CN101599165A - A kind of dynamic financial network monitoring analytical method - Google Patents

Abstract

The invention discloses a kind of dynamic financial network monitoring analytical method, specifically comprise: (1) sets up the dynamic financial network model: the conversion process from financial database to oriented weighted graph stream; (2) computation attribute weights: by analyzing suspicious transaction case library, statistical learning obtains the suspicious degree weights of attribute, is called for short the attribute weights; (3) the dynamic monitoring analysis of account and the suspicious degree of transaction: the common influence of the multiple attribute by taking all factors into consideration account and transaction and previous timeslice be to the influence of current time sheet, dynamic monitoring account and the time dependent suspicious degree of transaction; (4) upgrade the attribute weights: when new suspicious transaction occurs, upgrade suspicious transaction case library and attribute weights; (5) incrementally updating of dynamic financial network model: when new data of financial transaction occurs, upgrade financial database and dynamic financial network model.

Description

A kind of dynamic financial network monitoring analytical method

Technical field

The invention belongs to the Financial Information field, particularly a kind of dynamic financial network monitoring analytical method.

Background technology

Along with improving constantly of China's informationization and internationalization level, financial crime activity for example criminal offences such as credit card fraud, ecommerce crime, money laundering is becoming increasingly rampant.The means that the offender implements criminal offence are varied, and are easy to be submerged in a large amount of financial transaction every day, make manually to find that these criminal offences hardly may.

In the world, the research of carrying out the anti money washing monitoring analysis by infotech is many, and many countries have also set up financial information mechanism in succession.Domesticly also pay much attention to, formally set up collection, analysis, monitor and provide specialized agency---the Chinese anti money washing monitoring analysis center of anti money washing information on April 7th, 2004 to hitting crime of laundering.Some financial institutions and company are also in some financial transaction monitoring systems of exploitation.These systems mainly realize collection, management and the elementary statistical study of Financial Management information, and the technology of application mainly is inquiry, data warehouse, multidimensional analysis and some simple data mining technologies.Domestic method of also dynamic financial network not being carried out the intellectual monitoring analysis at present.

Abroad, method relevant for Financial Management comprises that portfolio management and financial risk management method etc. are (as E.S.Gerasimov, V.V.Dombrovskii. " Dynamic Network Model ofManaging Investment Portfolio under Random Stepwise Changes in Volatilitiesof Financial Assets " .Automation and Remote Control, 2003, Vol.64 (7), 1086-1093 and A.Nagurney, J.Cruz. " Dynamics of international financialnetworks with risk management ", Quantitative finance, 2004, Vol.4 (3) etc.), in addition financial transaction is carried out such as the network route in addition, the method of risk assessment and authorization decision (as TIEKEN CRAIG A[US], US2009070246 (A1). " Electronic FinancialTransaction Routing " and Matsuda Paul J[US]; Perry Sarah E[US], Wilk TracyL[US], US2009037304 (A1). " Conducting commerce between individuals ").For the monitoring of suspicious transaction, and the method that external with good grounds local anti money washing regulation detects automatically (G.A.Joseph[US], US2008270206 (A1). " Method for detecting suspicioustransactions ").

Because the difference between the national conditions, external existing suspicious transaction method for monitoring and analyzing or system can not be directly used in the anti money washing work of China.So at the characteristics of China's Financial network, the present invention has provided dynamic financial network monitoring analytical method, the suspicious degree of account in the banking network and transaction is carried out the dynamic monitoring analysis, give a clue for finding the financial crime behavior.

Summary of the invention

The object of the present invention is to provide a kind of dynamic financial network monitoring analytical method, the suspicious degree of account in the banking network and transaction thereof is carried out the dynamic monitoring analysis.

Dynamic financial network monitoring analytical method provided by the invention, its step comprises:

The 1st step was set up the dynamic financial network model, described the conversion process from financial database to oriented weighted graph stream; Financial database comprises account table and tran list;

The 2nd step, statistical learning obtained the suspicious degree weights of the attribute of account and transaction, was referred to as the attribute weights by analyzing suspicious transaction case library; Suspicious transaction case library is made of suspicious transaction record;

The 3rd step was carried out the dynamic monitoring analysis of suspicious degree of account and transaction, promptly took all factors into consideration the influence to the current time sheet of the common influence of multiple attribute of account and transaction and previous timeslice, dynamic monitoring account and the time dependent suspicious degree of transaction;

The 4th step judged whether that new suspicious transaction data occurred, if upgrade suspicious transaction case library and attribute weights, otherwise changed for the 5th step over to;

The 5th step judged whether that new data of financial transaction occurred, if, upgrade financial database, and the dynamic financial network model is carried out incrementally updating, forwarded for the 3rd step then to, otherwise changed for the 6th step over to;

The 6th step judged whether the whole process of ending method, if then finish, otherwise changed for the 4th step over to.

