Method, apparatus, device, medium and product for determining abnormal transaction event

Abstract

Embodiments of the present application provide a method and device for determining abnormal transaction events, and a medium and product, relating to the field of artificial intelligence or financial technology. First, a transaction to be identified is obtained, and an undirected graph is constructed according to the transaction to be identified. Then, a subgraph extraction operation is performed on the undirected graph, and a plurality of undirected subgraphs are obtained by splitting. Subsequently, the undirected subgraphs are identified one by one. According to the identification results, it is determined whether the corresponding transaction is abnormal. If the identification result of any undirected subgraph indicates abnormality, the abnormal transaction event corresponding to the undirected subgraph is output. The method converts the transaction content into a graph structure, splits independent transaction units, and then checks them one by one, thereby solving the problem that the prior art cannot accurately identify abnormal financial transactions, and effectively improving the accuracy and reliability of the identification of abnormal financial transactions.

Description

Technical Field

[0001] This application relates to the fields of artificial intelligence or financial technology, and in particular to a method, apparatus, device, medium and product for determining abnormal transaction events. Background Technology

[0002] With the increase in electronic transactions and digital records, financial institutions face growing risks of fraud and money laundering. Traditional monitoring methods mainly rely on two models: one is a rule-driven system, which screens financial transactions through preset transaction rules; the other is manual review, where operators manually verify financial transactions based on regulatory standards and business experience.

[0003] Both of these methods rely on event extraction to gather key information about financial transactions, providing a structured basis for anomaly monitoring. The existing event extraction process mainly includes four steps: trigger word detection, event type identification, argument detection, and argument role identification.

[0004] However, because the existing event extraction process adopts a step-by-step execution mode, trigger word identification needs to be completed first. If the trigger word cannot be identified from the financial transaction text, the entire event extraction chain will be directly interrupted, resulting in the inability to identify abnormal transaction events. Summary of the Invention

[0005] This application provides methods, apparatus, devices, media, and products for determining abnormal transaction events, in order to solve the problem that existing technologies are unable to accurately identify abnormal financial transaction events.

[0006] In a first aspect, embodiments of this application provide a method for determining abnormal transaction events, including:

[0007] Obtain the transaction to be identified;

[0008] Construct an undirected graph corresponding to the transaction to be identified;

[0009] The undirected graph is subjected to subgraph extraction processing to obtain at least one undirected subgraph, which is used to indicate a single independent transaction event;

[0010] Anomaly detection processing is performed on at least one of the undirected subgraphs to obtain the detection result corresponding to at least one of the undirected subgraphs;

[0011] If any of the identification results of the undirected subgraph indicates an anomaly, the abnormal transaction event corresponding to the undirected subgraph is output.

[0012] In one possible implementation, constructing the undirected graph corresponding to the transaction to be identified includes:

[0013] Determine a set of candidate arguments corresponding to the transaction to be identified, the set of candidate arguments including at least one candidate argument;

[0014] From at least one of the candidate arguments, determine the target argument of the transaction to be identified;

[0015] The undirected graph is constructed based on the target arguments of the transaction to be identified.

[0016] In one possible implementation, determining the set of candidate arguments corresponding to the transaction to be identified includes:

[0017] The transaction to be identified is subjected to text conversion processing to obtain the transaction text;

[0018] The transaction text is split into characters to obtain a sequence of word segments;

[0019] By traversing the sequence of word segmentation units, multiple consecutive text fragments are extracted;

[0020] The continuous text segments are summarized to obtain the candidate argument set.

[0021] In one possible implementation, determining the target argument of the transaction to be identified from at least one of the candidate arguments includes:

[0022] For any candidate argument, the candidate argument is input into the argument recognition model to obtain the argument score of the candidate argument;

[0023] If the argument score of the candidate argument is greater than the preset score, the candidate argument is determined as the target argument.

[0024] In one possible implementation, constructing the undirected graph based on the target arguments of the transaction to be identified includes:

[0025] The transaction to be identified and the target argument corresponding to the transaction to be identified are input into the graph construction model to obtain the undirected graph output by the graph construction model.

[0026] In one possible implementation, the subgraph extraction process on the undirected graph to obtain at least one undirected subgraph includes:

[0027] The undirected graph is subjected to recognition processing to obtain the recognition result of the undirected graph;

[0028] If the identification result indicates that any two nodes in the undirected graph are adjacent, then the undirected graph is determined to be the undirected subgraph.

[0029] In one possible implementation, the method further includes:

[0030] If the identification result indicates that there are non-adjacent pairs of nodes in the undirected graph, then the non-adjacent pairs of nodes are determined from the undirected graph, and the set of nodes of the non-adjacent pairs of nodes is determined from the undirected graph.

[0031] Based on the set of nodes of the non-adjacent node pairs, construct a temporary graph of the non-adjacent node pairs;

[0032] The temporary graph of the non-adjacent node pairs is identified and processed until an undirected subgraph in which any two nodes are adjacent is obtained.

[0033] In one possible implementation, the anomaly detection processing of at least one of the undirected subgraphs to obtain the detection result corresponding to at least one of the undirected subgraphs includes:

[0034] Obtain pre-built rules for abnormal behavior;

[0035] Based on the abnormal behavior rules, at least one of the undirected subgraphs is subjected to anomaly identification processing to obtain the identification results corresponding to at least one of the undirected subgraphs.

[0036] Secondly, embodiments of this application provide an apparatus for determining abnormal transaction events, comprising:

[0037] The acquisition module is used to acquire the transactions to be identified.

[0038] The construction module is used to construct an undirected graph corresponding to the transaction to be identified;

[0039] The processing module is used to perform subgraph extraction processing on the undirected graph to obtain at least one undirected subgraph, which is used to indicate a single independent transaction event;

[0040] The processing module is further configured to perform anomaly recognition processing on at least one of the undirected subgraphs to obtain recognition results corresponding to at least one of the undirected subgraphs;

[0041] The output module is used to output the abnormal transaction event corresponding to the undirected subgraph when the identification result of any of the undirected subgraphs indicates an abnormality.

