Fund transaction association relationship mining and abnormal behavior identification method based on knowledge graph

Abstract

The invention provides a fund transaction association relationship mining and abnormal behavior identification method based on a knowledge graph, and relates to the technical field of knowledge graphs, and the method comprises the steps: collecting fund transaction flow data, and carrying out the cleaning and time window division, and obtaining a standardized transaction data set; constructing a time sequence dynamic knowledge graph; defining a rule type exception graph mode, extracting exception sub-graphs from historical exception case data, selecting a prototype mode, and combining the prototype mode and the rule type exception graph mode to form an exception transaction graph mode library; executing graph pattern matching to obtain an abnormal sub-graph instance set; and calculating an abnormal score of each abnormal sub-graph instance in the abnormal sub-graph instance set, performing score propagation based on an account node overlapping relationship between the abnormal sub-graph instances, and aggregating the abnormal scores of all the abnormal sub-graph instances in which each account node participates for each account node to obtain an account-level abnormal score. According to the invention, the recognition accuracy of the complex hidden abnormal transaction network can be improved.

Description

Technical Field

[0001] This invention relates to the field of knowledge graph technology, and in particular to a method for mining financial transaction relationships and identifying abnormal behavior based on knowledge graphs. Background Technology

[0002] With the continuous expansion of financial transaction volume and the increasing complexity of transaction methods, financial transaction data exhibits characteristics of massive volume, multiple sources, and heterogeneity. Traditional methods for identifying abnormal transactions mainly analyze the transaction characteristics of single accounts, such as statistical indicators like transaction frequency, transaction amount, and transaction time, identifying abnormal behavior by setting threshold rules or training classification models. However, such methods struggle to detect abnormal patterns hidden in complex relationships between accounts, such as funds rapidly flowing through multiple accounts, multiple accounts coordinating decentralized transfers, and funds forming closed-loop return flows within account networks. The characteristics of these abnormal patterns are not reflected in the transaction data of a single account, but rather in the transaction relationship structure between multiple accounts, leading to a high false negative rate for traditional methods.

[0003] Chinese patent CN111400560A discloses a method for prediction based on a heterogeneous graph neural network model. This method constructs heterogeneous graph data and groups neighboring nodes based on path type. It then uses a graph neural network to aggregate node features from different groups and combines an attention mechanism to determine node and path weights, ultimately obtaining a representation vector of the node to be predicted for risk prediction. This patent utilizes node association information in the graph structure, which can uncover complex relationships between entities to some extent. However, this method does not consider the temporal evolution characteristics of abnormal transaction patterns when measuring graph pattern similarity, and it does not fully utilize the association information between abnormal subgraphs for score propagation when scoring anomalies. Therefore, its ability to identify hidden networked abnormal behaviors needs improvement. Summary of the Invention

[0004] In view of this, the present invention provides a method for mining fund transaction relationship and identifying abnormal behavior based on knowledge graph. By constructing a time-series dynamic knowledge graph to express the transaction relationship between accounts, an adaptive coupled graph pattern similarity measurement method is designed to fuse structural features and time-series features. A combination of soft and hard matching strategy is used to mine abnormal subgraph instances in the knowledge graph, and a trust propagation mechanism is established based on the account overlap relationship between abnormal subgraphs to carry out score propagation, thereby improving the accuracy of identifying complex and hidden abnormal transaction networks.

[0005] The technical solution of this invention is implemented as follows: This invention provides a method for mining financial transaction relationships and identifying abnormal behavior based on knowledge graphs, including: S1. Collect fund transaction flow data, clean it, and divide it into time windows to obtain a standardized transaction dataset; S2. Construct a time-series dynamic knowledge graph based on a standardized transaction dataset, converting account identifiers into graph nodes and transaction records into directed edges containing transaction timestamps, transaction amounts, and transaction type attributes; S3. Define rule-based anomaly graph patterns based on domain business knowledge, extract anomaly subgraphs from historical anomaly case data, and select prototype patterns by clustering based on graph pattern similarity. Merge prototype patterns with rule-based anomaly graph patterns to form an anomaly transaction graph pattern library. S4. Based on the abnormal transaction graph pattern library, perform graph pattern matching in the time-series dynamic knowledge graph to obtain a set of abnormal subgraph instances; S5. Calculate the anomaly score of each anomaly subgraph instance in the set of anomaly subgraph instances. Propagate the score based on the overlapping relationship of account nodes between anomaly subgraph instances. Aggregate the anomaly scores of all anomaly subgraph instances in which each account node participates to obtain the account-level anomaly score.

[0006] Preferably, for two abnormal subgraphs and , and Let p and q represent the anomalous subgraphs corresponding to the p-th and q-th historical anomalous samples, respectively. The formula for calculating graph pattern similarity is: ; In the formula, For structural similarity, For temporal similarity, The adaptive coupling factor is calculated using the following formula: ; In the formula, Let the edge density of the subgraph be... The urgency of transactions in the subgraph. For scale parameters, To prevent small constants from being divided by zero, the edge density is the ratio of the number of edges in the subgraph to the maximum possible number of edges, and the transaction urgency is the ratio of the number of edges in the subgraph to the time span of the subgraph.