A kind of dynamic financial network monitoring analytical method of the present invention has following advantage and effect:

1) dynamic

This method combines complex network technology and techniques of teime series analysis dynamic financial network is carried out modeling, complicated transaction in the banking network can be described accurately on the one hand, banking network dynamic change in time can be effectively described on the other hand.

2) dirigibility

This method allows the user that for example suspicious degree weights of parameter wherein, suspicious relatively degree weights and attribute weights etc. are provided with freely according to domain knowledge or experience.For different analysis task, can also introduce different weights tolerance.Different users' focal point also is not quite similar, and rules also may change, and freely the selecting of parameter brought very big dirigibility to various analyst's use.

3) quantitative property

This method has provided the Quantitative Monitoring analytical approach of account and the suspicious degree of transaction, can observe and be familiar with account more accurately and the suspicious degree of the dynamic change in time of concluding the business.

4) intelligent

This method has adopted the DS evidence theory that the attribute weights are calculated and has upgraded, and makes the The whole analytical process intellectuality.

Description of drawings

Fig. 1 is the process flow diagram that a kind of dynamic financial network monitoring of the present invention is analyzed;

Fig. 2 is a process flow diagram of setting up the dynamic financial network model;

Fig. 3 is the process flow diagram of computation attribute weights;

Fig. 4 is the process flow diagram that the dynamic monitoring of account and the suspicious degree of transaction is analyzed;

Fig. 5 is for upgrading the process flow diagram of attribute weights;

Fig. 6 is the process flow diagram of dynamic financial network model incrementally updating;

Fig. 7 is the description figure of the account attributes in the banking network;

Fig. 8 is the description figure of the transaction attribute in the banking network.

Embodiment

Core of the present invention is to provide a kind of dynamic financial network monitoring analytical method, this method is at first set up the dynamic financial network model based on financial database, and the attribute weights are calculated according to suspicious transaction case library, suspicious degree to account in the banking network and transaction carries out the dynamic monitoring analysis then, last when new suspicious transaction occurs, the attribute weights are upgraded; When new data of financial transaction occurs, the dynamic financial network model is carried out incrementally updating.

The process flow diagram of the inventive method as shown in Figure 1.Notice that step 4 and step 5 are processes of a continuous monitored data, as long as will execution in step 4 and step 5 when having new suspicious transaction data or new data of financial transaction to occur.In actual conditions, the realization of this method can not finish, and occurs unless no longer include new transaction data forever.

For example each step of the inventive method is described in further detail respectively below.As example, following suspicious degree refers to account and concludes the business and be accused of the suspicious degree of money laundering that following suspected cases storehouse refers to the money laundering case library particularly particularly.Transaction record in the money laundering case that the money laundering case library has been cracked by law enforcement agency constitutes.

(1) sets up the method for dynamic financial network model

The method of setting up the dynamic financial network model is intended to the account in the dynamic financial network and transaction thereof and their dynamic are described and define, concrete financial database is converted into oriented weighted graph stream, is the dynamic monitoring analysis of account and the suspicious degree of the transaction preparation that supplies a model.

The input of this method be financial database, output be oriented weighted graph stream.Introduce the form of input and output below respectively.

Concrete, financial database is mainly concerned with two views, credit (example sees Table 1) and tran list (example sees Table 2), actual credit and tran list field (attribute) number are howed a lot than sample table, the attribute of account and transaction is seen Fig. 7 and Fig. 8, is abstract come out on the basis of analyzing " financial institution's block trade and suspicious transaction reporting management method " and financial institution's block trade and suspicious transaction reporting factor content.

Table 1 credit

Sequence number	Number of the account	Account Type	Open an account the time	The bank of deposit
					1	081421100021	Individual account	2003-6-20	Bank of China
2	011421100498	Individual account	2003-6-30	Bank of China
					3	011421100538	Business account	2003-6-25	Industrial and commercial bank

Each explanation of field is as follows:

Number of the account: account ID, the unique identifying number of account;

Account Type: the classification logotype of account mainly is divided into individual account and business account etc.;

Open an account the time: the concrete time of setting up the account;

The bank of deposit: the bank that sets up the account.