[0042] In one possible implementation, the apparatus further includes: a determining module;

[0043] The determining module is used to determine a set of candidate arguments corresponding to the transaction to be identified, the set of candidate arguments including at least one candidate argument;

[0044] The determining module is further configured to determine the target argument of the transaction to be identified from at least one of the candidate arguments;

[0045] The construction module is specifically used to construct the undirected graph based on the target arguments of the transaction to be identified.

[0046] In one possible implementation, the processing module is further configured to perform text conversion processing on the transaction to be identified to obtain transaction text;

[0047] The processing module is also used to perform character splitting on the transaction text to obtain a sequence of word segmentation units;

[0048] The device further includes: a traversal module;

[0049] The traversal module is used to traverse the word segmentation unit sequence and extract multiple continuous text segments;

[0050] The processing module is specifically used to summarize the continuous text segments to obtain the candidate argument set.

[0051] In one possible implementation, the device further includes: an input module;

[0052] The input module is used to input any candidate argument into the argument recognition model to obtain the argument score of the candidate argument.

[0053] The determining module is specifically used to determine the candidate argument as the target argument when the argument score of the candidate argument is greater than a preset score.

[0054] In one possible implementation, the input module is specifically used to input the transaction to be identified and the target arguments corresponding to the transaction to be identified into a graph construction model to obtain an undirected graph output by the graph construction model.

[0055] In one possible implementation, the processing module is further configured to perform identification processing on the undirected graph to obtain the identification result of the undirected graph;

[0056] The determining module, if the identification result indicates that any two nodes in the undirected graph are adjacent, is specifically used to determine the undirected graph as the undirected subgraph.

[0057] In one possible implementation, if the identification result indicates that there are non-adjacent node pairs in the undirected graph, the determining module is further configured to determine non-adjacent node pairs from the undirected graph and determine the node set of the non-adjacent node pairs from the undirected graph.

[0058] The construction module is also used to construct a temporary graph of the non-adjacent node pairs based on the set of nodes of the non-adjacent node pairs;

[0059] The processing module is specifically used to identify and process the temporary graph of the non-adjacent node pairs until an undirected subgraph in which any two nodes are adjacent is obtained.

[0060] In one possible implementation, the acquisition module is further configured to acquire pre-built rules for abnormal behavior;

[0061] The processing module is specifically used to perform anomaly identification processing on at least one of the undirected subgraphs based on the abnormal behavior rules, and obtain the identification result corresponding to at least one of the undirected subgraphs.

[0062] Thirdly, embodiments of this application provide a device for determining abnormal transaction events, including: a memory and a processor;

[0063] The memory stores computer-executed instructions;

[0064] The processor executes computer execution instructions stored in the memory, causing the processor to perform the first aspect and / or various possible implementations of the first aspect as described above.

[0065] Fourthly, embodiments of this application provide a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the first aspect and / or various possible implementations of the first aspect.

[0066] Fifthly, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, implements the first aspect and / or various possible implementations of the first aspect.

[0067] The method, apparatus, device, medium, and product for determining abnormal transaction events provided in this application, after acquiring a transaction to be identified, first constructs an undirected graph corresponding to the transaction, then performs subgraph extraction processing on the undirected graph to obtain at least one undirected subgraph, and makes each undirected subgraph indicate a single independent transaction event; subsequently, performs anomaly identification processing on each of the at least one undirected subgraph to obtain the identification result corresponding to each undirected subgraph; when the identification result of any undirected subgraph is an abnormal transaction, the abnormal transaction event corresponding to that undirected subgraph is output. This method, by decomposing transaction information into independent subgraph units for anomaly identification, avoids the drawbacks of existing solutions that rely on trigger words, are prone to process interruption, and are difficult to distinguish between multiple mixed transactions. It not only ensures the continuous operation of the identification process, but also accurately distinguishes single transaction events, improving the comprehensiveness and accuracy of abnormal transaction identification in financial scenarios. Attached Figure Description

[0068] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0069] Figure 1 A flowchart illustrating the method for determining abnormal transaction events provided in this application. Figure 1 ;

[0070] Figure 2 A flowchart illustrating the method for determining abnormal transaction events provided in this application. Figure 2 ;

[0071] Figure 3 A schematic diagram of the undirected graph structure for the method of determining abnormal transaction events in this application. Figure 1 ;

[0072] Figure 4 A schematic diagram of the undirected graph structure for the method of determining abnormal transaction events in this application. Figure 2 ;

[0073] Figure 5 A schematic diagram of the structure of the device for determining abnormal transaction events provided in this application;

[0074] Figure 6 A schematic diagram of the device for determining abnormal transaction events provided in this application.

[0075] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0076] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application.

[0077] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of the relevant data all comply with the relevant laws, regulations, and standards of the relevant countries and regions, have taken necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation access points for users to choose to authorize or refuse.

[0078] Furthermore, the technical solution involved in this application, which involves big data analysis of user information (including but not limited to personal biometrics, identity data, consumption data, asset data, electronic terminal operation data, etc.) and the use of artificial intelligence technology for automated decision-making, and makes decisions that have a significant impact on personal rights based on the results of automated decision-making, provides users with corresponding operation entry points for users to choose to agree to or reject the results of automated decision-making; if the user chooses to reject, the process will proceed to the expert decision-making process.

[0079] It should be noted that the methods, apparatus, equipment, media and products for determining abnormal transaction events provided in this application can be used in the fields of artificial intelligence or fintech, or in any field other than artificial intelligence or fintech. The application fields of the methods, apparatus, equipment, media and products for determining abnormal transaction events in this application are not limited.

[0080] With the increase in electronic transactions and digital records, financial institutions face growing risks of fraud and money laundering. Traditional monitoring methods mainly rely on two models: one is a rule-driven system, which screens financial transactions through preset transaction rules; the other is manual review, where operators manually verify financial transactions based on regulatory standards and business experience.

[0081] Both of these methods rely on event extraction to gather key information about financial transactions, providing a structured basis for anomaly monitoring. The existing event extraction process mainly includes four steps: trigger word detection, event type identification, argument detection, and argument role identification.

