A money laundering gang identification method based on multi-dimensional correlation features

Abstract

This invention relates to the field of internet consumer finance risk control technology, specifically disclosing a method for identifying anti-money laundering gangs based on multi-dimensional correlation features, including: S1, synchronously collecting multi-source data from banks for preprocessing to generate a standardized dataset; S2, extracting account feature vectors based on the standardized dataset; S3, constructing a weighted directed association knowledge graph, with bank accounts as nodes and account feature vectors of the directed association knowledge graph as directed edges; S4, calculating the directional centrality index of nodes based on the weighted directed association knowledge graph; S5, performing gang clustering identification on the weighted directed association knowledge graph based on the directional centrality index and combined with a graph neural network (GNN), identifying the account roles of gangs in the flow of funds; S6, dividing the observation time axis into multiple consecutive time windows, and executing steps S3-S5 respectively; S7, performing risk analysis and judgment on accounts and gangs based on account roles and their role change trajectories, generating early warning information and analysis reports.

Description

Technical Field

[0001] This invention relates to the field of internet consumer finance risk control technology, specifically to a method for identifying anti-money laundering gangs based on multi-dimensional correlation features. Background Technology

[0002] With the increasing online and cross-border nature of financial transactions, money laundering crimes are becoming more organized, professional, and covert. Criminals typically use a large number of unidentified dummy accounts to split funds, quickly transfer funds in and out, use multiple layers of intermediaries, and move funds across regions to circumvent traditional monitoring rules, posing a significant challenge to financial regulation.

[0003] Existing anti-money laundering monitoring technologies, such as the patent publication CN115660802A "A Method and Device for Detecting Anti-Money Laundering Gangs," disclose a method to improve the accuracy of anti-money laundering gang detection by dividing customers in a transaction network into multiple communities and using a rule-based engine to identify suspicious information from customers. However, it does not consider the transaction dimension and limited modal features of accounts, nor does it achieve the fusion of multi-dimensional correlation features to capture the hidden correlation information of money laundering gangs. Furthermore, the aforementioned patent and existing technologies can only identify suspicious accounts but cannot distinguish between core accounts, transit accounts, and puppet accounts, making it difficult to reconstruct the fund flow and causing difficulties for regulatory verification. In addition, although the patent publication number CN119648235A, "A Method and Device for Generating Anti-Money Laundering Rule Thresholds," improves the generation efficiency of anti-money laundering rule model thresholds by setting model thresholds to adjust, update, and iteratively optimize them according to business needs, it does not perform supervised cluster analysis on the thresholds. Therefore, it cannot further identify unknown money laundering groups, resulting in a high false negative rate. Furthermore, in practical applications, manual intervention is often required to set clustering results and risk assessments, making it impossible to achieve full automation from data collection to report generation and failing to meet real-time monitoring requirements. Summary of the Invention

[0004] The purpose of this invention is to provide a method for identifying anti-money laundering groups based on multi-dimensional correlation features, and to solve the following technical problems: (1) How to achieve unsupervised automatic clustering by constructing an automatic identification gang structure, so as to discover unknown money laundering gangs without relying on blacklists, reduce the false negative rate, and solve the problem of high false negative rate of existing patents; (2) How to use automatic identification of gang structure to distinguish different accounts, and based on directional centrality indicators (out-degree, in-degree, net outflow), combined with role determination rules, to achieve accurate penetration of the internal hierarchical structure of money laundering gangs.

[0005] The objective of this invention can be achieved through the following technical solutions: A method for identifying anti-money laundering gangs based on multi-dimensional correlation features, the method comprising: S1. Receive the list of accounts to be analyzed, and simultaneously collect multi-source data from the bank for preprocessing to generate a standardized dataset; the multi-source data includes account opening data, account data, transaction flow data, device MAC address, login IP address, transaction terminal location and transaction remarks data; S2. Extract account feature vectors based on standardized datasets; account feature vectors include identity-related features, transaction-related features, device-related features, location-related features, and transaction comment text-related features; S3. Construct a weighted directed association knowledge graph, with bank accounts as nodes and the account feature vectors of the directed association knowledge graph as directed edges, with the direction from the payer to the payee. Assign edge weights based on transaction amount, frequency of association features, and association strength. S4. Based on the weighted directed association knowledge graph, calculate the directional centrality index of the nodes. The directional centrality index includes out-degree centrality, in-degree centrality and net outflow centrality. S5. Based on the orientation centrality index and combined with graph neural network (GNN), perform group clustering and identification on weighted directed association knowledge graphs to identify the account roles of groups in the flow of funds. S6. Divide the observation timeline into multiple consecutive time windows, and execute steps S3-S5 for each time window to construct a time-series knowledge graph and track the role change trajectory of the same account in different time windows. S7. Based on account roles and their change trajectories, conduct risk analysis and assessment of accounts and groups, and generate early warning information and analysis reports.

[0006] Preferably, the orientation centrality index includes: Out-degree centrality is the total amount of funds transferred out by an account as the payer and the frequency of transactions within a unit of time, used to characterize the ability of funds to disperse. In-degree centrality is used to characterize the ability to pool funds by counting the total amount of funds transferred into an account as the recipient and the frequency of transactions within a unit of time. Net outflow centrality is calculated as the ratio of the difference between the total amount of funds transferred out and the total amount of funds transferred in to the total transaction volume, which is used to characterize the net fund outflow tendency of an account.

[0007] Preferably, the rules for identifying account roles include: If both the out-degree centrality and net outflow centrality of an account are higher than the preset first threshold, it is determined to be a core account, indicating that funds radiate outward from the core. If the in-degree centrality and out-degree centrality of an account are both higher than the preset second threshold, and the net outflow centrality is close to zero, it is determined to be a transit account, which indicates that funds are quickly in and out and do not stay overnight. If an account's in-degree centrality is higher than the preset third threshold and its out-degree centrality is lower than the preset fourth threshold, it is determined to be a dummy account, which means that it only receives funds but does not actively transfer them out.

[0008] Preferably, the extraction of transaction remarks features includes: The transaction comment text is processed by word segmentation, stop word filtering, and semantic vectorization. Calculate the cosine similarity of transaction comment texts from different accounts to identify templated comment features; Based on a sensitive word database, keywords related to gambling, fraud, virtual currency, and underground banks are identified.

