Common transaction behavior identification method and system based on dynamic association strength

Abstract

The invention discloses a common transaction behavior identification method and system based on dynamic association strength, and belongs to the field of big data analysis and financial science and technology. Aiming at the problems of single dimension, low performance and lack of timeliness of the existing financial common transaction identification method, the method comprises the following steps: firstly, extracting frequency, amount and time multi-dimensional features of a transaction entity pair based on a sliding time window and standardizing the features; clustering coarse screening data through an improved DBSCAN, and mining a frequent item set in a clustering cluster by using an FP-Growth algorithm; then constructing an association strength scoring function to screen significant common transaction groups; and finally, realizing dynamic updating of the model through incremental updating, intensity attenuation judgment and trigger type local recalculation. According to the invention, efficient, accurate and real-time identification of common transaction behaviors in financial mass transaction flow data is realized, and the intelligence and timeliness of financial risk control are improved.

Description

Technical Field

[0001] This invention belongs to the field of big data analysis and data mining technology, and particularly relates to the technology for identifying common trading behaviors in the field of financial technology. Specifically, it is a method, system, electronic device and computer-readable storage medium for identifying common trading behaviors based on dynamic correlation strength. Background Technology

[0002] With the rapid development of electronic payments and digital finance, the daily transaction volume data generated by financial entities such as banks and payment institutions is growing exponentially. This data contains rich characteristics of transaction behavior and is an important basis for identifying financial risks and preventing financial fraud. In various financial risk control scenarios, identifying "joint transaction behavior"—that is, frequent and specific patterned transactions between multiple transaction entities and one or more common counterparties—is a key step in discovering organized financial risks.

[0003] Currently, existing methods for identifying common transaction behaviors in the industry have significant technical shortcomings: First, rule-based identification methods rely on static preset rules, which can only identify simple transaction patterns. When faced with complex and deliberately avoided fraudulent transactions, the false positive and false negative rates remain high, and the rule maintenance costs are also high. Second, traditional frequent itemset mining methods only focus on whether transactions "co-occur," ignoring key dimensions such as transaction frequency, amount, and time. The mining results have poor practicality and suffer from severe computational performance bottlenecks under massive data. Third, although static graph analysis methods can construct transaction networks, the storage and computational resources required for the full graph are large, and a full recalculation is required after data updates, which cannot meet the needs of real-time identification.

[0004] The common problems of existing technologies can be summarized as single dimension, low performance and lack of timeliness. Therefore, there is an urgent need in this field for a common transaction behavior identification scheme that can integrate multi-dimensional transaction features, efficiently process massive data and support dynamic updates, so as to solve the technical pain points of common transaction identification in financial risk control. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention provides a method and system for identifying common transaction behaviors based on dynamic association strength. It aims to achieve efficient, accurate, and real-time identification of common transaction behaviors in massive transaction flow data in the financial field through multi-dimensional feature fusion, improved clustering and association mining algorithms, and dynamic update mechanisms, thereby enhancing the intelligence and timeliness of financial risk control.

[0006] Firstly, this invention proposes a method for identifying joint transaction behavior based on dynamic correlation strength, applied to identify joint transaction behavior of entity groups with common counterparties in massive transaction flow data in the financial field. The method includes the following steps:

[0007] S1. Multi-dimensional feature streaming extraction and construction: Receive historical transaction flow data, extract multi-dimensional features for each pair of transaction entities (i,j) based on a preset sliding time window. The multi-dimensional features include frequency feature F, amount feature M, and time feature T. Perform Z-Score standardization on the multi-dimensional features and output a feature vector set {Vi,j}, where Vi,j is the feature vector of the transaction entity pair (i,j).

[0008] S2. Improved DBSCAN clustering analysis: The output feature vector set is used as input, and the improved DBSCAN clustering algorithm is used to perform clustering analysis, outputting a set of clusters {C1,C2,...,Ck};

[0009] S3. Intra-cluster FP-Growth Association Rule Mining: Treat each output cluster Ci as an independent transaction database, set a minimum support threshold min_sup, apply the FP-Growth algorithm to mine frequent itemsets within each cluster, and output the frequent itemset set;

[0010] S4. Calculation of Comprehensive Association Strength Score: For each frequent itemset in the output, construct a comprehensive association strength score function to calculate its association strength Sgroup; set an association strength threshold Sthreshold, and filter out frequent itemsets with Sgroup ≥ Sthreshold as significant common transaction groups; and

[0011] S5. Dynamic Update Mechanism: Real-time monitoring of new transaction data Dnew; when new transaction data flows in, only the feature vectors Vi,j of the transaction entity pairs affected by Dnew are incrementally updated; periodically scanning of identified significant common transaction groups and recalculating their correlation strength. If new If the population is below the inactive threshold (Sinactive), it is marked as "inactive" and removed. Simultaneously, the magnitude of the change in the feature vector after the incremental update (||v) compared to the original feature vector is calculated. new -v old If the change exceeds the preset threshold The corresponding transaction entity pairs are marked as "significant change points" and moved into the buffer pool. When the number of "significant change points" in the buffer pool reaches a preset scale or a preset trigger time is reached, local re-clustering and local association rule mining are initiated for the transaction entity pairs in the buffer pool and their original clusters, and significant common transaction groups are updated.

[0012] Preferably, in step S1, the frequency feature F is the total number of transactions of the transaction entity pair (i,j) within the sliding time window, calculated using the following formula:

[0013] Where T is the transaction timestamp, K is the current time, and I(·) is the indicator function, which takes the value of 1 when there is a transaction in the window, and 0 otherwise.

