A money laundering gang intelligent identification method and device based on graph clustering and GCN

Abstract

This invention discloses a method and apparatus for intelligent identification of money laundering gangs based on graph clustering and GCN, relating to the field of financial risk control. The method involves: acquiring a multi-dimensional set of related features; constructing a weighted association knowledge graph and assigning edge weights based on the association frequency of the related features; performing unsupervised clustering of the weighted association knowledge graph using a community detection algorithm; inputting each account community and the weighted association knowledge graph into a pre-trained graph convolutional neural network, outputting a suspicion score for each bank account and each account community; classifying the levels of each bank account in each account community based on the node centrality and suspicion score of the bank accounts; determining the risk level of each account community based on its suspicion score, association feature type, and quantity; and generating a risk analysis report for each account community. This invention combines graph clustering algorithms with weighted association knowledge graphs to achieve accurate and automatic clustering of money laundering gangs, significantly improving the accuracy of money laundering gang clustering.

Description

Technical Field

[0001] This invention relates to the field of financial risk control, and more specifically, to a method and apparatus for intelligent identification of money laundering gangs based on graph clustering and GCN. Background Technology

[0002] With the increasing networking and concealment of financial transactions, money laundering gangs are exhibiting characteristics of multi-layered nesting, group collaboration, and complex chains, with their account associations and fund flows forming a highly complex network structure. Traditional anti-money laundering monitoring mainly relies on rule engines, depending on fixed thresholds and single feature judgments, making it difficult to uncover hidden connections and deep gang networks. It also lacks the ability to identify unknown money laundering gangs, resulting in problems such as high false negative rates, high false positive rates, and inability to trace the source.

[0003] Traditional graph clustering methods for identifying money laundering groups fail to reflect the differences in the strength of connections between accounts, leading to inaccurate clustering results. This can easily result in unrelated accounts being mistakenly identified as belonging to the same group, or in the omission of hidden groups. Furthermore, these methods cannot distinguish between group hierarchies, only identifying clusters of suspicious accounts, and cannot differentiate between core accounts, transit accounts, and puppet accounts. This makes it difficult to reconstruct the group's operational patterns and hinders regulatory tracing. Summary of the Invention

[0004] In view of this, the present invention provides a method and apparatus for intelligent identification of money laundering gangs based on graph clustering and GCN, which solves the problem that existing graph clustering methods for identifying money laundering gangs have inaccurate clustering results and cannot distinguish gang levels.

[0005] To achieve the above objectives, the following solution is proposed: A method for intelligent identification of money laundering gangs based on graph clustering and GCN includes: Obtain a multi-dimensional association feature set, which includes identity association features, transaction association features, device association features, location association features, and postscript text association features; A weighted association knowledge graph is constructed using bank accounts as nodes and association features in a multi-dimensional association feature set as edges. Edge weights are assigned based on the association frequency of the association features. The Louvain community detection algorithm is used to perform unsupervised clustering on the weighted association knowledge graph, resulting in several independent account communities; Input each account community and the weighted association knowledge graph into a pre-trained graph convolutional neural network, and output the suspiciousness score of each bank account and each account community; The bank accounts in each account community are classified into different levels based on their node centrality and suspiciousness scores. The risk level of each account community is determined based on its suspiciousness score, the type and number of associated features; Generate risk analysis reports for each account community. These reports include: a list of bank accounts, the level of each bank account, association characteristics, account community suspiciousness scores, and account community risk levels.

[0006] Preferably, the node attributes of the weighted association knowledge graph include: basic account information, feature values, and preliminary suspicious identifiers.

[0007] Preferably, the graph convolutional neural network includes: an input layer, a convolutional layer, a weight attention mechanism, a ReLU function, and an output layer; The graph convolutional neural network introduces account historical risk labels as a monitoring signal.

