A method and system for identifying abnormal accounts in financial transactions
By calculating the imbalance of instruction flow and the temporal correlation of behavior between accounts, a directed graph is established and a temporal cooperative community is generated, which solves the problems of false positives and false negatives in the identification of abnormal accounts in financial transactions in the existing technology, and achieves more efficient abnormal account detection.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- COMP NETWORK INFORMATION CENT CHINESE ACADEMY OF SCI
- Filing Date
- 2026-05-07
- Publication Date
- 2026-06-05
Smart Images
Figure CN122153744A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of financial analysis technology, and more specifically to a method and system for identifying abnormal accounts in financial transactions. Background Technology
[0002] Currently, in modern financial transactions, abnormal financial activities pose certain risks to the security of financial institutions. With the increasing complexity of financial markets, especially the widespread adoption of electronic transactions, a massive amount of transaction data has emerged, significantly increasing the difficulty of analysis and monitoring.
[0003] However, existing screening methods for abnormal financial transaction accounts often rely on manually set rules for data screening, which often lack sufficient sensitivity and responsiveness to complex and covert manipulation behaviors. At the same time, the above screening methods often ignore the temporal relationship and synchronization between different accounts, resulting in low efficiency and serious false positives and false negatives when detecting coordinated fraud or market manipulation.
[0004] Therefore, how to provide a method for identifying abnormal financial transaction accounts that can solve the above problems is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention
[0005] In view of this, the present invention provides a method and system for identifying abnormal accounts in financial transactions, thereby improving the sensitivity and reliability of identifying high-risk behaviors.
[0006] To achieve the above objectives, the present invention adopts the following technical solution: A method for identifying abnormal financial transaction accounts includes the following steps: Acquire financial transaction data within a preset time period, and clean the financial transaction data to obtain corresponding transaction behavior data; The rate of change of the imbalance of instruction flow between different accounts is calculated based on transaction behavior data. When the rate of change exceeds the first preset threshold, the corresponding account is marked as a suspicious account. The financial transaction data of the suspicious accounts are processed to obtain the corresponding inter-account behavioral temporal correlation degree and time offset, and a corresponding behavioral temporal correlation directed graph is established based on the behavioral temporal correlation degree and time offset. The suspicious account is searched for neighboring accounts whose behavioral temporal correlation exceeds a second preset threshold based on the directed graph of behavioral temporal correlation, and the neighboring accounts are merged with the suspicious account to generate the corresponding temporal collaborative community. Determine whether the suspicious account belongs to any temporal collaborative cluster; if so, determine that the account is abnormal.
[0007] Preferred options also include: The financial transaction data is identified to obtain the current transaction spread ratio and depth data; Based on the relationship between the current trading spread ratio and the depth data and the corresponding ratio threshold, it is determined whether the first preset threshold and the second preset threshold need to be adjusted.
[0008] Preferably, the specific process of adjusting the first preset threshold and the second preset threshold includes: When the current trading price difference ratio exceeds a preset threshold and the depth data is less than the corresponding threshold, the first preset threshold is adjusted according to the first preset coefficient, and the second preset threshold is adjusted according to the second preset coefficient.
[0009] Preferred options also include: The leadership score and consistency index of each abnormal account are calculated based on the temporal correlation of the abnormal account's behavior and the time offset. Based on the relationship between leadership score and third preset threshold, and the relationship between consistency index and fourth preset threshold, determine whether false alarms are necessary.
[0010] Preferably, the specific process for determining whether a false alarm needs to be made includes: The financial transaction data of the abnormal account is preprocessed, and the rate of change of instruction flow imbalance is recalculated using the preprocessed financial transaction data. Determine whether the instruction flow imbalance meets the corresponding threshold requirements. If it does, perform false alarm processing; otherwise, perform account risk assessment.
[0011] Preferably, the specific process for conducting account risk assessment includes: Normalize the rate of change of instruction flow imbalance, leadership score, and behavioral temporal correlation degree corresponding to the abnormal account; The risk score is calculated by multiplying the rate of change of the normalized instruction flow imbalance, the leadership score, and the behavioral temporal correlation.
[0012] Preferably, the specific processing steps after obtaining the risk score include: The risk score is compared with a preset risk classification threshold to classify and handle abnormal accounts. The classification results include low risk, medium risk and high risk. When the risk score reaches high risk, a real-time alarm signal is output, and the corresponding account identifier, risk score, instruction flow imbalance rate, behavior time sequence correlation, leadership score, consistency index and time offset are pushed to the regulatory terminal or risk control terminal. When the risk score is at the medium risk level, the corresponding account will be included in the continuous monitoring list, and the account's operation data will continue to be tracked in the subsequent preset window; When the risk score is lower than the preset handling threshold, log entries and evidence will be recorded, but strong alarms will not be triggered.
[0013] Preferably, the specific processing steps for obtaining the corresponding inter-account behavioral temporal correlation and time offset include: Feature sequences are extracted from the transaction behavior data of the suspicious accounts to obtain the corresponding sequences to be processed; The sequence to be processed is processed using a dynamic time warping algorithm to obtain the DTW distance and time offset; The temporal correlation of behaviors between accounts is calculated based on DTW distance and time offset, combined with the exponential decay function.