[0007] Preferably, the pattern type difference degree used in step S5 to calculate the trust propagation strength is segmented according to whether the pattern types of the two abnormal subgraph instances are the same. When the pattern types of the two abnormal subgraph instances are exactly the same, the pattern type difference degree is 0. When the pattern types of the two abnormal subgraph instances are different but have common business characteristics, the pattern type difference degree is a medium value. When the pattern types of the two abnormal subgraph instances are completely unrelated, the pattern type difference degree is the maximum value.

[0008] Preferably, the rule-based anomaly graph patterns defined in step S3 include the fast loop pattern, the star cluster pattern, the hierarchical diffusion pattern, and the synchronous transaction pattern. In the fast loop pattern, funds form a closed loop path among multiple accounts and the time interval between adjacent transactions is less than a set threshold. In the star cluster pattern, a single central account conducts transactions with more than a threshold number of different accounts within a set time window, forming a star structure. In the hierarchical diffusion pattern, funds flow from a single source account through multiple layers and finally reach a large number of terminal accounts, presenting a tree structure. In the synchronous transaction pattern, multiple account pairs conduct transactions of similar amounts within similar time windows.

[0009] Preferably, step S4, which involves performing graph pattern matching in the time-series dynamic knowledge graph based on the abnormal transaction graph pattern library, includes: For regular anomaly graph patterns, a constrained graph traversal algorithm is used to perform hard matching to obtain subgraph instances that satisfy the constraints. For the prototype pattern, soft matching is performed by calculating the graph pattern similarity between the candidate subgraph and the prototype pattern, and the candidate subgraph with a similarity greater than the matching threshold is used as the matching instance. Each abnormal subgraph instance records the corresponding set of account nodes, set of transaction edges, matching pattern type, and matching score.

[0010] Preferably, step S5, which involves score propagation based on the overlapping relationship of account nodes between abnormal subgraph instances, includes: Construct an anomaly subgraph association network; If two abnormal subgraph instances have a common account node, then establish an association edge between the two abnormal subgraph instances and calculate the trust propagation strength between the abnormal subgraph instances. An iterative propagation algorithm is used to update the anomaly score of each anomaly subgraph instance based on the trust propagation strength; The strength of trust propagation is dynamically determined based on three factors: account overlap, pattern type differences, and rating levels.

[0011] Preferably, for anomaly subgraph instances Instances of anomaly subgraphs The strength of trust transmission and The index of the abnormal subgraph instance is calculated using the following formula: ; In the formula, For account overlap, For pattern type differences, For the first Exception subgraph instance during round iteration Abnormal scores, For the first The average anomaly score of all anomaly subgraph instances during round iteration. For control parameters, To prevent division by zero of small constants; Here, account overlap is the ratio of the number of common account nodes of two abnormal subgraph instances to the number of nodes of the smaller subgraph.

[0012] Preferably, for two abnormal subgraphs and The calculation of structural similarity includes obtaining a node alignment set using a node alignment strategy, for anomalous subgraphs. edge and abnormal subgraphs The corresponding edge in The formula for calculating the edge matching score is: ; In the formula, and These represent the transaction amounts for the two sides, To prevent division by zero of small constants; Calculation from abnormal subgraphs based on edge matching scores To the abnormal subgraph Matching accuracy and from anomaly subgraphs To the abnormal subgraph The matching recall rate is calculated using the harmonic mean of matching precision and matching recall rate, with the following formula: ; In the formula, For matching accuracy, To match the recall rate.

[0013] Preferably, for abnormal subgraphs Arrange the edges of its edge set in ascending order of timestamps. ,in Let be the number of sides. The order number of the edges is represented by the transaction rhythm sequence, which is defined as follows: ; In the formula, Let k be the time interval between the k-th and (k+1)-th transactions, where k is the index of the transaction edge. The timestamp of the k-th edge; The distance between the trading rhythm sequences of two anomalous subgraphs is calculated using the dynamic time warping algorithm. The formula for calculating temporal similarity is: ; In the formula, For abnormal subgraphs The mean of the trading rhythm sequence, For scale parameters, To prevent small constants from being divided by zero.

[0014] Preferably, calculating the anomaly score for each anomaly subgraph instance in step S5 includes calculating the initial anomaly score and the final anomaly score after propagation. For each anomaly subgraph instance... The initial anomaly score is calculated using the following formula: ; In the formula, Score the match rate. For structural complexity, In terms of funding scale, Due to the urgency of time, and These are the weighting coefficients; For an account node v in the knowledge graph, the formula for calculating its account-level anomaly score is as follows: ; In the formula, This represents the total number of instances in the abnormal subgraph. An instance of an abnormal subgraph The set of account nodes, This is the final abnormal score after the score propagation process.