[0009] Preferably, the time window is constructed in step S6 in the following ways: S61. Divide the observation time axis into multiple continuous and non-overlapping time windows according to a fixed duration. The granularity of the time window is selected from one or more combinations of daily, weekly or monthly levels. S62. For each time window, execute steps S4 to S6 independently to construct the weighted directed association knowledge graph corresponding to that time window and generate account role tags and risk scores for that window. S63. Perform timestamp alignment and serialization storage on the graph data and role tags within all time windows to form a temporal evolution dataset of account behavior.

[0010] Preferably, in step S6, role recognition is performed independently for each time window, specifically including: Regarding the first Time window Calculate accounts Out-degree centrality within this window in-degree centrality and net outflow centrality ; Based on the judgment rules, for the account Allocation of the first Role tags within a time window The set of character tags is {core account, transit account, puppet account, ordinary account}; Aggregate role tags from all time windows to build an account. Role sequence: .

[0011] Preferably, step S6 analyzes the role change trajectory of each node. The role change trajectory analysis includes role transition detection, new core detection, and role stability index. Specifically: Role transition detection includes defining a role hierarchy mapping function. :

[0012] If a continuous time window exists , ,and < The conditions are:

[0013] Then determine the account A role transition has occurred, indicating a promotion from a lower-level account to a core account; Core testing for newborns includes testing for those born in the first year of school. The account that first appeared in the time window If the following conditions are met simultaneously:

[0014] in, Indicate degree centrality, Indicates in-degree centrality. Indicates the degree of a node. , , If the preset threshold is used, then the determination is made. For new core accounts.

[0015] Preferably, the calculation of the character stability index specifically includes: Define account exist Role stability index within a time window for:

[0016] in, This is an indicator function that takes a value of 1 when the character changes, and 0 otherwise; The smaller the value, the greater the role fluctuation and the higher the risk of avoiding detection.

[0017] Preferably, the risk analysis and judgment logic is as follows: If the account is identified as a core account or a new core account, and < If so, it is classified as high risk; If the account exhibits role transition issues, or ≤ < If so, it is classified as medium risk; If the account character has been a puppet account for a long time and ≥ It is then classified as low risk. in, To preset the lower limit of the character stability index, This sets the upper limit for the character's stability index.

[0018] Preferably, the weighted directed association knowledge graph is constructed in step S3 as follows: S31. Define the graph topology and construct a weighted directed association knowledge graph. ,in, For a set of bank account nodes, In the first The set of directed edges within a time window The weight function for directed edges; S32. Establish directed edges based on fund flow, for any two account nodes Based on the transfer information between the two accounts, a directed edge is established. ; S33. For directed edges The weight is calculated by fusing transaction features and multidimensional correlation features. ; S34. Perform nonlinear transformation on the transaction weights to amplify the marginal contribution of large-scale capital flows. S35. Divide the observation time axis into continuous and non-overlapping time windows, and for a certain time window, independently execute steps S31-S34 to generate a corresponding weighted directed association knowledge graph, and arrange them in chronological order to generate a time-series knowledge graph sequence.

[0019] The beneficial effects of this invention are: (1) By introducing the Role Stability Index (RSI) and Role Transition Detection (LR function), this invention can not only identify current high-risk accounts, but also predict potential core accounts that are "promoted". For example, it can successfully identify the transition process of account A001 from "ordinary account" to "core account" (RSI=0) and block the outflow of funds in advance. (2) Based on the determination rule of directional centrality, the present invention accurately divides multiple accounts into corresponding hierarchical structures. Compared with traditional clustering, this can more realistically reflect the logic of fund flow, thus significantly improving the accuracy of core account identification.

[0020] (3) By segmenting, vectorizing and calculating the cosine similarity of transaction notes, this invention successfully identifies the templated note features such as "payment for goods" used by the gang, exposes the disguise of using legal trade to cover up the nature of illegal funds, and combines risk analysis judgment logic (high, medium and low risk) to transform qualitative behavior into quantitative scoring. In particular, the combination of "low RSI + core account" is judged as high risk, which is not only in line with regulatory logic, but also has strong interpretability, making it easy for manual verification and regulatory reporting.

[0021] (4) Through the new core detection mechanism, the present invention can immediately issue an early warning even when facing a "white account" with no history, as long as it shows high centrality and high connectivity in a short period of time, effectively countering the evasion method of using a new account to replace an old account to perform money laundering tasks.

[0022] Of course, any product implementing this invention does not necessarily need to achieve all the advantages described above at the same time. Attached Figure Description

[0023] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0024] Figure 1 This is a flowchart illustrating the steps of an anti-money laundering gang identification method based on multi-dimensional correlation features according to the present invention. Figure 2 This is a schematic diagram of the weighted directed association knowledge graph and gang hierarchy structure of the present invention; Figure 3 This diagram illustrates the steps involved in constructing the weighted directed association knowledge graph of this invention. Figure 4 This is a step diagram illustrating the construction method of the time window in step S6 of the present invention. Detailed Implementation

[0025] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0026] Please see Figure 1-2 As shown, this invention is a method for identifying anti-money laundering gangs based on multi-dimensional correlation features. The method includes: First, S1 receives the list of accounts to be analyzed, and simultaneously collects multi-source data from banks for preprocessing to generate a standardized dataset. The multi-source data includes account opening data, account data, transaction flow data, device MAC address, login IP address, transaction terminal location, and transaction remarks data. The account opening information includes the account opening time, branch, address, and agent information; the account information includes the customer ID, account ID, ID number, mobile phone number, and account status; the transaction history includes the transaction amount, transaction time, counterparty account, and transaction channel; the device MAC address and login IP address are the core identifiers of the account operation device; the transaction terminal location is the physical location information via GPS; and the transaction remarks are the user's explanation of the purpose of the transaction. The preprocessing of multi-source data includes data cleaning, deduplication, anonymization, and format standardization. Specific operations are as follows: 1) Data cleaning: Removing missing values ​​(such as records with missing ID numbers or transaction amounts) and outliers (such as records where the transaction amount exceeds 10 times the account balance); 2) Deduplication: Deleting duplicate transaction records and device login records; 3) Anonymization: Using AES encryption to protect sensitive information such as ID numbers (hiding the middle 8 digits) and mobile phone numbers (hiding the middle 4 digits); 4) Format standardization: Converting all data to UTF-8 format and transaction times to "YYYY-MM-DD HH:MM:SS" format; 5) IP address mapping: Connecting to a third-party IP address database (such as IP2Location) to map login IP addresses to corresponding provincial, municipal, and district geographic information (accurate to the district / county level); 6) Transaction comment processing: Using the jieba word segmentation algorithm to segment transaction comments, removing meaningless words using a stop word database (Harbin Institute of Technology stop word database), and annotating keywords such as "payment," "repayment," and "investment."

