Method and system for detecting abnormal behavior of financial transactions over time

Abstract

The present application belongs to the technical field of financial transaction compliance identification, and relates to a financial transaction abnormal behavior time sequence detection method and system. The method comprises the following steps: obtaining financial transaction event data, transaction participant association data and preliminary screening results; performing preliminary screening on the transaction events to obtain a first detection result and a candidate transaction event set; extracting candidate transaction segments with weak coupling signs; performing reservation, caching and cross-window recombination on the candidate transaction segments to form recombined transaction chains; calculating the cumulative suspicious value of each recombined transaction chain; performing secondary rejudgment when the cumulative suspicious value reaches a preset condition to identify hidden financial transaction abnormal behaviors; and fusing the first detection result and the secondary rejudgment result to output a time sequence detection result. The present application can improve the identification capability for cross-window and decentralized hidden abnormal behaviors.

Description

Technical Field

[0001] This invention pertains to financial transaction compliance identification, specifically referring to a method and system for detecting abnormal financial transaction behavior over time. Background Technology

[0002] Existing methods for detecting abnormal financial transaction behavior typically rely on strong rule matching, single-window anomaly identification, or single-transaction feature judgment. These methods have a good ability to identify explicit abnormal behaviors with obvious temporal proximity, pairing relationships, or abnormal volume-price relationships. However, for concealed abnormal behaviors formed by dispersing time points, weakening the intensity of a single anomaly, and splitting the chain of coordinated behavior, existing technologies tend to decompose them into multiple independent ordinary transaction segments that do not reach the threshold for a single judgment. This results in the abnormal behavior being compressed, weakened, or even misjudged as a normal transaction after structured processing, leading to insufficient identification of abnormal transaction behaviors with strong continuity, coordination, and disguise.

[0003] Therefore, the existing technology has a problem in improving the temporal detection capability of hidden financial transaction anomalies composed of multiple weak anomaly fragments by preserving, recombining across windows, accumulating evidence, and conducting secondary review of transaction fragments that do not hit strong anomaly rules but have weak coupling signs. Summary of the Invention

[0004] The purpose of this invention is to provide a method for detecting abnormal behavior in financial transactions over time, comprising: S1, obtain financial transaction event data, transaction participant association data, and preliminary screening results of the target object within the target detection period; S2, based on the financial transaction event data and transaction participant association data, perform preliminary screening of transaction events to obtain the first detection result that hits the strong anomaly rule and the candidate transaction event set that does not hit the strong anomaly rule; S3, extract candidate transaction fragments with weak coupling characteristics from the candidate transaction event set; S4, the candidate transaction fragments are retained and cached, and cross-window reorganization is performed according to the target transaction object, suspected related transaction participants, time adjacency relationship and behavioral correspondence relationship to form a reorganized transaction chain; S5, calculate the cumulative doubt value for each of the aforementioned restructuring transaction chains; S6. When the accumulated suspicion value reaches the preset condition, a second back-judgment is performed on the corresponding restructuring transaction chain to identify hidden financial transaction abnormal behavior. S7, integrate the first detection result and the second back judgment result, and output the time sequence detection result of abnormal financial transaction behavior.

[0005] Furthermore, the weak coupling indicators include the correlation and responsiveness characteristics between transaction participants, the temporal adjacency characteristics between transaction events, and the coordination characteristics between transaction behaviors.

[0006] Furthermore, the cross-window reorganization includes: using candidate transaction fragments as graph nodes; when any two candidate transaction fragments meet at least two of the following conditions: consistent target transaction object, overlapping suspected related transaction participants, time interval less than a preset threshold, and behavioral response intensity reaching a preset condition, establishing a connection edge between the corresponding graph nodes; and identifying the reorganized transaction chain based on the fragment relationship graph formed by the connection edge.

[0007] Furthermore, the cumulative suspicion value is determined by the degree of recurrence of candidate transaction segments, the degree of continuous participation of suspected related transaction participants around the same target transaction, and the strength of collaboration between candidate transaction segments.

[0008] Furthermore, the secondary judgment includes: relaxing the requirements for a single transaction event to hit the strong anomaly rule; making a joint judgment based on the overall temporal continuity, behavioral synergy, and cumulative suspicion value of the reorganization transaction chain; and outputting the abnormal behavior type, suspected related transaction participants, corresponding reorganization transaction chain, and risk level.

[0009] On the other hand, the present invention also provides a time-series detection system for abnormal financial transaction behavior, including: a data acquisition module, used to acquire financial transaction event data, transaction participant association data and preliminary screening results of the target object within the target detection period; The preliminary screening module is used to perform preliminary screening of transaction events, and obtain the first detection result of strong anomaly rules and the candidate transaction event set that does not hit the strong anomaly rules; A weakly coupled segment extraction module is used to extract candidate transaction segments with signs of weak coupling from the candidate transaction event set; The fragment retention and caching module is used to retain and cache the candidate transaction fragments; the cross-window recombination module is used to recombine the candidate transaction fragments across windows to form a recombined transaction chain. The evidence accumulation calculation module is used to calculate the cumulative doubt value for each of the aforementioned reorganization transaction chains; The secondary review module is used to perform a secondary review on the corresponding restructuring transaction chain when the accumulated suspicion value reaches a preset condition, so as to identify hidden financial transaction abnormal behavior. The result output module is used to integrate the first detection result and the second back judgment result to output the time sequence detection result of abnormal financial transaction behavior.

[0010] Furthermore, the financial transaction event data includes order information, transaction information, and transaction environment identification information.

