CN115131122A

CN115131122A - Abnormal fund link identification method, device, equipment and computer program product

Info

Publication number: CN115131122A
Application number: CN202210420102.3A
Authority: CN
Inventors: 许强; 季海靖
Original assignee: CCB Finetech Co Ltd
Current assignee: CCB Finetech Co Ltd
Priority date: 2022-04-20
Filing date: 2022-04-20
Publication date: 2022-09-30

Abstract

The embodiment of the invention discloses a method, a device, equipment and a computer program product for identifying an abnormal fund link, which relate to the technical field of big data and comprise the following steps: preprocessing original fund information to obtain a basic link unit, wherein the basic link unit comprises an end-to-end fund flow direction relation; performing entity fusion and relationship alignment on the link units based on a pre-specified ontology model to obtain a fund link in a map form, wherein the fund link comprises the category and the relationship of transaction objects; and detecting and identifying the fund link to obtain an abnormal fund link. Entity fusion and relationship alignment are carried out on basic link units containing end-to-end fund flow direction relationships through a pre-designated ontology model, fund links containing the types and the relationships of transaction objects can be obtained, and the obtained fund links are more accurate and comprehensive, so that the identification accuracy of abnormal fund links is improved when the obtained fund links are subjected to abnormal identification.

Description

Abnormal fund link identification method, device, equipment and computer program product

Technical Field

The embodiment of the invention relates to the technical field of big data, in particular to an abnormal fund link identification method, device, equipment and computer program product.

Background

With the rise and popularization of technologies such as the internet, big data and the like, commercial banks usually generate a large amount of customer transaction data, and have potential transaction risks typified by fund abnormality while bringing considerable profits. Therefore, currently, the fund link of the user transaction data is usually monitored, and the fund link is queried according to the monitoring result.

However, the existing fund link is mainly searched and penetrated through a traditional database, the depth of tracking fund is limited, so that an accurate fund link cannot be acquired, account-level penetration is realized when more fund is penetrated, and the main body division is unclear, so that the acquired fund link is not comprehensive enough. Therefore, in the prior art, an accurate and comprehensive fund link cannot be acquired, and effective identification of an abnormal fund link is influenced.

Disclosure of Invention

The embodiment of the invention provides an abnormal fund link identification method, device and equipment and a computer program product, which are used for realizing effective identification of an abnormal fund link.

In a first aspect, an embodiment of the present invention provides an abnormal fund link identification method, including: preprocessing original fund information to obtain a basic link unit, wherein the basic link unit comprises an end-to-end fund flow direction relation;

performing entity fusion and relationship alignment on the link unit based on a pre-specified ontology model to obtain a fund link in a map form, wherein the fund link comprises the category and the relationship of a transaction object;

and detecting and identifying the fund link to obtain an abnormal fund link.

In a second aspect, an embodiment of the present invention provides an abnormal fund link identification apparatus, including:

the basic link unit acquisition module is used for preprocessing original fund information to acquire a basic link unit, and the basic link unit comprises an end-to-end fund flow direction relation;

the fund link acquisition module is used for performing entity fusion and relationship alignment on the link units based on a pre-specified ontology model and acquiring a fund link in a map form, wherein the fund link comprises the category and the relationship of a transaction object;

and the abnormal fund link identification module is used for detecting and identifying the fund link to obtain the abnormal fund link.

In a third aspect, an embodiment of the present invention provides an electronic device, where the electronic device includes:

one or more processors;

a storage device to store one or more programs,

when executed by one or more processors, cause the one or more processors to implement the method as described above.

In a fourth aspect, an embodiment of the present invention provides a computer program product, which includes a computer program that, when executed by a processor, implements the method described above.

According to the technical scheme of the embodiment of the invention, entity fusion and relationship alignment are carried out on the basic link units containing the end-to-end fund flow direction relationship through the pre-specified ontology model, the fund links containing the types and the relationships of transaction objects can be obtained, and the obtained fund links are more accurate and comprehensive, so that the identification accuracy of the abnormal fund links is improved when the obtained fund links are subjected to abnormal identification.