[0027] Then, in S2, account feature vectors are extracted based on the standardized dataset. These account feature vectors include identity-related features, transaction-related features, device-related features, location-related features, and transaction comment text-related features. From the preprocessed multi-source data, account feature vectors are extracted, including five types of related features: identity-related features, transaction-related features, device-related features, location-related features, and transaction comment text-related features. The specific extraction logic is as follows: 1) Identity-related features: Identify the relationship between multiple accounts sharing the same ID, mobile phone number, address, contact person, or agent. The criterion is "the number of accounts associated with the same ID is ≥ 2"; when identifying concentrated... 1) Behavior of opening accounts in batches (7-30 days) at the same branch (≥5 accounts); judging the matching degree between customer occupation, income and account transaction scale, such as unemployed customer account with monthly transaction amount ≥1 million yuan is judged as mismatch; 2) Transaction association characteristics: identifying direct or 1-3 layers of indirect fund transfers between accounts, achieved by tracing upstream and downstream accounts of trading counterparties; judging whether funds show a pattern of concentrated transfer in and dispersed transfer out, dispersed transfer in and concentrated transfer out, quick in and quick out (funds transferred in and out within 24 hours without reasonable transaction background) or not overnight; identifying the similarity of transaction amount, frequency, time period and channel of multiple accounts (similarity ≥80% is judged as similar); judging 3) Device association characteristics: Identify whether multiple accounts log in or trade on the same MAC address, the same device fingerprint, or the same IP segment (within the same network segment) (≥2 accounts sharing the same IP is considered associated); Identify whether the account uses VPN, proxy IP, frequently switches IP (≥5 times per day), or operates in a virtual machine environment; Determine the consistency between the account opening device and the daily trading device (device fingerprint matching degree <60% is considered inconsistent); 4) Location association characteristics: Identify the concentration of multiple account opening locations and trading locations (≥3 accounts concentrated in the same district or county is considered concentrated); Determine whether the account trading locations are synchronized. Cross-regional changes (≥2 cross-provincial / municipal changes per day) or concentrated occurrences in high-risk areas (such as cross-border ports, areas with high incidence of gambling and fraud); identify frequent cross-regional operations outside of registered residence or work location (≥10 operations per month); 5) Transaction comment text association features: identify the consistency of keywords in transaction comments of multiple accounts through cosine similarity algorithm (similarity ≥70% is considered consistent); judge the contradiction between the content of the comments and the nature of the account, transaction amount and customer identity (such as the comment of an account without business background being "payment for goods"); identify sensitive words related to gambling, fraud, virtual currency, money laundering or underground banks in the comments through a preset sensitive word library (which can be dynamically updated).

[0028] Next, a weighted directed association knowledge graph is constructed in S3, with bank accounts as nodes and the account feature vectors of the directed association knowledge graph as directed edges, with the direction from the payer to the payee. Edge weights are assigned based on transaction amount, frequency of association features, and association strength. The weight assignment rules are as follows: transaction association feature weight 0.4, device association feature weight 0.25, identity association feature weight 0.15, location association feature weight 0.1, and remarks association feature weight 0.1. The higher the association frequency and the closer the association, the higher the weight value (weight range is 0-1). For example, if the same MAC address is associated with 10 accounts, the weight is assigned 0.9; if it is associated with 2 accounts, the weight is assigned 0.3.

[0029] Furthermore, S4 calculates the directional centrality index of nodes based on a weighted directed association knowledge graph. The directional centrality index includes out-degree centrality, in-degree centrality, and net outflow centrality. Specifically, this is achieved through the following steps: 1) Defining the edges of the knowledge graph as directed edges, with the direction representing the flow of funds (payer → payee); 2) Introducing direction-related centrality indices, namely: Out-degree centrality: fund outflow amount / frequency, identifying "fund dispersion accounts"; In-degree centrality: fund inflow amount / frequency, identifying "fund aggregation accounts"; Net outflow centrality: (total outflow amount) The ratio of total inflows to total transaction volume reflects the account's net output capacity. Furthermore, role determination is deeply linked to fund behavior patterns, specifically: Building a core account: high outflow centrality + high net outflow centrality → funds radiate outward from the core; Building a transit account: high inflow and outflow centrality + net outflow ≈ 0 → funds move in and out quickly, without overnight transactions; Building a puppet account: high inflow centrality + low outflow centrality → only receives funds, does not actively transfer them out.

[0030] S5 uses directional centrality indicators combined with graph neural networks (GNNs) to perform group clustering and identification on weighted directed association knowledge graphs, identifying the account roles of groups in the flow of funds. Further, S6 divides the observation timeline into multiple consecutive time windows, executing steps S3-S5 for each window to construct a temporal knowledge graph and track the role changes of the same account across different time windows. Specifically, this involves: 1) constructing temporal knowledge graphs for multiple consecutive time windows (e.g., weekly, monthly); 2) performing role identification independently for each time window; 3) analyzing the role change trajectory of each node, identifying role transitions: puppet → intermediary → core (potentially indicating the account is "promoted" to a group core); emerging core: newly emerging high-centrality, high-score nodes that quickly establish dense connections with multiple nodes; role stability index: long-term stability of core accounts indicates high credibility; abnormal stability (frequent changes) may be an attempt to evade detection.