[0011] Furthermore, the weakly coupled fragment extraction module is used to extract candidate transaction fragments based on correlation and response relationships, temporal proximity relationships, and behavioral coordination relationships; the cross-window reorganization module is used to construct a fragment relationship graph and form a reorganized transaction chain based on the fragment relationship graph.

[0012] Furthermore, the evidence accumulation calculation module is used to calculate the cumulative suspicion value based on the recurrence of candidate transaction fragments in multiple detection windows, the continuous participation of suspected related transaction participants, and the coordination between candidate transaction fragments; the secondary judgment module is used to jointly judge the corresponding reorganization transaction chain based on the cumulative suspicion value.

[0013] Furthermore, the result output module is used to output abnormal behavior determination information, associated subject information, and evidence chain information.

[0014] The beneficial effects achieved by the present invention using the above solution are as follows: After initial screening using strong rules, this invention introduces a mechanism for retaining and caching weakly coupled transaction fragments, preventing suspicious transactions that fail to meet a single strong rule from being directly reset to normal transactions, and thus preserving early clues of covert abnormal behavior.

[0015] This invention reorganizes originally scattered and low-significance anomalies into a continuously analyzable transaction chain by performing cross-window recombination and evidence accumulation on weakly coupled transaction fragments, thereby improving the ability to identify split, disguised, and persistent anomalies.

[0016] This invention extends the judgment of a single transaction to a joint judgment of the entire time sequence by performing a second judgment after the accumulated suspicious value reaches a preset condition. Without destroying the existing strong rule recognition framework, it improves the integrity, stability and accuracy of the time sequence detection of abnormal behavior in financial transactions. Attached Figure Description

[0017] Figure 1 This is a flowchart illustrating the time-series detection method for abnormal financial transaction behavior provided in an embodiment of the present invention.

[0018] Figure 2 This is a structural block diagram of a financial transaction abnormal behavior timing detection system provided in an embodiment of the present invention.

[0019] Figure 3 This is a schematic diagram of the cumulative doubt value calculation and secondary re-judgment of the present invention. Detailed Implementation

[0020] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0021] The present invention will be further described below with reference to embodiments. It should be understood that the following embodiments are for illustrative purposes only and are not intended to limit the scope of protection of the present invention. Without departing from the concept of the present invention, those skilled in the art can make several modifications or equivalent substitutions, all of which should fall within the scope of protection of the present invention.

[0022] This invention provides a method and system for detecting abnormal financial transaction behavior over time, which focuses on solving the following problem: In existing detection schemes, the identification of abnormal financial transaction behavior usually depends on whether a single transaction event directly hits a strong anomaly rule. However, for hidden abnormal financial transaction behavior that is scattered across multiple detection windows, has weak single-event performance but has continuous echo relationship, behavioral cooperation relationship and suspected continuous participation of related entities across time periods, it is often difficult to accurately identify in single-window detection.

[0023] like Figure 1 As shown, this invention extracts candidate transaction events that do not hit strong anomaly rules but have signs of weak coupling into candidate transaction fragments, and then retains, caches, reassembles across windows, accumulates evidence, and performs secondary review on the candidate transaction fragments, thereby achieving time-series detection of hidden financial transaction anomalies.

[0024] In one embodiment, the time-series detection method for abnormal financial transaction behavior is executed by one or more computing devices. The computing devices can be regulatory servers, risk control servers, transaction behavior analysis servers, graph computing servers, or combinations thereof. Each computing device includes at least a processor, memory, a network interface, and a program instruction storage unit. The processor executes the program instructions stored in the memory to perform operations such as acquiring financial transaction event data, constructing correlations, preliminary screening, extracting weakly coupled fragments, cross-window reconstruction, evidence accumulation calculation, secondary review, and result output.

[0025] The computing device can communicate with the transaction matching system, order submission system, transaction reporting system, account management system, customer information system, terminal log system, device identification system, fund flow system, and historical risk control result database. Specifically, the transaction matching system and order submission system provide raw financial transaction event data; the account management system and customer information system provide basic correlation data of transaction participants; the terminal log system, device identification system, and fund flow system provide deep correlation features; and the historical risk control result database and rule engine provide initial screening results or preliminary warning results.

[0026] In one embodiment, the time-series detection method for abnormal financial transaction behavior can be executed using a rolling window approach. Let the target detection period be... The target detection period is divided into multiple detection windows, denoted as the [number]th [window]. Each detection window is in, The window length can be set to several seconds, minutes, hours, or other preset durations, depending on the trading instrument, trading frequency, and regulatory granularity. For high-frequency trading scenarios, a shorter window can be used; for intraday or cross-day continuous monitoring scenarios, a longer window or a scrolling overlay window can be used.

[0027] In one implementation, a corresponding event description vector can be constructed for any financial transaction event generated by the target object during the target detection period. Each financial transaction event is recorded as in, Indicates the time when the transaction event occurred. Indicates the identifier of the target transaction. Indicates the identifier of the transaction participants. Indicates the direction of the transaction. Indicates price, Indicate quantity, Indicates the transaction method or event type. Indicates transaction environment identification information, This indicates additional contextual information. Trading environment identification information may include one or more of the following: terminal identifier, device fingerprint, network address, seat identifier, session identifier, and login path identifier. Additional contextual information may include a snapshot of market data before the order was placed, order book status, order cancellation rate, historical trading frequency, and historical collaborative behavior tags.

[0028] In this embodiment, financial transaction event data includes at least order information, transaction information, and transaction environment identification information. Order information may include order time, order price, order quantity, order direction, order status, and order cancellation status; transaction information may include transaction time, transaction price, transaction quantity, transaction direction, counterparty information, and transaction sequence number; transaction environment identification information may include terminal device identifier, network address identifier, session environment identifier, login authentication identifier, and transaction interface identifier, etc. By introducing transaction environment identification information, the accuracy of identifying suspected related transaction participants can be enhanced.