Drawings

In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings that are required to be used in the embodiments will be briefly described below, it should be understood that the following drawings only illustrate some embodiments of the present invention and therefore should not be considered as limiting the scope, and for those skilled in the art, other related drawings can be obtained according to the drawings without creative efforts.

FIG. 1 is a flow chart of a method for identifying an abnormal fund link according to an embodiment of the present invention;

FIG. 2 is a flow chart of a method for identifying an abnormal fund link according to an embodiment of the present invention;

FIG. 3 is a flow chart of a method for identifying an abnormal fund link according to a second embodiment of the present invention;

fig. 4 is a schematic structural diagram of an abnormal fund link identification device according to a third embodiment of the present invention;

fig. 5 is a schematic structural diagram of an electronic device according to a fourth embodiment of the present invention.

Detailed Description

The present invention will be described in further detail with reference to the accompanying drawings and examples. It is to be understood that the specific embodiments described herein are merely illustrative of the invention and are not limiting of the invention.

It should be further noted that, for the convenience of description, only some but not all of the relevant aspects of the present invention are shown in the drawings. Before discussing exemplary embodiments in greater detail, it should be noted that some exemplary embodiments are described as processes or methods depicted as flowcharts. Although a flowchart may describe the operations (or steps) as a sequential process, many of the operations can be performed in parallel, concurrently, or simultaneously. In addition, the order of the operations may be re-arranged. The process may be terminated when its operations are completed, but may have additional steps not included in the figure. The processes may correspond to methods, software implementations, hardware implementations, and so on. In the technical scheme of the application, the data acquisition, storage, use, processing and the like all accord with relevant regulations of national laws and regulations.

Example one

Fig. 1 is a flowchart of an abnormal fund link identification method provided in an embodiment of the present invention, which may be executed by an abnormal fund link identification apparatus in an embodiment of the present invention, and the apparatus may be implemented in software and/or hardware. As shown in fig. 1, the method specifically includes the following operations:

step S101, the original fund information is preprocessed to obtain a basic link unit.

Optionally, the link unit is obtained by preprocessing the original fund information, and includes: storing original fund information into a graph database to obtain an initial link unit; and checking the initial link unit according to a specified standard to obtain a basic link unit, wherein the specified standard comprises: business logic criteria and field criteria.

Specifically, the original fund information in this embodiment may specifically be detail data acquired by a bank monitoring department from a bank, and specifically may include transaction data, customer information, credit information, transfer flow information, transfer transaction data, and the like. After the original fund information of the bank is acquired, the original fund information is also imported into a large data storage part for storage, so that subsequent data processing, penetration calculation of a fund link and other related operations are facilitated.

When a user instruction is received and abnormal fund link identification is required, original fund information is extracted from the storage part and stored in the graph database to obtain an initial link unit, the graph database in the embodiment is a non-relational database used for storing relationship information between entities, so that the initial link unit containing an end-to-end fund flow relationship can be obtained by storing the original fund information in the graph database in the embodiment, for example, fund a flows between an entity A and an entity B.

Optionally, the checking the initial link unit according to a specified standard to obtain the basic link unit includes: judging whether the initial link unit meets the service logic standard, if so, judging whether the initial link unit meets the field standard, if so, taking the initial link unit as a basic link unit, otherwise, deleting the initial link unit; otherwise, deleting the initial link unit.