[0082] However, because the existing event extraction process adopts a step-by-step execution mode, trigger word identification needs to be completed first. If the trigger word cannot be identified from the financial transaction text, the entire event extraction chain will be directly interrupted, resulting in the inability to identify abnormal transaction events.

[0083] The method for determining abnormal transaction events provided in this application, after obtaining the transaction to be identified, first constructs an undirected graph that matches it, then extracts multiple undirected subgraphs from the undirected graph, and subsequently performs anomaly identification on each undirected subgraph to obtain the corresponding result. When the identification result of any undirected subgraph is an abnormal transaction, the abnormal transaction event corresponding to that undirected subgraph is output. This method replaces the traditional event extraction process with a graph structure decomposition and identification approach, solving the problems of existing technologies where event extraction is performed in steps, relies excessively on trigger word identification, and the process is interrupted if the trigger word cannot be identified, thus failing to identify abnormal transaction behavior. This method eliminates the dependence on trigger words and improves the comprehensiveness and accuracy of abnormal transaction identification in financial scenarios.

[0084] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will be described below with reference to the accompanying drawings.

[0085] Figure 1 A flowchart illustrating the method for determining abnormal transaction events provided in this application. Figure 1 The implementing entity of this application may be, for example, a business system, such as... Figure 1 As shown, the method includes:

[0086] S101, Obtain the transaction to be identified.

[0087] The process of acquiring transactions to be identified involves obtaining transaction data for determining abnormal transaction behavior. This data is then used to map transaction-related elements into a graph structure and to segment independent transaction events. Transactions to be identified can be single transaction records, or text descriptions associated with a specific transaction, business notes, customer communication content, contract fragments, audit records, investigation materials, or transaction information aggregated from multiple data sources.

[0088] This step can be achieved by acquiring data from a business terminal associated with the business system, such as when a user initiates a transaction through a terminal device, the transaction data can be collected as a transaction to be identified; alternatively, when a user conducts business at a corresponding institution, the institution's staff can enter the transaction information to form a transaction to be identified. This application does not impose any special restrictions on this.

[0089] S102. Construct an undirected graph corresponding to the transactions to be identified.

[0090] Among them, the undirected graph is used to represent the relationship between arguments corresponding to the transaction to be identified, and to provide a graph structure basis for subsequent subgraph extraction and anomaly identification. Its specific implementation is to first construct a graph structure based on the transaction to be identified, and then map the identifiable arguments in the transaction and their interrelationships into nodes and connections in the graph, thereby supporting the division of a single independent transaction event.

[0091] Understandably, after obtaining the transaction to be identified, arguments that can characterize the transaction behavior can be extracted. These arguments can include at least the exchange subject, exchange object, identity identifier, exchange value, time, location, channel, behavioral descriptive terms, voucher number, and usage description, and are mapped to nodes in an undirected graph. Simultaneously, edges are established based on the co-occurrence relationships, semantic dependencies, field associations, temporal adjacency relationships, or associations defined by business rules between arguments in the original data.

[0092] S103. Perform subgraph extraction processing on the undirected graph to obtain at least one undirected subgraph, which is used to indicate a single independent transaction event.

[0093] Among them, the undirected subgraph is used to indicate a single independent transaction event and serves as the basic object for anomaly identification processing. Its specific implementation is to perform subgraph extraction processing on the undirected graph to obtain at least one substructure in which each node is adjacent to the next. Each such substructure corresponds to an independent transaction event, and then anomaly identification is performed on it.

[0094] Understandably, after obtaining an undirected graph, connectivity analysis, cluster partitioning, bridging edge identification, or constraint-based graph search can be performed on the set of nodes and edges in the undirected graph to separate multiple local substructures that can each represent a single independent transaction event from the overall graph structure.

[0095] When extracting subgraphs, a preliminary division can be made according to connected components. Then, the preliminary results can be corrected by combining conditions such as time consistency, amount specificity, account ownership relationship, adjacency of behavior trigger words, and text segment boundaries. For cases with shared subjects, shared time, or shared behavior words, event boundaries can be adjusted by edge weight pruning, conflict node duplication, relationship strength comparison, or secondary clustering based on context windows. This avoids erroneously merging multiple independent transaction events and also avoids erroneously splitting a complete transaction event.

[0096] In this step, the transaction to be identified can be text containing information about a single transaction or text containing information about multiple transactions. When the transaction to be identified contains information about multiple transactions, the constructed undirected graph will contain nodes belonging to different transactions. In this case, subgraph extraction processing can be used to extract an undirected subgraph corresponding to each independent transaction. When the transaction to be identified contains only information about a single transaction, all nodes in the constructed undirected graph belong to the same transaction, and subgraph extraction processing directly yields the undirected subgraph corresponding to that transaction. The method of this application is applicable to both scenarios.

[0097] S104. Perform anomaly detection processing on at least one undirected subgraph to obtain the detection result corresponding to at least one undirected subgraph.

[0098] The purpose of this step is to determine transaction anomalies for each individual transaction event indicated by each undirected subgraph.

[0099] Understandably, structural features, entity features, relational features, and contextual features can be extracted from each undirected subgraph, and recognition results can be output based on preset abnormal behavior rules, statistical models, machine learning models, or a combination of these methods. Structural features may include the number of nodes, node type distribution, edge density, centrality of key nodes, and relational patterns; entity features may include subject category, account attributes, resource exchange value range, and geographical region; relational features may include the degree of account association between subjects and objects, the coupling relationship between time and resource exchange values, and the combination patterns between multiple behavioral nodes; contextual features may include risk words in the original text, review comments, historical similar transaction tags, and account historical behavior statistics, etc. The recognition result can be a binary result, such as "transaction abnormal" or "transaction normal," or a composite result containing risk score, hit rule number, abnormal type label, and explanatory information.

[0100] In one possible embodiment, anomaly detection processing employs a rule engine. Nodes and edges in the undirected subgraph are converted into rule-recognizable event elements, such as the exchange subject, exchange object, transaction value, transaction path, occurrence time, and purpose description, and compared with preset anomaly patterns. Anomaly patterns may include multiple split transfers within a short period, resource exchange with accounts in high-risk regions, resource exchange values ​​significantly deviating from the customer's historical profile, purpose descriptions not matching account types, and multiple accounts transferring funds out after being aggregated through the same intermediary account. When the undirected subgraph satisfies any of these anomaly patterns, the detection result is recorded as a transaction anomaly.