[0031] Finally, S7 performs risk analysis and judgment on accounts and groups based on account roles and their role change trajectories, generating early warning information and analysis reports; it identifies the risk levels of different risk groups based on account roles and role change trajectories, and triggers early warnings for risk groups through system pop-ups and SMS notifications; it automatically generates analysis reports containing group members, funding links, related evidence, risk levels, and evidence lists, and supports export in PDF and Excel formats; it retains full-process audit logs (including data collection, preprocessing, identification, and early warning stages), with a log retention period of ≥5 years, meeting regulatory archiving requirements.

[0032] In the above technical solution, a batch of key accounts were imported by the anti-money laundering department of a joint-stock bank. The method of this invention was used to identify anti-money laundering groups. The specific implementation process is as follows, which can be completely repeated: S1. Collect multi-source data from 19 accounts, including account opening information (account opening time concentrated between March 1-10, 2025, and accounts opened at the same branch), account information (all personal debit cards, unemployed customers), transaction history (cumulative transaction amount of RMB 8.6 million in the past 3 months, with single transaction amounts ranging from RMB 50,000 to RMB 800,000), MAC addresses (3 identical MAC addresses), IP addresses (all belonging to the same IP segment), transaction terminal locations (concentrated in a certain cross-border port city), and remarks (all marked "payment"). S2. Preprocess the collected data: 1) Clean and remove 2 records with missing MAC addresses; 2) Remove duplicate transaction records; 3) Encrypt and desensitize the ID number and mobile phone number using AES encryption; 4) Standardize the data format and convert the transaction time to "YYYY-MM-DD HH:MM:SS" format; 5) Map the IP address to a district / county in a cross-border port city using the IP2Location library; 6) Use jieba word segmentation to segment the "payment" remark, remove stop words, and then mark the keyword "payment". S3. Extract five types of correlation features: 1) Identity correlation features: All 19 accounts were opened by the same agent, and were opened in batches at the same branch within 10 days. The customers were unemployed, and the monthly transaction amount of each account was ≥1 million yuan. There was a serious mismatch between occupation and transaction scale; 2) Transaction correlation features: There were direct and 1-2 layers of indirect fund transfers between the 19 accounts. The funds showed a "centralized transfer in, decentralized transfer out" pattern. The transaction frequency and time period were highly similar (similarity 85%), forming a star-shaped aggregation network; 3) Device correlation features: 19 All accounts logged in to trade using three identical MAC addresses, switched IPs at least six times a day, suggesting the use of a VPN; the matching rate between the account opening device and the daily trading device was only 30%; 4) Location association characteristics: all 19 accounts were opened in the same city, and the trading locations were concentrated in a certain cross-border port city, with at least 15 transactions per month outside of their place of residence and work location; 5) Text association characteristics of the remarks: all 19 accounts had "payment" in the transaction remarks, with a keyword similarity of 90%, but the accounts had no business background, the remarks contradicted the nature of the accounts, and no sensitive words were found; S4. Using 19 accounts as nodes and fund transaction relationships as directed edges, with the direction strictly following payer → payee, weights are assigned to the edges based on five types of association characteristics. The weight assignment rules are as follows (0.4 for transaction association characteristics, 0.25 for device association characteristics, etc.). A weighted association knowledge graph is constructed, in which the average weight of transaction association edges is 0.85 and the average weight of device association edges is 0.8. S5. Employing the Louvain community detection algorithm, with modularity optimized to 0.82, it automatically identifies one money laundering group community. Inputting a weighted directed graph into the GCN model, it outputs account suspiciousness scores (0-100 points). Combining directional centrality and GCN scores, it completes role classification: Core account: A001 (score 92 points), Transit accounts: B003-B006 (score 75-80 points), Puppet accounts: C001-C014 (score 50-65 points). Directional centrality is calculated on the directed graph using the out-degree and in-degree indices. Centrality: Funds transfer out volume / frequency; In-degree centrality: Funds transfer in volume / frequency; Net outflow centrality: (Total outflow - Total inflow) / Total transaction volume; Role determination: Core account: High outflow centrality + High net outflow centrality → Score 92, Outflow centrality 0.92, Net outflow centrality 0.78; Transit account: High inflow centrality + High outflow centrality + Net outflow ≈ 0 → 4 accounts, Score 75-80, Centrality 0.68-0.74; Puppet account: High inflow centrality + Low outflow centrality → 14 accounts, Score 50-65, Centrality < 0.5.

[0033] S6. In the analysis of temporal evolution and role change trajectory, the observation time axis is divided into weekly time windows (T1-T4); S3-S5 are executed independently for each time window to construct a temporal knowledge graph; the role trajectory of account A001 is tracked to generate account role information corresponding to each time window; finally, the role stability index is calculated, and the role stability index of 0.33 is compared with the preset threshold lower limit of 0.5. If 0.33 < 0.5, the stability is judged to be abnormal, and there is a risk of evading detection.

[0034] S7. Based on risk grading and early warning, if a group meets ≥3 strongly correlated characteristics, such as transaction + device + identity, has a single large transaction of ≥500,000 yuan, exhibits role transition (puppet → intermediary → core), and has a low stability index, it is comprehensively judged as a high-risk group; the system will trigger a real-time early warning within 3 minutes (system pop-up + SMS notification) and automatically generate an analysis report, including: The report includes a list of gang members, a financial flow topology, evidence of connections (five-dimensional features), a timeline of role evolution, risk levels and a list of evidence. The report can be exported in PDF format. The entire process of auditing (collection, preprocessing, identification, and early warning stages) is recorded and retained for at least 5 years for manual verification and regulatory reporting.

[0035] As one embodiment of the present invention, the orientation centrality index includes: Out-degree centrality is the total amount of funds transferred out by an account as the payer and the frequency of transactions within a unit of time, used to characterize the ability of funds to disperse. In-degree centrality is used to characterize the ability to pool funds by counting the total amount of funds transferred into an account as the recipient and the frequency of transactions within a unit of time. Net outflow centrality is calculated as the ratio of the difference between the total amount of funds transferred out and the total amount of funds transferred in to the total transaction volume, which is used to characterize the net fund outflow tendency of an account.