Table 2 tran list

Sequence number	The area	Trade date	The main body number of the account	The object number of the account	Currency Type	The amount of money
							1	Hubei Province	2003-7-3	081421100021	011421100538	USD	14198
2	Jiangxi Province	2003-7-31	011421100498	081421100021	HKD	400000
							3	Xinjiang	2003-7-1	011421100538	011421100498	EUR	13300

Each explanation of field is as follows:

Area: the area that transaction takes place;

Trade date: the date that transaction takes place;

Main body number of the account: the number of the account of initiating parties;

Object number of the account: the number of the account of accepting parties;

Currency Type: the Currency Type that exchange adopts, for example this field is that USD represents dollar, and HKD represents Hongkong dollar, and EUR represents Euro or the like;

The amount of money: the dealing money number is a floating number.

Table 1 and table 2 have provided some sample datas respectively, and in order to protect client's privacy, number of the account has been carried out virtual conversion, promptly non-true number of the account.

Concrete, provide the definition of dynamic financial network model below.

Dynamic financial network is defined as oriented weighted graph stream S={G ¹, G ²..., G ^t... }, t is a positive integer, express time sheet sequence number, the oriented weighted graph of t timeslice is G ^t(V, E, L _V, L _E, A _V, A _E, F _V, F _E), wherein 1) V represents the set of account; 2) E={ (u, v) | u, v ∈ V} represent the set of concluding the business between the account, (u, v) and (v, u) the different transaction of expression; 3) L _VThe set of the weights of expression account; 4) L _EThe set of the weights of expression transaction; 5) A _VThe set of the attribute vector of expression account; 6) A _EThe set of the attribute vector of expression transaction; 7) F _VExpression account attributes vector set A _VWeights collection L to account _VMapping or function; 8) F _EExpression transaction attribute vector A _EWeights collection L to transaction _EMapping or function.

At definition F _V: V → L _VAnd F _E: E → L _EThe time, at first attribute vector is converted to the attribute weight vector, again the attribute weight vector is mapped to the weights on node and limit.In the methods of the invention, the weights on node and the limit are represented their suspicious degree respectively.In fact for the weights on node and limit, can define different tolerance according to different analysis task.In fact for the weights on node and limit, can define different tolerance according to different analysis task.For example, if when dynamic financial network being done group's detection, the weights on the limit are defined as two degree of getting close between the node etc.

The account in the banking network and the attribute of transaction have multiple, promptly are attribute vectors, and have level, and Fig. 7 and Fig. 8 have described the attribute of account and transaction respectively.

Consider that the transaction data in the financial database is a magnanimity, so the input data that this method is handled are mass datas.The subject matter that mass data causes is time space problem.How effectively control and balance time space problem are the key points of carrying out mass data processing.Mass data in the financial database both had been embodied in transaction data equally also may be embodied in account data.As worst case, account data in the database and transaction data all are magnanimity.In the face of mass data, the difficulty of setting up the existence of dynamic financial network model is:

1) data storage.How effectively do the data of memory model requirement make the storage space that needs few as much as possible for mass data? in setting up the process of model, how to handle the data scale and the selection of reading in internal memory and write back the opportunity that data arrive disk?

2) set up the efficient of model.For mass data, the method for setting up model should have good scalability, shortens the time of modelling as much as possible.

At how overcoming above-mentioned two difficulties, provide the concrete steps of this method below.The process flow diagram in the 1st step is specially as shown in Figure 2:

Step 1.1: the exchange hour field of tran list is set up clustered index according to ascending order in financial database.Record in the tran list will be according to the ordering successively from front to back of their exchange hours, and the transaction record of adjacent time is being to be distributed on same on the physical store, or on the continuous blocks;

Step 1.2:, calculate total number T=(the End-Start)/l of the timeslice that financial database comprises according to determining in advance exchange hour Start and the End in article one and the last item transaction record in good timeslice length l (for example a day, month or a season etc.) and the financial database;

Step 1.3: t is initialized as 1 with the timeslice sequence number;

Step 1.4: judge whether t≤T sets up, if enter step 1.5, otherwise entered for the 2nd step;

Step 1.5: the oriented weighted graph G that is t timeslice ^tSet up an empty file, prepare for the step of back writes data;

Step 1.6: the sequence number d of the data block that initialization will be read is 1;