[0101] In one possible embodiment, the anomaly identification process employs a model inference approach, whereby the undirected subgraph is encoded into a vector representation and input into a classification model. The classification model outputs a probability value indicating that the undirected subgraph belongs to an abnormal transaction. When the probability value reaches a preset threshold, an anomaly identification result is generated.

[0102] S105. If the identification result of any undirected subgraph indicates an anomaly, output the abnormal transaction event corresponding to the undirected subgraph.

[0103] This step means that as long as the identification result of at least one undirected subgraph indicates that its corresponding single independent transaction event is abnormal, it can be determined that the undirected subgraph is abnormal.

[0104] Understandably, after identifying each undirected subgraph, the identification results are traversed, aggregated, and their states are judged. When any identification result is detected as a transaction anomaly, the key nodes, key edges, anomaly type, risk score, and original data location information of the abnormal subgraph are stored simultaneously. Based on the stored information, the abnormal transaction event corresponding to the subgraph is output.

[0105] If multiple undirected subgraphs are all identified as transaction anomalies, the abnormal transaction events corresponding to each abnormal undirected subgraph are output one by one. If the identification result is not a transaction anomaly, the subgraph and its identification record can be retained as an audit sample, or the current processing flow can be terminated when the low-risk archiving conditions are met.

[0106] The method for determining abnormal transaction events provided in this application first obtains the transaction to be identified, constructs an undirected graph based on the transaction, and then performs a subgraph extraction operation on the undirected graph to obtain several undirected subgraphs. Subsequently, anomaly identification is performed on each undirected subgraph, and the corresponding transaction is determined as abnormal based on the identification results. The method then outputs the abnormal transaction events corresponding to the undirected subgraphs with anomalies. This method solves the problem of existing technologies' difficulty in accurately identifying abnormal financial transactions by transforming transaction content into a graphical structure, splitting it into independent transaction units, and then verifying them one by one, effectively improving the accuracy and reliability of abnormal financial transaction identification.

[0107] Figure 2 A flowchart illustrating the method for determining abnormal transaction events provided in this application. Figure 2 ,like Figure 2 As shown, in this embodiment... Figure 1 Based on the embodiments, the method for determining abnormal transaction events is described in detail. The method includes:

[0108] S201, Obtain the transaction to be identified.

[0109] The explanation of step S201 is similar to that of step S101 above, and will not be repeated here.

[0110] S202. Determine the candidate argument set corresponding to the transaction to be identified. The candidate argument set includes at least one candidate argument.

[0111] The candidate argument set is used to carry multiple possible arguments related to the transaction to be identified. Candidate arguments are used to represent text fragments in the text of the transaction to be identified.

[0112] Understandably, after obtaining the transaction to be identified, text conversion and character splitting can be performed on the transaction, and candidate arguments can be extracted by combining word segmentation results, punctuation boundaries and semantic segmentation boundaries, and at least one candidate argument can be summarized to form a candidate argument set.

[0113] Optionally, this application provides a possible implementation method, including: performing text conversion processing on the transaction to be identified to obtain transaction text; performing character splitting processing on the transaction text to obtain a sequence of word segmentation units; traversing the sequence of word segmentation units to extract multiple continuous text segments; and summarizing the continuous text segments to obtain a set of candidate arguments.

[0114] The transaction text is used to receive and identify the textual representation of the transaction, so as to convert the original transaction content into a character sequence that can be parsed.

[0115] The word segmentation unit sequence is the serialized result of the transaction text after character splitting. It can retain information such as the subject name, numerical expression, time expression, account identifier and action verb in the transaction description.

[0116] Continuous text segments are text segments extracted from the sequence of word segmentation units according to their adjacency relationship, and their length can be configured according to the complexity of the transaction text.

[0117] Understandably, the structured fields, remarks, notes, or related text in the transactions to be identified are first converted into transaction text, and the punctuation, spaces, special symbols, and mixed-encoded content are standardized to reduce the differences in expression between texts from different sources.

[0118] The transaction text is then split into characters, forming a sequence of word segments arranged in the original order. Each word segment can be a single character, a continuous character fragment, or a character block of a preset length. When traversing this sequence, multiple continuous text fragments are extracted using a sliding window approach. Fragments can be truncated and retained by combining fragment length thresholds, pause marks, semantic boundary markers, or the adjacency relationship between the amount and the main text.

[0119] By processing transaction text into a sequence of word segments, then into continuous text fragments, and finally summarizing them into a candidate argument set, the potential arguments in the transaction description can be fully preserved at a finer granularity, reducing omissions caused by directly extracting whole sentence information. Since the candidate argument set covers multiple local semantic fragments in the transaction text, subsequent identification of target arguments and construction of undirected graphs can more accurately match transaction participants and their relationships, thereby improving the accuracy of identifying individual transaction events.

[0120] For example, suppose the transaction text is that A completes a resource exchange of 500,000 yuan each with B and C. Based on the above information, we can first determine the word segmentation unit sequence as {A, separate, with, B, C, each, complete, 50,000, yuan, resources, exchange}. Then, we traverse this word segmentation unit sequence to extract consecutive adjacent segments, resulting in 15 single-character segments, 14 two-character adjacent segments, 13 three-character adjacent segments, and so on down to 1 complete text segment of 15 characters. Finally, we summarize the total number of segments to 120.

[0121] Optionally, the number of candidate arguments for the transaction to be identified can be determined using the following expression, including:

[0122]

[0123] Where S represents the number of candidate arguments; Indicates the number of characters in the transaction to be identified.

[0124] For example, assuming the transaction to be identified consists of 15 words, then the number of candidate arguments can be determined to be 120.

[0125] S203. Determine the target argument of the transaction to be identified from at least one candidate argument.

[0126] The purpose of this step is to filter out target arguments belonging to different roles from candidate text fragments of the transaction to be identified, with each role corresponding to different key elements in the transaction.