It should be noted that after the initial link unit is obtained through the graph database, the initial link unit needs to be checked according to a specified standard, and the specified etalon body may include a service logic standard and a field standard. For example, if a transfer-out is specified in the service logic standard, there must be a corresponding transfer-out, if a fund w flows from entity a to entity B, then for entity a of the transfer-out party, entity a has a fund w to transfer-out to entity B, there must be paired information, and for entity B of the transfer-in party, entity B has a fund w to transfer-in from entity a, therefore, if a fund in the initial link unit only contains the transfer-out information or only contains the transfer-in information, it is determined that the initial link unit is invalid, and the initial link unit is deleted; if the initial link unit contains both the transfer-out information and the transfer-in information about a fund, the initial link unit is determined to be valid, and the verification is continued according to the field standard. For example, the specific format of the account field is preset, and when it is determined that the format of the fund account involved in the initial link unit does not conform to the preset format, it is determined that the initial link unit is invalid, so that the initial link unit which fails to be verified is deleted, the initial link unit which passes through verification is reserved, and the reserved initial link unit is used as a basic link unit. Of course, the present embodiment is only an example, and does not limit the specific type of the specification standard in performing the verification, and all that is required is within the scope of the present application as long as the required basic link unit can be obtained, and the present embodiment does not limit the same.

And step S102, carrying out entity fusion and relationship alignment on the basic link unit based on a pre-specified ontology model, and acquiring a fund link in a map form.

Optionally, the entity fusion and the relationship alignment are performed on the basic link unit based on a pre-specified ontology model, and the obtaining of the fund link in the graph form includes: determining a type of a transaction entity in the primary link unit; reserving a basic link unit belonging to a specified type based on a pre-specified ontology model; and determining the relationship of transaction entities in the reserved basic link units, connecting the reserved basic link units according to the relationship, and acquiring the fund link in the form of the map.

Specifically, in this embodiment, the types of the transaction entities in the basic link unit are divided, for example, the types of the transaction entities may be banks, public enterprises, private enterprises, and individuals, and the embodiment is not limited to specific types of transactions. The ontology model is an important component of the indication map, is a logic model, and can convert the structural indication into a formalized relational tuple, so that the ontology model has certain directivity. In this embodiment, an ontology model may be pre-specified, and the ontology model is pre-set to enable funds to flow from an enterprise to an individual and enable the individual to flow to the individual, so that the basic link units determined by the transaction entity types may be screened through the ontology model, and the basic link units that the individual flows to the enterprise may be deleted. And also determines the relationship of the transaction entities in the reserved basic link units for relationship alignment, wherein the relationship specifically comprises transfer, stock occupation and the like. And connecting the reserved basic link units according to the relationship to acquire a fund link in a map form, wherein the acquired fund link comprises the category and the relationship of the transaction object. For example, a link of funds is obtained that includes funds from business a to person B, person B to person C, and person C to person D, with business a and person B having a stock relationship, person B and person C having a transfer relationship, and person C and person D having a transfer relationship.

In the embodiment, the basic link unit with directivity can be acquired through the ontology model, so that the basic link unit is screened, the abnormal fund link is detected and identified according to the directivity required by the ontology model, and the fund link does not contain the category of the transaction object and also comprises the relationship, so that the acquired fund link is more accurate, and the accuracy of identifying the abnormal fund link can be improved.

Step S103, detecting and identifying the fund link to obtain an abnormal fund link.

As shown in fig. 2, specifically describing step S103 includes:

and step S1031, screening out the appointed fund links containing the same transaction objects from the fund links.

Specifically, in practical applications, for example, in a scenario of credit issuance of a bank, a multi-entity service intersection is usually involved, and in such a scenario, the probability that an abnormal fund link exists is usually high, so in the embodiment, when detecting and identifying the fund link, the converged link is first determined, and then the converged link is detected and identified. Therefore, in this embodiment, the designated fund link containing the same transaction object is screened from the fund links. For example, funding link a is the flow of funds from business a to person B, which in turn flows to person C; fund link b is the flow of funds from enterprise a to individual C, and individual C to individual D; fund link c flows for person M to person N and person N to person P. It may be determined that the fund link a and the fund link b include the same transaction object C, and at this time, the fund link a and the fund link b are used as the designated fund link.

Step S1032, the appointed fund links are converged to obtain a converged link.

After the appointed fund links containing the same transaction objects are obtained, the appointed fund links are converged according to the same transaction objects, namely the same transaction objects are used as convergence points, and at least two appointed fund links are connected and converged, so that a convergence link is formed.