[0036] In the above technical solution, out-degree centrality is determined by statistically analyzing the out-of-payment behavior of an account as the payer (source of funds) within a unit observation time window T (e.g., the past 3 months). Specifically, this is calculated by statistically analyzing the total amount of funds transferred from the account to other accounts and the number of out-of-payment transactions initiated by the account. In this embodiment, account A001 initiated transfers to 18 other accounts in the past 3 months, with a total out-of-payment amount of 5 million yuan and 120 out-of-payment transactions. Compared with the average out-of-payment amount of 500,000 yuan of other accounts, A001 exhibits extremely high fund dispersion ability and is initially identified as a fund dispersion account. In-degree centrality is determined by statistically analyzing the inflow behavior of an account as a recipient (funds receiver) within a unit observation time window. Specifically, it is calculated by counting the total amount of funds transferred into the account from other accounts and the number of inflow transactions received by the account. Accounts C001 to C014 (puppet account group) have only received funds in the past 3 months, with a total inflow of 3.5 million yuan and a total of 95 inflow transactions, but almost no outflow behavior; their in-degree centrality is extremely high, indicating that this group of accounts mainly undertakes the function of fund aggregation. Net outflow centrality is calculated by measuring the ratio of the difference between the total amount of funds transferred out and the total amount transferred in to the total transaction volume. This eliminates interference from natural market flows and accurately characterizes an account's net outflow capacity. For example, account A001 transferred out 5 million yuan and transferred in 500,000 yuan, with a total transaction volume of 5.5 million yuan; therefore, its net outflow centrality is [value missing]. The value is close to 1, indicating that A001 is the net source of funds, rather than a transit or intermediary account. Through the comprehensive calculation of the above three indicators, the system can accurately quantify the account's real behavior pattern in the fund flow, providing a quantitative basis for subsequent role determination.

[0037] As one embodiment of the present invention, the rules for identifying account roles include: If both the out-degree centrality and net outflow centrality of an account are higher than the preset first threshold, it is determined to be a core account, indicating that funds radiate outward from the core. If the in-degree centrality and out-degree centrality of an account are both higher than the preset second threshold, and the net outflow centrality is close to zero, it is determined to be a transit account, which indicates that funds are quickly in and out and do not stay overnight. If an account's in-degree centrality is higher than the preset third threshold and its out-degree centrality is lower than the preset fourth threshold, it is determined to be a dummy account, which means that it only receives funds but does not actively transfer them out.

[0038] In the above technical solution, based on the directional centrality index calculated above, this embodiment uses a multi-threshold joint determination rule to accurately identify account roles. The specific logic is as follows: In the determination rules for core accounts, if the out-degree centrality and net outflow centrality of an account are both higher than a preset first threshold (the first threshold is set to 0.7 in this embodiment), it is determined to be a core account; and in terms of behavioral characteristics, funds radiate from the core account to external accounts on a large scale and at high frequency, showing obvious characteristics of the source of funds; the out-degree centrality of account A001 is 0.92 (far higher than 0.7), the net outflow centrality is 0.818 (far higher than 0.7), and its GNN risk score is 92 points. Based on this, the system determines that A001 is the core account of this money laundering gang, responsible for dispersing and transferring illegal funds to lower-level accounts; In the determination rules for transit accounts, if the in-degree centrality and out-degree centrality of an account are both higher than the preset second threshold (the second threshold is set to 0.6 in this embodiment), and the net outflow centrality is close to zero (absolute value less than 0.1), then it is determined to be a transit account. In addition, the behavioral characteristics are that funds come in and out quickly, and the account only serves as a channel for fund transfer and does not stay overnight in the account, thus playing a role in confusing the fund flow. The out-degree centrality of accounts B003-B006 is between 0.68 and 0.74, and the in-degree centrality is between 0.65 and 0.72, both of which are higher than 0.6. Their net outflow centrality is between -0.05 and 0.02, close to 0. The system determines these four accounts to be transit accounts, responsible for receiving funds from the core account and quickly transferring them downwards. In the criteria for identifying dummy accounts, if an account's in-degree centrality is higher than a preset third threshold (set to 0.8 in this embodiment) and its out-degree centrality is lower than a preset fourth threshold (set to 0.3 in this embodiment), it is identified as a dummy account. Its behavioral characteristics include passively receiving funds and almost never actively transferring funds out; these accounts are typically used to accumulate funds or await subsequent instructions. Accounts C001-C014 have an in-degree centrality as high as 0.81-0.93, but their out-degree centrality is only 0.12-0.28, far below 0.3. The system identifies these 14 accounts as dummy accounts, indicating that they are idle accounts stolen or controlled by criminals and used to receive illegal funds. Using the above rules, the system successfully divided the 19 accounts into a hierarchical structure of "1 core + 4 intermediaries + 14 puppets", thus fully reconstructing the money laundering gang's fund transfer path.

[0039] As one embodiment of the present invention, the extraction of transaction remarks features includes: The transaction comment text is processed by word segmentation, stop word filtering, and semantic vectorization. Calculate the cosine similarity of transaction comment texts from different accounts to identify templated comment features; Based on a sensitive word database, keywords related to gambling, fraud, virtual currency, and underground banks are identified.

[0040] In the above technical solution, in step S3 of the above embodiment, the present invention uses Natural Language Processing (NLP) technology to extract the associated features of transaction remark text, and identifies covert money laundering behavior through deep semantic analysis; the specific implementation process is as follows: The system first cleans and structures the collected transaction comment data, performs text preprocessing and vectorization, and uses the jieba word segmentation algorithm to segment the original comment text. For example, "payment for goods in March batch" is segmented into "payment / goods / March / batch". The stop word filter loads the Harbin Institute of Technology stop word library to remove some meaningless function words and punctuation marks, retaining words with substantial financial semantics. Semantic vectorization converts the filtered keywords into word frequency vectors (TF-IDF) or semantic embedding vectors for mathematical calculations. In the modular postscript recognition, the consistency of the text is quantified by calculating the cosine similarity of the postscript text between different accounts. If the similarity of the transaction postscript text between two accounts exceeds a preset threshold, it is determined to be a modular postscript. In this embodiment, when account A001 transfers money to transit accounts such as B003 and B004, the postscript is "payment for goods". After calculation, the cosine similarity of the postscript text between these 19 accounts is as high as 0.90. The system recognizes that the gang uses highly standardized templated postscripts in an attempt to cover up the real illegal nature of the funds. This feature is used as an important basis for the weight of the associated edges. Sensitive semantic monitoring involves constructing a dynamically updated, multi-dimensional sensitive word database covering slang related to gambling, fraud, virtual currency, money laundering, and underground banks. An AC automaton or multi-pattern matching algorithm is used to perform a full scan of the appendix text. Although the appendix texts of the 19 accounts in this example all appear to be legitimate "payment," in other test cases, the system has identified appendix texts containing sensitive terms such as "U-coin settlement," "money laundering commission," and "gambling recharge." Once detected, the system immediately increases the weight of the account and related edges and marks it as extremely high risk.