[0014] Preferably, in step S1, the time characteristic T includes a time decay factor and transaction interval stability; the time decay factor ΔT = Kt last , where t last The timestamp of the most recent transaction for transaction entity pair (i,j); transaction interval stability is the standard deviation of the time interval between consecutive transactions. Eigenvector Vi,j=(F,M) total M avg M std ,ΔT,T std ,…).

[0015] Preferably, in step S2, the improved DBSCAN clustering algorithm uses weighted Mahalanobis distance as the distance metric. In the weighted Mahalanobis distance, the weights of monetary and frequency features are higher than those of time features. The neighborhood radius ε and the minimum number of points MinPts are dynamically adjusted based on the k-distance graph and clustering results. The formula for calculating the weighted Mahalanobis distance is as follows: Where S is the covariance matrix of the eigenvectors, and S-1 is the inverse matrix of S.

[0016] Preferably, in step S4, the comprehensive scoring function for correlation strength is: Among them, w f For frequency weight, w m Weighted by amount, w t The time weight is given, and w satisfies f +w m +w t =1; log(F) sum +1) represents the logarithm of the total transaction frequency of the group; The normalized total amount is processed using the hyperbolic tangent function; exp(-λ·T) avg ) is the average time difference processed by the exponential decay function, and λ is the decay coefficient.

[0017] Preferably, in step S1, the parameters of the sliding time window are: window size Twindow = 30 days and sliding step size Tslide = 1 day.

[0018] In a second aspect, embodiments of the present invention provide a joint transaction behavior identification system based on dynamic correlation strength, used to implement the method described in any one of the first aspects, including:

[0019] Feature extraction module: Used to receive historical transaction flow data, extract multi-dimensional features for each pair of transaction entities (i,j) based on a preset sliding time window. The multi-dimensional features include frequency feature F, amount feature M, and time feature T. The multi-dimensional features are then Z-score standardized to output a feature vector set {Vi,j}, where Vi,j is the feature vector of the transaction entity pair (i,j).

[0020] Clustering analysis module: It receives the feature vector set output by the feature extraction module as input, performs clustering analysis using the improved DBSCAN clustering algorithm, and outputs a set of clusters {C1,C2,...,Ck};

[0021] Association mining module: It receives the output of the clustering analysis module, treats each cluster Ci as an independent transaction database, sets a minimum support threshold min_sup, applies the FP-Growth algorithm to mine frequent itemsets within each cluster, and outputs a set of frequent itemsets.

[0022] The strength scoring module receives the set of frequent itemsets output by the association mining module. For each frequent itemset, it constructs a comprehensive association strength scoring function to calculate its association strength Sgroup; sets an association strength threshold Sthreshold, and filters out frequent itemsets with Sgroup ≥ Sthreshold as significant common transaction groups; and so on.

[0023] The dynamic update module is used to monitor new transaction data Dnew in real time. When new transaction data flows in, it only incrementally updates the feature vectors Vi,j of the transaction entity pairs affected by Dnew; it also periodically scans the identified significant common transaction groups and recalculates their correlation strength. If new If the population is below the inactive threshold (Sinactive), it is marked as "inactive" and removed. Simultaneously, the magnitude of the change in the feature vector after the incremental update (||v) compared to the original feature vector is calculated. new -v old If the change exceeds the preset threshold The corresponding transaction entity pairs are marked as "significant change points" and moved into the buffer pool. When the number of "significant change points" in the buffer pool reaches a preset scale or a preset trigger time is reached, local re-clustering and local association rule mining are initiated for the transaction entity pairs in the buffer pool and their original clusters, and significant common transaction groups are updated.

[0024] Preferably, in the feature extraction module, the extraction logic of the multi-dimensional features is as follows: frequency feature F is extracted according to... The calculations show that the monetary characteristic M includes total amount, average amount, and monetary volatility, while the time characteristic T includes time decay factor and transaction interval stability.

[0025] Preferably, in the intensity scoring module, the weight w of the correlation intensity comprehensive scoring function f w m w t It is obtained through training using logistic regression or entropy weighting, and w f +w m +w t =1.

[0026] Preferably, the sliding time window parameters of the feature extraction module are Twindow = 30 days and Tslide = 1 day.

[0027] Thirdly, embodiments of the present invention provide an electronic device, including: one or more processors; and a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the method described in any implementation of the first aspect.

[0028] Fourthly, embodiments of the present invention provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method as described in any of the implementations of the first aspect.

[0029] Compared with the prior art, the beneficial results of the present invention are as follows:

[0030] (1) More comprehensive identification dimensions: It integrates multiple dimensions such as transaction frequency, amount, and time, and constructs a quantitative correlation strength index, which breaks through the limitations of single-dimensional analysis in existing technologies and can more accurately depict the characteristics of common transaction behavior.

[0031] (2) More efficient processing: By adopting the two-layer strategy of "improved DBSCAN clustering preprocessing + intra-cluster FP-Growth mining", the scope of association mining is reduced from the full data to the cluster, which solves the computing performance bottleneck under massive data.

[0032] (3) More timely: The innovative dynamic update mechanism adopts "incremental update + trigger-based local recalculation", which can respond to changes in new transaction data in real time without full recalculation, avoiding the analysis lag problem of static models;

[0033] (4) High practicality and interpretability: The correlation strength index is a quantitative scalar with a clear meaning, which is easy for financial business personnel to understand and apply. At the same time, the design of the system modules and the combination of electronic devices and storage media can be quickly implemented in the actual scenario of financial risk control. Attached Figure Description

[0034] The accompanying drawings are included to provide a further understanding of the embodiments and are incorporated in and constitute a part of this specification. The drawings illustrate embodiments and, together with the description, serve to explain the principles of the invention. Other embodiments and many anticipated advantages of the embodiments will be readily recognized as they become better understood through reference to the following detailed description. Elements in the drawings are not necessarily to scale. The same reference numerals refer to corresponding similar parts.