[0015] The present invention has the following advantages over the prior art: (1) This invention uses time-series dynamic knowledge graph to model the fund transaction network, converting transaction records into directed edges containing timestamps, amounts and type attributes, which can systematically express the multidimensional relationship between accounts. Compared with traditional methods based on single account features, it can more comprehensively depict the topological structure and temporal evolution characteristics of the transaction network. (2) The adaptive coupling factor mechanism proposed in this invention can dynamically adjust the weights of structural similarity and temporal similarity according to the edge density and transaction urgency of the abnormal subgraph, so that structural matching is emphasized for long-term latent abnormal patterns and temporal matching is emphasized for fast-transfer abnormal patterns. This overcomes the limitation of existing methods that use fixed weights and cannot adapt to the differences in the characteristics of different abnormal patterns, and improves the accuracy and adaptability of graph pattern similarity calculation. (3) The present invention adopts a combination of rule-based anomaly graph pattern definition and historical case prototype learning to construct an anomaly transaction graph pattern library. It can not only cover the typical anomaly patterns summarized by domain experts, but also extract new anomaly pattern prototypes from historical cases through data-driven methods, thereby enhancing the completeness and scalability of the pattern library and reducing the dependence on manual annotation. (4) The trust propagation mechanism designed in this invention comprehensively considers three factors—account overlap, pattern type difference, and score level—to dynamically determine the propagation strength. Through the iterative propagation algorithm, the score of the high-confidence abnormal subgraph can be propagated to the associated subgraph, which can effectively identify the hidden abnormal network formed by cross-account participation. It overcomes the problem of missed detection caused by isolated evaluation of a single abnormal subgraph in existing methods and improves the detection capability of collaborative abnormal behavior. (5) This invention uses a multi-level anomaly scoring system to calculate the initial anomaly score at the subgraph level by comprehensively considering the matching degree, structural complexity, fund size and time urgency. After the score is propagated, it is aggregated to the account level, which can quantify the degree of anomaly from two dimensions: subgraph pattern and account participation, providing a more granular decision-making basis for risk warning and disposal. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 This is a flowchart of the method of the present invention; Figure 2 This is a diagram illustrating the technical implementation of the present invention; Figure 3 This is a schematic diagram of the dynamic temporal knowledge graph of the present invention; Figure 4 This is a schematic diagram of a typical anomaly diagram pattern of the present invention; Figure 5 This is a schematic diagram of the abnormal subgraph association network and score propagation of the present invention. Detailed Implementation

[0018] The technical solutions of the present invention will be clearly and completely described below with reference to the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0019] like Figure 1 and Figure 2As shown, this invention provides a method for mining fund transaction relationships and identifying abnormal behavior based on knowledge graphs, including: S1, collecting fund transaction flow data and cleaning and dividing it into time windows to obtain a standardized transaction dataset; S2, constructing a time-series dynamic knowledge graph based on the standardized transaction dataset, converting account identifiers into graph nodes, and converting transaction records into directed edges containing transaction timestamps, transaction amounts, and transaction type attributes; S3, defining rule-based abnormal graph patterns according to domain business knowledge, extracting abnormal subgraphs from historical abnormal case data, and selecting prototype patterns by clustering based on graph pattern similarity, merging prototype patterns with rule-based abnormal graph patterns to form an abnormal transaction graph pattern library; S4, performing graph pattern matching in the time-series dynamic knowledge graph based on the abnormal transaction graph pattern library to obtain a set of abnormal subgraph instances; S5, calculating the abnormal score of each abnormal subgraph instance in the abnormal subgraph instance set, propagating the score based on the overlapping relationship of account nodes between abnormal subgraph instances, and aggregating the abnormal scores of all abnormal subgraph instances in which each account node participates to obtain an account-level abnormal score.

[0020] In one embodiment of the present invention, this method requires two types of input data. The first type is current fund transaction flow data, collected from multiple data sources such as bank transaction systems and third-party payment platforms, used in steps S1 and S2 to construct the knowledge graph to be detected. The second type is historical anomaly case data, including transaction flow records when historical anomalies occurred and corresponding anomaly annotation information. The anomaly annotation information includes the set of core account identifiers involved and anomaly type labels, used for anomaly pattern learning in step S3.

[0021] In one embodiment of the present invention, step S1 includes: Fund transaction records are collected from multiple data sources, including bank transaction logs, third-party payment platforms, and clearing systems. Each record contains a source account identifier. Target account identifier Transaction amount Transaction timestamp Transaction type Fields such as; The collected raw data is cleaned, records with missing key fields are deleted, duplicate transaction records are processed and the earliest timestamp is retained, the time format is unified to Unix timestamp, and the monetary unit is unified to yuan; The cleaned transaction data is divided into windows based on the time dimension, and the size of the time window is set. All transaction records are divided into different time windows according to their timestamps; For a transaction record with timestamp t, its corresponding time window number is: ,in The start timestamp of the dataset. This indicates rounding down; the set of transaction records within each time window w is denoted as... ; Output a standardized transaction dataset. Where W is the total number of time windows. Time window size In this embodiment, it can be set to 1 hour, or 3600 seconds. In practical applications, it can be adjusted according to the time granularity of the transaction data and business needs.