[0014] This invention also provides a financial transaction abnormal account identification system, comprising: The data acquisition module is used to acquire financial transaction data within a preset time period and clean the financial transaction data to obtain corresponding transaction behavior data. The detection module is used to calculate the rate of change of the imbalance of instruction flow between different accounts based on transaction behavior data. When the rate of change exceeds a first preset threshold, the corresponding account is marked as a suspicious account. The graph construction module is used to process the financial transaction data of the suspicious accounts, obtain the corresponding inter-account behavioral temporal correlation degree and time offset, and establish a corresponding behavioral temporal correlation directed graph based on the behavioral temporal correlation degree and time offset. The analysis module is used to find neighbor accounts whose behavioral temporal correlation degree exceeds a second preset threshold in the suspicious account according to the directed graph of behavioral temporal correlation, and merge the neighbor accounts with the suspicious account to generate the corresponding temporal collaborative community; The determination module is used to determine whether the suspicious account belongs to any time-series collaborative community; if so, it determines that the account is abnormal.
[0015] As can be seen from the above technical solution, compared with the prior art, the present invention discloses a method and system for identifying abnormal financial transaction accounts, which has the following beneficial effects: 1. By using behavior sequence alignment processing and dynamic time warping algorithm, this invention can accurately quantify the temporal correlation and time offset of behavior between accounts, construct a directed graph of behavior temporal correlation, and discover temporal cooperative communities based on iterative merging. This method overcomes the defect of traditional rule system ignoring time synchronization, effectively identifies abnormal accounts, significantly reduces false alarm and false negative rates, and improves detection efficiency. 2. This invention calculates the price spread ratio and market depth in real time and automatically adjusts the threshold for judging suspicious accounts and the threshold for merging behavioral temporal correlation. This enables the system to more sensitively capture hidden collaborative behaviors during periods of insufficient liquidity or price sensitivity, thereby improving the system's robustness and adaptability to different market environments. 3. By calculating the leadership score of each account and the overall community consistency index, misjudgments caused by accidental behavior synchronization are avoided, thereby improving the sensitivity of high-risk behavior identification and the reliability of assessment. Attached Figure Description
[0016] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.
[0017] Figure 1 A flowchart illustrating the overall process of a method for identifying abnormal accounts in financial transactions provided by this invention; Figure 2 The present invention provides a structural principle block diagram of a financial transaction abnormal account identification system. Detailed Implementation
[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0019] In traditional financial transaction monitoring systems, static rule-based data screening methods struggle to effectively identify coordinated manipulation behaviors with time-synchronized characteristics. Due to the lack of dynamic analysis of the temporal correlation between inter-account delegation activities, the system cannot detect coordinated deception operations implemented through time-shifting strategies, leading to a significant reduction in detection accuracy and timeliness. Specifically, in high-frequency trading scenarios where multiple accounts employ time-dispersed but strategy-synchronized delegation operations, traditional methods can only identify abnormal indicators for individual accounts, failing to analyze cross-account time-series patterns, resulting in numerous missed detections of coordinated behaviors. The system's false alarm rate also increases, as normal trading fluctuations in independent accounts may trigger isolated anomaly alarms, requiring secondary manual verification and significantly increasing regulatory costs.
[0020] For example, during the continuous bidding phase of the securities market, multiple related accounts may coordinate their operations using a time-leading-lag strategy. Account A creates false demand by placing a buy order at time t1 that deviates from the optimal price; Account B follows suit with a buy order at a higher price at time t1+Δt; and Account C quickly cancels its original order at time t2. In such operations, the rate of change of the order flow imbalance of a single account may not reach a threshold, but the cross-account behavior exhibits a strong correlation in the time dimension. Existing systems, lacking mechanisms for calculating time offsets and aligning behavioral sequences, cannot identify the synchronous characteristics of order behavior within the Δt time window between accounts, resulting in the coordinated operations not being effectively flagged. The monitoring system only outputs isolated abnormal events of isolated accounts, failing to link them to form a complete chain of evidence for coordinated behavior.
[0021] If these problems are not addressed, market manipulation will remain hidden within normal trading data for a long time, undermining market fairness and increasing systemic risks. Regulatory agencies will struggle to detect deceptive operations implemented through time-coordinated strategies in a timely manner, leading to delays in handling abnormal trading activities. The continuously rising false alarm rate will waste regulatory resources, and a large number of invalid alerts will interfere with the identification of genuine risk signals.
