Abnormal capital collection account group identification, clustering and labeling method based on capital flow data

Abstract

The invention provides an abnormal capital collection account group identification, clustering and label labeling method based on capital flow data, and belongs to the technical field of financial risk prevention and control and data mining. A time sequence LSTM-structured self-encoding fusion AI feature extraction module is customized; the method comprises the following steps: capturing time sequence features such as periodic transfer and large-amount concentrated transfer through an LSTM attention layer, extracting structured features such as cross-regional association through an auto-encoder with a risk penalty term, and performing weighted fusion to obtain 12-dimensional AI features; and then semi-supervised K-means is used to identify a suspicious account group, spectral clustering is used to divide a case cluster, a random forest is used to label a'capitator / investor 'label, and the precision is ensured through three-layer verification. The method solves the problems of incomplete artificial feature coverage and poor universal AI adaptability in the prior art, and is suitable for abnormal capital investigation of financial supervision departments.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of financial risk prevention and data mining technology, and particularly relates to an abnormal fund-raising account group identification, clustering and label annotation method based on fund flow data. It is suitable for the abnormal fund-raising risk investigation scene of the financial supervision department, and the core is to automatically extract the risk features in the fund flow through the customized AI module to replace part of the artificial feature design. BACKGROUND

[0002] The current abnormal fund-raising case presents the characteristics of "account dispersion, fund flow concealment, cross-regional linkage", and the traditional identification method mainly relies on manual investigation, which has three core problems: 1. Low efficiency: when manually analyzing massive fund flow data (such as million-level transaction records per day), all accounts cannot be covered, and suspicious objects are easily missed; 2. Poor clustering accuracy: only single transaction features (such as amount and frequency) are used to divide case clusters, and the topological association of fund "centralized transfer-in and dispersed transfer-out" is ignored, which leads to confusion of accounts in different cases; 3. Label annotation depends on subjective judgment: there is no data-driven standard for determining the fund collection party and the fund outflow party, which easily leads to incorrect and missed labeling. SUMMARY

[0003] In order to solve the above technical problems, the present application provides an abnormal fund-raising account group identification, clustering and label annotation method based on fund flow data. It solves the problems of "low efficiency, clustering disorder and poor label accuracy" in existing abnormal fund-raising account identification, and makes up for the defects of "incomplete artificial feature coverage and poor adaptability of general AI model" in the prior art. Through the customized AI feature extraction module, hidden risk features in the fund flow are automatically captured, realizing the upgrade from "artificial feature design + single algorithm" to "AI automatic feature + multi-algorithm cooperation", ensuring that the clustering result matches the actual case and the label annotation conforms to the fund flow logic.

[0004] The technical scheme of the present application is: An abnormal fund-raising account group identification, clustering and label annotation method based on fund flow data, the core of which is to customize a "time series LSTM-structured auto-encoding fusion AI feature extraction module": first, the fund flow data is split into time series / structured data, the "periodic transfer, large amount of concentrated transfer" and other time series features are captured through the LSTM attention layer, and the "cross-region association" and other structured features are extracted through the auto-encoder with risk penalty term. After weighted fusion, 12-dimensional AI features are obtained; Then use semi-supervised K-means to identify suspicious account groups, spectral clustering to divide case clusters, random forest to annotate "fund raiser / investor" labels, and through three layers of verification to ensure accuracy.