[0008] Preferably, the bank accounts in each account community are classified into different levels based on their node centrality and suspiciousness scores, including: If the node centrality of a bank account is greater than or equal to the first centrality threshold, and the suspicion score is greater than or equal to the first suspicion threshold, then the bank account is a core account. If the node centrality of a bank account is less than the first centrality threshold and greater than or equal to the second centrality threshold, and the suspicion score is less than the first suspicion threshold and greater than or equal to the second suspicion threshold, then the bank account is a transit account. If the node centrality of a bank account is less than the second centrality threshold and the suspicion score is less than the second suspicion threshold, then the bank account is a dummy account.

[0009] Preferably, the node centrality of the bank account is degree centrality or betweenness centrality.

[0010] Preferably, the identity association features include account association, abnormal account opening behavior, and transaction matching degree; Transaction correlation characteristics include fund transfer patterns and transaction similarities; Device association characteristics: shared devices by accounts, abnormal IP addresses, and device consistency; Location-related characteristics include abnormal distribution of account opening location and transaction location, cross-regional changes, and off-site operation behavior; The text association features of the postscript include keyword similarity, postscript contradictions, and sensitive words.

[0011] Preferably, the risk level of each account community is determined based on its suspiciousness score, the type and number of associated features, including: If the account community's suspiciousness score is within the first suspiciousness score range, and the number of strong correlation features is greater than or equal to the first quantity threshold, then the account community is determined to be a high-risk community; the strong correlation features include identity correlation features, transaction correlation features, and device correlation features; If the account community's suspiciousness score is in the second suspiciousness score range and the number of associated features is greater than or equal to the second quantity threshold, then the account community is determined to be a medium-risk community. If the account community's suspicion score is in the third suspicion score range and the number of weak correlation features is less than the third threshold, then the account community is determined to be a low-risk community. The weak correlation features include location correlation features and postscript text correlation features.

[0012] Preferably, it also includes: triggering a real-time alert if a high-risk community is identified.

[0013] A money laundering gang intelligent identification device based on graph clustering and GCN includes: The feature acquisition unit acquires a multi-dimensional associated feature set, which includes identity associated features, transaction associated features, device associated features, location associated features, and postscript text associated features. The graph construction unit uses bank accounts as nodes and associated features in a multi-dimensional associated feature set as edges to construct a weighted associated knowledge graph, assigning edge weights based on the association frequency of associated features; The community clustering unit uses the Louvain community detection algorithm to perform unsupervised clustering on the weighted association knowledge graph, resulting in several independent account communities. The suspiciousness assessment unit inputs each account community and the weighted association knowledge graph into a pre-trained graph convolutional neural network, and outputs the suspiciousness score of each bank account and each account community. The account rating unit classifies bank accounts in each account community based on their node centrality and suspiciousness scores. The community risk classification unit determines the risk level of each account community based on its suspiciousness score, type and number of associated characteristics; The report generation unit generates risk analysis reports for each account community. These risk analysis reports include: a list of bank accounts, the level of each bank account, association characteristics, account community suspiciousness score, and account community risk level.

[0014] According to specific embodiments provided by the present invention, the present invention discloses the following technical effects: The present invention provides a method for intelligent identification of money laundering gangs using graph clustering and GCN, which obtains a multi-dimensional set of related features; constructs a weighted association knowledge graph with bank accounts as nodes and related features in the multi-dimensional set of related features as edges, and assigns edge weights according to the association frequency of the related features; uses the Louvain community detection algorithm to perform unsupervised clustering on the weighted association knowledge graph to obtain several mutually independent account communities; the embodiments of the present invention combine graph clustering algorithm with weighted association knowledge graph to achieve accurate and automatic clustering of money laundering gangs, greatly improving the accuracy of money laundering gang clustering.

[0015] This invention inputs each account community and a weighted association knowledge graph into a pre-trained graph convolutional neural network, outputting a suspicion score for each bank account and each account community. This invention combines a graph neural network model to score the suspicion of accounts and account communities, achieving accurate suspicion scoring for accounts and groups, providing a benchmark for identifying money laundering groups.