[0127] Understandably, the candidate argument set contains irrelevant fields, redundant text, invalid word segments, and other non-key transaction content. If all candidate arguments are used directly to construct an undirected graph, it will introduce a large number of invalid nodes, resulting in a messy undirected graph structure and mixed and disordered elements of multiple transactions. Therefore, it is necessary to filter target arguments according to the role dimension in order to provide reliable structured data for the subsequent construction of the undirected graph.

[0128] Optionally, this application provides a possible implementation method, including: for any candidate argument, inputting the candidate argument into an argument recognition model to obtain the argument score of the candidate argument; if the argument score of the candidate argument is greater than a preset score, determining the candidate argument as the target argument.

[0129] The argument recognition model outputs scores for candidate arguments under various roles. Roles can be, for example, organization names or resource exchange values. Different roles can be configured with their own preset scores; for example, a preset score for a single role can be 90 or 95 points. This application does not impose any special limitations on the specific value of the threshold.

[0130] The preset score can be, for example, 90 points or 95 points; this application does not impose any special restrictions on this.

[0131] Understandably, when any candidate argument is input into the argument recognition model, the model performs joint operations by combining the trigger information of the transaction context, the features of adjacent entities, and the location features, and independently outputs the corresponding score of the candidate argument for each type of role. When the argument score of a candidate argument for a certain type of role exceeds the preset score specific to that role, the candidate argument is determined to meet the admission criteria of that role and is identified as the target argument for that role. The same candidate argument can be identified as the target argument for multiple different roles based on the scores of different roles.

[0132] When the model outputs argument scores for various roles corresponding to multiple candidate arguments, the same judgment can be made for each candidate argument and each role to filter out the target arguments that truly participate in the expression of the transaction relationship and correspond to various roles from multiple possible fragments.

[0133] This approach frees the determination of target arguments from strong reliance on manually generated rules and improves the accuracy of identifying the subjects, amounts, and behavioral relationships of different roles in complex transaction texts. Furthermore, it effectively reduces the probability of irrelevant text fragments being mistakenly included in the event structure and minimizes misidentification in scenarios with multiple intertwined events, thereby enhancing the completeness and consistency of transaction event analysis.

[0134] Optionally, this application provides a possible implementation method for any candidate argument, which involves inputting the candidate argument into an argument recognition model to obtain the argument score of the candidate argument, including:

[0135] The first step is to determine the candidate argument sequence vector for any given candidate argument.

[0136] The purpose of this step is to split all the individual characters in the candidate argument text, encode each character individually, and then concatenate the character vectors of all the characters to form a complete candidate argument sequence vector, providing basic data for subsequent feature transformation.

[0137] The second step is to perform linear mapping on the candidate argument sequence vector to obtain the starting feature sequence and ending feature sequence of the candidate arguments.

[0138] The purpose of this step is to split two independent feature sequences from the original sequence vector based on linear transformation. The starting feature sequence contains feature vectors of each character as the starting position of the entity segment, and the ending feature sequence contains feature vectors of each character as the ending position of the entity segment, thereby quantifying the degree of fit of each character as the beginning and end of the entity.

[0139] In this step, for example, the original sequence vector can be uniformly linearly scaled according to a pre-set linear coefficient to obtain the corresponding starting feature sequence and ending feature sequence.

[0140] The third step is to determine the score of the candidate arguments based on their initial and final feature sequences.

[0141] In this step, for example, the following formula can be used to determine it, including:

[0142]

[0143] in, Used to represent a text segment consisting of the i-th to j-th characters in a candidate argument, belonging to The score of the role argument; The starting character number of the segment. The segment termination character index and satisfying ; Indicates the role of a candidate argument; The starting feature vector represents the i-th character as the starting position of the α-class entity segment; The j-th character is used as the endpoint feature vector of the termination position of the α-class entity segment; The transpose of the starting vector is used to perform the inner product operation by multiplying the row vector and the column vector, and finally outputs the segment matching score.

[0144] S204. Construct an undirected graph based on the target arguments of the transactions to be identified.

[0145] Understandably, by using the selected target arguments as nodes of an undirected graph, and constructing undirected edges between nodes with business associations according to the transaction business association rules, fragmented text transaction information is mapped into a complete undirected topology graph composed of nodes and edges, thus completing the transformation from text information to graph structured data.

[0146] By first forming a candidate argument set, then selecting target arguments and constructing an undirected graph based on this, the effective arguments in the transaction to be identified can be expressed in a structured way, avoiding interference from irrelevant fragments in determining transaction relationships. The undirected graph can preserve the bidirectional correlation information between target arguments, providing a foundation for subsequent extraction of subgraphs and identification of individual transaction events, thereby improving the accuracy of event boundary delineation under complex transaction descriptions.

[0147] Optionally, this application provides a possible implementation method, including: inputting the transaction to be identified and the target arguments corresponding to the transaction to be identified into a graph construction model to obtain an undirected graph output by the graph construction model.

[0148] The graph construction model is used to jointly encode the textual semantics, entity associations, and argument relationships in the transaction to be identified. It maps the related arguments in the same transaction to nodes in the graph or the semantic units corresponding to the nodes. Then, it generates undirected connections between nodes based on semantic relevance, co-occurrence relationships, and dependency associations, thereby forming a structured graph representation.

[0149] Understandably, after constructing a model from the input graph of the transaction to be identified and the target arguments, the model can first vectorize the input content, and then, combined with preset graph generation rules or learned edge determination parameters, determine whether a connection is established between each target argument, and output an undirected graph with stable adjacency relationships. This undirected graph can fully express the argument relationships within the transaction to be identified, providing a structural foundation for subsequently extracting individual independent transaction events from the graph.

[0150] By mapping transaction texts and their target arguments to an undirected graph, the problem of isolated and scattered argument information in traditional methods can be avoided. This allows the relationships between transaction subjects, transaction objects, amounts, and behaviors to be presented in a centralized graph structure, thereby improving the accuracy of segmenting independent transaction events. In subsequent processing, this undirected graph can more effectively distinguish between multiple transactions that are parallel, share arguments, or are intertwined, reducing misjudgments and omissions caused by mismatched relationships, and providing a clearer and more interpretable structured input for identifying abnormal transaction behavior.

