determination module is used to perform transaction feature binning on each transaction entity in the transaction entity topology based on the transaction description data of each transaction entity in the transaction entity topology, and determine the binning embedding vector for each transaction entity in the transaction entity topology. The feature determination module is specifically used to determine the original adjacency matrix and degree matrix of the transaction entity topology based on the transaction relationship between any two transaction entities in the transaction entity topology, and to perform self-loop enhancement processing on the original adjacency matrix to obtain an enhanced adjacency matrix; the first encoder of the graph convolutional network uses a pre-trained first parameter matrix to process the enhanced adjacency matrix, the degree matrix, and the bin embedding vectors corresponding to each transaction entity in the transaction entity topology to obtain a first encoding result; wherein, the representation of each node in the first encoding result incorporates the features of its first-order neighbors; the first encoding result, the enhanced adjacency matrix, and the degree matrix are then combined... The first encoding result, the enhanced adjacency matrix, and the degree matrix are fed into the second encoder of the graph convolutional network. The second encoder of the graph convolutional network uses a pre-trained second parameter matrix to process the first encoding result, the enhanced adjacency matrix, and the degree matrix to obtain the group transaction features of the transaction entity topology. In the group transaction features, the representation of each node incorporates the features of all its neighboring nodes within two hops, used to characterize the collaborative behavior between transaction entities. The group transaction features are feature vectors obtained from the global perspective of the transaction entity topology, after aggregating and encoding the binning embedding vector and the transaction relationship, and used to characterize the group collaborative behavior pattern. The risk scoring module is used to determine the abnormal risk score of the target trading entity based on the risk characteristics of the target trading entity and the group trading characteristics of the trading entity topology; the risk characteristics of the target trading entity are obtained by feature extraction from the transaction description data of the target trading entity from a preset risk dimension; The vector determination module includes: a feature extraction submodule, used to extract features from the transaction description data of each transaction entity in the transaction entity topology using at least two preset feature dimensions, and determine at least two transaction features for each transaction entity in the transaction entity topology; a binning matching submodule, used to determine a matching target feature bin for each transaction entity in the transaction entity topology based on the feature dimensions and data content corresponding to the at least two transaction features, and the feature dimensions and data range corresponding to the preset feature bins; and an identifier processing submodule, used to perform vectorization processing on the bin identifier of the target feature bin, and determine a binning embedding vector for each transaction entity in the transaction entity topology. The dimension determination module is used to determine the preset risk dimension. The dimension determination module includes: a transaction feature determination submodule, used to extract features from the transaction description data of the transaction entity sample using at least two preset feature dimensions to obtain at least two transaction features of the transaction entity sample; the transaction entity sample is associated with a sample label, which is used to determine whether the transaction entity sample is a risky entity or a normal entity; a transaction feature binning module, used to perform equal-frequency binning on the at least two transaction features of the transaction entity sample based on the feature dimension to which the transaction feature belongs, to obtain at least two preset feature bins; an entity proportion determination submodule, used to determine the risk entity proportion and normal entity proportion of each preset feature bin based on the sample label of the transaction entity sample; and an information value determination submodule, used to determine the dimensional information value of each preset feature dimension based on the risk entity proportion and normal entity proportion of each preset feature bin, and to determine the preset risk dimension from the at least two preset feature dimensions based on the dimensional information value of each preset feature dimension.

6. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the group abnormal transaction behavior identification method as described in any one of claims 1-4.

7. An electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the group abnormal transaction behavior identification method as described in any one of claims 1-4.

Images