[0005] Based on the artificially labeled abnormal fund account fund transaction network, the core includes a "time series LSTM-structured auto-encoding fusion AI feature extraction module", and the specific steps are as follows: Step 1: Data preprocessing and dataset construction, collect multi-source fund flow data (including but not limited to bank account transaction records, third-party payment account flow, digital currency transaction flow), eliminate invalid transactions (determination rules: 1. Transaction amount≤0 yuan; 2. Self-transfer of the same account; 3. Transaction notes contain "test" and "reversal" keywords; 4. Transaction time is the system maintenance period), complete the missing fields and split into time series data (account transaction sequence in the past 30 days) and structured data (20 original transaction statistics fields), then associate with artificially labeled "fund raiser account", "investor account" and "irrelevant account" data, and construct an initial dataset containing labels (annotated data accounts for 10%-20%), divided into training set, validation set and test set; Step 2: Abnormal fund-raising feature extraction based on customized AI module, build "time series LSTM-structured auto-encoding fusion AI feature extraction module", which includes three subunits: (1) Time series feature extraction subunit: use 3-layer LSTM network (hidden layer neuron number 64, dropout rate 0.2, ReLU activation function) + 1-layer 4-head attention layer, the attention layer increases the weight of samples with "single amount>50000 yuan" and "same payee account transaction≥3 times a day" by 2 times; The input is the encoded 30-day transaction time series sequence (12-dimensional vector for each sample), and the output is 6-dimensional time series risk features (including 30-day large transaction time series concentration, periodic transfer intensity, single-day high-frequency associated transaction proportion, cross-period transaction volatility, monthly fund inflow peak, and non-working day transfer proportion); (2) Structured feature extraction subunit: a stacked autoencoder SAE (encoder dimension 20→128→64→6, decoder dimension 6→64→128→20) is adopted, and an abnormal set financing risk penalty term is added to the decoder loss function (when the cross-regional transaction proportion feature weight is <0.3 or the number of core associated accounts is <5, the reconstruction error MSE is increased by 1.5 times); the input is 20 original structured fields, and the output is 6-dimensional structured risk features (including associated account regional distribution entropy, core account capital concentration, enterprise account transfer-in proportion, capital collection rate fluctuation coefficient, cross-bank transaction proportion, and small dispersed transfer-out intensity); (3) Feature fusion and verification subunit: the outputs of the first two subunits are fused through attention weighting (time series feature weight 0.6, structured feature weight 0.4), a risk feature verification loss is introduced (the classification loss is calculated by inputting the fused features into a logistic regression model), and if the loss value is >0.1, the parameters of the first two subunits are adjusted, and finally a 12-dimensional AI fused feature vector is output; Meanwhile, the AI module is trained with the training set in step 1, an Adam optimizer (learning rate 0.001, decay coefficient 0.9) is adopted, and the joint loss function is “time series LSTM cross-entropy loss + SAE reconstruction MSE loss + feature verification cross-entropy loss” (weight 4:3:3), and the iteration training is performed until the validation set joint loss value is ≤0.08; Step 3: Abnormal set financing account group identification based on semi-supervised learning, a semi-supervised K-means algorithm is adopted, the 12-dimensional AI fused feature vector in step 2 is input, the AI feature mean value of manually labeled accounts is used as the initial clustering center, the cosine similarity between unlabeled accounts and the initial center is calculated, the accounts with a similarity ≥85% are classified into “suspected abnormal set financing account group”, and the accounts with a similarity <50% are determined as irrelevant accounts and excluded; Step 4: Case cluster division based on graph clustering, the “suspected abnormal set financing account group” is constructed into a fund transaction graph (accounts are nodes, transaction relationships are edges, and edge weight = transaction amount × transaction frequency × core account capital concentration feature value in step 2), a spectral clustering algorithm (Laplacian matrix calculation, eigenvalue decomposition, K-means clustering) is adopted, and subgraphs with high fund interconnection are classified into one “case cluster”; Step 5: The "sponsor / investor" label is automatically labeled, the artificial labeling data in step 1 is used as the training set, a random forest classification model (100 decision trees, maximum depth 15 layers) is trained, the input is the AI fusion feature vector in step 2, and the output label (sponsor: fund collection rate fluctuation coefficient > 1.2 and core account fund concentration > 0.6; investor: small and dispersed transfer strength > 0.8 and non-working day transfer ratio > 0.4); Rule verification is performed on the label (a) Label sponsor but no transfer record, b) Label investor but monthly fund inflow peak > 0.7), trigger manual review and correct the wrong label; Step 6: AI features and identification results are visualized and output, AI feature weight distribution is displayed through a heat map, and case cluster account association is displayed through a network diagram, and result export is supported.