[0035] Figure 1 This is a schematic diagram of the overall algorithm flow of the joint transaction behavior identification method based on dynamic correlation strength according to an embodiment of the present invention;

[0036] Figure 2 This is a sub-flowchart of the dynamic update mechanism in an embodiment of the present invention;

[0037] Figure 3 This is a visualized network diagram of a common trading group in an embodiment of the present invention;

[0038] Figure 4 This is a module architecture diagram of a joint transaction behavior identification system based on dynamic correlation strength, according to an embodiment of the present invention.

[0039] Figure 5 This is a schematic diagram of the structure of a computer device suitable for implementing electronic devices according to embodiments of the present invention. Detailed Implementation

[0040] The present invention will now be described in further detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and not intended to limit it. Furthermore, it should be noted that, for ease of description, only the parts relevant to the invention are shown in the accompanying drawings.

[0041] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other. The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0042] The common shortcomings of existing technologies are: limited dimensionality, low performance, and lack of timeliness. Therefore, there is an urgent need in this field for a technical solution that can efficiently process massive amounts of data, deeply integrate multi-dimensional features, and have dynamic update capabilities.

[0043] The purpose of this invention is to address the above-mentioned problems by providing an efficient, accurate, and dynamically updated method for identifying common trading behaviors, thereby solving the challenge of mining common trading patterns from complex trading networks in real time and from multiple dimensions.

[0044] By integrating multi-dimensional feature analysis, improved clustering and association rule mining algorithms, and introducing an innovative dynamic update mechanism, efficient, accurate, and real-time identification of common transaction behaviors is achieved.

[0045] Addressing the issues of single-dimensional features that ignore key characteristics such as amount and time, and rigid rules that fail to uncover complex and hidden patterns, this invention introduces multi-dimensional feature fusion analysis. This analysis comprehensively considers multiple dimensions of information, including transaction frequency, amount, and time intervals, to more fully characterize transaction behavior.

[0046] To address the issue of poor query performance and difficulty in real-time or near-real-time analysis under massive datasets, this invention employs a "clustering preprocessing" strategy. This involves first narrowing down the candidate set using an efficient clustering algorithm, and then performing refined association rule mining within each cluster, significantly improving analysis efficiency.

[0047] To address the issue of analysis results being outdated and failing to reflect dynamic changes in transaction relationships, this invention employs a dynamic update mechanism. Through incremental learning and a correlation strength decay model, the system can capture changes in transaction behavior in real time, maintaining the model's timeliness.

[0048] We construct a "correlation strength" index, which quantifies the closeness of the correlation by comprehensively considering multiple factors such as the number of transactions, amount, and time, to avoid randomness and improve the accuracy of identification.

[0049] Firstly, Figure 1 This invention discloses an embodiment of a method for identifying joint transaction behavior based on dynamic association strength, applied to identify joint transaction behavior of entity groups with common counterparties in massive transaction flow data in the financial field, such as... Figure 1 As shown, the method includes the following steps:

[0050] S1. Multi-dimensional feature streaming extraction and construction: Receive historical transaction flow data, extract multi-dimensional features for each pair of transaction entities (i,j) based on a preset sliding time window. The multi-dimensional features include frequency feature F, amount feature M, and time feature T. Perform Z-Score standardization on the multi-dimensional features and output a feature vector set {Vi,j}, where Vi,j is the feature vector of the transaction entity pair (i,j).

[0051] Specifically, in this step, the frequency feature F is the total number of transactions for the transaction entity pair (i,j) within the sliding time window, calculated using the following formula:

[0052] Where T is the transaction timestamp, K is the current time, and I(·) is the indicator function, which takes a value of 1 when a transaction exists within the window and 0 otherwise. The time characteristic T includes the time decay factor and transaction interval stability; the time decay factor ΔT = Ktlas t, where t last The timestamp of the most recent transaction for transaction entity pair (i,j); transaction interval stability is the standard deviation of the time interval between consecutive transactions. Eigenvector Vi,j=(F,M) total M avg M std ,ΔT,T std ,…).

[0053] In one specific embodiment, this step includes setting the sliding time window Twindow to 30 days and the sliding step size Tslide to 1 day. For the transaction flow within each window, the frequency feature (F), amount feature (M, including total amount, average amount, and standard deviation), and time feature (T, including time decay factor and interval stability) are calculated for each pair of transaction entities, and Z-score normalization is performed to form a feature vector.

[0054] S2. Improved DBSCAN clustering analysis: The output feature vector set is used as input, and the improved DBSCAN clustering algorithm is used to perform clustering analysis, outputting a set of clusters {C1,C2,...,Ck};

[0055] Specifically, in this step, the improved DBSCAN clustering algorithm uses weighted Mahalanobis distance as the distance metric. In the weighted Mahalanobis distance, the weights of monetary and frequency features are higher than those of time features. The neighborhood radius ε and the minimum number of points MinPts are dynamically adjusted based on the k-distance graph and clustering results. The formula for calculating the weighted Mahalanobis distance is as follows: Where S is the covariance matrix of the eigenvectors, and S-1 is the inverse matrix of S.

[0056] In one specific embodiment, this step employs a modified DBSCAN algorithm for clustering. The distance metric used is a weighted Mahalanobis distance, with higher weights assigned to monetary and frequency features. Initially, ε = 0.5 and MinPts = 10 are determined using a k-distance graph, and then fine-tuned to ε = 0.55 and MinPts = 8 based on the clustering results. Ultimately, the data is divided into approximately 500 effective clusters and some noisy points.