It should be noted that, in this embodiment, multiple aggregation links may be obtained according to a specified fund link, and aggregation points corresponding to each aggregation link are different, and the specific number of aggregation links is not limited in this embodiment.

Step S1033, detecting and identifying the aggregation link to obtain an abnormal fund link.

Optionally, detecting and identifying the aggregation link to obtain an abnormal fund link includes: carrying out similarity calculation on the aggregation links, and acquiring the appointed aggregation links belonging to the same graph structure according to the similarity calculation result; and when the graph structure is determined to be the pre-specified abnormal graph structure, the fund link forming the specified aggregation link is taken as the abnormal fund link.

Example two

Fig. 3 is a flowchart of an abnormal fund link identification method provided in the embodiment of the present invention, where the embodiment specifically describes the step S1033 based on the foregoing embodiment, and the method specifically includes the following steps:

step S201, similarity calculation is carried out on the aggregation links, and the appointed aggregation links belonging to the same graph structure are obtained according to the similarity calculation result.

Optionally, the performing similarity calculation on the aggregation links, and obtaining the designated aggregation links belonging to the same graph structure according to the similarity calculation result includes: calculating the similarity between each aggregation link, and acquiring a similarity sequence corresponding to each aggregation link, wherein the similarity sequence comprises the similarity between each aggregation link except the aggregation link; comparing the similarity in the similarity sequence with a preset threshold value, and taking the aggregation link corresponding to the similarity greater than the preset threshold value as an appointed aggregation link; the designated aggregated link is attributed to the same graph structure.

In a specific implementation, when detecting and identifying the aggregation links, specifically, similarity calculation is performed on each aggregation link, for example, there are three aggregation links of x, y, and z, similarity between each aggregation link is calculated respectively, and a similarity sequence corresponding to each aggregation link is obtained, where the similarity sequence includes similarities with each aggregation link except for the aggregation link itself, and as shown in table 1 below, an example of a similarity sequence 1 corresponding to an aggregation link x is:

TABLE 1

Convergence link	Degree of similarity
		xy	0.6
xz	0.3

The following table 2 is an example of a similarity sequence 2 corresponding to the aggregation link y:

TABLE 2

Convergence link	Degree of similarity
		yx	0.6
yz	0.2

Table 3 below is an example of a similarity sequence 3 corresponding to the aggregation link z:

TABLE 3

Convergence link	Degree of similarity
		zx	0.3
zy	0.2

It should be noted that, in this embodiment, the preset threshold may be 0.5, and the aggregation link corresponding to the similarity greater than the preset threshold is used as the designated aggregation link, which can be obtained according to table 1, table 2, and table 3, where the similarity between the aggregation link x and the aggregation link z exceeds the preset threshold, so that the aggregation link x and the aggregation link z can be used as the designated aggregation link, and the designated aggregation link belongs to the same graph structure f.

Step S202, when the graph structure is determined to be the pre-designated abnormal graph structure, the fund link forming the designated aggregation link is taken as the abnormal fund link.

Specifically, in this embodiment, a graph structure is preset for a scenario in which the fund flow is abnormal, for example, an abnormal fund transaction in which credit fund flows to real estate mainly occurs in the graph structure f, so that the aggregation link x and the aggregation link z belonging to the graph structure f can be used as abnormal aggregation links, and the fund links constituting the aggregation link x and the aggregation link z can be used as abnormal fund links, respectively.

According to the technical scheme, entity fusion and relation alignment are carried out on the basic link units containing the end-to-end fund flow direction relation through the pre-specified ontology model, the fund links containing the types and the relations of transaction objects can be obtained, and the obtained fund links are more accurate and comprehensive, so that when abnormal recognition is carried out on the obtained fund links, the recognition accuracy of the abnormal fund links is improved.

EXAMPLE III

Fig. 4 is a schematic structural diagram of an abnormal fund link identification apparatus according to an embodiment of the present invention, where the apparatus includes: a basic link unit acquisition module 310, a fund link acquisition module 320, and an abnormal fund link identification module 330.