[0022] To solve the above problem, see Figure 1 As shown in the figure, this invention discloses a method for identifying abnormal financial transaction accounts, including the following steps: The system acquires financial transaction data within a preset time period and cleans the data to obtain corresponding transaction behavior data. This transaction behavior data may include individual order data, which may also include account identifier, order timestamp, order type, order price, order quantity, and cancellation status. Order types include buy orders and sell orders. The data can be legally and compliantly acquired through official channels of banks or payment institutions, compliant third-party data services, and official channels of regulatory agencies. Specifically, a subscription request can be sent to the exchange via a dedicated financial data interface protocol, specifying the data type to be acquired as order data and ensuring that the subscription parameters include all required fields, such as account identifier, order timestamp, order type, order price, order quantity, and cancellation status. The exchange then begins pushing real-time data streams. The system continuously monitors data packets through an asynchronous receiving mechanism to prevent data loss or delay. Upon receiving the data packets, the system immediately parses them, extracting each field of each order record according to a predefined data structure (such as binary or JSON format), and verifying the integrity and accuracy of the data, such as checking the continuity and reasonableness of the timestamp values. The parsed data is converted to an internal standard format, and a receiving timestamp is added to mark the local processing time. Finally, the data is stored in a buffer queue, awaiting aggregation and analysis by subsequent processing modules according to time windows. Throughout the process, the system monitors the connection status and data stream quality in real time. If any anomalies are detected, such as network interruptions or data format errors, a reconnection mechanism or alarm notification will be triggered to ensure the reliability and continuity of data acquisition. The rate of change of the imbalance of instruction flow between different accounts is calculated based on transaction behavior data. When the rate of change exceeds the first preset threshold, the corresponding account is marked as a suspicious account. The financial transaction data of the suspicious accounts are processed to obtain the corresponding behavioral temporal correlation degree and time offset between accounts. A corresponding behavioral temporal correlation directed graph is established based on the behavioral temporal correlation degree and time offset. The nodes of the behavioral temporal correlation directed graph are the account identifiers of the suspicious accounts, the edge weights are the behavioral temporal correlation degrees, and the edge directions are determined by the time offset. The suspicious account is searched for neighboring accounts whose behavioral temporal correlation exceeds the second preset threshold according to the directed graph of behavioral temporal correlation. The neighboring accounts are merged with the suspicious account to generate the corresponding temporal collaborative community. The merging process is iteratively executed until no new merging occurs or the maximum number of iterations is reached. If the suspicious account belongs to any time-series collaborative cluster, then the account is determined to be abnormal.
[0023] Specifically, the maximum number of iterations is used to limit the merging depth of temporal collaborative communities, preventing excessive merging or excessive computational overhead when there are many accounts or weakly related edges. This parameter is preferably determined through experiments using historical samples: the stability of community size, detection rate, false alarm rate, and runtime latency are tested at different numbers of iterations. When the number of iterations continues to increase but the number of newly merged accounts has decreased significantly and the community partitioning results tend to stabilize, the corresponding number of iterations can be selected as the maximum number of iterations.
[0024] The maximum number of iterations can be set to 3. The reason is that the first iteration mainly completes the merging of strongly associated direct neighbors, the second iteration identifies secondary follower accounts, and the third iteration basically completes the expansion of stable communities. If the number of iterations is increased further, the number of new merges will be limited, and it is easy to introduce weakly associated accounts, which will lead to an increase in false alarms. Therefore, setting the maximum number of iterations to 3 can balance the integrity of community identification and computational efficiency.
[0025] The specific calculation process for the rate of change of instruction flow imbalance includes: First, calculate the instruction flow imbalance. , In the formula, B i Indicates buy data, S i This indicates sales data; The result of this formula takes values in the range of [-1, 1], where a positive value indicates that buy orders dominate and a negative value indicates that sell orders dominate.
[0026] In the formula, Indicates the current data. This displays the data from the previous window, and then the absolute value of the rate of change is examined. Does it exceed a preset first threshold? If it does, it indicates a significant change in the account's transaction behavior, marking it as a suspicious account and triggering subsequent collaborative behavior analysis.
[0027] In constructing the directed graph of behavioral temporal correlation in this embodiment of the invention, the first step is to use all account identifiers that have been marked as suspicious accounts as nodes, with each node representing an independent account. Then, the calculated behavioral temporal correlation degree is used... As the edge weight, where This reflects the similarity and temporal synchronization of the behavioral sequences between accounts i and j. The direction of the edge is determined by the time offset. Decision: If This indicates that account i is ahead of account j in time, therefore the edge points from i to j; if This means that j is ahead of i, and the edge points from j to i; while if If the edges are undirected, it indicates that the two are synchronized in time. In this way, the directed graph not only captures the strength of the association between accounts, but also reflects the temporal order of behaviors, laying the foundation for subsequent community identification.
[0028] In one specific embodiment, it also includes: The financial transaction data is identified to obtain the current transaction spread ratio and depth data; Based on the relationship between the current trading spread ratio and the depth data and the corresponding ratio threshold, it is determined whether the first preset threshold and the second preset threshold need to be adjusted.
[0029] Preferably, the specific process of adjusting the first preset threshold and the second preset threshold includes: When the current trading price difference ratio exceeds a preset threshold and the depth data is less than the corresponding threshold, the first preset threshold is adjusted according to the first preset coefficient, and the second preset threshold is adjusted according to the second preset coefficient.