[0057] S3. Intra-cluster FP-Growth Association Rule Mining: Treat each output cluster Ci as an independent transaction database, set a minimum support threshold min_sup, apply the FP-Growth algorithm to mine frequent itemsets within each cluster, and output the frequent itemset set;

[0058] In a specific embodiment, this step specifically includes: for each cluster, setting a minimum support min_sup = 0.1 (i.e., the counterparty appears more frequently in entities within the cluster than 10%), and applying the FP-Growth algorithm to mine frequent itemsets. For example, mining a frequent itemset {merchant M1, merchant M2} in a cluster indicates that multiple accounts with similar behavioral patterns to that cluster have transactions with M1 and M2.

[0059] S4. Calculation of Comprehensive Association Strength Score: For each frequent itemset in the output, construct a comprehensive association strength score function to calculate its association strength Sgroup; set an association strength threshold Sthreshold, and filter out frequent itemsets with Sgroup ≥ Sthreshold as significant common transaction groups; and

[0060] Specifically, in this step, the comprehensive scoring function for correlation strength is:

[0061] Among them, w f For frequency weight, w m Weighted by amount, w t The time weight is given, and w satisfies f +w m +w t =1; log(F) sum +1) represents the logarithm of the total transaction frequency of the group; The normalized total amount is processed using the hyperbolic tangent function; exp(-λ·ΔT) avg ) is the average time difference processed by the exponential decay function, and λ is the decay coefficient.

[0062] In a specific embodiment, the association strength is calculated for the frequent itemset {merchant M1, merchant M2} in step S3 above. A weight w is set. f =0.4,w m =0.4,w t =0.2, attenuation coefficient λ =0.1. Assume the total transaction frequency F of this group is... sum =150, normalized total amount Mean time difference ΔT avg =5 days, then S is calculated. group ≈0.76. If the threshold Sthreshold = 0.6 is set, the group is considered a valid joint trading group.

[0063] S5. Dynamic Update Mechanism: Real-time monitoring of new transaction data Dnew; when new transaction data flows in, only the feature vectors Vi,j of the transaction entity pairs affected by Dnew are incrementally updated; periodically scanning of identified significant common transaction groups and recalculating their correlation strength. If new If the population is below the failure threshold (Sinactive), then the population is marked as "failed" and removed.

[0064] Simultaneously, calculate the magnitude of change ||v| between the incrementally updated feature vector and the original feature vector. new -v old If the change exceeds the preset threshold The corresponding transaction entity pairs are marked as "significant change points" and moved into the buffer pool. When the number of "significant change points" in the buffer pool reaches a preset scale or a preset trigger time is reached, local re-clustering and local association rule mining are initiated for the transaction entity pairs in the buffer pool and their original clusters, and significant common transaction groups are updated.

[0065] Specifically, the system receives new transaction data daily. For new transactions, only the feature values ​​of relevant entity pairs within the most recent time window are updated. The identified group is scanned every 24 hours (ΔTscan), and its strength is recalculated. If the feature vector change of an account exceeds a threshold... Then, the accounts are placed in the buffer pool. When the number of accounts in the buffer pool reaches 100, a local re-clustering and association mining is triggered for these accounts and their original clusters, and the identification results are updated.

[0066] In one specific embodiment, the overall data processing flow of the present invention is as follows: Figure 1 As shown, it illustrates the complete algorithm chain from raw data input to final result output, specifically including the following steps:

[0067] 1: Multi-dimensional streaming feature extraction (S1): The system receives the input historical transaction data, performs streaming feature calculation in parallel, and cleans and standardizes the original transaction data.

[0068] To capture the characteristics of data changing over time and meet the requirements of streaming processing, a streaming feature computation based on a sliding time window is adopted. The window size Twindow (e.g., 30 days) and the sliding step Tslide (e.g., 1 day) are set. The system calculates streaming features within each window w... k Feature statistics are performed within the range [K-Twindow, K], where K is the current time point. This allows the features to dynamically reflect recent transaction behavior and lays the foundation for incremental updates to the model.

[0069] For each pair of transactions (e.g., account A → account B), the following multi-dimensional features are extracted to form a feature vector:

[0070] Frequency characteristic (F): The total number of transactions within a specific time window.

[0071] Quantity characteristics (M): total transaction amount, average amount, volatility of amount (standard deviation), etc.

[0072] Time characteristics (T): include the time difference of the most recent transaction (time decay factor) and the stability of the time interval between consecutive transactions (standard deviation).

[0073] Feature construction and calculation: For any pair of transaction entities (i,j) (e.g., user i and merchant j), in window w k The following features are calculated internally:

[0074] Frequency feature (F):

[0075]

[0076] Where K is the current time, and I(·) is an indicator function that takes the value 1 when there is a transaction in the window, and 0 otherwise.

[0077] Transaction amount characteristics (M):

[0078] lump sum:

[0079] Average amount:

[0080] Volatility of amount (standard deviation):

[0081] Normalization: To eliminate the influence of different feature dimensions, the above features are normalized using Z-Score.

[0082]

[0083] Where μ M and σ M These are the mean and standard deviation of the feature across all samples.

[0084] Transaction time characteristics (T):

[0085] Time decay factor: ΔT = Kt last , where t last The timestamp of the most recent transaction.

[0086] Transaction interval stability: Calculate the standard deviation of consecutive transaction time intervals. The smaller the value, the more regular the trading behavior.

[0087] Output: Each trading pair (i,j) is ultimately represented as a high-dimensional feature vector Vi,j = (F,M) total M avg M std ,ΔT,T std ,…). This vector forms the basis for all subsequent analyses.