[0151] For example, Figure 3 A schematic diagram of the undirected graph structure for the method of determining abnormal transaction events in this application. Figure 1 ,like Figure 3 As shown, the graph contains three nodes: A, B, and C. The three nodes are connected in pairs to form a complete graph. Nodes A and B are the main parties in the transaction, and the line connecting them represents the relationship between the two parties in the resource exchange. The line connecting nodes A and C represents the relationship of A transferring the corresponding resource to C. The line connecting nodes B and C represents the relationship of resource C transferring into node B.

[0152] S205. Perform recognition processing on the undirected graph to obtain the recognition result of the undirected graph.

[0153] The identification result is used to characterize the output conclusion after performing relation determination on the undirected graph, which comes from the verification of the adjacency relationship between nodes one by one.

[0154] The purpose of this step is to determine the relationship between the nodes within an undirected graph, thereby distinguishing whether the entire undirected graph can be directly used as a subgraph for a single transaction or needs to be further split and processed, providing a basis for subsequent extraction of the undirected subgraph corresponding to a single transaction event.

[0155] Understandably, the original undirected graph may contain all the elements of multiple mixed transactions, with nodes existing across transactions but not related to each other. Therefore, only by identifying clear node adjacency relationships can we distinguish whether the entire graph represents a complete single transaction or a mixture of multiple transactions, and then choose to directly construct the graph or split it into a temporary graph, ensuring that each subsequently extracted undirected subgraph corresponds to an independent transaction event.

[0156] S206. If the identification result indicates that any two nodes in the undirected graph are adjacent, then the undirected graph is determined to be an undirected subgraph. The undirected subgraph is used to indicate a single independent transaction event.

[0157] The purpose of this step is to directly delineate the original graph as an undirected subgraph corresponding to a single transaction when all nodes in the entire undirected graph are interconnected, thus eliminating the need for further graph splitting and reconstruction, and quickly completing the extraction of the subgraph for a single transaction event.

[0158] Understandably, if the identification results show that any two nodes in the graph are adjacent, it means that all argument elements in the graph belong to the same transaction event, and there are no scattered nodes belonging to multiple different transactions. Therefore, the undirected graph can be directly identified as an undirected subgraph. This identification process can determine the subgraph boundary at the graph structure level without relying on manual rule-based screening, thus ensuring the consistency and verifiability of the extraction results.

[0159] S207. If the identification result indicates that there are non-adjacent pairs of nodes in the undirected graph, then determine the non-adjacent pairs of nodes from the undirected graph, and determine the set of nodes of the non-adjacent pairs of nodes from the undirected graph.

[0160] Non-adjacent nodes are used to indicate nodes in an undirected graph that are not connected to each other by edges, and serve as the starting point for subsequent reconstruction processing.

[0161] A node set is used to represent a group of nodes associated with a non-adjacent node. The node group can originate from other nodes that share common arguments, common transaction elements, or common relational edges with the node.

[0162] The purpose of this step is to identify non-adjacent node pairs in an undirected graph, lock the non-adjacent node pairs, and extract the sets of associated nodes corresponding to each of the two nodes in the node pair.

[0163] Understandably, when the undirected graph identification results show that there are non-adjacent node pairs, it means that the entire undirected graph has aggregated the argument elements of multiple independent transactions. Therefore, it is necessary to first locate the two non-adjacent nodes that constitute the node pair, and then extract the node sets corresponding to the two nodes respectively based on the edge connection relationship, argument attribute similarity and entity association of the graph. Based on the grouping results, the initial splitting of multiple mixed transaction data can be achieved.

[0164] S208. Based on the set of non-adjacent node pairs, construct a temporary graph of non-adjacent node pairs.

[0165] The purpose of this step is to process the node sets corresponding to the two nodes in a non-adjacent node pair separately, generate a temporary graph for each node set, and finally generate two independent temporary graphs for a set of non-adjacent node pairs.

[0166] Understandably, for a set of non-adjacent node pairs, two independent sets of nodes can be decomposed. Based on all the argument nodes contained in each set of nodes and using the associated edge relationships between nodes in the original graph, corresponding independent temporary graphs can be built one by one. This can achieve the block decomposition of the undirected graph and ensure that the final undirected subgraph corresponds to only a single transaction event.

[0167] S209. Identify and process temporary graphs with non-adjacent node pairs until an undirected subgraph is obtained in which any two nodes are adjacent.

[0168] The purpose of this step is to iteratively identify and split the temporary graph corresponding to each node in the non-adjacent node pairs, and then parse it to obtain a compliant undirected subgraph in which all internal nodes are adjacent to each other.

[0169] Understandably, the temporary graph constructed from the set of nodes will still likely include argument nodes from multiple different transactions, and cannot be directly used as a valid subgraph for a single transaction. Only through continuous identification and splitting can nodes that are irrelevant across transactions be separated, ensuring that all argument elements in the final subgraph belong to the same transaction, thus avoiding misjudgments and omissions in subsequent abnormal identification caused by data mixing.

[0170] For example, Figure 4 A schematic diagram of the undirected graph structure for the method of determining abnormal transaction events in this application. Figure 2 ,like Figure 4 As shown, the target arguments of the graph correspond to nodes 1, 2, 3, 4, 5, 6, and 7, totaling 7 nodes. First, adjacency identification is performed on the undirected graph, which determines that there are multiple pairs of non-adjacent nodes, including (1, 5), (1, 6), (1, 7), (2, 5), (2, 6), (2, 7), (3, 5), (3, 6), and (3, 7). In this embodiment, only the node pair (1, 5) is selected as a splitting example. The associated node sets corresponding to nodes 1 and 5 are extracted respectively, and temporary graphs are constructed based on the two sets of node sets. Then, the two temporary graphs are iteratively identified and processed, and finally, an undirected subgraph in which all internal nodes are paired and adjacent is obtained.

[0171] S210. Obtain pre-built rules for abnormal behavior.

[0172] Among them, abnormal behavior rules are used to characterize the basis for judging abnormalities in financial transaction scenarios. They can be pre-constructed by risk control personnel in combination with historical suspicious transaction samples, regulatory reporting standards and business experience. The content may include abnormal amount thresholds, abnormal relationship patterns, abnormal subject combinations, abnormal time sequence correlations and abnormal semantic features.