Step 1.7: judge d≤k ^tWhether set up k ^tIt is total number of t timeslice data block.If enter step 1.8, otherwise make t=t+1 change step 1.4 then over to;

Step 1.8: the d piece transaction data of t timeslice is read in internal memory, and leave among the set M;

Step 1.9: the interim figure of definition G ' is used to deposit the oriented weighting subgraph with the d blocks of data formation of t timeslice, and it is initialized as sky;

Step 1.10: judge that whether M is empty, if will scheme temporarily that G ' is attached to write oriented weighting G ^tIn and make d=d+1 change step 1.7 then over to, otherwise enter step 1.11;

Step 1.11: from M, take out a transaction record and be designated as m, and m is left out from M;

Step 1.12: deposit the main body accounts information of transaction record m in variables A ₁, deposit the object accounts information of transaction record m in variables A ₂, deposit other Transaction Informations of transaction record m in variable B;

Step 1.13: general＜A ₁, A ₂, B〉add among the subgraph G ', and change step 1.10 over to.

It more than is exactly the whole process that financial database is established as the dynamic financial network model.The purpose of the piecemeal accessing operation that wherein relates to is for the data of reading in can be held by internal memory.

This method is solving being embodied in aspect the time space problem: aspect storage and visit data, the data volume of at every turn reading in internal memory is limited in the range of capacity of internal memory, and it is to do together after transaction data in internal memory has all been analyzed that analysis result writes back disk operating.Aspect efficient, count linearity about transaction record on the whole, actual conditions are more complex, at other linear complexity of internal memory level is best situation, and be the worst situation at the linear complexity of disk level, so real efficiency be actual operation be in internal memory, finish or need write disk, analyze above-mentioned algorithm and know that its time complexity is that the linear complexity of internal memory level adds N/r disk operating.This efficient is the more excellent result that the balance time space problem obtains.This still is a relatively more optimistic result, and actual conditions are not only simple write-back when disk operating, and also has comparison and sum operation, and the duplicate detection of for example will concluding the business also will be carried out sum operation etc. when having situation about repeating.Because these operate in and all relate to some extra disk read-write expenses in the above-mentioned algorithm, so that time complexity is compared is higher optimistically.

(2) method of computation attribute weights

The method of computation attribute weights is intended to calculate according to the suspicious degree weights abbreviation attribute weights of suspicious transaction case library to each attribute.For the dynamic monitoring analysis of account and the suspicious degree of transaction provides parameter to prepare.

A suspicious transaction case library is made of a large amount of suspicious transaction records.Suppose the practical function that in suspected cases, is risen according to each transaction, for example merge, placement and transfer fund etc. that we draw one or transaction attribute that some are important by analysis, are called suspicious attribute or suspicious property set.An attribute is suspicious attribute in a transaction, and in another transaction may not be.Article one, transaction also may have a suspicious property set.

In fact, the reflection of attribute weights is that this attribute is the degree of suspicious attribute in suspicious transaction case library.Attribute is that the probability of suspicious attribute is high more in the case, and the attribute weights are big more so, otherwise more little.So how calculating the suspicious probability of each attribute is the key point of problem.Because suspected cases are incomplete evidences, promptly specific suspected cases often can not relate to all properties, the suspicious degree of some attribute may not have to embody in some suspected cases at all, perhaps constitutes a suspicious property set with other attributes.Therefore, carrying out the definite of attribute weights according to suspected cases often is not a simple statistical problem.Provide computing method below based on the attribute weights of DS evidence theory.

Need to suppose the total x of transaction attribute that considers individual, constitute the transaction community set $\mathrm{\Ω}=\left\{A_E^i\right|1\≤i\≤x\},$ Corresponding to the framework of identification in the DS evidence theory.Be defined in basic reliability distribution b:2 on this framework of identification ^ΩSatisfy → [0,1]: 1) 2) $\∀A\∈2^{\mathrm{\Ω}},$ b(A)≥0， $\underset{A\∈2^{\mathrm{\Ω}}}{\mathrm{\Σ}}b\left(A\right)=1.$ Provide below according to suspicious transaction case library and carry out the concrete steps that the attribute weights calculate, the process flow diagram in the 2nd step as shown in Figure 3, its process is:

Step 2.1: definition set U is used to deposit the suspicious property set of every transaction record correspondence, and the sequence number of establishing suspicious transaction record is e, and All Activity record adds up to N in the suspicious transaction case library; U is initialized as empty set, and e is initialized as 1;

Step 2.2: judge whether e≤N sets up, if enter step 2.3, otherwise change step 2.5 over to;