[0029] In one implementation, to characterize the degree of association between transaction participants, an association strength function can be constructed based on control relationships, equipment relationships, address relationships, financial relationships, historical collaborative behavior relationships, etc. For any two transaction participants... and Its correlation strength can be defined as in, Indicators representing control relationships Indicators representing shared equipment relationships Indicators representing address sharing relationships Indicators representing financial transactions. Indicators representing historical collaborative behavior relationships For the corresponding weights, and satisfying when When it exceeds the preset threshold, it can and Considered a suspected related-party transaction participant; when Even if a relationship does not reach the threshold but is significant on a single relation indicator, it can still be retained as an observable relation for subsequent cross-window evidence accumulation.

[0030] The method steps of the present invention will be described in detail below.

[0031] S1: Obtain financial transaction event data, transaction participant association data, and preliminary screening results for the target object within the target detection period.

[0032] In one implementation, the data acquisition process includes two modes: real-time acquisition and historical backtracking. In real-time acquisition mode, the data acquisition module receives transaction event streams from the streaming message bus and caches them according to the detection window. In historical backtracking mode, the data acquisition module extracts event records within a specified time period from the historical transaction database. The transaction participant association data can originate from static master data or dynamic behavioral data, such as recent shared equipment, shared network, mutual transfers, and consecutive intraday collaborative reporting. The initial screening results can be the "strong anomaly hit," "weak anomaly warning," or "to be observed" markings made by the rule engine for some events in the current window or previous window, or they can be the pre-judgment labels output by other early warning systems.

[0033] In one implementation, to ensure unified processing of data from different sources, financial transaction event data, transaction participant association data, and preliminary screening results can be time-aligned, field-mapped, and standardized. For example, transaction directions in different systems can be uniformly encoded as buy, sell, or order cancellation; account identifiers, customer identifiers, and device identifiers can be uniformly mapped to the same identity index space; and timestamps from different systems can be unified to millisecond or second-level timelines. After standardization, an event set within the target detection period can be constructed. and the collection of participants S2, based on financial transaction event data and transaction participant association data, performs preliminary screening of transaction events to obtain the first detection result that hits the strong anomaly rule and the candidate transaction event set that does not hit the strong anomaly rule.

[0034] In one implementation, the initial screening is performed by a rules engine. The rules engine is used to identify behaviors that are significantly anomalous at the level of a single transaction event, such as instantaneous wash trading, obvious self-buying and selling, repeated wash trading within a very short period, abnormally concentrated order cancellations, intraday price manipulation orders, and spoofed liquidity orders. For any given transaction event... Strong anomaly rule hit functions can be defined. in, These represent the hit results for different strong anomaly rules, with a value of 1 when the rule is hit and 0 otherwise. The transaction event will then directly enter the first detection result set. like However, if a transaction event exhibits certain suspicious characteristics, it will be included in the candidate transaction event set. in, This represents the candidate retention decision function, used to identify transaction events that, although they do not meet the strong anomaly rules, should not be discarded immediately.

[0035] In one implementation, the candidate retention decision function The following information can be used to set the criteria: First, whether the transaction event was initiated by a suspected related party; second, whether the transaction event occurred during a sensitive period, such as the opening call auction period, the closing matching period, a period of high volatility, or a period of low liquidity; third, whether the transaction event repeatedly revolves around the same target trading instrument; and fourth, whether the transaction event partially corresponds to the preceding event in terms of price, quantity, direction, or time. Through this step, the present invention is not limited to "only retaining strong hit events," but rather retains intermediate evidence for subsequent time-series chain judgments.

[0036] S3 extracts candidate transaction fragments with signs of weak coupling from the candidate transaction event set.

[0037] In one implementation, a candidate transaction segment is the smallest suspicious unit consisting of one or more candidate transaction events that are related within a local time period. For any candidate transaction segment... , can be written as in, .like If so, the candidate transaction fragment is a single-event fragment; if If so, the candidate transaction segment is a multi-event combination segment. Each candidate transaction segment has corresponding segment attributes, including segment start time, segment end time, target transaction object, set of participants, behavior type label, local coupling feature value, etc.

[0038] In one embodiment, weak coupling indicators include correlation and responsiveness between transaction participants, temporal adjacency between transaction events, and coordination between transaction behaviors.

[0039] Among them, the correlation and echo feature is used to characterize whether suspected related-party transaction participants engage in mutually echoing transaction actions around the same target transaction object within a similar time period. For candidate transaction segments... Let the set of its participants be... Then its correlation score can be defined as in, Let f(x) represent the set of participant pairs formed by any two participants in a transaction within a segment. For the aforementioned correlation strength function, For the number of participants. The larger the value, the higher the degree of connection and responsiveness among the participants within the segment.

[0040] Temporal adjacency features are used to characterize whether transaction events within a segment have strong temporal adjacency. Let the segment... The interval between adjacent events sorted by time is Then its temporal adjacency score can be defined as in, This is the time decay coefficient. The shorter the time interval, the larger the exponent, and therefore... The larger the value, the more concentrated the events within the segment.

[0041] Behavioral coordination features are used to characterize whether different trading participants coordinate in terms of trading direction, price level, quantity timing, order cancellation methods, or execution coordination methods. A behavioral coordination score can be defined as follows: in, Indicates direction and coordination indicators. This indicates a price response indicator. Indicates quantity matching indicators, Indicates the transaction connection indicator. , where is the weighting coefficient. The higher the behavioral coordination score, the more likely the transaction events within the segment are not accidental co-occurrences, but rather show signs of coordination.