[0041] Please see Figure 4 As shown, in one embodiment of the present invention, the method for constructing the time window in step S6 includes: S61. Divide the observation time axis into multiple continuous and non-overlapping time windows according to a fixed duration. The granularity of the time window is selected from one or more combinations of daily, weekly or monthly levels. S62. For each time window, execute steps S4 to S6 independently to construct the weighted directed association knowledge graph corresponding to that time window and generate account role tags and risk scores for that window. S63. Perform timestamp alignment and serialization storage on the graph data and role tags within all time windows to form a temporal evolution dataset of account behavior.

[0042] In the above technical solution, based on the aforementioned static graph analysis, in order to capture the dynamic evolution pattern of money laundering groups, this invention introduces a sliding time window mechanism. The following, using data from 19 accounts, details the construction method of the time window in step S6: First, step S61 determines the time axis slice. Specifically, the system will observe the time axis, generally the past 3 months, and divide it into four continuous and non-overlapping time windows W1, W2, W3, and W4 at a weekly granularity. In the window granularity selection logic, the daily window is suitable for identifying high-frequency, fast-moving funds; the weekly window is suitable for identifying the incubation period of a group; and the monthly window is suitable for identifying long-term capital accumulation. Because it involves role promotion, the weekly granularity is selected. Then, in step S62, through independent graph construction and role labeling, the system independently executes the entire process analysis for each time window without interference: that is, within window W1, only the fund flow and related features within that week are counted, a local weighted directed association knowledge graph G1 is constructed based on the calculated directional centrality index, and the risk score within that window is output in combination with the GNN model; according to the aforementioned judgment rules, the role label R of the t-th time window is assigned to the account. For example, in the first week W1, account A001 has a small fund flow and is judged as a regular account; in the second week W2, account A001 begins to transfer funds to a small number of accounts and is judged as a puppet account; in the third week W3, account A001's fund dispersal ability increases dramatically and is judged as a transit account; in the fourth week W4, A001 becomes a fund hub and is judged as a core account.

[0043] Finally, in step S63, a serialized storage and time-series dataset is generated. Specifically, the system timestamps the calculation results within all time windows and vertically concatenates them according to the account dimension to form a time-series evolution dataset of account behavior. This dataset records the full lifecycle behavior trajectory of each account from high to low or from low to high, providing a data foundation for subsequent identification of regulatory evasion behaviors such as "cultivating" and "promotion".

[0044] In one embodiment of the present invention, step S6 involves independently performing role recognition for each time window, specifically including: Regarding the first Time window Calculate accounts Out-degree centrality within this window in-degree centrality and net outflow centrality ; Based on the judgment rules, for the account Allocation of the first Role tags within a time window The set of character tags is {core account, transit account, puppet account, ordinary account}; Aggregate role tags from all time windows to build an account. Role sequence: .

[0045] In the above technical solution, based on the construction of time windows, a specific implementation process for independent role identification is further carried out for each time window. Unlike global static analysis, this step emphasizes the calculation of local features and dynamic label allocation within the window, specifically targeting the first... Time window ,For example Week 1 For the second week, and so on, the system only uses the transaction data within that window for calculations, shielding against interference from historical data; Window: A001 has only a small amount of daily expenses, with 10,000 yuan transferred out and 5,000 yuan transferred in; calculation shows... , , ;exist In window A001, funds begin to be received from upstream suppliers and a small amount is transferred out: 200,000 yuan is transferred in and 50,000 yuan is transferred out. Calculations show... , , ;exist Window: A001 saw a surge in fund activity, with 1.5 million yuan transferred out and 500,000 yuan transferred in. Calculations show... , , ;exist Window: A001 reaches its peak, with 5 million yuan transferred out and 500,000 yuan transferred in. Calculations show... , , .

[0046] Based on the calculation results within the above window, for the account Allocation of the first Role tags within a time window The system invokes preset judgment rules to assign a role label for this window to account A001. The allocation table is shown in Table 1, which includes time window information, out-degree centrality, in-degree centrality, net outflow centrality, judgment result and role label R; Table 1

[0047] Construct the role evolution sequence of account A001 across all time windows by summarizing its role labels. The system constructs a sequence of roles for the remaining 18 accounts, categorized as {core account, transit account, puppet account, ordinary account}. For example, the sequence for account B003 is {ordinary account, ordinary account, puppet account, transit account}; and the sequence for account C001 is {ordinary account, puppet account, puppet account, puppet account}. This sequence visually demonstrates the complete lifecycle of a money laundering gang, from "infiltration and account nurturing" to "fund collection" and then to "decentralized laundering," serving as a key basis for identifying the gang's operational model.

[0048] As one embodiment of the present invention, step S6 analyzes the role change trajectory of each node. The role change trajectory analysis includes role transition detection, new core detection, and role stability index. Specifically: Role transition detection includes defining a role hierarchy mapping function. :

[0049] If a continuous time window exists , ,and < The conditions are:

[0050] Then determine the account A role transition has occurred, indicating a promotion from a lower-level account to a core account; Core testing for newborns includes testing for those born in the first year of school. The account that first appeared in the time window If the following conditions are met simultaneously:

[0051] in, Indicate degree centrality, Indicates in-degree centrality. Indicates the degree of a node. , , If the preset threshold is used, then the determination is made. For new core accounts.