[0006] The beneficial effects of the present application are (1) Improved feature extraction accuracy: AI module automatically captures hidden risk features (such as periodic transfers), which improves the risk identification coverage rate of artificial design features and reduces the omission rate; (2) Efficiency improvement: Automatic processing of massive fund flow data, AI feature extraction time is shorter than artificial feature design, overall identification speed is improved compared with existing technology, and real-time daily inspection can be realized; (3) Accurate clustering: Combined with the spectral clustering of AI association strength features, the case cluster division is more accurate; (4) Reliable label: The process of "AI feature input + rule verification + manual review" improves the accuracy of label annotation; (5) Strong scalability: Support for adding new fund data sources (such as cross-border payment flow), only need to supplement the corresponding time series / structured input fields, adjust the input encoding dimension of the AI model to adapt, without the need to reconstruct the module. DETAILED DESCRIPTION

[0007] In order to make the purpose, technical scheme and advantages of the embodiments of the present application more clear, the technical scheme in the embodiments of the present application will be described clearly and completely below. Obviously, the described embodiments are part of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0008] The present application takes "artificially labeled abnormal fund transaction network" as the initial training basis, adds "time series LSTM-structured auto-encoding fusion AI feature extraction module" as the core, combines fund flow feature engineering, semi-supervised clustering and classification model, and realizes the target in 6 steps. The specific process is as follows: Step 1: Data Preprocessing and Dataset Construction Collect multi-source fund flow data, including but not limited to bank account transaction records (transaction time, amount, receiver and payer account numbers, remarks), third-party payment account flow, and digital currency transaction flow; Clean the data: remove invalid transactions (determination rules: 1. Transaction amount ≤ 0 yuan; 2. Self-transfer between the same account; 3. Transaction remarks contain the keywords "test" and "correct"; 4. Transaction time is during system maintenance period (such as 2:00-4:00 am)), and complete missing fields (such as matching regional information through account ownership); Data format conversion: split the cleaned data into two types of input: ① Time series data (account transaction sequence in the past 30 days, each containing timestamp, amount, and receiver and payer account number hash value); ② Structured data (account basic transaction statistics fields, such as daily frequency, cross-regional transaction number, etc. 20 original fields); Integrate human-labeled data: associate the "fund raiser account", "investor account", and "irrelevant account" labeled in history with the two types of data to construct an initial dataset with labels (labeled data accounts for 10-20%), divided into training set (70%), validation set (15%), and test set (15%); Storage format: pre-processed data is stored in "CSV format + relational database (MySQL)" dual mode, supporting batch calling of AI models.

[0009] Step 2: Abnormal Fund Raising Feature Extraction Based on Customized AI Module (Core New Module) Add "Time Series LSTM - Structured Auto-encoding Fusion AI Feature Extraction Module", which automatically extracts 12-dimensional high-dimensional risk features, replacing some manual feature design. The module is divided into 3 sub-units, as follows: (1) Time Series Feature Extraction Sub-unit (LSTM + Attention Mechanism) ① Model structure: 3-layer LSTM network (64 hidden layer neurons, dropout rate 0.2, activation function ReLU) + 1-layer 4-head attention layer; ② Scenario customization: the attention layer gives twice the weight to transactions with "single amount > 5,000 yuan" and "same receiver and payer account number with ≥3 transactions per day", strengthening the time series features of abnormal fund raising with "large amount and high frequency association"; ③ Input processing: sort the 30-day transaction time series sequence by timestamp, and encode each transaction sample as a 12-dimensional vector (timestamp normalized value, amount normalized value, receiver and payer account number hash value, transaction region code, etc.); ④ Output: 6-dimensional time-series risk characteristics, including "30-day concentration of large transactions", "intensity of periodic transfers", "proportion of high-frequency related transactions on a single day", "transaction volatility across time periods", "peak inflow of funds at the end of the month" and "proportion of transfers on non-working days".