[0042] In one implementation, the associated response features, temporal adjacency features, and behavioral coordination features can be combined to obtain a weakly coupled comprehensive score for candidate transaction fragments. in, .

[0043] when When the corresponding segment is identified as a candidate transaction segment with weak coupling, it is retained in the cache. When the threshold is not reached but close to the threshold and any of its sub-features are significant, it can also be temporarily stored as a boundary segment for subsequent cross-window reorganization with other segments.

[0044] S4 preserves and caches candidate transaction fragments, and reorganizes them across windows according to the target transaction object, suspected related transaction participants, time adjacency, and behavioral correspondence to form a reorganized transaction chain.

[0045] In one implementation, the fragment retention and caching module stores each candidate transaction fragment in a cache as a structured record. Each fragment record includes at least: fragment identifier, belonging detection window, fragment start and end time, target transaction identifier, participant set, transaction direction sequence, price sequence, quantity sequence, local coupling feature value, fragment category label, and referenced original event sequence index. The cache can be implemented using an in-memory database, distributed key-value store, graph cache, or other data structures suitable for short-term, fast read and write operations. To support cross-window concatenation, candidate transaction fragments are not immediately deleted after a single window ends, but remain visible for a preset retention period.

[0046] In one embodiment, let the set of candidate transaction fragments cached in multiple detection windows be . Candidate transaction fragments can be used as graph nodes to construct a fragment relationship graph. in, Represents the set of graph nodes. This represents the set of connecting edges.

[0047] For any two candidate transaction segments and The following four criteria are extracted for judgment: First, the target transaction is consistent; second, the parties involved in the suspected related-party transaction overlap; third, the time interval is less than a preset threshold; and fourth, the intensity of behavioral correlation reaches a preset condition. Accordingly, we can define... in, and These represent the target trading assets corresponding to the two candidate trading segments.

[0048] like and Let represent the sets of participants for the two candidate transaction segments, respectively. Then, the participant overlap condition can be expressed as: in, The threshold for overlap among participants.

[0049] If the time interval between two candidate transaction segments is The temporal adjacency condition can then be expressed as: in, This is the time interval threshold. This allows... lie in Then, undirected relations can be constructed as needed.

[0050] The behavioral response intensity condition can be defined as follows: in, Indicates directional responsiveness. Indicates price responsiveness. Indicates the degree of rhythmic correspondence in quantity. The behavioral response condition can then be expressed as: In one implementation, when When this happens, connecting edges are established between the corresponding graph nodes.

[0051] To reflect the importance of different connecting edges, edge weights can be further defined. in, Indicates the overlap coefficient of the participating parties set. For time decay parameters, , where is the weighting coefficient. The larger the edge weight, the more likely two candidate transaction segments should be considered adjacent evidence units on the same hidden anomaly path.

[0052] In one implementation, the reorganized transaction chain can be obtained by performing connected component identification, path search, community segmentation, chain tracing, or maximum weight path extraction on the fragment relationship graph. For a fragment subgraph formed under the same target transaction object, its set of connected nodes can be regarded as a reorganized transaction chain, denoted as […]. in, Indicates the first A restructuring transaction chain, This indicates the number of candidate transaction fragments contained in the chain. A reconstructed transaction chain can represent either a sequence of consecutively occurring fragments or a set of fragments that appear repeatedly in multiple detection windows but are strung together by participants and behavioral patterns.

[0053] In one implementation, fragment retention and caching are not simply temporary storage, but rather a means to establish the "accumulative nature of weak anomaly evidence over time." That is, a single candidate transaction fragment may not be sufficient to constitute an anomaly determination, but multiple candidate transaction fragments appearing in different windows, after being recombined, can exhibit obvious characteristics of continuous participation, temporal continuity, and behavioral synergy, thereby constituting a chain of evidence for covert financial transaction anomalies.

[0054] S5 calculates the cumulative doubt value for each restructuring transaction chain.

[0055] In one implementation, the cumulative suspicion value is used to characterize the overall suspicion level of a restructuring transaction chain across multiple detection windows. For any restructuring transaction chain... The calculation can be performed from three aspects: first, the degree of repetition of candidate transaction segments; second, the degree of continuous participation of suspected related transaction participants in the same target transaction; and third, the strength of synergy between candidate transaction segments.

[0056] The degree of repetition of candidate transaction fragments is used to characterize whether similar suspicious fragments reappear in multiple detection windows. If the transaction chain is reorganized... The set of detection windows covered is The degree of repetition can then be defined as in, This represents the total number of windows within the target detection period. This indicates the number of windows actually covered by the restructuring transaction chain. Alternatively, it can be defined using the segment repetition counting method. in, Representation and fragment Frequency of occurrence of similar or highly similar segments in different windows.

[0057] The degree of sustained involvement is used to characterize whether parties suspected of related-party transactions continue to participate in the same target transaction. Let's consider a restructuring transaction chain. The corresponding set of suspected related-party transaction participants is Then it can be defined in, Indicates the participants in the transaction The number of participating windows within the coverage window of this restructuring transaction chain. The larger this value, the more likely that the corresponding transaction participant is not participating sporadically, but rather appears continuously in multiple windows.

[0058] Synergy strength characterizes the overall degree of synergy among candidate transaction fragments. It can be calculated based on the edge weights within the reorganization transaction chain. in, Indicates the restructuring transaction chain The set of internal connecting edges, This corresponds to the edge weights. If the internal edge weights of the reorganized transaction chain are generally large, it indicates that there is strong behavioral correspondence and temporal connection between the segments.