[0088] 2. Behavioral pattern coarse screening based on improved clustering algorithm (S2): The improved DBSCAN algorithm is used to cluster all feature vectors, and trading pairs with similar trading behavior patterns are divided into the same cluster to achieve data dimensionality reduction.

[0089] Algorithm input: The set of feature vectors V = {v1, v2, ..., vn} obtained after preprocessing.

[0090] 2.1: Distance Metric Innovation: Employing weighted Mahalanobis distance to more accurately measure behavioral similarity. Addressing correlations between features and reflecting business weights:

[0091] Weighted Euclidean distance:

[0092]

[0093] Here, w* represents the weights assigned to different feature dimensions based on business knowledge, emphasizing the importance of frequency and amount.

[0094] Distance from Maharanobis:

[0095]

[0096] Where S is the covariance matrix of the feature vectors, and this distance can automatically handle the correlation between features, which is more consistent with the data distribution.

[0097] 2.2: Parameter Adaptive Selection: A parameter adaptive selection mechanism based on k-distance graph and clustering result evaluation is adopted to dynamically adjust the neighborhood radius (ε) and minimum number of points (MinPts) to obtain stable clustering results.

[0098] Algorithm output: a cluster C = {C1, C2, ..., Ck} and noise points. Each cluster Ci contains a set of trading pairs with highly similar trading behavior patterns.

[0099] The goal of this stage is not to directly identify common trading groups, but rather to reduce the dimensionality of the data and shrink the search space. By clustering, massive trading pairs are divided into multiple subsets with similar behaviors. Subsequent association rule mining is then performed only within each subset, greatly improving computational efficiency.

[0100] 3. Refined Mining of Intra-Cluster Association Rules (S3): Each cluster obtained in S2 is treated as an independent transaction database, transaction entities are considered "transactions," and their counterparty sets are considered "itemsets." The FP-Growth algorithm is applied to mine frequent itemsets (i.e., potential groups of common counterparties) between entities within the cluster. Since the data size has been significantly reduced within the cluster, this step effectively avoids the performance bottleneck of traditional association rule mining under massive data.

[0101] 3.1 Constructing an FP-Tree:

[0102] 3.1.1: Scan all transactions within the cluster, calculate the support for each item (opponent), and filter out items whose support is lower than the minimum support threshold min_sup.

[0103] 3.1.2 Sort the items in descending order of support to obtain a list of frequent items.

[0104] 3.1.3 Scan the transaction data again, sort the items in each transaction by the list of frequent items, and insert them into the FP-Tree. Paths that share the same prefix are merged, which greatly compresses the data storage.

[0105] 3.2 Mining Frequent Itemsets from FP-Tree:

[0106] 3.2.1 Generate a conditional pattern base (a set of prefix paths containing all paths of that item) for each item from the FP-Tree.

[0107] 3.2.2 Construct a conditional FP-Tree for each conditional pattern base.

[0108] 3.2.3 Recursively mine on the conditional FP-Tree until the tree is empty or contains only one path. At this point, all combinations on that path are frequent itemsets.

[0109] The FP-Growth algorithm, through its tree structure and divide-and-conquer strategy, operates within significantly smaller clusters rather than on the entire dataset, avoiding the generation of a large number of candidate sets and significantly improving mining efficiency. It is suitable for rapid analysis of large clusters and solves the performance bottleneck problem of traditional methods on massive datasets.

[0110] 4. Association Strength Quantification and Group Screening (S4): For each frequent itemset (representing a potential group) mined in S3, the association strength value S is calculated using a comprehensive scoring algorithm. This value combines the group's transaction frequency, total amount, and most recent transaction time, aiming to transform the vague concept of "frequent" into a quantifiable and interpretable "association strength" indicator.

[0111] Comprehensive strength function: For a mined frequent itemset (i.e., candidate group), its association strength Sgroup is calculated by the following formula:

[0112]

[0113] Function analysis:

[0114] log(F sum+1): Take the logarithm of the total frequency of transactions in the group. Using a logarithmic function prevents excessively high frequencies from dominating the results; "+1" avoids zero-frequency errors.

[0115] The hyperbolic tangent function processes the normalized total amount. This function maps the amount contribution to the (0,1) interval and exhibits saturation characteristics, which aligns with business logic.

[0116] exp(-λ·ΔT avg The exponential decay function handles the average time difference. λ is the decay coefficient, which controls the rate at which the intensity decays over time, ensuring that recent transactions contribute more.

[0117] Weight configuration: weight parameter w f ,w m ,w t It can be obtained through domain knowledge pre-setting, or by using historical samples and training with machine learning algorithms such as logistic regression and entropy weight method.

[0118] Output: Each frequent itemset is computed with a scalar strength value Sgroup∈(0,+∞). By setting a threshold Sthreshold, the group is considered a significant common trading group only if Sgroup≥Sthreshold.

[0119] 5. Dynamic Update Mechanism (S5): The system continuously monitors new data. When a new transaction flows in, the feature vector is incrementally updated, and the degree of change determines whether to trigger retraining (re-clustering and re-mining) of the local model.

[0120] This mechanism ensures that the system can update the model in near real-time without requiring a full recalculation, greatly improving efficiency. The process is as follows: Figure 2 As shown.

[0121] Incremental feature update:

[0122] When new transaction data Dnew flows in, the system only updates the feature vectors vi,j of the affected entity pairs.

[0123] Using a streaming update formula, such as:

[0124]

[0125] This calculation method requires very little computation and is extremely fast.

[0126] Correlation strength decay and triggered recalculation:

[0127] 5.1. The system maintains a list of all identified populations and their strength values ​​Sgroup.

[0128] 5.2 Periodically (e.g., every ΔTscan time), perform a scan procedure to recalculate ΔTavg for each population using the latest time Knew.