The basic link unit obtaining module 310 is configured to pre-process original fund information to obtain a basic link unit, where the basic link unit includes an end-to-end fund flow relationship;

a fund link acquisition module 320, configured to perform entity fusion and relationship alignment on link units based on a pre-specified ontology model, and acquire a fund link in a map form, where the fund link includes a category and a relationship of a transaction object;

and the abnormal fund link identification module 330 is configured to detect and identify the fund link to obtain an abnormal fund link.

Optionally, the basic link unit obtaining module is configured to store the original fund information in the graph database to obtain an initial link unit;

and checking the initial link unit according to a specified standard to obtain a basic link unit, wherein the specified standard comprises: business logic criteria and field criteria.

Optionally, the basic link unit obtaining module is specifically configured to determine whether the initial link unit meets an service logic standard, if yes, determine whether the initial link unit meets a field standard, if yes, use the initial link unit as the basic link unit, and if not, delete the initial link unit;

otherwise, deleting the initial link unit.

Optionally, the fund link acquiring module is configured to determine a type of a transaction entity in the basic link unit;

reserving basic link units belonging to a specified category based on a pre-specified ontology model;

and determining the relationship of transaction entities in the reserved basic link units, connecting the reserved basic link units according to the relationship, and acquiring the fund link in the form of the map.

Optionally, the abnormal fund link identification module is configured to screen out an appointed fund link including the same transaction object from the fund link;

converging the appointed fund links to obtain a converged link;

and detecting and identifying the converged link to obtain an abnormal fund link.

Optionally, the abnormal fund link identification module is specifically configured to perform similarity calculation on the aggregation links, and obtain an assigned aggregation link belonging to the same graph structure according to a similarity calculation result;

and when the graph structure is determined to be the pre-specified abnormal graph structure, the fund link forming the specified aggregation link is taken as the abnormal fund link.

Optionally, the abnormal fund link identification module is specifically configured to calculate a similarity between each aggregation link, and obtain a similarity sequence corresponding to each aggregation link, where the similarity sequence includes similarities with each aggregation link except for the similarity sequence itself;

comparing the similarity in the similarity sequence with a preset threshold value, and taking the aggregation link corresponding to the similarity greater than the preset threshold value as an appointed aggregation link;

the designated aggregated link is attributed to the same graph structure.

The device can execute the abnormal fund link identification method provided by any embodiment of the invention, and has corresponding functional modules and beneficial effects of the execution method. For technical details that are not described in detail in this embodiment, reference may be made to the method provided in any embodiment of the present invention.

Example four

Fig. 5 is a schematic structural diagram of an electronic device according to an embodiment of the present invention. FIG. 5 illustrates a block diagram of an exemplary electronic device 412 suitable for use in implementing embodiments of the present invention. The electronic device 412 shown in fig. 5 is only an example and should not bring any limitations to the functionality and scope of use of the embodiments of the present invention.

As shown in fig. 5, the electronic device 412 is in the form of a general purpose computing device. The components of the electronic device 412 may include, but are not limited to: one or more processors 416, a memory 428, and a bus 418 that couples the various system components (including the memory 428 and the processors 416).

Bus 418 represents one or more of any of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, and a processor or local bus using any of a variety of bus architectures. By way of example, such architectures include, but are not limited to, Industry Standard Architecture (ISA) bus, micro-channel architecture (MAC) bus, enhanced ISA bus, Video Electronics Standards Association (VESA) local bus, and Peripheral Component Interconnect (PCI) bus.

Electronic device 412 typically includes a variety of computer system readable media. Such media may be any available media that is accessible by electronic device 412 and includes both volatile and nonvolatile media, removable and non-removable media.