[0010] (2) Structured feature extraction subunit (stacked autoencoder SAE) ① Model structure: Encoder (input dimension 20 → hidden layer 128 → hidden layer 64 → output dimension 6) + Decoder (input dimension 6 → hidden layer 64 → hidden layer 128 → output dimension 20); ② Scenario-based customization: Add an "abnormal fundraising risk penalty item" to the decoder loss function - if the weight of the "cross-regional transaction proportion feature" and the "number of core related accounts" are less than 0.3, the reconstruction error (MSE) will increase by 1.5 times, ensuring that the features are strongly bound to the "cross-regional and multi-related" attributes of abnormal fundraising; ③ Input: 20 raw structured fields of the account (average daily transaction frequency, monthly cumulative amount, number of cross-regional transactions, total number of associated accounts, etc.); ④ Output: 6-dimensional structured risk characteristics, including "geographical distribution entropy of related accounts", "fund concentration of core accounts", "proportion of transfers into corporate accounts", "fluctuation coefficient of fund aggregation rate", "proportion of cross-bank transactions" and "intensity of small-amount dispersed transfers out".

[0011] (3) Feature fusion and verification subunit ① Fusion logic: "Feature attention weighting" is adopted. The weights of temporal features and structured features are determined by training on the validation set (temporal feature weight 0.6, structured feature weight 0.4). After weighting, a 12-dimensional fusion feature vector is obtained. ② Validity verification: Introduce "risk feature verification loss" - input the fused features into the pre-trained binary classification model (logistic regression), calculate the classification loss with "whether it is an abnormal fundraising account" as the label. If the loss value is > 0.1, it is fed back to the first two sub-units to adjust the parameters (such as the dropout rate of LSTM and the penalty term coefficient of SAE) until the loss value is ≤ 0.1. ③ Output: 12-dimensional final fused feature vector, used in subsequent account group identification steps.

[0012] (4) AI module training process ① Training data: The training set in step 1 (including labeled data of abnormal fundraising accounts and normal accounts); ② Optimizer and loss function: The Adam optimizer is used (learning rate 0.001, decay coefficient 0.9), and the joint loss function is "temporal LSTM loss (cross entropy) + SAE reconstruction loss (MSE) + feature validation loss (cross entropy)", with a weight ratio of 4:3:3; ③ Training termination condition: 100 rounds of iterative training, or the joint loss value of the validation set is ≤0.08 for 5 consecutive rounds, to ensure that the model converges and the overfitting rate is <5%.

[0013] Step 3: Identification of Abnormal Fundraising Account Groups Based on Semi-Supervised Learning (1) The semi-supervised K-means algorithm is used, with the 12-dimensional AI fusion feature vector output in step 2 as input; (2) Initial cluster center determination: The mean value of AI features of “fundraiser account” and the mean value of AI features of “investor account” are manually labeled as two initial cluster centers (to avoid clustering bias caused by random initialization of unsupervised algorithm). (3) Clustering judgment rules: Calculate the cosine similarity between the unlabeled account and the two initial cluster centers, and classify the accounts with a similarity of ≥85% into the "suspicious and abnormal fundraising account group" (among which, accounts with a similarity of ≥85% with the "fundraiser center" are "suspicious fundraiser accounts", and accounts with a similarity of ≥85% with the "investor center" are "suspicious investor accounts"); and classify the accounts with a similarity of <50% with both initial cluster centers as irrelevant accounts (such as normal personal consumption accounts) and exclude them; (4) Threshold basis: Through 9 sets of experiments (threshold 50%-90%), it was verified that when the threshold is 85%, the "false negative rate" (abnormal accounts are mistakenly judged as normal accounts) of the suspicious account group is 2.5%, and the "false positive rate" (normal accounts are mistakenly judged as suspicious accounts) is 4.8%, which is the best overall effect.