[0059] In one embodiment, the cumulative doubt value can be expressed as: in, . , , These correspond to the degree of repetition, the degree of sustained participation, and the intensity of collaboration, respectively. The larger the value, the more suspicious the entire restructuring transaction chain is.

[0060] To enable dynamic updating of the accumulated doubt value, one embodiment employs a recursive approach for updating it. Let the... After each testing window ends, the reorganization transaction chain... The calculated instantaneous doubt value is The cumulative update result can then be represented as in, This is the historical memory coefficient. This method ensures that the suspiciousness of information in a preceding window is not completely diluted by subsequent ordinary windows, thus enhancing the ability to continuously track intermittent covert behavior.

[0061] In one implementation, to prevent misjudgment due to the long-term persistence of abnormally aged evidence, a decay mechanism can be introduced for reorganization transaction chains that have not been continued for a long time. Let the idle time since the last addition of a candidate transaction segment be denoted as . Then the cumulative skepticism value after attenuation can be defined as follows: in, This is the skepticism value decay coefficient. In this way, as fragments are continuously added, the skepticism value of the reorganized transaction chain can gradually accumulate; when there are no new fragments for a long period of time, the skepticism value will gradually decrease.

[0062] S6. When the accumulated suspicion value reaches the preset condition, a second review is performed on the corresponding restructuring transaction chain to identify hidden financial transaction abnormalities.

[0063] In one implementation, the preset conditions can be: in, This is the cumulative threshold for suspicion. It can also be set to two conditions, such as "the suspicion value exceeds a preset threshold and the number of windows covered by the reorganization transaction chain is not less than a preset lower limit." Reorganization transaction chains that meet the preset conditions enter the secondary review stage.

[0064] In one implementation, the key to the second-order judgment is to relax the requirement that a single transaction event hits the strong anomaly rule. Instead of requiring any single event in the chain to reach the strong anomaly level, the reorganized transaction chain is regarded as a whole object, and a joint judgment is made based on its overall temporal continuity, behavioral coordination and cumulative suspicion value.

[0065] Specifically, regarding the restructuring transaction chain Its temporal continuity index, behavioral synergy index, and cumulative evidence index can be calculated separately.

[0066] The time-series continuity metric is used to measure the extent to which a restructuring transaction chain continues over time. If the restructuring transaction chain includes... There are candidate transaction segments, and the time interval between adjacent segments is... Then the time series continuity index can be defined as in, This is the continuous attenuation coefficient. The larger the value, the more continuous the segment is in time.

[0067] Behavioral synergy metrics are used to measure whether multiple candidate transaction segments within a restructuring transaction chain coordinate in a consistent manner around the same behavioral intent. This can be defined as... in, Representing fragments The scoring of collaborative behavior can comprehensively consider factors such as consistency of direction, correspondence of price levels, recurrence of quantity rhythm, characteristics of counterparty cooperation, and traces of influence from the betting market. The larger the value, the more likely the on-chain behavior is to have a unified intent.

[0068] The cumulative evidence index can be directly adopted using the aforementioned attenuated cumulative skepticism value. And normalize it, denoted as in, and These are the minimum and maximum doubt values ​​in the current evaluation batch, respectively, or the preset normalization boundaries.

[0069] In one embodiment, the joint decision value of the second back-judgment can be expressed as: in, .when At that time, the corresponding restructuring transaction chain was determined to constitute concealed financial transaction abnormality; when When, it can be output as a key focus status; when In such cases, it may not be considered abnormal at the moment, but its chain of evidence should be preserved for further observation in subsequent windows.

[0070] In one implementation, the secondary review can also output the type of abnormal behavior, suspected related-party transaction participants, the corresponding restructuring transaction chain, and the risk level. The type of abnormal behavior can be identified based on the main behavioral patterns on the chain, such as concealed collaborative reporting anomalies, concealed wash trading anomalies, concealed price manipulation anomalies, and concealed fabrication of false activity anomalies. Suspected related-party transaction participants can be a set of entities in the restructuring transaction chain that participate frequently, have strong connections, and high core connectivity. The corresponding restructuring transaction chain is used to preserve the original evidence path. The risk level can be determined based on the joint judgment value. Or the accumulated doubt value The risk level can be categorized into low risk, medium risk, high risk, and extremely high risk.

[0071] In one implementation, the risk level mapping can be set as follows: in, This is the threshold for grading.

[0072] S7 integrates the first detection result and the second return judgment result to output the time sequence detection result of abnormal financial transaction behavior.

[0073] In one implementation, the final output includes two parts: explicit anomaly results and implicit anomaly results. Explicit anomaly results originate from the first detection result that hits the strong anomaly rule in step S2; implicit anomaly results originate from the reorganization transaction chain anomaly results identified through secondary back-judgment in step S6. The two can be combined to form a unified output set. in, This represents the set of secondary feedback results. In this way, the system can quickly identify single strong abnormal behaviors as well as cumulatively identify weak abnormal behaviors across windows.

[0074] In one embodiment, the time-series detection results of abnormal financial transaction behavior include at least abnormal behavior determination information, related entity information, and evidence chain information. The abnormal behavior determination information describes the type of abnormal behavior, the triggering time, the basis for determination, and the risk level; the related entity information describes the identification, correlation strength, frequency of participation, and core status of suspected related transaction participants; and the evidence chain information describes the candidate transaction segment sequence, the original transaction event sequence, the connection status of the segment relationship diagram, and key time nodes that constitute the abnormality identification.