Step 2.3: defining variable r is used to deposit the suspicious transaction record of e bar, obtains its suspicious property set according to suspicious transaction record r role in suspected cases, and is designated as R;

Step 2.4: R is joined set go among the U, make e=e+1 then and change step 2.2 over to;

Step 2.5: the number of times that all properties subclass is occurred in case library is initialized as 0, promptly $\∀A=2^{\mathrm{\Ω}},$ F (A)=0, the number of times that f (A) representation attribute subclass A occurs at case library, 2 ^ΩIt is the set of all subclass formations of property set Ω;

Step 2.6: judge whether set U is empty, if change step 2.9 over to, otherwise enter step 2.7;

Step 2.7: an element of getting among the set U is the suspicious property set Y of certain bar transaction record correspondence, and Y is deleted from U;

Step 2.8:f (Y)=f (Y)+1 changes step 2.6 then over to;

Step 2.9:u=1, u are the sequence number of attribute set;

Step 2.10: judge u≤2 ^x-1, wherein 2 ^xThe-1st, total number of attribute set is if enter step 2.11, otherwise change step 2.13 over to; X is the number of attribute among the property set Ω;

Step 2.11: with 2 ^ΩIn the basic reliability branch of u attribute set be configured to the frequency that it occurs in suspicious transaction case, promptly b ((2 ^Ω) [u])=f ((2 ^Ω) [u])/N, symbol (2 ^Ω) u the subclass of [u] representation attribute collection Ω;

Step 2.12: make u=u+1, change step 2.10 then over to;

Step 2.13: the lower limit and the upper limit of calculating the suspicious reliability of all single attributes by formula (1) and formula (2) respectively.To i attribute A among the Ω _E ⁱIt is as follows to carry out computing formula, wherein 1≤i≤x, then { A _E ⁱBe the subclass of property set Ω, promptly there are 1≤u≤2 ^x-1, make $\left\{A_E^i\right\}=\left(2^{\mathrm{\Ω}}\right)\left[u\right],$ If $X\⊆\mathrm{\Ω};$

$\mathrm{bel}\left(A_E^i\right)=\mathrm{bel}\left(\right\{A_E^i\left\}\right)=\underset{x\⊆\left\{A_E^i\right\}}{\mathrm{\Σ}}b\left(X\right)=b\left(\right\{A_E^i\left\}\right)---\left(1\right)$

Step 2.14: the weights that calculate all properties by formula (3)

In the DS evidence theory, formula (1) and (2) are called reliability and likelihood degree, and its meaning is respectively the reliability lower limit and the upper limit.

(3) account and the suspicious degree dynamic monitoring analytical approach of transaction

Account and the suspicious degree dynamic monitoring analytical approach of transaction are intended to based on the dynamic financial network model of setting up and the attribute weights that calculate the suspicious degree of account and transaction be carried out dynamic quantitative Analysis.This method relates to some notions, comprises broad sense attribute, incident and suspicious degree weights etc.At first specify the implication of these notions below.

The broad sense attribute is meant the general name of the attribute of the attribute of object itself and the residing environment of object.For example, the type of account is the attribute of account itself, belongs to the broad sense attribute of account.Account is its structure of deal that presents on every side in process of exchange, for example disperses to change over to, and concentrated producing is exactly an attribute of the residing environment of account, also belongs to the broad sense attribute of account.Incident is meant that object has certain value on its certain broad sense attribute.For example, transaction has certain value on amount of money attribute, determines that promptly the number of dealing money is an incident.Suspicious degree weights are meant the suspicious degree that certain incident causes, value is in [0,1] interval, and 0 this incident of expression is unsuspicious fully, and 1 expression is the most suspicious, and other fall between.

According to the regulation of block trade, for dissimilar accounts, the suspicious degree that different transaction Currency Types and different dealing money cause is different.Will the attribute synthesis relevant consider to obtain the suspicious degree weights that cause by equivalent amount with the amount of money together.In order to calculate the suspicious degree weights that equivalent amount causes, at first calculate the equivalent amount of transaction, need a reference standard and calculate equivalent amount.This reference standard is described below.

Reference standard: single or single timeslice add up the transaction of 2,000,000 yuan of Renminbi between business account and the business account.

The notion that provides suspicious relatively degree weights at above reference standard is as follows.Suspicious relatively degree weights are meant the ratio of the suspicious degree weights that suspicious degree weights that certain incident causes and the incident in the reference standard cause, are decided to be 1 with reference to the suspicious degree of the incident in the standard, and suspicious so relatively degree weights can be arbitrarily positive floating numbers.