[0129] 5.3. Attenuation Judgment: If the new intensity value of a certain population... If the population is below the failure threshold (Sinactive), then the population is marked as "failed" and removed from the results.

[0130] 5.4. Trigger Decision: If the change in the feature vector of an entity is ||v new -v old || Exceeds the threshold These points are then marked as "significant change points" and moved to a buffer pool. When the number of change points in the buffer pool reaches a predetermined size or a trigger time is reached, local re-clustering and local association rule mining are initiated for these points and related clusters, instead of initiating global computation. This maintains the model's up-to-date state with extremely low computational cost. This mechanism avoids frequent recalculation of the global model, achieving "up-to-date" model performance with minimal computational overhead, and ensuring the rationality and feasibility of the technical solution.

[0131] Visualization: such as Figure 3 As shown, the recognition results can be visually displayed through a network diagram.

[0132] 8.1 Nodes: Circular nodes represent counterparties in a transaction (e.g., merchants M1, M2, M3), and square nodes represent transaction entities (e.g., accounts A, B, C, D). The size of a node can map its transaction activity (e.g., degree centrality).

[0133] 8.2 Edges: The lines connecting nodes represent shared transaction relationships. The thickness of the lines directly reflects the magnitude of the association strength S calculated in step S4. As shown in the figure, accounts A, B, C, and D have the highest association strength (S = 0.92) with merchant M1, so their lines are the thickest; their association strength with M3 is the weakest (S = 0.45), so their lines are the thinnest and may not even be displayed.

[0134] 8.3 Clusters: Through layout algorithms, strongly related nodes will naturally cluster together to form a clear cluster (as shown in the dashed box), allowing users to easily identify potential joint trading groups. This visualization method presents complex analysis results intuitively and efficiently.

[0135] This embodiment successfully identified multiple significant common transaction groups within the commercial bank through the aforementioned steps. Accounts A, B, C, and D showed the strongest association with merchants M1 and M2. Manual verification confirmed that this group was suspected of credit card cash-out activities, validating the effectiveness of the method presented in this invention. Furthermore, compared to the traditional FP-Growth algorithm, the "clustering + mining" strategy of this invention reduces processing time from 12 hours to 2 hours, and the dynamic update mechanism keeps the model's response time to new data within 1 hour, significantly improving identification efficiency and timeliness.

[0136] The novelty of the embodiments of the present invention lies in:

[0137] 1. Comprehensive and accurate: By integrating multiple dimensions such as transaction frequency, amount, and time, it overcomes the limitations of single-dimensional analysis and provides a more comprehensive and accurate portrayal of common transaction behaviors.

[0138] 2. High-efficiency processing: By adopting a two-layer strategy of "clustering preprocessing to narrow down the search space and then fine mining within the cluster", the performance bottleneck under massive data is effectively solved, and the analysis efficiency is significantly higher than that of traditional methods.

[0139] 3. Dynamic Real-time: The innovative dynamic update mechanism (incremental update, intensity decay, and triggered local recalculation) enables the system to respond to data changes in near real-time, ensuring the timeliness of analysis results and overcoming the problem of lag in static models.

[0140] 4. High interpretability: The designed correlation strength index is a comprehensive and quantitative scalar with a clear meaning, which is easy for business personnel to understand and apply, thus improving the credibility and usability of the results.

[0141] Further reference Figure 4 As an implementation of the methods shown in the above figures, this application provides an embodiment of a joint transaction behavior identification system based on dynamic correlation strength. This system embodiment is similar to... Figure 1 Corresponding to the method embodiments shown, the system can be specifically applied to various electronic devices.

[0142] Secondly, embodiments of the present invention also disclose a joint transaction behavior identification system based on dynamic correlation strength, used to implement the method described in any one of the first aspects, such as... Figure 4 As shown, it includes: feature extraction module 41, cluster analysis module 42, association mining module 43, strength scoring module 44, and dynamic update module 45.

[0143] In one specific embodiment, the feature extraction module 41 is used to receive historical transaction flow data, extract multi-dimensional features for each pair of transaction entities (i,j) based on a preset sliding time window, the multi-dimensional features include frequency feature F, amount feature M, and time feature T, and perform Z-Score standardization on the multi-dimensional features to output a feature vector set {Vi,j}, where Vi,j is the feature vector of the transaction entity pair (i,j); the clustering analysis module 42 is used to receive the feature vector set output by the feature extraction module as input, perform clustering analysis using the improved DBSCAN clustering algorithm, and output a cluster set {C1,C2,...,Ck}.

[0144] Association mining module 43: Receives the output from the clustering analysis module, treats each cluster Ci as an independent transaction database, sets a minimum support threshold min_sup, applies the FP-Growth algorithm to mine frequent itemsets within each cluster, and outputs a set of frequent itemsets; Strength scoring module 44: Receives the set of frequent itemsets output by the association mining module, constructs a comprehensive association strength scoring function for each frequent itemset to calculate its association strength Sgroup; sets an association strength threshold Sthreshold, and filters out frequent itemsets with Sgroup ≥ Sthreshold as significant common transaction groups; and;

[0145] Dynamic update module 45: Used to monitor new transaction data Dnew in real time. When new transaction data flows in, it only incrementally updates the feature vector Vi,j of the transaction entity pairs affected by Dnew; it periodically scans the identified significant common transaction groups and recalculates their correlation strength. If new If the population is below the inactive threshold (Sinactive), it is marked as "inactive" and removed. Simultaneously, the magnitude of the change in the feature vector after the incremental update (||v) compared to the original feature vector is calculated. new -v old If the change exceeds the preset threshold The corresponding transaction entity pairs are marked as "significant change points" and moved into the buffer pool. When the number of "significant change points" in the buffer pool reaches a preset scale or a preset trigger time is reached, local re-clustering and local association rule mining are initiated for the transaction entity pairs in the buffer pool and their original clusters, and significant common transaction groups are updated.