[0075] In one implementation, the output may also include explanatory information, such as "This anomaly judgment was not directly triggered by a single transaction event, but rather by a chain of evidence formed by cross-window recombination of candidate transaction fragments from multiple detection windows"; or it may include explanatory items such as "The main basis for this judgment is the continuous participation of the parties involved, the high degree of behavioral responsiveness, and the strong temporal continuity." This approach can improve the auditability and verifiability of the detection results.

[0076] The following description, in conjunction with the system implementation method, provides an explanation.

[0077] like Figure 2 The financial transaction abnormal behavior time sequence detection system shown includes a data acquisition module, a preliminary screening module, a weakly coupled fragment extraction module, a fragment retention and caching module, a cross-window reconstruction module, an evidence accumulation calculation module, a secondary review module, and a result output module.

[0078] The data acquisition module is used to acquire financial transaction event data, transaction participant association data, and preliminary screening results for the target object within the target detection period. Specifically, the data acquisition module may include a streaming acquisition unit, a batch extraction unit, a data cleaning unit, a time alignment unit, and a standardization mapping unit. The streaming acquisition unit is used to access real-time event streams; the batch extraction unit is used to extract historical data from offline databases according to time ranges; the data cleaning unit is used to remove invalid records and supplement necessary fields; the time alignment unit is used to unify the timeline; and the standardization mapping unit is used to map heterogeneous fields to a unified internal data structure.

[0079] The preliminary screening module performs initial screening of transaction events, obtaining the first detection result of strong anomaly rules and a set of candidate transaction events that do not match strong anomaly rules. The preliminary screening module may include a strong anomaly rule library, a rule execution engine, and a candidate retention subunit. The strong anomaly rule library stores various rule templates that can directly identify single anomaly events; the rule execution engine performs hit determination on input events individually or in batches; the candidate retention subunit retains events that do not match strong anomaly rules but possess suspicious edge characteristics.

[0080] The weakly coupled fragment extraction module is used to extract candidate transaction fragments exhibiting weak coupling characteristics from a set of candidate transaction events. This module may include a relationship evaluation subunit, a temporal aggregation subunit, and a behavioral cooperation identification subunit. Specifically, the relationship evaluation subunit calculates the correlation and responsiveness features between transaction participants, the temporal aggregation subunit identifies the temporal adjacency relationships between events, and the behavioral cooperation identification subunit identifies the cooperation features between transaction behaviors. The weakly coupled fragment extraction module extracts candidate transaction fragments based on correlation and responsiveness, temporal proximity, and behavioral cooperation relationships.

[0081] The fragment retention and caching module is used to retain and cache candidate transaction fragments. This module may include a fragment recording subunit, a short-term cache subunit, an expired elimination subunit, and an index maintenance subunit. The fragment recording subunit generates structured records of fragments; the short-term cache subunit saves candidate transaction fragments according to the detection period; the expired elimination subunit removes historical fragments that have not been updated for a long time and have low suspicion values; and the index maintenance subunit builds a fast retrieval index based on the target transaction object, the set of participants, the time interval, and behavioral tags.

[0082] The cross-window reorganization module is used to reorganize candidate transaction fragments across windows to form a reorganized transaction chain. The cross-window reorganization module may include a graph node generation subunit, a connection edge determination subunit, a fragment relationship graph construction subunit, and a chain identification subunit. The graph node generation subunit maps candidate transaction fragments to graph nodes; the connection edge determination subunit establishes connection edges based on at least two of the following conditions: consistency of target transaction object, overlap of suspected related transaction participants, time interval less than a preset threshold, and behavioral response strength reaching a preset condition; the fragment relationship graph construction subunit generates a fragment relationship graph; and the chain identification subunit forms a reorganized transaction chain based on the fragment relationship graph.

[0083] like Figure 3 As shown, the evidence accumulation calculation module is used to calculate the cumulative suspicion value for each restructuring transaction chain. The evidence accumulation calculation module may include a recurrence statistics subunit, a continuous participation analysis subunit, a synergy strength analysis subunit, and a comprehensive scoring subunit. The recurrence statistics subunit is used to count the recurrence of candidate transaction segments across multiple detection windows; the continuous participation analysis subunit is used to analyze the continuous participation of suspected related-party transaction participants around the same target transaction; the synergy strength analysis subunit is used to analyze the synergy between candidate transaction segments; and the comprehensive scoring subunit is used to calculate the cumulative suspicion value based on the aforementioned results.

[0084] The secondary review module is used to perform a secondary review on the corresponding restructuring transaction chain when the accumulated suspicion value reaches a preset condition, in order to identify concealed abnormal financial transaction behaviors. The secondary review module may include a trigger judgment subunit, an overall time series analysis subunit, an overall collaborative behavior analysis subunit, a joint judgment subunit, and an anomaly type output subunit.

[0085] The trigger judgment subunit is used to determine whether the accumulated suspicion value has reached the preset condition; the overall time sequence analysis subunit is used to analyze the overall time sequence continuity of the restructuring transaction chain; the overall collaborative behavior analysis subunit is used to analyze the overall behavioral synergy of the restructuring transaction chain; the joint judgment subunit is used to make a joint judgment on whether it is abnormal based on the accumulated suspicion value; the abnormal type output subunit is used to output the abnormal behavior type, suspected related transaction participants, corresponding restructuring transaction chain and risk level.

[0086] The results output module is used to merge the first detection result and the second review result to output the time-series detection result of abnormal financial transaction behavior. The results output module may include a result merging subunit, a risk classification subunit, an evidence chain display subunit, and an external interface subunit.

[0087] The results merging subunit is used to merge explicit and implicit abnormal results; the risk grading subunit is used to generate grade labels; the evidence chain display subunit is used to output candidate transaction fragments, reconstructed transaction chains and key events that constitute the basis for judgment; and the external interface subunit is used to output structured detection results to the regulatory platform, alarm platform or manual review terminal.