The suspicious relatively degree weights that the different Account Types of table 3 cause

The suspicious relatively degree weights that the different Currency Types of table 4 cause

The transaction Currency Type	Suspicious relatively degree weights (γ 2 t(i，j))
		Renminbi	1
Dollar	7
		Hongkong dollar	0.9
Euro	8
		Sterling	10

Table 3 basis " financial institution's block trade and suspicious transaction reporting management method " has provided the suspicious relatively degree weights that different Account Types cause for reference standard to the criterion of block trade.Table 4 provides the suspicious relatively degree weights that different Account Types and different Currency Types cause for reference standard according to the exchange rate between present different Currency Types relation.

Relative suspicious degree weights in table 3 and the table 4 are according to the sample data that present " financial institution's block trade and suspicious transaction reporting management method " (brief note is " way ") and present Currency Type exchange rate relation provide, and need when specifically implementing to concern according to current " way " and the current Currency Type exchange rate adjust.

Say that as institute institute above the value on each attribute all has suspicious degree weights, show that transaction has the suspicious degree of this transaction in certain value on certain attribute.Table 5 provides the suspicious degree weights in transaction area.Suspicious degree weights can be provided with by some existing data on the one hand.For example, for the suspicious degree in transaction area, there is the data demonstration to be divided into core monitoring area, to pay close attention to area and other suspicious regional three classes.According to the regional suspicious degree classification of transaction, the suspicious degree weights in the area that we are big with suspicious degree are made as certain value in the interval [0.8～1.0], the suspicious degree in the area that suspicious degree is medium be made as [0.5～0.8) in certain value, the suspicious degree weights in the area that suspicious degree is little be made as [0.2,0.5) certain value.Concrete value can be provided with as the case may be freely.On the other hand, suspicious degree weights can be added up according to the suspected cases that law enforcement agency has cracked and obtain.For example in the money laundering case that all the are cracked money laundering behavior of being changed to of the suspicious degree weights in transaction area occurs in the frequency of this area.

The suspicious degree weights that table 5 area causes

The area	Suspicious degree weights (ω concludes the business 1 t(i，j))
		Core monitoring area (Xinjiang, Heilungkiang etc.)	Greatly: 0.8
Pay close attention to area (Zhejiang, Fujian, Yunnan etc.)	In: 0.6
		Other suspicious areas (Guangdong, Jilin etc.)	Little: 0.4

In order to further specify the concrete steps of dynamic financial network monitoring analytical method, at first provide the meaning of some symbols.

ω _k ^t(i, (i is j) by its k attribute E j) to be illustrated in t timeslice transaction _Ij.A _kThe suspicious degree weights that cause of value, i.e. limit (i, k component of attribute weight vector j).Especially, ω _A ^t(i, j) the expression transaction has the suspicious degree weights that corresponding equivalent amount EA causes, γ _l ^t(i, j) t timeslice transaction of expression (i, l (1≤l≤N j) _A) suspicious relatively degree weights that the value of the individual attribute relevant with the amount of money causes, α represents dealing money, N _AThe number of representing the attribute relevant with the amount of money.And ω _s ^t(i) being illustrated in the suspicious degree weights that t timeslice node i structure of deal on every side causes, is one of them component of the attribute weight vector of node i.

Step 3.1: t is initialized as 1 with the timeslice sequence number;

Step 3.2: judge t≤T, T is total number of timeslice, if enter step 3.3, otherwise entered for the 4th step;

Step 3.3: the initial account sequence number i that will conclude the business is initialized as 1;

Step 3.4: judge whether i≤L sets up, L is total number of account, if enter step 3.5, otherwise change t=t+1 over to step 3.2 then;

Step 3.5: the sequence number j that closes an account that will conclude the business is initialized as 1;

Step 3.6: judge whether j≤L sets up, if enter step 3.7, otherwise change step 3.12 over to;

Step 3.7: judge ordered pair＜i, j〉whether belong to E (G ^t), E (G ^t) be G ^tThe set on limit, G ^tThe oriented weighted graph that is t timeslice is if enter step 3.8, otherwise make j=j+1 change step 3.6 then over to;

Step 3.8: calculate transaction＜i, j according to formula (4)〉equivalent amount;