[0022] In one embodiment of the present invention, step S2 includes: Based on the transaction dataset output in step S1 Construct a time-series dynamic knowledge graph, which is represented as: ,in For a set of nodes, Let be the set of edges. For node attribute functions, For edge attribute functions; During node construction, all account identifiers appearing in the transaction records are extracted as graph nodes; for account A, a node is created. Node attributes Includes static attributes such as account type and account opening time; When constructing the edge, for each transaction record in the transaction dataset Create a node To the node Directed edge edge attributes Includes transaction timestamp t, transaction amount amount, and transaction type type; there may be multiple edges between the same pair of accounts, corresponding to multiple transactions at different times; When constructing the time index, a timestamp index is created for each edge; for a time window w, all edges within that time window are extracted to form a subgraph. ,in , for All nodes involved; The knowledge graph to be constructed Stored in a graph database, node ID index and edge timestamp index are created, and a time-series dynamic knowledge graph is output. and its subgraph sequence divided by time window ,like Figure 3 As shown in one example, the constructed time-series dynamic knowledge graph contains account nodes and transaction edges with timestamps and amounts, with different colors representing different transaction records.

[0023] In one embodiment of the present invention, step S3 includes: Based on historical anomaly case data, an anomaly transaction graph pattern library is constructed through a combination of rule definition and data-driven learning. ; Based on business knowledge in the financial field, we define rule-based anomaly graph patterns, including fast loop patterns. Star-shaped clustering pattern Hierarchical diffusion pattern and synchronous trading mode ; The rapid circulation mode involves funds forming a closed-loop path among n accounts. Furthermore, the time interval between adjacent transactions in the path is less than the threshold. The mode constraint is the path length. Time difference between adjacent sides Fund retention rate ; The star-shaped clustering model uses a single central account. In the time window A star schema is formed where transactions occur between the central node and more than m different accounts. The schema constraint is the degree of the central node. ; The hierarchical diffusion model involves funds originating from a single source account. After multiple layers of traffic diversion, the final destination is a large number of terminal accounts, presenting a tree-like structure. The pattern constraint is the tree depth. Number of leaf nodes ; The synchronous trading mode involves multiple accounts making transactions of similar amounts within a similar time window. The mode is constrained by the existence of at least k pairs of accounts and a transaction timestamp error of less than [a certain value]. The relative error of the transaction amount is less than 0.1; In this embodiment, It can be set to 2 hours, or 7200 seconds. It can be set to 20. It can be set to 15, and k can be set to 5. It can be set to 30 minutes (1800 seconds), and these parameter values ​​can be adjusted according to the characteristics of abnormal patterns in actual business scenarios. For example... Figure 4 As shown, Figure 4 (a) represents the rapid loop mode: funds form a closed loop path from v1 to v2 to v3 to v4 to v1, and the time interval Δt between adjacent transactions is less than the threshold. ; Figure 4 (b) in the diagram represents a star-shaped clustering pattern: the central account engages in transactions with multiple accounts within a time window ΔT, forming a star-shaped structure. Figure 4 (c) in the diagram represents a hierarchical diffusion pattern: funds flow from the source account through multiple levels to the terminal account, presenting a tree-like structure. Figure 4(d) in the example is the synchronous trading mode: multiple accounts make transactions of similar amounts within similar time windows (e.g., B1-B2 and C1-C2 make transactions of amounts m1 and m2 at times t1 and t1+Δt, respectively).

[0024] In one embodiment of the present invention, step S3 further includes extracting anomaly subgraphs from historical anomaly case data and performing prototype learning; For each anomalous sample in the historical anomaly case data, an anomaly subgraph is extracted from the corresponding historical transaction record based on the core account identifier set in its anomaly annotation information; for the p-th anomalous sample... Its core account set is denoted as Extract all transaction records containing these core accounts and their r-hop neighbors from the historical transaction flow corresponding to the sample, and construct an anomaly subgraph according to the method in step S2. ; The above processing is performed on m historical anomaly samples to obtain an anomaly subgraph set. The neighbor hop count r can be set to 2 in this embodiment, but can be adjusted according to the spread range of the abnormal mode in practical applications. For any two subgraphs in the set of abnormal subgraphs and Calculate the graph pattern similarity. First, structural similarity is calculated using a node alignment strategy for subgraphs. Each node in the subgraph The system finds the most similar unaligned nodes in terms of attributes and aligns them accordingly. The node attribute similarity is calculated based on factors such as whether the account type is consistent and the difference in node degree, resulting in a node alignment set. ; Edge matching scores are calculated based on node alignment for subgraphs. Each edge in Check the subgraphs after alignment. Does there exist a corresponding edge in? ,in and If it exists, the formula for calculating the monetary matching score of that edge pair is: ,in and These represent the transaction amounts for the two sides, To prevent division by zero of small constants; Define from subgraph To subgraph Matching accuracy For subgraph All edges in the aligned subgraph The average matching score of the corresponding edge in the subgraph is defined as the subgraph. To subgraph Match recall For subgraph All edges in the aligned subgraph The average matching score of the corresponding edges in the middle; the calculation formula is: ; ; in This indicates that after alignment, it may be with The set of matched edges; Structural similarity is calculated using the harmonic mean of precision and recall, as shown in the formula: in For matching accuracy, To match the recall rate; in this embodiment, It can be set to 0.01, and can be adjusted according to the numerical stability requirements in practical applications.