[0088] In one implementation, the system can be implemented using a centralized deployment approach, that is, deploying each module in the same server cluster; Alternatively, a distributed deployment approach can be adopted. For example, the data acquisition module and the preliminary screening module can be deployed on the stream processing node, the weakly coupled fragment extraction module and the cross-window reconstruction module can be deployed on the graph computing node, the evidence accumulation calculation module and the secondary back-judgment module can be deployed on the risk control decision node, and the result output module can be deployed on the alarm service node.

[0089] For high-throughput financial transaction scenarios, a distributed deployment approach is preferred to improve real-time processing capabilities.

[0090] In one embodiment, the system may further include a parameter configuration unit for configuring the window length. Overlapping threshold of participants Time interval threshold Behavioral response threshold Fragment determination threshold Cumulative Suspicion Threshold , Regression threshold In addition, various weight parameters can be configured. These parameters can be preset by experts, obtained from training with historical samples, or adaptively adjusted during long-term operation based on false alarm rate, false negative rate, and feedback from manual review.

[0091] The following is a non-limiting description of the detection process to help understand the working mechanism of the present invention.

[0092] Assuming that during the target detection period, the trading activities revolve around the same target asset... Several transaction events occurred. While not all of these events individually matched the strong anomaly rules, they were distributed across multiple adjacent detection windows. In the first window, the transaction participants... and around This forms a set of opposing order events with similar prices and timings; in the second window, the trading participants... and Again around The third window generates a combination of similar order and transaction volumes; (The third window, the trading participants...) and Then, within a short period of time, transaction events occur that correspond to the behavior patterns of the previous two windows. Since a single occurrence in each window does not necessarily reach the threshold of the strong anomaly rule, traditional single-window solutions may treat them as ordinary transaction behaviors and ignore them.

[0093] In this invention, the local suspicious events in the aforementioned windows are first included in the candidate transaction event set and further extracted as candidate transaction fragments. Subsequently, the system discovers that these candidate transaction fragments share characteristics such as consistent target transactions, overlapping participants, short time intervals, and high behavioral responsiveness. Therefore, connecting edges are established in the fragment relationship graph, and these fragments are reorganized into a single reorganized transaction chain. As the number of windows covered by this reorganized transaction chain increases, the number of repeated fragments increases, the number of participants continues to appear, and the internal coordination strength increases, its cumulative suspicion value continuously rises until it reaches a preset condition. At this point, the system triggers a secondary review and makes a joint judgment based on overall temporal continuity, overall behavioral coordination, and the cumulative suspicion value, thereby identifying the behavior as a concealed type of abnormal financial transaction behavior.

[0094] Therefore, this invention does not require each individual transaction event to be sufficiently "strong," but rather allows for the preservation and accumulation of scattered weak anomaly evidence, followed by anomaly identification through cross-window recombination and overall back-judgment. This is precisely the key implementation mechanism that distinguishes this invention from traditional single-event strong hit detection schemes.

[0095] In one implementation, to avoid excessive graph computation due to an excessive number of candidate transaction fragments, a priority mechanism can be introduced during the fragment retention phase. Priority can be determined by factors such as weak coupling comprehensive score, participant association strength, sensitivity level of the target transaction, and rarity of behavioral patterns. For candidate transaction fragments with higher priority, a longer caching duration and higher reorganization priority are granted; for candidate transaction fragments with lower priority, the retention time can be shortened or their reorganization candidate weight can be reduced.

[0096] In one implementation, key participant identification metrics can also be defined at the restructuring transaction chain level. Let a certain transaction participant... In restructuring the transaction chain The number of segments appearing in the text is Then its core degree can be expressed as in, Transaction participants with high core involvement can be prioritized as suspected leading entities in output, thereby improving the interpretability of the results.

[0097] In one implementation, the evidence chain information can also be stored in a hierarchical manner. The first layer is the original transaction event layer, used to store each order, transaction, or cancellation record; the second layer is the candidate transaction fragment layer, used to store local suspicious units; the third layer is the reconstructed transaction chain layer, used to store cross-window connection results; and the fourth layer is the final anomaly determination layer, used to store the abnormal behavior type and risk level output by the secondary review. Through hierarchical storage, the basis for each level of judgment can be quickly located in regulatory review, case investigation, or model backtracking.

[0098] In one implementation, the system can also generate a visual evidence view upon output. For example, it can display the distribution of candidate transaction fragments in each detection window using a timeline, show the relationship structure between suspected related transaction participants using a relationship network, show the formation process of the reorganization transaction chain using a path diagram, and show the change of the cumulative suspicion value over time using a risk curve.

[0099] In one embodiment, the "abnormal financial transaction behavior" in this invention is not limited to a single specific abnormal type, but rather refers to abnormal transaction behavior that requires comprehensive judgment through transaction events, participant relationships, and temporal chain evidence. Therefore, the indicator definitions and parameter settings of the correlation response features, temporal adjacency features, behavioral coordination features, reorganized transaction chains, accumulated doubt values, and secondary re-judgment formulas in the above embodiments can be appropriately adjusted according to different business scenarios without changing the core technical idea of ​​this invention: "preserving weakly coupled candidate transaction fragments, reorganizing them across windows, accumulating evidence, and making overall re-judgments."