[0016] This invention classifies bank accounts within each account community based on their node centrality and suspiciousness score; determines the risk level of each account community based on its suspiciousness score, association feature type, and quantity; and generates a risk analysis report for each account community. Based on suspiciousness scoring, this invention can automatically identify the hierarchical structure of money laundering groups, distinguish between core accounts, transit accounts, and surrogate accounts, and reconstruct the fund flow chain, providing precise support for regulatory tracing and verification. Deeply integrating graph clustering results with risk assessment eliminates the need for manual intervention, improving the efficiency of anti-money laundering monitoring. Attached Figure Description To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0017] Figure 1 This is a flowchart of the intelligent identification method for money laundering gangs based on graph clustering and GCN provided in an embodiment of the present invention; Figure 2 This is a schematic diagram of a weighted association knowledge graph and a hierarchical structure of a group, provided in an embodiment of the present invention. Figure 3 This is a schematic diagram of the structure of the optimized GCN model provided in an embodiment of the present invention; Figure 4 This is a schematic diagram of the structure of the money laundering gang intelligent identification device based on graph clustering and GCN provided in an embodiment of the present invention. Detailed Implementation

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] First, combined Figure 1 This invention introduces a method for intelligent identification of money laundering gangs based on graph clustering and GCN, as provided in an embodiment of the present invention. Figure 1 As shown, the method includes: Step S1: Obtain a multi-dimensional set of related features.

[0020] Specifically, a standardized set of multi-dimensional related features has been obtained, and normalization, encoding, and redundancy removal have been completed, making it directly usable for knowledge graph construction.

[0021] The multi-dimensional association feature set includes identity association features, transaction association features, device association features, location association features, and postscript text association features. Identity association features include account association relationships, abnormal account opening behavior, and transaction matching degree; transaction association features include fund transfer patterns and transaction similarity; device association features include shared devices among accounts, abnormal IP addresses, and device consistency; location association features include abnormal distribution of account opening locations and transaction locations, cross-regional changes, and remote operation behavior; postscript text association features include keyword similarity, postscript contradictions, and sensitive words.

[0022] Step S2: Using bank accounts as nodes and related features in the multi-dimensional related feature set as edges, construct a weighted related knowledge graph, and assign edge weights according to the association frequency of related features.

[0023] Specifically, a weighted association knowledge graph is constructed, edge weights are assigned, and node attributes are improved. Bank accounts are used as nodes, and multi-dimensional association features are used as edges. Edge weights are assigned based on the frequency or strength of association features. Node attributes include basic account information, feature values, and preliminary suspicious indicators. For example, the weight range is 0-1; the higher the association frequency and the stronger the association, the higher the weight value. For example, if the same MAC address is associated with 10 accounts, the weight is assigned 0.9; if it is associated with 2 accounts, the weight is assigned 0.3.

[0024] like Figure 2As shown, circular nodes represent bank accounts, node size represents node centrality (the larger the node, the higher the centrality), and node color intensity represents the suspicion score (the darker the color, the higher the score). Lines represent related edges, and line thickness represents edge weight (the thicker the line, the higher the weight). Different line types can represent different related features, for example: a solid line with "—" represents transaction related features; a dashed line with "- -" represents device related features; and a dotted line with "-·-" represents identity related features.

[0025] Step S3: The Louvain community detection algorithm is used to perform unsupervised clustering on the weighted association knowledge graph.

[0026] Specifically, the Louvain community detection algorithm is used to perform unsupervised clustering on the weighted association knowledge graph, iteratively optimizing the modularity to ≥0.8, automatically dividing it into several independent account communities, each corresponding to a potential money laundering group. During the clustering process, isolated nodes with no associated features and a weight of 0 are removed to avoid irrelevant accounts interfering with the clustering results.