[0025] In one embodiment of the present invention, the calculation of temporal similarity in step S3 includes: The transaction rhythm sequence of a subgraph is defined as the time interval sequence of adjacent transactions after all edges are sorted by timestamp; for anomalous subgraphs... , and its edge set The edges in the array are arranged in ascending order of timestamps. ,in The number of edges, indicated by the superscript. Given the edge sorting index, the transaction rhythm sequence is defined as follows: ,in Let k be the time interval between the k-th and (k+1)-th transactions, where k is the index of the transaction edge. The timestamp of the k-th edge; The distance between the trading rhythm sequences of two anomalous subgraphs is calculated using the dynamic time warping algorithm. The formula for calculating temporal similarity is: ; in For abnormal subgraphs The mean of the trading rhythm sequence, For scale parameters, To prevent division by zero by small constants; in this embodiment, It can be set to 2, and can be adjusted according to the scale of the time interval in practical applications.

[0026] In one embodiment of the present invention, the graph pattern similarity in step S3 adopts an adaptive coupling form, for two anomalous subgraphs. and subscript and Let p and q represent the anomalous subgraphs corresponding to the p-th and q-th historical anomalous samples, respectively. The formula for calculating graph pattern similarity is: ; in For structural similarity, For temporal similarity, The adaptive coupling factor is calculated using the following formula: ,in Let the edge density of the subgraph be... The urgency of transactions in the subgraph. For scale parameters, To prevent division by zero by a small constant; the edge density is the ratio of the number of edges in the subgraph to the maximum possible number of edges, calculated using the following formula: ,in The number of edges in the subgraph. The number of nodes in the subgraph; the transaction urgency is the ratio of the number of edges in the subgraph to the time span of the subgraph, calculated using the following formula: ,in The time span of the subgraph is divided by 3600 to convert the time span to hours; in this embodiment, It can be set to 2, and can be adjusted according to the differences in the timing characteristics of different anomaly modes in practical applications; The design of the adaptive coupling factor is based on the temporal characteristics of the subgraph. When the edge density of the subgraph is high and the transaction urgency is low, A value close to 1 indicates a greater emphasis on structural similarity, making it suitable for long-term latent anomaly patterns; when the edge density of the subgraph is low and the transaction urgency is high, A value close to 0 emphasizes temporal similarity, making it suitable for rapidly shifting anomaly patterns. This adaptive mechanism automatically adjusts weights based on the temporal characteristics of different anomaly subgraphs, overcoming the problem that fixed weights cannot adapt to the differences in features across different anomaly patterns.

[0027] In one embodiment of the present invention, step S3 further includes: Based on the calculated similarity matrix, the spectral clustering algorithm is used to cluster the abnormal subgraphs into... A cluster; For each cluster The subgraph with the highest average similarity to other subgraphs within the cluster is selected as the prototype pattern. ; The learned prototype pattern Combined with the pattern defined by the rules, they form a complete anomaly graph pattern library. Each mode Includes a pattern subgraph structure, constraints, and anomaly type labels; in this embodiment... It can be set to 3 to 5 clusters, and can be adjusted according to the diversity of historical anomaly cases in practical applications.