[0030] Specifically, the process of calculating the spread ratio and market depth includes: Price difference ratio = (Best selling price - Best buying price) / Best buying price; Market depth = First-tier buy order volume + First-tier sell order volume; When the price spread ratio exceeds a preset ratio threshold or the market depth is lower than a preset depth threshold, the market is marked as fragile. In a vulnerable state, the first preset threshold is reduced by a first preset coefficient, and the second preset threshold is reduced by a second preset coefficient.
[0031] Specifically, this embodiment of the invention mainly analyzes the stock trading market. The corresponding current trading price difference ratio and market depth data are determined through real-time market snapshots from the exchange. The current trading price difference ratio is calculated as the ratio of the difference between the best selling price and the best buying price to the best buying price. Market depth is calculated as the sum of the buy and sell orders in the first tier of the order book. The price difference ratio can be calculated as a percentage; for example, when the best buying price is 100 yuan and the best selling price is 101 yuan, the price difference ratio is 1%. Market depth can be calculated by combining the total buy and sell orders in the first tier of the order book; for example, when the first buy order volume is 500 lots and the first sell order volume is 300 lots, the market depth is 800 lots.
[0032] The spread ratio threshold can be set at 0.5%, and the depth threshold at 1000 lots. When the current trading spread ratio exceeds 0.5% or the depth data falls below 1000 lots, the market is deemed to be in a vulnerable state, triggering a dynamic threshold adjustment mechanism. The aforementioned spread and depth thresholds are preferably determined based on historical market snapshots. Specifically, long-term statistics are performed on the optimal bid-ask spread ratio and first-tier depth data of the target market during normal trading phases, and their empirical distributions are calculated. Then, a quantile that can characterize low liquidity and high spread conditions is selected as the threshold. For example, the upper quantile of the spread ratio can be used as the spread threshold, and the lower quantile of the market depth can be used as the depth threshold, enabling the system to automatically identify vulnerable states in scenarios of insufficient liquidity and increased price sensitivity.
[0033] Specifically, the first preset threshold is used to determine whether there is an abnormal sudden change in the rate of change of the account's instruction flow imbalance. This threshold can be determined through statistical analysis of historical transaction data, and can be implemented in the following ways: Based on historical samples from normal trading days, the distribution of the rate of change of the order flow imbalance for each account is calculated according to a preset time window. Then, the high percentile is selected as the first preset threshold, so that most normal fluctuations do not trigger alarms, while significant abnormal fluctuations are preserved.
[0034] The first preset threshold can be set to 10%. When the market enters a fragile state, the threshold is adjusted downwards by the first preset coefficient. For example, when the first adjustment coefficient is 0.7, the first preset threshold is adjusted from 10% to 7%. The second preset threshold is used to determine whether the temporal correlation between the behaviors of accounts is high enough, thereby deciding whether to merge neighboring accounts. This threshold can be determined by using historical labeled samples or manually reviewed samples. That is, by statistically analyzing the temporal correlation distribution of known collaborative behavior account pairs and normal account pairs, and selecting a boundary value that can better distinguish between the two types of samples.
[0035] Since the behavioral temporal correlation is obtained by applying an exponential decay function to the DTW distance and time offset, the larger the value, the more similar and synchronous the behaviors of the two accounts are in time. Therefore, the second preset threshold should be set in a higher correlation range. The second preset threshold can be determined based on historical sample statistics, and it is preferred to set it to 0.7 in specific implementation. In a fragile market, it can be adjusted downward according to the second preset coefficient. For example, when the second preset coefficient is 0.8, the second preset threshold is adjusted from 0.7 to 0.56.
[0036] The first and second preset coefficients are used to dynamically lower the threshold and improve detection sensitivity under fragile market conditions. Their determination method is preferably as follows: Based on historical vulnerable market samples, the detection rate, false alarm rate and false negative rate under different coefficients are compared, and a coefficient that balances sensitivity and stability is selected. The first preset coefficient can be 0.7, and the second preset coefficient can be 0.8.
[0037] In one specific embodiment, it also includes: The leadership score and consistency index of each abnormal account are calculated based on the temporal correlation of the abnormal account's behavior and the time offset. Based on the relationship between leadership score and third preset threshold, and the relationship between consistency index and fourth preset threshold, determine whether false alarms are necessary.