[0173] This step can be achieved by obtaining data from local data or from a cloud server. This application does not impose any special restrictions on this.

[0174] S211. Based on the abnormal behavior rules, perform anomaly identification processing on at least one undirected subgraph to obtain the identification result corresponding to at least one undirected subgraph.

[0175] Understandably, after obtaining the pre-constructed abnormal behavior rules, anomaly identification can be performed on at least one undirected subgraph, and each undirected subgraph can be matched and judged according to the abnormal behavior rules. During the anomaly identification process, the node attributes, edge attributes, and graph structure features in the undirected subgraph can be checked item by item. When an undirected subgraph meets the corresponding abnormal condition in the rule, the identification result corresponding to that undirected subgraph is output as abnormal; when the abnormal condition is not hit, the output is normal.

[0176] By performing anomaly identification processing on at least one undirected subgraph based on abnormal behavior rules, it is no longer necessary to rely on coarse-grained judgment of the entire transaction. Instead, it can use a single undirected subgraph as the smallest identification unit for targeted verification, which can improve the accuracy and interpretability of anomaly judgment and reduce the problems of missed judgment and false judgment caused by the mixing of multiple transaction data.

[0177] In one possible implementation, the abnormal behavior rules can be extended according to the business scenario. For example, corresponding judgment conditions can be established for situations such as closed-loop transfers with the same value occurring multiple times in a short period of time for the same account, abnormal value backflow between multiple entities, and inconsistencies between transaction descriptions and account relationships.

[0178] S212. If the identification result of any undirected subgraph indicates an anomaly, output the abnormal transaction event corresponding to the undirected subgraph.

[0179] The explanation of step S212 is similar to that of step S105 above, and will not be repeated here.

[0180] This application provides a method for determining abnormal transaction events. The method involves: acquiring the transaction to be identified; determining the candidate argument set corresponding to the transaction and selecting the target argument from it; constructing an undirected graph based on the target argument; performing identification processing on the undirected graph; if all nodes in the graph are pairwise adjacent, then the undirected graph is directly used as an undirected subgraph; if there are pairs of non-adjacent nodes, then the corresponding node set is extracted and a temporary graph is constructed; the temporary graph is repeatedly identified until an undirected subgraph with pairwise adjacent nodes is obtained; subsequently, preset abnormal behavior rules are invoked to identify anomalies in each undirected subgraph; as long as any subgraph is determined to be an abnormal transaction, the abnormal transaction event corresponding to that undirected subgraph is output.

[0181] This method transforms transaction information into a graph structure and splits it into independent transaction units layer by layer for detection. It then uses a recursive identification and splitting method to extract compliant subgraphs before anomaly detection. This solves the problem that existing technologies are unable to accurately identify abnormal financial transactions, effectively distinguishes multiple mixed transactions, and significantly improves the accuracy of identifying abnormal financial transactions.

[0182] Figure 5 A schematic diagram of the structure of the device for determining abnormal transaction events provided in this application is shown below. Figure 5 As shown, the abnormal transaction event determination device 300 provided in this embodiment includes:

[0183] Module 301 is used to acquire the transaction to be identified;

[0184] Module 302 is used to construct an undirected graph corresponding to the transaction to be identified;

[0185] Processing module 303 is used to perform subgraph extraction processing on an undirected graph to obtain at least one undirected subgraph, which is used to indicate a single independent transaction event;

[0186] The processing module 303 is also used to perform anomaly recognition processing on at least one undirected subgraph to obtain the recognition result corresponding to at least one undirected subgraph;

[0187] The output module 304 is used to output the abnormal transaction event corresponding to the undirected subgraph when the identification result of any undirected subgraph indicates an abnormality.

[0188] In one possible implementation, the apparatus further includes: a determining module 305;

[0189] The determination module is used to determine the candidate argument set corresponding to the transaction to be identified. The candidate argument set includes at least one candidate argument.

[0190] The determining module 305 is further configured to determine the target argument of the transaction to be identified from at least one candidate argument;

[0191] Module 302 is specifically used to construct an undirected graph based on the target arguments of the transaction to be identified.

[0192] In one possible implementation, the processing module 303 is further configured to perform text conversion processing on the transaction to be identified to obtain transaction text;

[0193] Processing module 303 is also used to perform character splitting on the transaction text to obtain a sequence of word segments;

[0194] The device also includes: traversal module 306;

[0195] Traversal module 306 is used to traverse the sequence of word segmentation units and extract multiple consecutive text fragments;

[0196] The processing module is specifically used to summarize and process continuous text segments to obtain a set of candidate arguments.

[0197] In one possible implementation, the device further includes: an input module 307;

[0198] The input module 307 is used to input any candidate argument into the argument recognition model to obtain the argument score of the candidate argument;

[0199] The determination module 305 is specifically used to determine the candidate argument as the target argument when the argument score of the candidate argument is greater than the preset score.

[0200] In one possible implementation, the input module 307 is specifically used to input the transaction to be identified and the target arguments corresponding to the transaction into the graph construction model to obtain an undirected graph output by the graph construction model.

[0201] In one possible implementation, the processing module 303 is further configured to perform recognition processing on the undirected graph to obtain the recognition result of the undirected graph;

[0202] The determination module 305 is specifically used to determine an undirected graph as an undirected subgraph if the recognition result indicates that any two nodes in the undirected graph are adjacent.

[0203] In one possible implementation, the determining module 305, if the identification result indicates that there are non-adjacent pairs of nodes in the undirected graph, is further configured to determine non-adjacent pairs of nodes from the undirected graph and to determine the set of nodes of non-adjacent pairs of nodes from the undirected graph.

[0204] Module 302 is also used to construct a temporary graph of non-adjacent node pairs based on the set of non-adjacent node pairs.

[0205] The processing module 303 is specifically used to identify and process temporary graphs with non-adjacent node pairs until an undirected subgraph is obtained in which any two nodes are adjacent.