The memory 428 is used to store instructions. Memory 428 can include computer-system readable media in the form of volatile memory, such as Random Access Memory (RAM)430 and/or cache memory 432. The electronic device 412 may further include other removable/non-removable, volatile/nonvolatile computer system storage media. By way of example only, storage system 434 may be used to read from and write to non-removable, non-volatile magnetic media (not shown in FIG. 5, and commonly referred to as a "hard drive"). Although not shown in FIG. 5, a magnetic disk drive for reading from and writing to a removable, nonvolatile magnetic disk (e.g., a "floppy disk") and an optical disk drive for reading from or writing to a removable, nonvolatile optical disk (e.g., a CD-ROM, DVD-ROM, or other optical media) may be provided. In these cases, each drive may be connected to bus 418 by one or more data media interfaces. Memory 428 may include at least one program product having a set (e.g., at least one) of program modules that are configured to carry out the functions of embodiments of the invention.

A program/utility 440 having a set (at least one) of program modules 442 may be stored, for instance, in memory 428, such program modules 442 including, but not limited to, an operating system, one or more application programs, other program modules, and program data, each of which examples or some combination may include an implementation of a network environment. The program modules 442 generally perform the functions and/or methodologies of the described embodiments of the invention.

The electronic device 412 may also communicate with one or more external devices 414 (e.g., keyboard, pointing device, display 424, etc.), with one or more devices that enable a user to interact with the electronic device 412, and/or with any devices (e.g., network card, modem, etc.) that enable the electronic device 412 to communicate with one or more other computing devices. Such communication may occur via input/output (I/O) interfaces 422. Also, the electronic device 412 may communicate with one or more networks (e.g., a Local Area Network (LAN), a Wide Area Network (WAN), and/or a public network, such as the internet) through the network adapter 420. As shown, network adapter 420 communicates with the other modules of electronic device 412 over bus 418. It should be appreciated that although not shown in FIG. 5, other hardware and/or software modules may be used in conjunction with the electronic device 412, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, among others.

The processor 416, by executing instructions stored in the memory 428, performs various functional applications and data processing, such as implementing the abnormal fund link identification method provided by the embodiments of the present invention: preprocessing original fund information to obtain a basic link unit, wherein the basic link unit comprises an end-to-end fund flow direction relation; carrying out entity fusion and relationship alignment on the link units based on a pre-specified ontology model to obtain a fund link in a graph spectrum form, wherein the fund link comprises the category and the relationship of transaction objects; and detecting and identifying the fund link to obtain an abnormal fund link.

EXAMPLE five

Embodiments of the present invention provide a computer program product, including a computer program, where the computer program, when executed by a processor, implements a method for identifying an abnormal fund link, as provided in all inventive embodiments of the present application: preprocessing original fund information to obtain a basic link unit, wherein the basic link unit comprises an end-to-end fund flow direction relation; performing entity fusion and relationship alignment on the link units based on a pre-specified ontology model to obtain a fund link in a graph spectrum form, wherein the fund link comprises the category and the relationship of transaction objects; and detecting and identifying the fund link to obtain an abnormal fund link.

Any combination of one or more computer-readable media may be employed. The computer readable medium may be a computer readable signal medium or a computer readable storage medium. A computer readable storage medium may be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination of the foregoing. More specific examples (a non-exhaustive list) of the computer readable storage medium would include the following: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the context of this document, a computer readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device.

A computer readable signal medium may include a propagated data signal with computer readable program code embodied therein, for example, in baseband or as part of a carrier wave. Such a propagated data signal may take many forms, including, but not limited to, electro-magnetic, optical, or any suitable combination thereof. A computer readable signal medium may also be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device.

Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

Computer program code for carrying out operations for aspects of the present invention may be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C + +, or a conventional procedural programming language such as the "C" language or similar programming languages. The program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer through any type of network, including a Local Area Network (LAN) or a Wide Area Network (WAN), or the connection may be made to an external computer (for example, through the Internet using an Internet service provider).

It is to be noted that the foregoing is only illustrative of the preferred embodiments of the present invention and the technical principles employed. It will be understood by those skilled in the art that the present invention is not limited to the particular embodiments described herein, but is capable of various obvious changes, rearrangements and substitutions without departing from the scope of the invention. Therefore, although the present invention has been described in some detail by the above embodiments, the present invention is not limited to the above embodiments, and may include other equivalent embodiments without departing from the spirit of the present invention, and the scope of the present invention is determined by the scope of the appended claims.