[0014] Step 4: Case clustering based on graph clustering (1) Construct a fund transaction graph for the “suspicious and abnormal fundraising account group”: with the account as the node and the transaction relationship (with fund transfer) as the edge, the edge weight is “transaction amount × transaction frequency × correlation strength feature value in AI features” (the correlation strength feature value is taken from the “core account fund concentration” in step 2 to strengthen the closeness of risk correlation); (2) Use spectral clustering algorithm to divide the transaction graph: ① Calculate the Laplace matrix of the transaction graph; ② Perform eigenvalue decomposition on the Laplace matrix and select the eigenvectors corresponding to the first k largest eigenvalues ​​to construct the sample matrix; ③ Use the K-means algorithm to cluster the sample matrix and group the subgraphs with "highly interconnected funds" (such as the same account transferring funds to multiple accounts, and these accounts having no other external funding sources) into a "case cluster"; (3) Algorithm advantages: Compared with the DBSCAN algorithm commonly used in existing technologies, spectral clustering combined with AI association strength features has higher processing accuracy for "sparse transaction graphs" (abnormal fundraising accounts are mostly "one-to-many" associations), and the accuracy of case cluster division is improved by 16%.

[0015] Step 5: Automatic labeling of "Fundraiser / Investor" (1) Model training: Using the manually labeled data in step 1 as the training set, train a random forest classification model (parameters: 100 decision trees, maximum depth of 15 layers, feature selection method is "Gini coefficient"), and input features are the 12-dimensional AI fusion features in step 2; (2) Label output: Input the accounts in each case cluster after clustering in step 4 into the model and output the labels (judgment criteria: "fundraiser" must meet the AI ​​features of "funds collection rate fluctuation coefficient > 1.2" and "core account funds concentration > 0.6"; "investor" must meet the features of "small amount dispersed transfer intensity > 0.8" and "non-working day transfer ratio > 0.4"). (3) Rule verification and manual review: 1. If an account is marked as “fundraiser” but has no transfer records to other accounts, manual review is triggered; 2. If an account is marked as “investor” but the “month-end fund inflow peak” in the AI ​​feature is >0.7 (there is a large inflow, which does not meet the investor feature), manual review is triggered; 3. If the label is confirmed to be incorrect after review, the label is corrected and the AI ​​model training set is updated to optimize the subsequent feature extraction accuracy.

[0016] Step 6: Visualization of AI Features and Recognition Results (1) Feature visualization: The distribution of 12-dimensional feature weights extracted by AI is displayed through heat maps, and “high-risk feature items” are marked (such as “cross-regional transaction ratio feature weight 0.8” and “periodic transfer intensity 0.9” for a certain account) to help regulators quickly locate risk points; (2) Results visualization: The network diagram shows the account associations within the case cluster (node ​​size represents transaction amount, and edge thickness represents association strength), and the regional heat map shows the regional distribution of cluster accounts. Results can be exported (PDF / Excel format).

[0017] The above description is merely a preferred embodiment of the present invention and is used only to illustrate the technical solution of the present invention, and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention are included within the scope of protection of the present invention.