[0146] Preferably, in the feature extraction module 41, the extraction logic for multi-dimensional features is as follows: frequency feature F is extracted according to... The calculations include the monetary characteristic M (total amount, average amount, and volatility) and the time characteristic T (time decay factor and trading interval stability). In the strength scoring module 44, the weight w of the correlation strength comprehensive scoring function... f wm w t It is obtained through training using logistic regression or entropy weighting, and w f +w m +w t =1. The sliding time window parameters of feature extraction module 41 are Twindow = 30 days and Tslide = 1 day.

[0147] The functions and methods of the above modules correspond to each other, and will not be repeated here.

[0148] The present invention provides a method and system for identifying joint transaction behavior based on dynamic correlation strength. This method and system can be directly applied to the risk control systems of financial entities such as banks, payment institutions, and stock exchanges. It enables the analysis of joint transaction behavior in scenarios such as anti-money laundering, cash-out detection, and identification of related enterprise risks. Furthermore, it can be deployed and promoted on a large scale using electronic devices and computer-readable storage media. The technical solution of this invention possesses the advantages of high efficiency, accuracy, and dynamic performance, and can solve practical technical problems in financial risk control, demonstrating significant industrial applicability and market application value.

[0149] The following is for reference. Figure 5 It shows a schematic diagram of the structure of a computer device 500 suitable for implementing an electronic device according to embodiments of the present invention. Figure 5 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of use of the embodiments of the present invention.

[0150] like Figure 5 As shown, the computer device 500 includes a central processing unit (CPU) 501 and a graphics processing unit (GPU) 502, which can perform various appropriate actions and processes according to programs stored in read-only memory (ROM) 503 or programs loaded from storage section 509 into random access memory (RAM) 504. The RAM 504 also stores various programs and data required for the operation of the device 500. The CPU 501, GPU 502, ROM 503, and RAM 504 are interconnected via a bus 505. An input / output (I / O) interface 506 is also connected to the bus 505.

[0151] The following components are connected to I / O interface 506: an input section 507 including a keyboard, mouse, etc.; an output section 508 including an LCD, speakers, etc.; a storage section 509 including a hard disk, etc.; and a communication section 510 including a network interface card, such as a LAN card or modem. The communication section 510 performs communication processing via a network such as the Internet. A drive 511 may also be connected to I / O interface 506 as needed. A removable medium 512, such as a hard disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on drive 511 as needed so that computer programs read from it can be installed into storage section 509 as needed.

[0152] In particular, according to the embodiments disclosed in this invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this invention include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 510, and / or installed from removable medium 512. When the computer program is executed by central processing unit (CPU) 501 and graphics processing unit (GPU) 502, it performs the functions defined in the methods of this invention.

[0153] It should be noted that the computer-readable medium described in this invention can be a computer-readable signal medium, a computer-readable medium, or any combination thereof. A computer-readable medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor device, apparatus, or any combination thereof. More specific examples of a computer-readable medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this invention, a computer-readable medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution apparatus, device, or device. In this invention, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media can also be any computer-readable medium other than a computer-readable medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution device, apparatus, or apparatus. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0154] Computer program code for performing the operations of this invention can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as "C" or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0155] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented using dedicated hardware-based devices that perform the specified functions or operations, or using a combination of dedicated hardware and computer instructions.

[0156] The modules described in the embodiments of the present invention can be implemented in software or hardware. The described modules can also be located in a processor.

[0157] In another aspect, the present invention also provides a computer-readable medium, which may be included in the electronic device described in the above embodiments; or it may exist independently and not assembled into the electronic device. The computer-readable medium carries one or more programs, which, when executed by the electronic device, cause the electronic device to perform the methods and steps described in the first aspect of the embodiments of the present invention.

[0158] The above description is merely a preferred embodiment of the present invention and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of the invention is not limited to the specific combination of the above-described technical features, but also includes other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the inventive concept. For example, technical solutions formed by substituting the above-described features with (but not limited to) technical features with similar functions disclosed in this invention.

Claims

1. A method for identifying joint transaction behavior based on dynamic correlation strength, characterized in that, This method, applied to identifying joint trading activities of entity groups with common counterparties in massive transaction flow data in the financial field, includes the following steps: S1. Multi-dimensional feature streaming extraction and construction: Receive historical transaction flow data, extract multi-dimensional features for each pair of transaction entities (i,j) based on a preset sliding time window. The multi-dimensional features include frequency feature F, amount feature M, and time feature T. Perform Z-Score standardization on the multi-dimensional features and output a feature vector set {Vi,j}, where Vi,j is the feature vector of the transaction entity pair (i,j). S2. Improved DBSCAN clustering analysis: The output feature vector set is used as input, and the improved DBSCAN clustering algorithm is used to perform clustering analysis, outputting a set of clusters {C1,C2,...,Ck}; S3. Intra-cluster FP-Growth Association Rule Mining: Treat each output cluster Ci as an independent transaction database, set a minimum support threshold min_sup, apply the FP-Growth algorithm to mine frequent itemsets within each cluster, and output the frequent itemset set; S4. Calculation of comprehensive association strength score: For each frequent itemset in the output, construct a comprehensive association strength score function to calculate its association strength Sgroup; Set a correlation strength threshold Sthreshold, and filter out frequent itemsets with Sgroup ≥ Sthreshold as significant common transaction groups; and S5. Dynamic Update Mechanism: Real-time monitoring of new transaction data Dnew; when new transaction data flows in, only the feature vectors Vi,j of the transaction entity pairs affected by Dnew are incrementally updated; periodically scanning of identified significant common transaction groups and recalculating their correlation strength. If new If the population is below the inactivity threshold (Sinactive), it is marked as "inactive" and removed. Simultaneously, the magnitude of the change in the feature vector after the incremental update (||v) compared to the original feature vector is calculated. new -v old If the change exceeds the preset threshold The corresponding transaction entity pairs are marked as "significant change points" and moved into the buffer pool. When the number of "significant change points" in the buffer pool reaches a preset scale or a preset trigger time is reached, local re-clustering and local association rule mining are initiated for the transaction entity pairs in the buffer pool and their original clusters, and significant common transaction groups are updated.