[0100] In summary, this invention acquires financial transaction event data, transaction participant association data, and preliminary screening results for the target object within the target detection period. This initial screening yields a first detection result that hits strong anomaly rules and a set of candidate transaction events that do not. Next, candidate transaction fragments with weak coupling characteristics are extracted from the candidate transaction event set. These fragments are retained and cached, and then recombined across windows according to the target transaction object, suspected related transaction participants, temporal adjacency, and behavioral correspondence to form recombined transaction chains. Subsequently, a cumulative suspicion value is calculated for each recombined transaction chain. When the cumulative suspicion value reaches a preset condition, a secondary review is performed on the corresponding recombined transaction chain to identify concealed financial transaction anomalies. Finally, the first detection result and the secondary review result are merged to output the time-series detection result of financial transaction anomalies. This technical solution effectively improves the detection capability for concealed, dispersed, and cross-window financial transaction anomalies, while also enhancing the evidentiary continuity, interpretability, and usability for manual verification of the detection results.

[0101] The above are merely specific embodiments of the present invention and are not intended to limit the invention. For those skilled in the art, any modifications, equivalent substitutions, or improvements made to the above embodiments without departing from the inventive concept should fall within the protection scope of the present invention. The protection scope of the present invention is defined by the claims, and the specification and drawings can be used to interpret the claims.

Claims

1. A method for detecting abnormal behavior in financial transactions over time, characterized in that, include: S1, obtain financial transaction event data, transaction participant association data, and preliminary screening results of the target object within the target detection period; S2, based on the financial transaction event data and transaction participant association data, perform preliminary screening of transaction events to obtain the first detection result that hits the strong anomaly rule and the candidate transaction event set that does not hit the strong anomaly rule; S3, extract candidate transaction fragments with weak coupling characteristics from the candidate transaction event set; S4, the candidate transaction fragments are retained and cached, and cross-window reorganization is performed according to the target transaction object, suspected related transaction participants, time adjacency relationship and behavioral correspondence relationship to form a reorganized transaction chain; S5, calculate the cumulative doubt value for each of the aforementioned restructuring transaction chains; S6. When the accumulated suspicion value reaches the preset condition, a second back-judgment is performed on the corresponding restructuring transaction chain to identify hidden financial transaction abnormal behavior. S7, integrate the first detection result and the second back judgment result, and output the time sequence detection result of abnormal financial transaction behavior.

2. The method for detecting abnormal financial transaction behavior according to claim 1, characterized in that, The signs of weak coupling include the correlation and responsiveness between transaction participants, the temporal adjacency between transaction events, and the coordination between transaction behaviors.

3. The method for detecting abnormal financial transaction behavior according to claim 1, characterized in that, The cross-window reorganization includes: using candidate transaction fragments as graph nodes; when any two candidate transaction fragments meet at least two of the following conditions: the target transaction is consistent, the suspected related transaction participants overlap, the time interval is less than a preset threshold, and the behavioral response intensity reaches a preset condition, a connection edge is established between the corresponding graph nodes; and the reorganized transaction chain is identified based on the fragment relationship graph formed by the connection edge.

4. The method for detecting abnormal financial transaction behavior according to claim 1, characterized in that, The cumulative suspicion value is determined by the degree of recurrence of candidate transaction segments, the degree of continuous participation of suspected related parties in the same target transaction, and the strength of collaboration between candidate transaction segments.

5. The method for detecting abnormal financial transaction behavior according to claim 1, characterized in that, The secondary judgment includes: relaxing the requirements for a single transaction event to hit the strong anomaly rule; making a joint judgment based on the overall temporal continuity, behavioral synergy, and cumulative suspicion value of the reorganized transaction chain; and outputting the abnormal behavior type, suspected related transaction participants, corresponding reorganized transaction chain, and risk level.

6. A time-series detection system for abnormal financial transaction behavior, characterized in that, include: The data acquisition module is used to acquire financial transaction event data, transaction participant association data, and preliminary screening results of the target object within the target detection period; The preliminary screening module is used to perform preliminary screening of transaction events, and obtain the first detection result of strong anomaly rules and the candidate transaction event set that does not hit the strong anomaly rules; A weakly coupled segment extraction module is used to extract candidate transaction segments with signs of weak coupling from the candidate transaction event set; The fragment retention and caching module is used to retain and cache the candidate transaction fragments; The cross-window recombination module is used to recombine the candidate transaction fragments across windows to form a recombined transaction chain; The evidence accumulation calculation module is used to calculate the cumulative doubt value for each of the aforementioned reorganization transaction chains; The secondary review module is used to perform a secondary review on the corresponding restructuring transaction chain when the accumulated suspicion value reaches a preset condition, so as to identify hidden financial transaction abnormal behavior. The result output module is used to integrate the first detection result and the second back judgment result to output the time sequence detection result of abnormal financial transaction behavior.

7. The financial transaction abnormal behavior time-series detection system according to claim 6, characterized in that, The financial transaction event data includes order information, transaction information, and transaction environment identification information.

8. The financial transaction abnormal behavior time-series detection system according to claim 6, characterized in that, The weakly coupled segment extraction module is used to extract candidate transaction segments based on correlation, temporal proximity, and behavioral coordination; the cross-window reorganization module is used to construct a segment relationship graph and form a reorganized transaction chain based on the segment relationship graph.

9. The financial transaction abnormal behavior time-series detection system according to claim 6, characterized in that, The evidence accumulation calculation module is used to calculate the cumulative suspicion value based on the recurrence of candidate transaction fragments in multiple detection windows, the continuous participation of suspected related transaction participants, and the coordination between candidate transaction fragments; the secondary judgment module is used to jointly judge the corresponding reorganization transaction chain based on the cumulative suspicion value.

10. The financial transaction abnormal behavior timing detection system according to claim 6, characterized in that, The result output module is used to output abnormal behavior determination information, associated subject information, and evidence chain information.

Images