[0038] Specifically, leadership scores can be calculated based on the difference in correlation between outgoing and incoming edges. For example, this can be achieved by summing the product of the temporal correlation of outgoing behavior and the sign of the time offset, then subtracting the difference in the corresponding value of the incoming edge. The sign function of the time offset quantifies the leading or lagging relationship as a coefficient of ±1, allowing the leadership score to reflect the account's dominance in initiating behavior. The specific expression is as follows:
[0039] Among them, L i A represents the leadership score of suspicious account i. ij Δt represents the temporal correlation between suspicious account i and suspicious account j. ij This represents the time offset of suspicious account i relative to suspicious account j. The sign function represents the time offset. The sum of the product of the outgoing neighbor's behavioral temporal correlation and the sign of the time offset is defined as the leadership contribution value. This calculation method transforms the behavioral correlation of account i actively guiding other accounts into a positive contribution value through the sign function of the time offset. For example, when account i's outgoing edge time offset is positive, the sign function converts it to +1, making the behavioral temporal correlation positively weighted; if the time offset is negative, the sign function is -1, thus suppressing the contribution of that correlation. The sum of the product of the neighbor node's behavioral temporal correlation and the sign of the time offset is defined as the follower value. This calculation method transforms account i's passive following of other accounts into a negative contribution value through the sign function of the time offset. For example, when account j's incoming edge time offset is negative, the sign function is -1, making the behavioral temporal correlation negatively weighted, thus reducing the interference of the follower value on the final leadership score. The difference between leadership contribution and followership values is used to construct a leadership score, which quantifies an account's dominance in collaborative behavior through a two-way weighting. For example, when the sum of the outgoing neighbor correlations of account i is significantly higher than the sum of the incoming neighbor correlations, the leadership score is positive, indicating that the account has a leadership role in the community; conversely, it is negative, indicating that it is in a follower position. The sign function of the time offset further distinguishes the directional effects of time lead and lag. For example, if account i's behavior is always ahead of its outgoing neighbors and lags behind its incoming neighbors, the sign function ensures that its leadership contribution value is enhanced while its followership value is weakened, thus accurately reflecting its dynamic role. The calculation process for the overall community consistency index includes: for each suspicious account with a positive leadership score within the time-series collaborative community, calculating its average time lead with suspicious accounts with a negative leadership score, and then performing a weighted average with leadership score as the weight. The specific expression is as follows:
[0040] In the formula, Indicators of consistency This represents the normalized leadership score of suspicious account i. This represents the average time lead of suspicious account i relative to all following accounts. The normalized leadership score can be calculated using either maximum normalization or standard deviation normalization. For example, each account's leadership score can be divided by the absolute value of the maximum leadership score in its cluster, compressing the numerical range to the [-1, 1] interval. The calculation of time lead needs to incorporate time offset data obtained from the alignment of behavioral sequences between accounts. For instance, the arithmetic mean of the time offsets between the leading account and each following account can be taken to reflect its overall lead stability. In the weighted averaging process, the normalized leadership score serves as a weighting factor, ensuring that accounts with stronger leadership contribute more to the consistency index. Simultaneously, the denominator uses the sum of the absolute values of the normalized weights to eliminate the offsetting effects of positive and negative weights. Specifically, when calculating the consistency index, all suspicious accounts with positive leadership scores within the cluster are first screened to eliminate interference from following accounts. For each leader account, the time offset data set relative to all follower accounts is extracted, and the average time lead is calculated. For example, if a leader account's time offset relative to three follower accounts is +2 seconds, +3 seconds, and +1 second respectively, then the average time lead is 2 seconds. The normalized leadership score is then multiplied by the average time lead. For example, if an account has a normalized leadership score of 0.8 and an average time lead of 2 seconds, its weighted contribution value is 1.6. Finally, the weighted contribution values of all leader accounts are summed and divided by the sum of the absolute values of the normalized leadership scores. For example, if the sum is 4.8 and the sum of the absolute values is 3, then the consistency index is 1.6. This calculation method eliminates dimensional differences through normalization, measures behavioral synchronicity using time lead, and highlights the role of core leader accounts through weighted averaging. This ensures that the final index accurately represents the stability of the leader-follower relationship, providing a reliable basis for judging collaborative deception behavior.
[0041] Finally, it is determined whether there are any suspicious accounts within the time-series collaborative community whose leadership scores exceed a preset third threshold and whose overall community consistency index exceeds a preset fourth threshold. If both conditions are met, the determination result remains unchanged. Otherwise, false alarm filtering is performed, which may include further data analysis or manual review. The overall community consistency index can be calculated by combining normalized leadership scores with average time primacy. For example, a weighted average of time primacy can be calculated using leadership scores as the weight, thereby quantifying the stability of the leader-follower relationship. The third and fourth thresholds can be determined based on historical data statistics. For example, the third threshold can be set to a normalized score range of 0.8 to 1.2, and the fourth threshold can be set to a stability range of 0.7 to 0.9.
[0042] In one specific embodiment, the process for determining whether a false alarm needs to be made includes: The financial transaction data of the abnormal account is preprocessed, and the rate of change of instruction flow imbalance is recalculated using the preprocessed financial transaction data. Determine whether the instruction flow imbalance meets the corresponding threshold requirements. If it does, perform false alarm processing; otherwise, perform account risk assessment.
[0043] In one specific embodiment, the specific process for conducting account risk assessment includes: Normalize the rate of change of instruction flow imbalance, leadership score, and behavioral temporal correlation degree corresponding to the abnormal account; The risk score is calculated by multiplying the rate of change of the normalized instruction flow imbalance, the leadership score, and the behavioral temporal correlation.