[0027] Step S4: Input each account community and the weighted association knowledge graph into the pre-trained graph convolutional neural network.

[0028] Specifically, a graph convolutional neural network (GCN) is used as the basic model. The model structure is optimized for anti-money laundering scenarios. The input is the node features, edge weights and clustering results of the weighted association knowledge graph. The output is a suspiciousness score for each account and each account community (potential money laundering group), with a score range of 0-100.

[0029] The optimization measures for the GCN model structure include: (1) adding an edge weight attention mechanism to strengthen the influence of high-weight associations (such as transaction associations) on the score; (2) introducing account historical risk labels as a supervision signal to improve the accuracy of the score; and (3) optimizing the activation function by using the ReLU function to avoid gradient vanishing and improve the convergence speed of the model. Figure 3 As shown, the GCN model structure includes: input layer, convolutional layer, attention mechanism layer, activation layer, and output layer.

[0030] Step S5: Classify the levels of each bank account in each account community based on the node centrality and suspiciousness score of the bank account.

[0031] Specifically, based on node centrality (calculated through degree centrality and betweenness centrality) and suspiciousness score, the system automatically distinguishes core accounts, transit accounts, and puppet accounts within each money laundering group. For example... Figure 2 As shown: the core account is located at the center of the gang, the intermediate accounts surround the core account, and the puppet accounts are located at the edge of the gang. The weighted association knowledge graph can clearly show the gang's hierarchical structure and relationships.

[0032] If a bank account has a node centrality greater than or equal to the first centrality threshold and a suspicion score greater than or equal to the first suspicion threshold, then the bank account is a core account. For example, if the node centrality is ≥0.8 and the suspicion score is ≥80, then the bank account is a core account, responsible for fund collection and instruction issuance, and is the core of the group.

[0033] If a bank account has a node centrality less than the first centrality threshold but greater than or equal to the second centrality threshold, and a suspicion score less than the first suspicion threshold but greater than or equal to the second suspicion threshold, then the bank account is a transit account. For example, if the node centrality is between 0.5 and 0.79, and the suspicion score is between 60 and 79, then the bank account is a transit account responsible for transferring and splitting funds, connecting the core account and the puppet account.

[0034] If a bank account has a node centrality less than the second centrality threshold and a suspicion score less than the second suspicion threshold, then the bank account is a dummy account. For example, if the node centrality is less than 0.5 and the suspicion score is less than 60, then the bank account is a dummy account, responsible for receiving and transferring funds, and is often a manipulated, unrelated account.

[0035] Step S6: Determine the risk level of each account community based on its suspiciousness score, associated feature type, and quantity.

[0036] Specifically, each money laundering group is classified into high, medium, and low risk levels based on its suspiciousness score, type and number of associated characteristics.

[0037] If an account community's suspiciousness score falls within the first suspiciousness score range, and the number of strong correlation features is greater than or equal to the first threshold, then the account community is determined to be a high-risk community. Strong correlation features include identity-related features, transaction-related features, and device-related features. For example, if an account community's suspiciousness score is between 80 and 100, and it meets the requirement of having ≥3 types of strong correlation features, then the account community is considered a high-risk community. Furthermore, analysis can be conducted in conjunction with transaction amounts and transaction methods. For instance, based on the aforementioned judgment criteria, it can be further determined whether there are large transactions (single transaction ≥ 500,000 RMB) / cross-border / virtual currency connections. If so, the account community is confirmed as a high-risk community.

[0038] If an account community's suspicion score falls within the second suspicion score range, and the number of associated features is greater than or equal to the second threshold, then the account community is determined to be a medium-risk community. For example, if an account community's suspicion score is between 60 and 79, and the account community exhibits two types of associated features, then the account community is determined to be a medium-risk community. Furthermore, analysis can be conducted in conjunction with transaction patterns. Based on the aforementioned judgment criteria, it can be further determined whether there are abnormal fund transfer patterns (rapid inflows and outflows, centralized aggregation) among the associated features of the account community.