$\mathrm{EA}=\mathrm{\α}*\underset{l=1}{\overset{N_A}{\mathrm{\Π}}}{\mathrm{\γ}}_l^t(i,j)---\left(4\right)$

γ wherein _l ^t(i, j) t timeslice transaction＜i of expression, j〉the suspicious relatively degree weights that cause of the value of the individual attribute relevant of l with the amount of money, 1≤l≤N wherein _A, α represents dealing money

Step 3.9: according to the suspicious degree weights of the equivalent amount correspondence that calculates more than formula (5) calculating;

Step 3.10: calculate transaction＜i, j according to formula (6)〉suspicious degree,

Wherein

The weights of representing non-amount of money attribute, special

The attribute weights of the expression amount of money are special cases of attribute weights,

Represent the influence weights of the suspicious degree of last timeslice interior nodes, and satisfy current transaction

N _AThe number of other attributes of expression except that relevant attribute with the amount of money, formula (6) is corresponding to the F in the banking network model _E, the weights L of the corresponding transaction in the formula left side _E, the attribute weight vector A of the corresponding transaction in formula the right _EA COMPREHENSIVE CALCULATING, and consider suspicious degree of the timeslice both parties.

J=j+1 and change step 3.6 over to then;

Step 3.11: calculate the suspicious weights that account i structure attribute on every side causes according to formula (7);

${\mathrm{\ω}}_s^t\left(i\right)=1-\min (d_{\mathrm{in}}^t\left(i\right),d_{\mathrm{out}}^t\left(i\right))/\max (d_{\mathrm{in}}^t\left(i\right),d_{\mathrm{out}}^t\left(i\right))---\left(7\right)$

D wherein _In ^t(i) be illustrated in the in-degree of timeslice t node i, d _Out ^t(i) be illustrated in the out-degree of timeslice t node i.

Step 3.12: the suspicious degree that calculates account i according to formula (8);

D wherein _{I, j} ^tRepresent that account i arrives the suspicious degree of the transaction of account j in t the timeslice,

The transaction of sending of expression account is to the weights that influence of the suspicious degree of account, and

The weights of the structure attribute of expression node, and satisfy Г _i ^tRepresent the other side's of the transaction that the interior starting point of t timeslice is i set.Formula (8) is corresponding to the F in the banking network model _V, the weights L of formula left side corresponding sides _V, the attribute weight vector A of formula the right corresponding sides _VA COMPREHENSIVE CALCULATING.

(4) update method of attribute weights

The update method of attribute weights is intended to when new suspicious transaction data occurs original attribute weights be upgraded.The concrete steps of this method are as follows:

Step 4.1: original reliability distribution is designated as m ₁

Step 4.2:, calculate the reliability that makes new advances according to step 2.1 in the attribute weight calculation method to step 2.12 and distribute m to emerging suspicious transaction data ₂

Step 4.3: calculate the basic reliability of merging according to formula (9) and distribute m ₁And m ₂The new basic reliability that produces is distributed m ₁₂, right $\∀Z\⊆\mathrm{\Ω},$ Distribute by the basic reliability that following calculating is new;

Though formula (9) is that two basic reliabilities are merged, merge a plurality of purposes as long as constantly merge in twos just can reach for situation more than two.The most applications that we run into is such, beginning to have a case to obtain an initial reliability distributes, occurring a new case then obtains a new reliability and distributes by formula (9) it to be distributed with initial reliability and merge, reliability after occurring again when new it and front merged is distributed and is merged, and the rest may be inferred.

Step 4.4: with the step 2.13 in the computation attribute weights method;

Step 4.5: with the step 2.14 in the computation attribute weights method.

Formula (9) is used is merging rule in the DS evidence theory, and two basic belief functions are merged.

(5) the incrementally updating method of dynamic financial network model

The incrementally updating method of dynamic financial network model is intended to when new data of financial transaction occurs dynamic financial network be carried out local incrementally updating.The concrete steps of this method are as follows:

Step 5.1: initialization financial transaction record sequence number c is 1, the sum of the transaction record that comprises in Q ← New Transaction data;

Step 5.2: judge c≤Q, if, enter step 5.3, otherwise method ends;

Step 5.3: the account that the c bar is concluded the business and is correlated with is inserted into goes in the financial database;

Step 5.4: defining variable time, and the exchange hour that the c bar is concluded the business deposits among the time;

Step 5.5: judge time≤T.dl, T.dl represents the closing time of last timeslice, if enter step 5.6, otherwise change step 5.7 over to;

Step 5.6: the attached file G that writes of information that transaction record c is comprised ^TIn remove c=c+1 and change step 5.2 over to then; G ^TThe oriented weighted graph of representing T timeslice.