Claims

1. A method for identifying, clustering and labeling abnormal fund-raising account groups based on fund flow data, characterized in that, First, the fund flow data is divided into time series / structured data, the time series features are captured through the LSTM attention layer, the structured features are extracted through the autoencoder with risk penalty term, and the 12-dimensional AI features are obtained after weighted fusion; then the semi-supervised K-means is used to identify suspicious account groups, the spectral clustering is used to divide case clusters, the random forest is used to label fund-raising person / investor labels, and three layers of verification are used to ensure accuracy. 2.The method of claim 1, characterized in that, The specific steps are as follows: Step 1): data preprocessing and data set construction, collecting multi-source fund flow data, eliminating invalid transactions, completing missing fields, then dividing into time series data and structured data, and then associating with artificially labeled fund-raising account, investor account, and irrelevant account data to construct an initial data set containing labels, and dividing into training set, validation set, and test set; Step 2): abnormal fund-raising feature extraction based on customized AI module, constructing a time series LSTM-structured autoencoder fusion AI feature extraction module, which includes three subunits: (1) Time series feature extraction subunit: using 3-layer LSTM network + 1-layer 4-head attention layer, the attention layer increases the weight of the sample by 2 times for "single amount>50000" and "same receiving and paying account number single day transaction≥3"; input is the encoded 30-day transaction time series sequence, output is 6-dimensional time series risk features; (2) Structured feature extraction subunit: using stacked autoencoder SAE, adding abnormal fund-raising risk penalty term to the decoder loss function; input is 20 original structured fields, output is 6-dimensional structured risk features; (3) Feature fusion and verification subunit: weighted fusion of the outputs of the first two subunits through attention, introducing risk feature verification loss, if the loss value>0.1, adjust the parameters of the first two subunits, finally output 12-dimensional AI fusion feature vector; At the same time, train the AI module with the training set of step 1), use Adam optimizer, and the joint loss function is "time series LSTM cross-entropy loss + SAE reconstruction MSE loss + feature verification cross-entropy loss", iterate until the validation set joint loss value≤0.08; Step 3): abnormal fund-raising account group identification based on semi-supervised learning, using semi-supervised K-means algorithm, taking 12-dimensional AI fusion feature vector of step 2) as input, taking AI feature mean of artificially labeled account as initial clustering center, calculating the cosine similarity between unlabeled account and initial center, and classifying the accounts with similarity≥85% into suspicious abnormal fund-raising account group, and classifying the accounts with similarity all<50% as irrelevant accounts and excluding them; Step 4): case cluster division based on graph clustering, constructing the suspicious abnormal fund-raising account group into a fund transaction graph, and using the spectral clustering algorithm to divide the subgraph with high fund interconnection into a case cluster; Step 5): Automatic labeling of fund-raiser / investor tags, using the manually labeled data from Step 1 as the training set, training a random forest classification model with input as the AI fusion feature vector from Step 2, and outputting the label; performing rule verification on the label, triggering manual review and correcting incorrect labels; Step 6): AI feature and recognition result visualization output, displaying AI feature weight distribution through a heat map and case cluster account association through a network graph, and supporting result export.

3. The method of claim 2, wherein The multi-source fund flow data includes, but is not limited to, bank account transaction records, third-party payment account flow, and digital currency transaction flow. Invalid transaction determination rules: 1) Transaction amount ≤ 0 yuan; 2) Self-transfer of the same account; 3) Transaction remarks containing "test" or "correct" keywords; 4) Transaction time during system maintenance period.

4. The method of claim 2, wherein The stacked autoencoder SAE has an encoder dimension of 20→128→64→6 and a decoder dimension of 6→64→128→20. The decoder loss function adds an abnormal fund-raising risk penalty term, i.e., when the cross-region transaction proportion feature weight is <0.3 or the number of core associated accounts is <5, the reconstruction error MSE increases by 1.5 times.

5. The method of claim 2, wherein The 6-dimensional structured risk features include associated account regional distribution entropy, core account fund concentration, enterprise account transfer-in proportion, fund collection rate fluctuation coefficient, cross-bank transaction proportion, and small dispersed transfer-out intensity.

6. The method of claim 2, wherein The 6-dimensional time series risk features include 30-day large transaction time series concentration, periodic transfer intensity, single-day high-frequency associated transaction proportion, cross-period transaction fluctuation, monthly fund inflow peak value, and non-working day transfer proportion.

7. The method of claim 2, wherein The fund transaction graph is a graph with accounts as nodes and transaction relationships as edges, with edge weights = transaction amount × transaction frequency × core account fund concentration feature value from Step 2.

8. The method of claim 2, wherein The output labels include fund-raiser: fund collection rate fluctuation coefficient >1.2 and core account fund concentration >0.6; Investor: small dispersed transfer-out intensity >0.8 and non-working day transfer proportion >0.

4.

9. The method of claim 2, wherein The rule verification includes a) labeling fund-raiser but no transfer-out record, and b) labeling investor but monthly fund inflow peak value >0.7.