[0039] If an account community's suspicion score falls within the third suspicion score range, and the number of weak correlation features is less than the third threshold, then the account community is determined to be a low-risk community. Weak correlation features include location-based correlation features and postscript text correlation features. For example, if an account community's suspicion score is between 0 and 60, and there is only a single weak correlation feature (such as location-based correlation), then the account community is confirmed as a low-risk community. Furthermore, based on the aforementioned judgment criteria, it can be further determined whether there are abnormal fund transfer patterns among the correlation features of the account community.

[0040] Step S7: Generate risk analysis reports for each account community.

[0041] Specifically, it automatically generates risk analysis reports containing a list of bank accounts (group member list), account levels (hierarchical structure), association characteristics (evidence of association), fund transfer links, account community suspiciousness scores, and risk levels, for manual verification and regulatory reporting. The risk analysis reports can be exported in PDF and Excel formats. Furthermore, it can retain full-process audit logs (including graph construction, clustering, scoring, and early warning stages), with a log retention period of ≥5 years, meeting regulatory archiving requirements.

[0042] To more promptly prevent and control money laundering activities, this embodiment of the invention, based on the aforementioned embodiments, can further identify high-risk money laundering account communities and... Real-time alerts are triggered for high-risk groups, with an alert response time of ≤5 minutes. Alert methods include system pop-ups, SMS notifications, or email reminders.

[0043] Next, the feasibility of the money laundering gang intelligent identification method based on graph clustering and GCN provided by this invention is verified using a batch of key accounts imported by the anti-money laundering department of a joint-stock bank. The process is as follows: Step S1: Obtain a multi-dimensional set of related features.

[0044] A multi-dimensional set of related features for 22 accounts was obtained. This set has undergone standardization (normalization, encoding, and redundancy removal) and includes five categories of features: identity-related features, transaction-related features, device-related features, location-related features, and postscript text-related features. Among them, the identity feature shows that the 22 accounts were opened in batches by the same agent, and all the clients are unemployed; the transaction feature shows that there are multiple layers of fund transfers between the accounts, showing a centralized aggregation pattern; the device feature shows that the accounts share four identical MAC addresses; the location feature shows that the transaction locations are concentrated at cross-border ports; and the postscript feature shows that all accounts are marked "payment for goods," which contradicts the nature of the accounts.

[0045] Step S2: Using bank accounts as nodes and related features in the multi-dimensional related feature set as edges, construct a weighted related knowledge graph, and assign edge weights according to the association frequency of related features.

[0046] Using 22 accounts as nodes and five types of related features as edges, the edges are assigned weights according to the weighting rules. The average weight of transaction-related edges is 0.88, the average weight of device-related edges is 0.82, the average weight of identity-related edges is 0.75, the average weight of location-related edges is 0.65, and the average weight of remarks-related edges is 0.7. The node attributes include information such as account ID, document number (after anonymization), and transaction amount.

[0047] Step S3: The Louvain community detection algorithm is used to perform unsupervised clustering on the weighted association knowledge graph.

[0048] The Louvain community detection algorithm was used for clustering, and the modularity was iteratively optimized to 0.83. One account community (potential money laundering group) was automatically identified, and 0 isolated nodes were removed. The clustering results were free from interference from irrelevant accounts.

[0049] Step S4: Input each account community and the weighted association knowledge graph into the pre-trained graph convolutional neural network.

[0050] The optimized GCN model is used as input, including node features, edge weights and clustering results, and outputs the suspicion score of each account and group. Among them, the suspicion score of the group is 86 points, the score of 1 account is 93 points, the score of 5 accounts is 76-80 points, and the score of 16 accounts is 52-65 points.

[0051] Step S5: Classify the levels of each bank account in each account community based on the node centrality and suspiciousness score of the bank account.