[0028] In one embodiment of the present invention, step S4 includes: Anomaly graph pattern library built based on step S3 The knowledge graph constructed in step S2 Perform graph pattern matching to discover subgraph instances in the knowledge graph that match abnormal patterns; For regular anomaly graph patterns in the pattern library, a constrained graph traversal algorithm is used to perform hard matching to obtain subgraph instances that satisfy the constraints. Taking the fast loop mode as an example, a depth-first search is performed starting from the candidate starting node to trace the closed-loop path that satisfies the time and amount constraints; the path is initialized. From the current node Traverse its outgoing edges ,like The path length is greater than or equal to 3 and the time constraint is met, i.e., the time interval between adjacent edges is less than 3. If the amount constraint, i.e., the capital retention rate is greater than 0.8, then the path subgraph is recorded as a matching instance; if... If the path is unvisited and the time constraint is satisfied, then recursively expand the path; obtain the set of all subgraph instances that match the fast loop pattern. Similarly, other rule patterns are processed to obtain the corresponding set of matching instances; For prototype patterns, soft matching is performed by calculating the graph pattern similarity between candidate subgraphs and prototype patterns; for candidate subgraphs in the knowledge graph... Candidate subgraphs are obtained through sliding time windows or node neighborhood extraction, and their relationship with the prototype pattern is calculated. similarity The similarity calculation uses the adaptive coupling similarity method defined in step S3; similarity values ​​greater than the matching threshold are considered. The candidate subgraph is used as a matching instance. And its similarity score records are added to the set of matching instances. In this embodiment, It can be set to 0.7, and can be adjusted according to the requirements for the strictness of matching in practical applications; Integrate all matching instances of the pattern into a total set of exception subgraph instances. Each abnormal subgraph instance records the set of account nodes involved, the set of transaction edges, the matching pattern type, and the matching score. A hard match has a matching score of 1, while a soft match has a similarity score. For each matching instance... superscript The index number of the subgraph instance records the set of account nodes. Transaction edge set Mode type Match score Output the set of instances of the abnormal subgraph. The collection includes the CCP An instance of an abnormal subgraph.

[0029] In one embodiment of the present invention, step S5 includes: Based on the set of abnormal subgraph instances mined in step S4 Anomaly scoring and correlation analysis were performed. For each anomaly subgraph instance superscript For each instance of the abnormal subgraph, calculate its initial abnormal score; The formula for calculating structural complexity is defined as follows: ; in The number of edges in the subgraph. The exponential parameter is used; the formula directly uses the power form of the number of edges, which includes information about the number of accounts and connection density. The power function form allows high-density, high-scale anomaly subgraphs to obtain higher complexity scores. The formula for calculating capital size is defined as follows: ; in The transaction amount for the edge; The formula for calculating time urgency is defined as follows: ; in For reference time window, The time span of the subgraph; the formula uses a proportional form, when the time span is close to 0, the score is close to 1, indicating high urgency, and when the time span is much larger than the reference window, the score is close to 0, indicating low urgency. The initial anomaly score calculation formula is: ; in Score the match rate. and These are the weighting coefficients; In this embodiment, It can be set to 1.2. It can be set to 24 hours, which is 86,400 seconds. It can be set to 0.3. These parameters can be set to 0.5, and can be adjusted according to the weight of the influence of different dimensional features on the degree of anomaly.

[0030] In one embodiment of the present invention, step S5 further includes scoring propagation based on the overlapping relationship of account nodes between abnormal subgraph instances; Construct an anomaly subgraph association network, connecting each anomaly subgraph Treat it as a supernode; if two abnormal subgraph instances have a common account node, then establish an association edge between the two abnormal subgraph instances; Account overlap is defined as the ratio of the number of common account nodes to the number of nodes in the smaller subgraph of two anomalous subgraph instances. The calculation formula is as follows: ; in and The index is the instance of the abnormal subgraph; the formula uses minimum normalization, and the overlap is 1 when one subgraph is completely contained in another subgraph; The pattern type difference degree is defined in segments based on whether the pattern types of two abnormal subgraph instances are the same. When the pattern types of two abnormal subgraph instances are completely identical, the pattern type difference degree is 0; when the pattern types of two abnormal subgraph instances are different but share common business characteristics, the pattern type difference degree is of medium value; and when the pattern types of two abnormal subgraph instances are completely unrelated, the pattern type difference degree is of maximum value. In this embodiment, when the pattern types are completely identical... When they have common business characteristics When completely unrelated These segment values ​​can be adjusted according to the degree of semantic association between different pattern types; Calculate the trust propagation strength between instances of an anomalous subgraph. Instances of anomaly subgraphs The strength of trust propagation is calculated using the following formula: ; in For account overlap, For pattern type differences, For the first Exception subgraph instance during round iteration Abnormal scores, For the number of iteration rounds, For the first The average anomaly score of all anomaly subgraph instances during round iteration. For control parameters, To prevent division by zero of small constants; In this embodiment, It can be set to 1.5. It can be set to 2. These control parameters can be set to 0.5 and can be adjusted according to the degree of influence of different factors on the propagation intensity. The strength of trust propagation is dynamically determined based on three factors: account overlap, pattern type difference, and rating level. The power form of overlap amplifies the impact of high overlap, the exponential decay of pattern differences makes the trust level of similar patterns higher, and the power form of rating normalization makes subgraphs with higher-than-average ratings have stronger propagation capabilities. like Figure 5 The diagram illustrates the anomaly subgraph association network and score propagation mechanism. It contains five anomaly subgraph instances (G1 to G5), each labeled with its matching pattern type and initial anomaly score. Blue dots inside the subgraphs represent participating account nodes (e.g., G1 contains accounts A1, A2, and A3). Dashed arrows represent trust propagation paths established based on public accounts; the trust value marked on the arrows indicates the trust propagation strength, with line thickness corresponding to the trust value. For example, G1 and G2 establish a high-strength association through public account A2 (trust=0.85), and G1's high anomaly score (0.92) can propagate to G2. This association network updates the final anomaly scores of each subgraph through an iterative propagation algorithm and aggregates them into account-level anomaly scores, thereby enabling the identification of hidden anomaly networks.