[0206] In one possible implementation, module 301 is also used to acquire pre-built rules for abnormal behavior;

[0207] The processing module 303 is specifically used to perform anomaly recognition processing on at least one undirected subgraph based on abnormal behavior rules, and obtain the recognition result corresponding to at least one undirected subgraph.

[0208] The device for determining abnormal transaction events provided in this embodiment can execute the method provided in the above method embodiment. Its implementation principle and technical effect are similar, and will not be described in detail here.

[0209] Figure 6 A schematic diagram of the device for determining abnormal transaction events provided in this application. Figure 6As shown, the electronic device 400 provided in this embodiment includes at least one processor 401 and a memory 402. Optionally, the device 400 further includes a communication component 403. The processor 401, memory 402, and communication component 403 are connected via a bus 404.

[0210] In a specific implementation, at least one processor 401 executes computer execution instructions stored in memory 402, causing at least one processor 401 to perform the above-described method.

[0211] The specific implementation process of processor 401 can be found in the above method embodiments, and its implementation principle and technical effect are similar. It will not be repeated here.

[0212] In the above embodiments, it should be understood that the processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this invention can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules within the processor.

[0213] The memory may include high-speed memory (Random Access Memory, RAM) and may also include non-volatile memory (NVM), such as at least one disk storage device.

[0214] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, the buses shown in the accompanying drawings are not limited to a single bus or a single type of bus.

[0215] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method.

[0216] This application also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the above-described method.

[0217] The aforementioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The readable storage medium can be any available medium accessible to a general-purpose or special-purpose computer.

[0218] An exemplary readable storage medium is coupled to a processor, enabling the processor to read information from and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can reside in an Application-Specific Integrated Circuit (ASIC). Alternatively, the processor and the readable storage medium can exist as discrete components in the device.

[0219] The division of units is merely a logical functional division; in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces, devices, or units, and may be electrical, mechanical, or other forms.

[0220] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0221] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0222] If a function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0223] Those skilled in the art will understand that all or part of the steps of the above-described method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.

[0224] Finally, it should be noted that other embodiments of the invention will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This invention is intended to cover any variations, uses, or adaptations of the invention that follow the general principles of the invention and include common knowledge or customary techniques in the art not disclosed herein, and is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope.

Claims

1. A method for determining abnormal transaction events, characterized in that, The method includes: Obtain the transaction to be identified; Construct an undirected graph corresponding to the transaction to be identified; The undirected graph is subjected to subgraph extraction processing to obtain at least one undirected subgraph, which is used to indicate a single independent transaction event; Anomaly detection processing is performed on at least one of the undirected subgraphs to obtain the detection result corresponding to at least one of the undirected subgraphs; If any of the identification results of the undirected subgraph indicates an anomaly, the abnormal transaction event corresponding to the undirected subgraph is output.

2. The method according to claim 1, characterized in that, The construction of the undirected graph corresponding to the transaction to be identified includes: Determine a set of candidate arguments corresponding to the transaction to be identified, the set of candidate arguments including at least one candidate argument; From at least one of the candidate arguments, determine the target argument of the transaction to be identified; The undirected graph is constructed based on the target arguments of the transaction to be identified.

3. The method according to claim 2, characterized in that, The determination of the candidate argument set corresponding to the transaction to be identified includes: The transaction to be identified is subjected to text conversion processing to obtain the transaction text; The transaction text is split into characters to obtain a sequence of word segments; By traversing the sequence of word segmentation units, multiple consecutive text fragments are extracted; The continuous text segments are summarized to obtain the candidate argument set.

4. The method according to claim 2, characterized in that, Determining the target argument of the transaction to be identified from at least one of the candidate arguments includes: For any candidate argument, the candidate argument is input into the argument recognition model to obtain the argument score of the candidate argument; If the argument score of the candidate argument is greater than the preset score, the candidate argument is determined as the target argument.

5. The method according to claim 2, characterized in that, The step of constructing the undirected graph based on the target arguments of the transaction to be identified includes: The transaction to be identified and the target argument corresponding to the transaction to be identified are input into the graph construction model to obtain the undirected graph output by the graph construction model.

6. The method according to claim 1, characterized in that, The subgraph extraction process of the undirected graph to obtain at least one undirected subgraph includes: The undirected graph is subjected to recognition processing to obtain the recognition result of the undirected graph; If the identification result indicates that any two nodes in the undirected graph are adjacent, then the undirected graph is determined to be the undirected subgraph.

7. The method according to claim 6, characterized in that, The method further includes: If the identification result indicates that there are non-adjacent pairs of nodes in the undirected graph, then the non-adjacent pairs of nodes are determined from the undirected graph, and the set of nodes of the non-adjacent pairs of nodes is determined from the undirected graph. Based on the set of nodes of the non-adjacent node pairs, construct a temporary graph of the non-adjacent node pairs; The temporary graph of the non-adjacent node pairs is identified and processed until an undirected subgraph in which any two nodes are adjacent is obtained.

8. The method according to claim 1, characterized in that, The step of performing anomaly detection processing on at least one of the undirected subgraphs to obtain the detection result corresponding to at least one of the undirected subgraphs includes: Obtain pre-built rules for abnormal behavior; Based on the abnormal behavior rules, at least one of the undirected subgraphs is subjected to anomaly identification processing to obtain the identification results corresponding to at least one of the undirected subgraphs.

9. A device for determining abnormal transaction events, characterized in that, include: The acquisition module is used to acquire the transactions to be identified. The construction module is used to construct an undirected graph corresponding to the transaction to be identified; The processing module is used to perform subgraph extraction processing on the undirected graph to obtain at least one undirected subgraph, which is used to indicate a single independent transaction event; The processing module is further configured to perform anomaly recognition processing on at least one of the undirected subgraphs to obtain recognition results corresponding to at least one of the undirected subgraphs; The output module is used to output the abnormal transaction event corresponding to the undirected subgraph when the identification result of any of the undirected subgraphs indicates an abnormality.

10. A device for determining abnormal transaction events, characterized in that, include: Memory, processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory, causing the processor to perform the method as described in any one of claims 1-8.

11. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1-8.

12. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the method described in any one of claims 1-8.

Images