[0052] In the above technical solution, based on the constructed account role sequence, this embodiment further conducts in-depth analysis of the dynamic evolution behavior of nodes, focusing on identifying two high-risk evolution modes: role transition and emerging core. Firstly, role transition detection aims to quantify changes in an account's status within the group. This invention defines a role hierarchy mapping function (LR) to convert discrete text labels into continuous numerical values ​​for mathematical comparison. The hierarchy is defined as... traverse accounts Role sequence If a continuous time window exists < ,satisfy If so, it is determined that the account has undergone a role transition; the role sequence of account A001 is: {ordinary account (0), puppet account (1), transit account (2), core account (3)}, detection process: from week 1 (t1, ordinary account, L(R)=3): The system determined that account A001 had undergone a role transition, indicating that the account was not exposed at the beginning, but rather gradually tested and accumulated credit, eventually becoming the group's financial hub. This low-start-high-financial-end pattern is a typical advanced money laundering evasion technique.

[0053] Secondly, the new core detection targets newly joined or suddenly active accounts within the group. This invention designs a new core detection mechanism to prevent underreporting of newly formed money laundering hubs. Accounts that first recorded a transaction within a given time window (i.e., no activity in the foreground window), the system calculates its metrics within that window: Indicate degree centrality, Indicates in-degree centrality. This represents the node degree, which is equal to the number of associated accounts. Furthermore, if the following conditions are met simultaneously... , such as setting a threshold The threshold is 0.8. The threshold is 0.7. If the value is 10, then the judgment is... Assuming that account X999 first appears in the transaction network in week 3 (W3), the system detects that: X999 transferred out 2 million yuan in a single week (Cout is extremely high); X999 received 1.8 million yuan in a single week (Cin is extremely high); X999 transacted with 15 different downstream accounts (deg>10). Although X999's historical records are empty, the system immediately marks it as a new core account based on its explosive fund dispersal ability and extensive connectivity, prompting risk control personnel to pay attention to the registration source and actual controller of the account to prevent it from taking over the money laundering task from the frozen old account.

[0054] As one embodiment of the present invention, the calculation of the role stability index specifically includes: Define account exist Role stability index within a time window for:

[0055] in, This is an indicator function that takes a value of 1 when the character changes, and 0 otherwise; The smaller the value, the greater the role fluctuation and the higher the risk of avoiding detection.

[0056] In the above technical solution, the role stability index is used. To measure the consistency of account behavior within the observation period, the indicator function is set to 1 when the roles change between two adjacent time windows, and 0 otherwise. For the comparative analysis of core account A001 and puppet account C001, the role sequence of core account A001 is obtained as: {ordinary (0), puppet (1), transit (2), core (3)}. The RSI(A001) is calculated as 1-1 / 3(1+1+1)=0, which means that A001 has completed 3 role jumps within 4 weeks, with extremely low stability, indicating that it is actively adjusting its funding strategy to evade rule monitoring. For the role sequence of puppet account C001 as: {ordinary (0), puppet (1), puppet (1), puppet (1)}, the RSI(C001) is calculated as: 1-1 / 3(1+0+0)≈0.67, which means that the role of C001 is relatively stable, with only one change in the early stage, and a long-term dormant state in the later stage.

[0057] As one embodiment of the present invention, the risk analysis and determination logic is as follows: If the account is identified as a core account or a new core account, and < If so, it is classified as high risk; If the account exhibits role transition issues, or ≤ < If so, it is classified as medium risk; If the account character has been a puppet account for a long time and ≥ It is then classified as low risk. in, To preset the lower limit of the character stability index, This sets the upper limit for the character's stability index.

[0058] In the above technical solution, the system combines the account's current role, evolving behavior, and RSI value to perform the final risk classification determination and set a preset threshold. A value of 0.3 indicates the lower limit of stability. A stability cap of 0.7 is set based on the current account information. The size determination condition is whether it falls within the preset threshold range. A value <0.3 indicates the individual is at the top of the group and exhibits extremely unstable behavior, attempting to evade detection through frequent changes of identity; in this case, immediate freezing is necessary. If the value falls between two ranges: 0.3 ≤ <0.7 indicates the account's status is rising or fluctuating significantly, requiring increased monitoring and restrictions on non-counter transaction limits; if >0.7 indicates a low level of involvement within the group, passively receiving funds over a long period, exhibiting a fixed behavioral pattern, and posing a relatively low threat. The above is achieved by introducing... Unlike traditional methods that categorically classify any large-scale account as high-risk, for example, if a normal company's corporate account experiences large inflows and outflows due to seasonal purchases, its role may remain consistently as a "core account." If the probability is high, the system will combine it with other characteristics to rule out its suspicion; however, in this case, A001 is because... Extremely low risk, coupled with a role shift, makes them precisely targeted as high-risk objectives.

[0059] Please see Figure 3 As shown, in one embodiment of the present invention, the weighted directed association knowledge graph is constructed in step S3 as follows: S31. Define the graph topology and construct a weighted directed association knowledge graph. ,in, For a set of bank account nodes, In the first The set of directed edges within a time window The weight function for directed edges; S32. Establish directed edges based on fund flow, for any two account nodes Based on the transfer information between the two accounts, a directed edge is established. ; S33. For directed edges The weight is calculated by fusing transaction features and multidimensional correlation features. ; S34. Perform nonlinear transformation on the transaction weights to amplify the marginal contribution of large-scale capital flows. S35. Divide the observation time axis into continuous and non-overlapping time windows, and for a certain time window, independently execute steps S31-S34 to generate a corresponding weighted directed association knowledge graph, and arrange them in chronological order to generate a time-series knowledge graph sequence.

[0060] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the embodiments of apparatus, devices, and non-volatile computer storage media are basically similar to the method embodiments, and therefore described more simply; relevant parts can be referred to the descriptions of the method embodiments.

[0061] The above content is merely an example and illustration of the concept of the present invention. Those skilled in the art can make various modifications or additions to the specific embodiments described or use similar methods to replace them, as long as they do not deviate from the concept of the invention or exceed the scope defined in this application, they should all fall within the protection scope of the present invention.