[0031] In one embodiment of the present invention, step S5 further includes updating the anomaly score of each anomaly subgraph instance based on the trust propagation strength using an iterative propagation algorithm; For subgraph Define its neighbor subgraph set as ; Initialize the anomaly score for each subgraph as follows: ; Perform L rounds of iterative propagation, with the update formula for each round being: When the neighbor set is not empty ; When the neighbor set is empty ,in The propagation coefficient; The formula retains the initial rating term to ensure that the rating is not completely influenced by the neighbors. The propagation of the neighbor rating is weighted by the trust strength and the denominator is normalized to ensure that the total number of propagated ratings is conserved and to guarantee the convergence of the iteration. After L iterations, the final anomaly score for each subgraph is obtained. ; In this embodiment, L can be set to 3 wheels. These parameters can be set to 0.3, and can be adjusted based on the convergence speed of the score propagation and the degree to which the initial score is preserved. This scoring propagation mechanism takes into account the account overlap relationship, pattern type semantic association, and score credibility difference between anomalous subgraphs, enabling the scores of high-confidence anomalous subgraphs to propagate to related subgraphs, thereby improving the ability to identify hidden anomalous networks formed through cross-account participation.

[0032] In one embodiment of the present invention, step S5 further includes aggregating the anomaly scores of all anomaly subgraph instances in which each account node participates to obtain an account-level anomaly score. For an account node v in the knowledge graph, the formula for calculating its account-level anomaly score is as follows: ; in This represents the total number of instances in the abnormal subgraph. An instance of an abnormal subgraph The set of account nodes, This is the final abnormal rating after the rating propagation process; This formula sums the scores of each anomalous subgraph in which an account participates, distributed evenly over the number of nodes in that subgraph. This reflects the degree of account participation in the anomalous network and the severity of the anomalous patterns involved. All accounts are then sorted in descending order based on their account-level anomalous scores, and the top accounts with the highest anomalous scores are output. A list of individual accounts; for each anomalous account, output the account identifier, anomalous score, a list of anomalous subgraphs involved, the matching pattern type of each subgraph, and the set of associated accounts involved; also output the visualization results of the anomalous subgraph association network.

[0033] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for mining relationships in financial transactions and identifying abnormal behavior based on knowledge graphs, characterized in that, include: S1. Collect fund transaction flow data, clean it, and divide it into time windows to obtain a standardized transaction dataset; S2. Construct a time-series dynamic knowledge graph based on a standardized transaction dataset, converting account identifiers into graph nodes and transaction records into directed edges containing transaction timestamps, transaction amounts, and transaction type attributes; S3. Define rule-based anomaly graph patterns based on domain business knowledge, extract anomaly subgraphs from historical anomaly case data, and select prototype patterns by clustering based on graph pattern similarity. Merge prototype patterns with rule-based anomaly graph patterns to form an anomaly transaction graph pattern library. S4. Based on the abnormal transaction graph pattern library, perform graph pattern matching in the time-series dynamic knowledge graph to obtain a set of abnormal subgraph instances; S5. Calculate the anomaly score of each anomaly subgraph instance in the set of anomaly subgraph instances. Propagate the score based on the overlapping relationship of account nodes between anomaly subgraph instances. Aggregate the anomaly scores of all anomaly subgraph instances in which each account node participates to obtain the account-level anomaly score.

2. The method for mining fund transaction relationships and identifying abnormal behavior based on knowledge graphs according to claim 1, characterized in that, For two abnormal subgraphs and , and Let p and q represent the anomalous subgraphs corresponding to the p-th and q-th historical anomalous samples, respectively. The formula for calculating graph pattern similarity is: ； In the formula, For structural similarity, For temporal similarity, The adaptive coupling factor is calculated using the following formula: ； In the formula, Let the edge density of the subgraph be... The urgency of transactions in the subgraph. For scale parameters, To prevent small constants from being divided by zero, the edge density is the ratio of the number of edges in the subgraph to the maximum possible number of edges, and the transaction urgency is the ratio of the number of edges in the subgraph to the time span of the subgraph.

3. The method for mining fund transaction relationships and identifying abnormal behavior based on knowledge graphs according to claim 1, characterized in that, In step S5, the pattern type difference used to calculate the trust propagation strength is segmented based on whether the pattern types of the two abnormal subgraph instances are the same. When the pattern types of the two abnormal subgraph instances are exactly the same, the pattern type difference is 0. When the pattern types of the two abnormal subgraph instances are different but have common business characteristics, the pattern type difference is a medium value. When the pattern types of the two abnormal subgraph instances are completely unrelated, the pattern type difference is the maximum value.