2. The method for identifying joint transaction behavior according to claim 1, characterized in that, In step S1, the frequency feature F is the total number of transactions of the transaction entity pair (i,j) within the sliding time window, and the calculation formula is as follows: Where T is the transaction timestamp, K is the current time, and I(·) is the indicator function, which takes the value of 1 when there is a transaction in the window, and 0 otherwise.

3. The method for identifying joint transaction behavior according to claim 1, characterized in that, In step S1, the time feature T includes a time decay factor and transaction interval stability; Time decay factor ΔT = Kt last , where t last The timestamp of the most recent transaction for transaction entity pair (i,j); transaction interval stability is the standard deviation of the time interval between consecutive transactions. Eigenvector Vi,j=(F,M) total M avg M std ,ΔT,T std ,…).

4. The method for identifying joint transaction behavior according to claim 1, characterized in that, In step S2, the improved DBSCAN clustering algorithm uses weighted Mahalanobis distance as the distance metric. In the weighted Mahalanobis distance, the weights of monetary and frequency features are higher than those of time features. The neighborhood radius ε and the minimum number of points MinPts are dynamically adjusted based on the k-distance graph and clustering results. The formula for calculating the weighted Mahalanobis distance is as follows: Where S is the covariance matrix of the eigenvectors, S -1 Let S be the inverse matrix of S.

5. The method for identifying joint transaction behavior according to claim 1, characterized in that, In step S4, the comprehensive scoring function for correlation strength is: Among them, w f For frequency weight, w m Weighted by amount, w t The time weight is given, and w satisfies f +w m +w t =1; log(F) sum +1) represents the logarithm of the total transaction frequency of the group; The normalized total amount is processed using the hyperbolic tangent function; exp(-λ·ΔT) avg ) is the average time difference processed by the exponential decay function, and λ is the decay coefficient.

6. The method for identifying joint transaction behavior according to claim 1, characterized in that, In step S1, the parameters of the sliding time window are: window size Twindow = 30 days and sliding step size Tslide = 1 day.

7. A joint transaction behavior identification system based on dynamic correlation strength, characterized in that, For implementing the method as described in any one of claims 1-6, comprising: Feature extraction module: Used to receive historical transaction flow data, extract multi-dimensional features for each pair of transaction entities (i,j) based on a preset sliding time window. The multi-dimensional features include frequency feature F, amount feature M, and time feature T. The multi-dimensional features are then Z-score standardized to output a feature vector set {Vi,j}, where Vi,j is the feature vector of the transaction entity pair (i,j). Clustering analysis module: It receives the feature vector set output by the feature extraction module as input, performs clustering analysis using the improved DBSCAN clustering algorithm, and outputs a set of clusters {C1,C2,...,Ck}; Association mining module: It receives the output of the clustering analysis module, treats each cluster Ci as an independent transaction database, sets a minimum support threshold min_sup, applies the FP-Growth algorithm to mine frequent itemsets within each cluster, and outputs a set of frequent itemsets. The strength scoring module receives the set of frequent itemsets output by the association mining module. For each frequent itemset, it constructs a comprehensive association strength scoring function to calculate its association strength Sgroup; sets an association strength threshold Sthreshold, and filters out frequent itemsets with Sgroup ≥ Sthreshold as significant common transaction groups; and so on. The dynamic update module is used to monitor new transaction data Dnew in real time. When new transaction data flows in, it only incrementally updates the feature vectors Vi,j of the transaction entity pairs affected by Dnew; it also periodically scans the identified significant common transaction groups and recalculates their correlation strength. If new If the population is below the inactivity threshold (Sinactive), it is marked as "inactive" and removed. Simultaneously, the magnitude of the change in the feature vector after the incremental update (||v) compared to the original feature vector is calculated. new -v old If the change exceeds the preset threshold The corresponding transaction entity pairs are marked as "significant change points" and moved into the buffer pool. When the number of "significant change points" in the buffer pool reaches a preset scale or a preset trigger time is reached, local re-clustering and local association rule mining are initiated for the transaction entity pairs in the buffer pool and their original clusters, and significant common transaction groups are updated.

8. The joint transaction behavior identification system according to claim 7, characterized in that, In the feature extraction module, the extraction logic of the multi-dimensional features is as follows: frequency feature F is extracted according to... The calculations show that the monetary characteristic M includes total amount, average amount, and monetary volatility, while the time characteristic T includes time decay factor and transaction interval stability.

9. The joint transaction behavior identification system according to claim 7, characterized in that, In the intensity scoring module, the weight w of the correlation intensity comprehensive scoring function f w m w t It is obtained through training using logistic regression or entropy weighting, and w f +w m +w t =1.

10. The joint transaction behavior identification system according to claim 7, characterized in that, The sliding time window parameters of the feature extraction module are Twindow = 30 days and Tslide = 1 day.

11. An electronic device, comprising: One or more processors; Storage device for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the method as described in any one of claims 1 to 6.

12. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the method as described in any one of claims 1 to 6.

Images