Claims

1. A method for identifying anti-money laundering gangs based on multi-dimensional correlation features, characterized in that, The method includes: S1. Receive the list of accounts to be analyzed, synchronously collect multi-source data from the bank for preprocessing, and generate a standardized dataset; the multi-source data includes account opening data, account data, transaction flow data, device MAC address, login IP address, transaction terminal location, and transaction remarks data; S2. Extract account feature vectors based on the standardized dataset; the account feature vectors include identity-related features, transaction-related features, device-related features, location-related features, and transaction comment text-related features; S3. Construct a weighted directed association knowledge graph, with bank accounts as nodes and the account feature vectors of the directed association knowledge graph as directed edges, with the direction from the payer to the payee. Assign edge weights based on transaction amount, frequency of association features, and association strength. S4. Based on the weighted directed association knowledge graph, calculate the directional centrality index of the nodes, wherein the directional centrality index includes out-degree centrality, in-degree centrality and net outflow centrality. S5. Based on the directional centrality index and combined with graph neural network (GNN), perform group clustering and identification on the weighted directed association knowledge graph to identify the account roles of the group in the flow of funds. S6. Divide the observation timeline into multiple consecutive time windows, and execute steps S3-S5 for each time window to construct a time-series knowledge graph and track the role change trajectory of the same account in different time windows. S7. Based on the account role and the trajectory of role changes, conduct risk analysis and judgment on the account and the group, and generate early warning information and analysis report.

2. The anti-money laundering gang identification method based on multi-dimensional correlation features according to claim 1, characterized in that, The directional centrality index includes: Out-degree centrality is the total amount of funds transferred out by an account as the payer and the frequency of transactions within a unit of time, used to characterize the ability of funds to disperse. In-degree centrality is used to characterize the ability to pool funds by counting the total amount of funds transferred into an account as the recipient and the frequency of transactions within a unit of time. Net outflow centrality is calculated as the ratio of the difference between the total amount of funds transferred out and the total amount of funds transferred in to the total transaction volume, which is used to characterize the net fund outflow tendency of an account.

3. The anti-money laundering gang identification method based on multi-dimensional correlation features according to claim 2, characterized in that, The rules for determining account roles include: If both the out-degree centrality and net outflow centrality of an account are higher than the preset first threshold, it is determined to be a core account, indicating that funds radiate outward from the core. If the in-degree centrality and out-degree centrality of an account are both higher than the preset second threshold, and the net outflow centrality is close to zero, it is determined to be a transit account, which indicates that funds are quickly in and out and do not stay overnight. If an account's in-degree centrality is higher than the preset third threshold and its out-degree centrality is lower than the preset fourth threshold, it is determined to be a dummy account, which means that it only receives funds but does not actively transfer them out.

4. The anti-money laundering gang identification method based on multi-dimensional correlation features according to claim 1, characterized in that, The extraction of the transaction remarks features includes: The transaction comment text is processed by word segmentation, stop word filtering, and semantic vectorization. Calculate the cosine similarity of transaction comment texts from different accounts to identify templated comment features; Based on a sensitive word database, keywords related to gambling, fraud, virtual currency, and underground banks are identified.

5. The anti-money laundering gang identification method based on multi-dimensional correlation features according to claim 3, characterized in that, The time window is constructed in step S6 in the following ways: S61. Divide the observation time axis into multiple continuous and non-overlapping time windows according to a fixed duration, wherein the granularity of the time window is selected from one or more combinations of daily, weekly or monthly levels. S62. For each time window, execute steps S4 to S6 independently to construct the weighted directed association knowledge graph corresponding to that time window and generate account role tags and risk scores for that window. S63. Perform timestamp alignment and serialization storage on the graph data and role tags within all time windows to form a temporal evolution dataset of account behavior.

6. The anti-money laundering gang identification method based on multi-dimensional correlation features according to claim 5, characterized in that, In step S6, role recognition is performed independently for each time window, specifically including: Regarding the first Time window Calculate accounts Out-degree centrality within this window in-degree centrality and net outflow centrality ; Based on the aforementioned determination rules, for the account Allocation of the first Role tags within a time window The set of character tags is {core account, transit account, puppet account, ordinary account}; Aggregate role tags from all time windows to build an account. Role sequence: 。 7. The anti-money laundering gang identification method based on multi-dimensional correlation features according to claim 6, characterized in that, Step S6 analyzes the role change trajectory of each node. This role change trajectory analysis includes role transition detection, new core detection, and role stability index. Specifically: The role transition detection includes defining a role hierarchy mapping function. : If a continuous time window exists , ,and < The conditions are: Then determine the account A role transition has occurred, indicating a promotion from a lower-level account to a core account; The newborn core detection includes for the first The account that first appeared in the time window If the following conditions are met simultaneously: in, Indicate degree centrality, Indicates in-degree centrality. Indicates the degree of a node. , , If the preset threshold is used, then the determination is made. For new core accounts.

8. The anti-money laundering gang identification method based on multi-dimensional correlation features according to claim 7, characterized in that, The calculation of the role stability index specifically includes: Define account exist Role stability index within a time window for: in, This is an indicator function that takes a value of 1 when the character changes, and 0 otherwise; The smaller the value, the greater the role fluctuation and the higher the risk of avoiding detection.

9. The anti-money laundering gang identification method based on multi-dimensional correlation features according to claim 8, characterized in that, The risk analysis and judgment logic is as follows: If the account is identified as a core account or a new core account, and < If so, it is classified as high risk; If the account exhibits role transition issues, or ≤ < If so, it is classified as medium risk; If the account character has been a puppet account for a long time and ≥ It is then classified as low risk. in, To preset the lower limit of the character stability index, This sets the upper limit for the character's stability index.

10. The anti-money laundering gang identification method based on multi-dimensional correlation features according to claim 1, characterized in that, The method for constructing the weighted directed association knowledge graph in step S3 is as follows: S31. Define the graph topology and construct a weighted directed association knowledge graph. ,in, For a set of bank account nodes, In the first The set of directed edges within a time window The weight function for directed edges; S32. Establish directed edges based on fund flow, for any two account nodes Based on the transfer information between the two accounts, a directed edge is established. ; S33. For directed edges The weight is calculated by fusing transaction features and multidimensional correlation features. ; S34. Perform nonlinear transformation on the transaction weights to amplify the marginal contribution of large-scale capital flows. S35. Divide the observation time axis into continuous and non-overlapping time windows, and for a certain time window, independently execute steps S31-S34 to generate a corresponding weighted directed association knowledge graph, and arrange them in chronological order to generate a time-series knowledge graph sequence.

Images