[0052] The system calculates node centrality, identifying accounts with a score of 93 and a node centrality of 0.86 as core accounts; 5 accounts with scores of 76-80 and a node centrality of 0.6-0.78 as transit accounts; and 16 accounts with scores of 52-65 and a node centrality of <0.5 as puppet accounts, clearly revealing the internal hierarchical structure and fund flow of the group.

[0053] Step S6: Determine the risk level of each account community based on its suspiciousness score, associated feature type, and quantity.

[0054] The group's account community suspiciousness score was 86 points, meeting three strong correlation characteristics (transactions + devices + identity), and there were large transactions of ≥500,000 yuan in a single transaction, so it was judged as a high-risk group.

[0055] Step S7: Generate risk analysis reports for each account community.

[0056] It automatically generates analysis reports containing information such as gang members, hierarchical structure, and funding channels, and supports PDF export; it also retains full-process audit logs for manual verification and regulatory reporting.

[0057] In addition, a real-time alert is triggered, with a response time of 4 minutes, and relevant personnel are notified via system pop-ups and SMS.

[0058] The following describes the intelligent identification device for money laundering gangs based on graph clustering and GCN provided in the embodiments of the present invention. The intelligent identification device for money laundering gangs based on graph clustering and GCN described below can be referred to in correspondence with the intelligent identification method for money laundering gangs based on graph clustering and GCN described above.

[0059] First, combine Figure 4 This paper introduces a smart identification device for money laundering gangs based on graph clustering and GCN, such as... Figure 4 As shown, the intelligent identification device for money laundering gangs based on graph clustering and GCN may include: The feature acquisition unit 100 acquires a multi-dimensional associated feature set, which includes identity associated features, transaction associated features, device associated features, location associated features, and postscript text associated features. The graph construction unit 200 uses bank accounts as nodes and related features in the multi-dimensional related feature set as edges to construct a weighted related knowledge graph, and assigns edge weights according to the association frequency of related features. Community clustering unit 300 uses the Louvain community detection algorithm to perform unsupervised clustering on the weighted association knowledge graph, resulting in several independent account communities; The suspiciousness evaluation unit 400 inputs each account community and the weighted association knowledge graph into a pre-trained graph convolutional neural network and outputs the suspiciousness score of each bank account and each account community. The account grading unit is 500, which classifies the bank accounts in each account community according to the node centrality and suspiciousness score of the bank accounts. The community risk classification unit is 600, and the risk level of each account community is determined based on the suspiciousness score, the type and number of associated characteristics. The report generation unit 700 generates risk analysis reports for each account community. The risk analysis reports include: a list of bank accounts, the level of each bank account, association characteristics, account community suspiciousness score, and account community risk level.

[0060] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0061] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0062] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for intelligent identification of money laundering gangs based on graph clustering and GCN, characterized in that, include: Obtain a multi-dimensional association feature set, which includes identity association features, transaction association features, device association features, location association features, and postscript text association features; A weighted association knowledge graph is constructed using bank accounts as nodes and association features in a multi-dimensional association feature set as edges. Edge weights are assigned based on the association frequency of the association features. The Louvain community detection algorithm is used to perform unsupervised clustering on the weighted association knowledge graph, resulting in several independent account communities; Input each account community and the weighted association knowledge graph into a pre-trained graph convolutional neural network, and output the suspiciousness score of each bank account and each account community; The bank accounts in each account community are classified into different levels based on their node centrality and suspiciousness scores. The risk level of each account community is determined based on its suspiciousness score, the type and number of associated features; Generate risk analysis reports for each account community. These reports include: a list of bank accounts, the level of each bank account, association characteristics, account community suspiciousness scores, and account community risk levels.

2. The intelligent identification method for money laundering gangs based on graph clustering and GCN according to claim 1, characterized in that, The node attributes of the weighted association knowledge graph include: basic account information, feature values, and preliminary suspicious indicators.