[0044] Specifically, in the risk scoring process, the maximum absolute value of the rate of change of order flow imbalance is first extracted to identify the most abnormal order volume fluctuations within the cluster. For example, if an account issues large reverse orders consecutively within a short period, causing a drastic change in order flow imbalance, this is a case in point. Secondly, the average behavioral temporal correlation is assessed by aligning account behavior sequences using a dynamic time warping algorithm, combined with a decay function of time offset, to comprehensively evaluate the synchronicity of account behavior within the cluster. For instance, when the order behavior of multiple accounts shows a regular offset on the time axis, the average correlation will significantly increase. Thirdly, the maximum normalized leadership score is calculated by the difference between the leadership contribution value and the followership, and then normalized using the range method. This highlights the dominant controlling account within the cluster. For example, when an account consistently issues order orders ahead of other accounts, its normalized leadership score will reach 1.0. Finally, the overall cluster consistency index is calculated using a weighted average time lead, reflecting the stability of the leader-follower relationship. For instance, when the standard deviation of the follower account's time delay is less than 0.5 seconds, the consistency index will exceed 0.7. By multiplying the four indicators, the coupling of features across different dimensions can be enhanced. For example, when both the rate of change in instruction flow imbalance and the leadership score are high, the risk score will increase exponentially, effectively improving the sensitivity of identification. Compared to the traditional linear weighting method, this non-linear combination method is more consistent with the multi-level correlation characteristics of market manipulation behavior. For instance, when a single indicator is abnormal while other indicators are normal, the product operation can still produce a significant change in the risk score, avoiding the feature cancellation problem that may occur with linear weighting.
[0045] In one specific embodiment, the specific processing procedure after obtaining the risk score includes: The risk score is compared with a preset risk classification threshold to classify and handle abnormal accounts. The classification results include low risk, medium risk, and high risk. For example, below 0.2 is low risk, 0.2 to 0.5 is medium risk, and above 0.5 is high risk. High-risk accounts trigger alarms and manual review, medium-risk accounts trigger continuous tracking, and low-risk accounts are retained in the background. When the risk score reaches high risk, a real-time alarm signal is output, and the corresponding account identifier, risk score, instruction flow imbalance rate, behavior time sequence correlation, leadership score, consistency index and time offset are pushed to the regulatory terminal or risk control terminal. When the risk score is at the medium risk level, the corresponding account will be included in the continuous monitoring list, and the account's operation data will continue to be tracked in the subsequent preset window; When the risk score is lower than the preset handling threshold, log entries and evidence will be recorded, but strong alarms will not be triggered.
[0046] In a specific embodiment, the specific processing steps for obtaining the corresponding inter-account behavioral temporal correlation degree and time offset include: Feature sequences are extracted from the transaction behavior data of the suspicious accounts to obtain the corresponding sequences to be processed; The sequence to be processed is processed using a dynamic time warping algorithm to obtain the DTW distance and time offset; Based on the DTW distance and time offset, and combined with the exponential decay function, the temporal correlation of behavior between accounts is calculated, as shown in the following expression:
[0047] Among them, A ij D represents the temporal correlation between the behaviors of account i and account j. ij Δt represents the DTW distance. ij Indicates the time offset. This represents the time decay constant. Time decay constant The time interval can be adjusted according to specific market characteristics and detection needs; for example, it can be set to 5 minutes or 10 minutes. On the one hand, the smaller the DTW distance, the more similar the two sequences are; on the other hand, the larger the time offset, the more severe the temporal misalignment between the two sequences. The behavioral temporal correlation is obtained by multiplying these two factors. It can simultaneously reflect the similarity of behaviors and the synchronicity of time.
[0048] Specifically, the order sequence is constructed using a structured data format that associates timestamps with quantities. Buy orders are marked with positive numbers, and sell orders with negative numbers, thus transforming differences in action direction into differences in numerical signs. The dynamic time warping algorithm allows for flexible matching with non-fixed time steps during sequence alignment. It achieves cross-time point mapping by finding the path with the minimum cumulative distance. For example, if two accounts have similar order volumes at times t1 and t2 respectively, the algorithm can automatically align these two time points. The time offset is calculated based on the difference in the starting point of the optimal alignment path. For example, if the earliest matching point of account i is 5 seconds later than that of account j, the time offset is recorded as +5 seconds. The time decay constant τ in the exponential decay function can be set as a multiple of the market average order interval, such as 300 seconds in the stock market, to adjust the sensitivity of time synchronization.
[0049] The behavior sequence alignment process first transforms the original order data into a signed numerical sequence, providing a comparable input structure for subsequent algorithms. The Dynamic Time Warping (DTW) algorithm calculates the optimal alignment path using a dynamic programming matrix, simultaneously recording the time difference between the path's starting points as the time offset. For example, for two sequences of lengths m and n, the algorithm constructs an m×n cost matrix, recursively calculates the minimum cumulative distance to determine the optimal path, and finally outputs the DTW distance as the total path cost, with the time offset being the difference between the path's starting points on the time axis. This calculation method ensures a high correlation value is obtained only when the order behaviors of two accounts are highly similar in form and have small time offsets, effectively solving the misjudgment problem in traditional methods where the order behaviors are similar in form but asynchronous in time, or synchronous in time but with large differences in form. The adjustability of the time decay constant further enhances the method's adaptability to different market environments; for example, in high-frequency trading scenarios, the τ value can be reduced to improve time synchronization requirements.