Claims

1. An abnormal fund link identification method, comprising:

preprocessing original fund information to obtain a basic link unit, wherein the basic link unit comprises an end-to-end fund flow direction relation;

performing entity fusion and relationship alignment on the basic link unit based on a pre-specified ontology model to obtain a fund link in a map form, wherein the fund link comprises the category and the relationship of a transaction object;

and detecting and identifying the fund link to obtain an abnormal fund link.

2. The method of claim 1, wherein preprocessing the raw fund information to obtain a basic link unit comprises:

storing the original fund information into a graph database to obtain an initial link unit;

and checking the initial link unit according to a specified standard to obtain the basic link unit, wherein the specified standard comprises: business logic criteria and field criteria.

3. The method of claim 2, wherein said checking said initial link element against a specified criteria to obtain said basic link element comprises:

judging whether the initial link unit meets the service logic standard, if so, judging whether the initial link unit meets the field standard, if so, taking the initial link unit as the basic link unit, otherwise, deleting the initial link unit;

otherwise, deleting the initial link unit.

4. The method according to claim 1, wherein the entity fusing and relationship aligning the basic link unit based on a pre-specified ontology model to obtain a fund link in a graph form comprises:

determining a type of a transacting entity in the primary link unit;

reserving a basic link unit belonging to a specified type based on the pre-specified ontology model;

and determining the relationship of transaction entities in the reserved basic link units, connecting the reserved basic link units according to the relationship, and acquiring the fund link in the map form.

5. The method of claim 1, wherein the detecting the fund link identifies acquiring an abnormal fund link, comprising:

screening out appointed fund links containing the same transaction objects from the fund links;

converging the appointed fund link to obtain a converged link;

and detecting and identifying the aggregation link to obtain an abnormal fund link.

6. The method of claim 5, wherein the detecting the aggregated link identifies an abnormal fund link, comprising:

carrying out similarity calculation on the aggregation links, and acquiring the appointed aggregation links belonging to the same graph structure according to the similarity calculation result;

and when the graph structure is determined to be a pre-specified abnormal graph structure, taking the fund link forming the specified aggregation link as the abnormal fund link.

7. The method according to claim 6, wherein said performing similarity calculation on the aggregation links and obtaining the specified aggregation links belonging to the same graph structure according to the similarity calculation result comprises:

calculating the similarity between each aggregation link, and acquiring a similarity sequence corresponding to each aggregation link, wherein the similarity sequence comprises the similarity between each aggregation link except the aggregation link;

comparing the similarity in the similarity sequence with a preset threshold value, and taking the aggregation link corresponding to the similarity greater than the preset threshold value as the designated aggregation link;

attributing the designated aggregated links to the same graph structure.

8. An abnormal fund link identification device, comprising:

the fund link acquisition module is used for carrying out entity fusion and relation alignment on the link unit based on a pre-specified ontology model and acquiring a fund link in a map form, wherein the fund link comprises the category and the relation of a transaction object;

9. The apparatus of claim 8, wherein the basic link unit obtaining module is configured to store the original fund information in a database to obtain an initial link unit;

and checking the initial link unit according to a specified standard to obtain the basic link unit, wherein the specified standard comprises the following steps: business logic criteria and field criteria.

10. The apparatus of claim 8, wherein the funding link acquisition module is configured to determine a type of a transaction entity in the primary link unit;

reserving basic link units belonging to a specified category based on the pre-specified ontology model;

11. The apparatus according to claim 8, wherein the abnormal fund link identification module is configured to screen out the fund links for designated fund links containing the same transaction object;

converging the appointed fund link to obtain a converged link;

12. An electronic device, characterized in that the electronic device comprises:

one or more processors;

a storage device for storing one or more programs,

when executed by the one or more processors, cause the one or more processors to implement the method of any one of claims 1-7.

13. A computer program product comprising a computer program, characterized in that the computer program realizes the method according to any of claims 1-7 when executed by a processor.