4. The method for mining fund transaction relationships and identifying abnormal behavior based on knowledge graphs according to claim 1, characterized in that, The rule-based anomaly graph patterns defined in step S3 include the fast loop pattern, the star cluster pattern, the hierarchical diffusion pattern, and the synchronous transaction pattern. The fast loop pattern is where funds form a closed loop path among multiple accounts and the time interval between adjacent transactions is less than a set threshold. The star cluster pattern is where a single central account trades with more than a threshold number of different accounts within a set time window, forming a star structure. The hierarchical diffusion pattern is where funds flow from a single source account through multiple layers and finally reach a large number of terminal accounts, presenting a tree structure. The synchronous transaction pattern is where multiple account pairs conduct transactions of similar amounts within similar time windows.

5. The method for mining fund transaction relationships and identifying abnormal behavior based on knowledge graphs according to claim 1, characterized in that, Step S4 involves performing graph pattern matching in the time-series dynamic knowledge graph based on the abnormal transaction graph pattern library, including: For regular anomaly graph patterns, a constrained graph traversal algorithm is used to perform hard matching to obtain subgraph instances that satisfy the constraints. For the prototype pattern, soft matching is performed by calculating the graph pattern similarity between the candidate subgraph and the prototype pattern, and the candidate subgraph with a similarity greater than the matching threshold is used as the matching instance. Each abnormal subgraph instance records the corresponding set of account nodes, set of transaction edges, matching pattern type, and matching score.

6. The method for mining fund transaction relationships and identifying abnormal behavior based on knowledge graphs according to claim 1, characterized in that, Step S5 involves score propagation based on the overlapping relationship of account nodes between abnormal subgraph instances, including: Construct an anomaly subgraph association network; If two abnormal subgraph instances have a common account node, then establish an association edge between the two abnormal subgraph instances and calculate the trust propagation strength between the abnormal subgraph instances. An iterative propagation algorithm is used to update the anomaly score of each anomaly subgraph instance based on the trust propagation strength; The strength of trust propagation is dynamically determined based on three factors: account overlap, pattern type differences, and rating levels.

7. The method for mining fund transaction relationships and identifying abnormal behavior based on knowledge graphs according to claim 6, characterized in that, For abnormal subgraph instances Instances of anomaly subgraphs The strength of trust transmission and The index of the abnormal subgraph instance is calculated using the following formula: ； In the formula, For account overlap, For pattern type differences, For the first Exception subgraph instance during round iteration Abnormal scores, For the first The average anomaly score of all anomaly subgraph instances during round iteration. For control parameters, To prevent division by zero of small constants; Here, account overlap is the ratio of the number of common account nodes of two abnormal subgraph instances to the number of nodes of the smaller subgraph.

8. The method for mining financial transaction relationships and identifying abnormal behavior based on knowledge graphs according to claim 2, characterized in that, For two abnormal subgraphs and The calculation of structural similarity includes obtaining a node alignment set using a node alignment strategy, for anomalous subgraphs. edge and abnormal subgraphs The corresponding edge in The formula for calculating the edge matching score is: ； In the formula, and These represent the transaction amounts for the two sides, To prevent division by zero of small constants; Calculation from abnormal subgraphs based on edge matching scores To the abnormal subgraph Matching accuracy and from anomaly subgraphs To the abnormal subgraph The matching recall rate is calculated using the harmonic mean of matching precision and matching recall rate, with the formula as follows: ； In the formula, For matching accuracy, To match the recall rate.

9. The method for mining fund transaction relationships and identifying abnormal behavior based on knowledge graphs according to claim 2, characterized in that, For abnormal subgraphs Arrange the edges of its edge set in ascending order of timestamps. ,in Let be the number of sides. The order number of the edges is represented by the transaction rhythm sequence, which is defined as follows: ； In the formula, Let k be the time interval between the k-th and (k+1)-th transactions, where k is the index of the transaction edge. The timestamp of the k-th edge; The distance between the trading rhythm sequences of two anomalous subgraphs is calculated using the dynamic time warping algorithm. The formula for calculating temporal similarity is: ； In the formula, For abnormal subgraphs The mean of the trading rhythm sequence, For scale parameters, To prevent small constants from being divided by zero.

10. The method for mining fund transaction relationships and identifying abnormal behavior based on knowledge graphs according to claim 1, characterized in that, Step S5 calculates the anomaly score for each anomaly subgraph instance, including calculating the initial anomaly score and the final anomaly score after propagation. For each anomaly subgraph instance... The initial anomaly score is calculated using the following formula: ； In the formula, Score the match rate. For structural complexity, In terms of funding scale, Due to the urgency of time, and These are the weighting coefficients; For an account node v in the knowledge graph, the formula for calculating its account-level anomaly score is as follows: ； In the formula, This represents the total number of instances in the abnormal subgraph. An instance of an abnormal subgraph The set of account nodes, This is the final abnormal score after the score propagation process.

Images