[0050] In some of the solutions mentioned above in this application, market state perception processing is proposed to dynamically adjust the threshold for judging suspicious accounts. However, when relying solely on the temporal correlation of behavior for collaborative judgment in fragile market conditions, the synergy of price strategies between accounts may be overlooked. For example, multiple accounts may place orders at similar prices that deviate from the best market quote, making it impossible for traditional methods to effectively identify such covert collaborative manipulation behavior.
[0051] To this end, this application further proposes that the behavioral sequence alignment processing also includes order price deviation feature fusion: Based on the best bid and best ask prices among the best five bid and ask prices, the median of the best bid prices is calculated; the median of the best bid prices is the arithmetic mean of the best bid and best ask prices; based on the order price and the median of the best bid prices, the price deviation of each order is calculated; the price deviation represents the degree of deviation of the order price from the best market price; based on the price deviation, the behavioral temporal correlation is adjusted using a consistency factor; the consistency factor represents the similarity of price strategies between accounts, and the smaller the difference in price deviation, the larger the consistency factor; the formula for calculating the behavioral temporal correlation after feature fusion is as follows: in, This represents the temporal correlation between the behaviors of account i and account j. Indicates DTW distance, Indicates the time offset. Represents the time decay constant. This represents the average price deviation between accounts i and j. This indicates the price deviation scaling parameter.
[0052] The median of the optimal quote is calculated by adding the optimal bid price and the optimal ask price and then dividing by two. For example, when the optimal bid price is 10.00 yuan and the optimal ask price is 10.05 yuan, the median of the optimal quote is 10.025 yuan. The price deviation is calculated based on the absolute difference between the order price and the median of the optimal quote. For example, when the order price is 10.03 yuan, the price deviation is 0.005 yuan. The consistency factor is adjusted using an exponential function. When the average price deviation difference between accounts i and j is 0.002 yuan and σ is set to 0.01, the consistency factor is... This reduces the correlation; if the difference is 0.001 yuan, the consistency factor is 0.9048, enhancing the correlation. The price deviation scaling parameter σ can range from 0.005 to 0.02, used to adjust the sensitivity of market fluctuations to the synergy of price strategies.
[0053] Specifically, in fragile market conditions, when the price spread exceeds a threshold or market depth is insufficient, the median optimal quote is dynamically updated to provide a real-time benchmark for price deviation. The average price deviation for each account is obtained by statistically analyzing the average price deviation of all its orders. For example, the average deviation of 10 orders for account i is 0.008 yuan, while the average deviation of 10 orders for account j is 0.007 yuan, a difference of 0.001 yuan. By incorporating the price deviation difference into the behavioral temporal correlation calculation formula, the original correlation based on DTW distance and time offset is further modified. When the price strategies between accounts are highly similar, even with weak time synchronization, the modified correlation may still exceed the second threshold, thus being identified as coordinated behavior. Therefore, in fragile market conditions, the system can simultaneously capture both time synchronization and price coordination, avoiding missed detections caused by relying on only a single dimension.
[0054] Through the aforementioned technical solution, this application enhances the ability to identify the coordination of price strategies among accounts. Specifically, by integrating order price deviation characteristics, the system not only focuses on the temporal synchronization of account behavior but also captures the coordination of price strategies. This method is particularly effective in fragile market conditions, enabling a more accurate distinction between independent spoofing and coordinated spoofing with covert price coordination. This improves the detection accuracy of complex market manipulation behaviors and reduces false positives and false negatives. Furthermore, by introducing an adjustable price deviation scaling parameter, the system becomes adaptable to different market volatility scenarios, further enhancing the robustness and practicality of the identification method.
[0055] See Figure 2 As shown, embodiments of the present invention also provide a system for identifying abnormal financial transaction accounts using any of the above embodiments, comprising: The data acquisition module is used to acquire financial transaction data within a preset time period and clean the financial transaction data to obtain corresponding transaction behavior data. The detection module is used to calculate the rate of change of the imbalance of instruction flow between different accounts based on transaction behavior data. When the rate of change exceeds a first preset threshold, the corresponding account is marked as a suspicious account. The graph construction module is used to process the financial transaction data of the suspicious accounts, obtain the corresponding inter-account behavioral temporal correlation degree and time offset, and establish a corresponding behavioral temporal correlation directed graph based on the behavioral temporal correlation degree and time offset. The analysis module is used to find neighbor accounts whose behavioral temporal correlation degree exceeds a second preset threshold in the suspicious account according to the directed graph of behavioral temporal correlation, and merge the neighbor accounts with the suspicious account to generate the corresponding temporal collaborative community; The determination module is used to determine whether the suspicious account belongs to any time-series collaborative community; if so, it determines that the account is abnormal.
[0056] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to the method section.
[0057] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.