3. The intelligent identification method for money laundering gangs based on graph clustering and GCN according to claim 1, characterized in that, The graph convolutional neural network includes: an input layer, a convolutional layer, a weight attention mechanism, a ReLU function, and an output layer; The graph convolutional neural network introduces account historical risk labels as a monitoring signal.

4. The intelligent identification method for money laundering gangs based on graph clustering and GCN according to claim 1, characterized in that, The ranking of bank accounts in each account community is determined based on their node centrality and suspiciousness scores, including: If the node centrality of a bank account is greater than or equal to the first centrality threshold, and the suspicion score is greater than or equal to the first suspicion threshold, then the bank account is a core account. If the node centrality of a bank account is less than the first centrality threshold and greater than or equal to the second centrality threshold, and the suspicion score is less than the first suspicion threshold and greater than or equal to the second suspicion threshold, then the bank account is a transit account. If the node centrality of a bank account is less than the second centrality threshold and the suspicion score is less than the second suspicion threshold, then the bank account is a dummy account.

5. The intelligent identification method for money laundering gangs based on graph clustering and GCN according to claim 4, characterized in that, The node centrality of the bank account is either degree centrality or betweenness centrality.

6. The intelligent identification method for money laundering gangs based on graph clustering and GCN according to claim 1, characterized in that, Identity-related characteristics include account association, abnormal account opening behavior, and transaction matching degree; Transaction correlation characteristics include fund transfer patterns and transaction similarities; Device association characteristics: shared devices by accounts, abnormal IP addresses, and device consistency; Location-related characteristics include abnormal distribution of account opening location and transaction location, cross-regional changes, and off-site operation behavior; The text association features of the postscript include keyword similarity, postscript contradictions, and sensitive words.

7. The intelligent identification method for money laundering gangs based on graph clustering and GCN according to claim 6, characterized in that, The risk level of each account community is determined based on its suspiciousness score, the type and number of associated features, including: If the account community's suspiciousness score is within the first suspiciousness score range, and the number of strong correlation features is greater than or equal to the first quantity threshold, then the account community is determined to be a high-risk community; the strong correlation features include identity correlation features, transaction correlation features, and device correlation features; If the account community's suspiciousness score is in the second suspiciousness score range and the number of associated features is greater than or equal to the second quantity threshold, then the account community is determined to be a medium-risk community. If the account community's suspicion score is in the third suspicion score range and the number of weak correlation features is less than the third threshold, then the account community is determined to be a low-risk community. The weak correlation features include location correlation features and postscript text correlation features.

8. The intelligent identification method for money laundering gangs based on graph clustering and GCN according to any one of claims 1-7, characterized in that, Also includes: If a high-risk community is identified, a real-time alert will be triggered.

9. A smart identification device for money laundering gangs based on graph clustering and GCN, characterized in that, include: The feature acquisition unit acquires a multi-dimensional associated feature set, which includes identity associated features, transaction associated features, device associated features, location associated features, and postscript text associated features. The graph construction unit uses bank accounts as nodes and associated features in a multi-dimensional associated feature set as edges to construct a weighted associated knowledge graph, assigning edge weights based on the association frequency of associated features; The community clustering unit uses the Louvain community detection algorithm to perform unsupervised clustering on the weighted association knowledge graph, resulting in several independent account communities. The suspiciousness assessment unit inputs each account community and the weighted association knowledge graph into a pre-trained graph convolutional neural network, and outputs the suspiciousness score of each bank account and each account community. The account rating unit classifies bank accounts in each account community based on their node centrality and suspiciousness scores. The community risk classification unit determines the risk level of each account community based on its suspiciousness score, type and number of associated characteristics; The report generation unit generates risk analysis reports for each account community. These risk analysis reports include: a list of bank accounts, the level of each bank account, association characteristics, account community suspiciousness score, and account community risk level.

Images