Claims
1. A method for identifying abnormal accounts in financial transactions, characterized in that, Includes the following steps: Acquire financial transaction data within a preset time period, and clean the financial transaction data to obtain corresponding transaction behavior data; The rate of change of the imbalance of instruction flow between different accounts is calculated based on transaction behavior data. When the rate of change exceeds the first preset threshold, the corresponding account is marked as a suspicious account. The financial transaction data of the suspicious accounts are processed to obtain the corresponding inter-account behavioral temporal correlation degree and time offset, and a corresponding behavioral temporal correlation directed graph is established based on the behavioral temporal correlation degree and time offset. The suspicious account is searched for neighboring accounts whose behavioral temporal correlation exceeds a second preset threshold based on the directed graph of behavioral temporal correlation, and the neighboring accounts are merged with the suspicious account to generate the corresponding temporal collaborative community. Determine whether the suspicious account belongs to any temporal collaborative cluster; if so, determine that the account is abnormal.
2. The method for identifying abnormal financial transaction accounts according to claim 1, characterized in that, Also includes: The financial transaction data is identified to obtain the current transaction spread ratio and depth data; Based on the relationship between the current trading spread ratio and the depth data and the corresponding ratio threshold, it is determined whether the first preset threshold and the second preset threshold need to be adjusted.
3. The method for identifying abnormal financial transaction accounts according to claim 2, characterized in that, The specific process for adjusting the first preset threshold and the second preset threshold includes: When the current trading price difference ratio exceeds a preset threshold and the depth data is less than the corresponding threshold, the first preset threshold is adjusted according to the first preset coefficient, and the second preset threshold is adjusted according to the second preset coefficient.
4. The method for identifying abnormal financial transaction accounts according to claim 1, characterized in that, Also includes: The leadership score and consistency index of each abnormal account are calculated based on the temporal correlation of the abnormal account's behavior and the time offset. Based on the relationship between leadership score and third preset threshold, and the relationship between consistency index and fourth preset threshold, determine whether false alarms are necessary.
5. The method for identifying abnormal financial transaction accounts according to claim 4, characterized in that, The specific procedures for determining whether a false alarm needs to be made include: The financial transaction data of the abnormal account is preprocessed, and the rate of change of instruction flow imbalance is recalculated using the preprocessed financial transaction data. Determine whether the instruction flow imbalance meets the corresponding threshold requirements. If it does, perform false alarm processing; otherwise, perform account risk assessment.
6. The method for identifying abnormal financial transaction accounts according to claim 5, characterized in that, The specific process for conducting account risk assessment includes: Normalize the rate of change of instruction flow imbalance, leadership score, and behavioral temporal correlation degree corresponding to the abnormal account; The risk score is calculated by multiplying the rate of change of the normalized instruction flow imbalance, the leadership score, and the behavioral temporal correlation.
7. The method for identifying abnormal financial transaction accounts according to claim 6, characterized in that, The specific processing steps after obtaining the risk score include: The risk score is compared with a preset risk classification threshold to classify and handle abnormal accounts. The classification results include low risk, medium risk and high risk. When the risk score reaches high risk, a real-time alarm signal is output, and the corresponding account identifier, risk score, instruction flow imbalance rate, behavior time sequence correlation, leadership score, consistency index and time offset are pushed to the regulatory terminal or risk control terminal. When the risk score is at the medium risk level, the corresponding account will be included in the continuous monitoring list, and the account's operation data will continue to be tracked in the subsequent preset window; When the risk score is lower than the preset handling threshold, log entries and evidence will be recorded, but strong alarms will not be triggered.
8. The method for identifying abnormal financial transaction accounts according to claim 1, characterized in that, The specific processing steps to obtain the corresponding inter-account behavior temporal correlation and time offset include: Feature sequences are extracted from the transaction behavior data of the suspicious accounts to obtain the corresponding sequences to be processed; The sequence to be processed is processed using a dynamic time warping algorithm to obtain the DTW distance and time offset; The temporal correlation of behaviors between accounts is calculated based on DTW distance and time offset, combined with the exponential decay function.
9. A system utilizing the financial transaction abnormal account identification method according to any one of claims 1-8, characterized in that, include: The data acquisition module is used to acquire financial transaction data within a preset time period and clean the financial transaction data to obtain corresponding transaction behavior data. The detection module is used to calculate the rate of change of the imbalance of instruction flow between different accounts based on transaction behavior data. When the rate of change exceeds a first preset threshold, the corresponding account is marked as a suspicious account. The graph construction module is used to process the financial transaction data of the suspicious accounts, obtain the corresponding inter-account behavioral temporal correlation degree and time offset, and establish a corresponding behavioral temporal correlation directed graph based on the behavioral temporal correlation degree and time offset. The analysis module is used to find neighbor accounts whose behavioral temporal correlation degree exceeds a second preset threshold in the suspicious account according to the directed graph of behavioral temporal correlation, and merge the neighbor accounts with the suspicious account to generate the corresponding temporal collaborative community; The determination module is used to determine whether the suspicious account belongs to any time-series collaborative community; if so, it determines that the account is abnormal.