Step 5.7:T=T+1, and put G ^TBe sky, change step 5.5 then over to.

It should be noted that the exchange hour in the new data of financial transaction is strictly increasing.Because in the actual conditions, the exchange hour in the emerging data is bigger than the exchange hour in the old data certainly.

The above is preferred embodiment of the present invention, but the present invention should not be confined to the disclosed content of this embodiment and accompanying drawing.So everyly do not break away from the equivalence of finishing under the spirit disclosed in this invention or revise, all fall into the scope of protection of the invention.

Claims (6)

1, a kind of dynamic financial network monitoring analytical method, its step comprises:

The 1st step was set up the dynamic financial network model, described the conversion process from financial database to oriented weighted graph stream; Financial database comprises account table and tran list;

The 2nd step, statistical learning obtained the suspicious degree weights of the attribute of account and transaction, was referred to as the attribute weights by analyzing suspicious transaction case library; Suspicious transaction case library is made of suspicious transaction record;

The 3rd step was carried out the dynamic monitoring analysis of suspicious degree of account and transaction, promptly took all factors into consideration the influence to the current time sheet of the common influence of multiple attribute of account and transaction and previous timeslice, dynamic monitoring account and the time dependent suspicious degree of transaction;

The 4th step judged whether that new suspicious transaction data occurred, if upgrade suspicious transaction case library and attribute weights, otherwise changed for the 5th step over to;

The 5th step judged whether that new data of financial transaction occurred, if, upgrade financial database, and the dynamic financial network model is carried out incrementally updating, forwarded for the 3rd step then to, otherwise changed for the 6th step over to;

The 6th step judged whether the whole process of ending method, if then finish, otherwise changed for the 4th step over to.

According to the described dynamic financial network monitoring analytical method of claim 1, it is characterized in that 2, the 1st step was set up the dynamic financial network model according to following step, promptly was built with to weighted graph and flowed;

The 1.1st step exchange hour field of tran list in financial database is set up clustered index according to ascending order;

The 1.2nd step is according to determining in advance exchange hour Start and the End in article one and the last item transaction record in good timeslice length l and the financial database, calculates total number T=(the End-Start)/l of the timeslice that financial database comprises;

The 1.3rd step was initialized as 1 with timeslice sequence number t;

The 1.4th step judged whether t≤T sets up, if entered for the 1.5th step, otherwise entered for the 2nd step;

The 1.5th step was the oriented weighted graph G of t timeslice ^tSet up an empty file;

The sequence number d of the data block that the 1.6th step initialization will be read is 1;

The 1.7th step was judged d≤k ^tWhether set up k ^tIt is total number of t timeslice data block; If entered for the 1.8th step; Otherwise make t=t+1, changed for the 1.4th step then over to;

The d piece transaction data of the 1.8th step with t timeslice reads in internal memory, and leaves among the set M;

The interim figure of the 1.9th step definition G ' is used to deposit the oriented weighting subgraph with the d piece transaction data formation of t timeslice, and it is initialized as sky;

The 1.10th step judged that whether M was sky, if will scheme temporarily that G ' is attached to write oriented weighted graph G ^tIn and make d=d+1, change over to then the 1.7th the step; Otherwise entered for the 1.11st step;

The 1.11st step was taken out a transaction record from M, remember that this transaction record is m, and m is left out from M;

The main body accounts information of the 1.12nd step with transaction record m deposits variables A in ₁, deposit the object accounts information of transaction record m in variables A ₂, deposit other Transaction Informations of transaction record m in variable B;

The 1.13rd step general＜A ₁, A ₂, B〉add among the interim figure G ', and changed for the 1.10th step over to.

According to the described dynamic financial network monitoring analytical method of claim 2, it is characterized in that 3, the 2nd step specifically comprised the steps:

The 2.1st step definition set U is used to deposit the suspicious property set of every transaction record correspondence, and the sequence number of establishing suspicious transaction record is e, and the All Activity record adds up to N in the suspicious transaction case library; U is initialized as empty set, and e is initialized as 1;

The 2.2nd step judged whether e≤N sets up, if entered for the 2.3rd step, otherwise changed for the 2.5th step over to;

The 2.3rd step: defining variable r is used to deposit the suspicious transaction record of e bar, and the suspicious property set that obtains it according to suspicious transaction record r role in suspected cases is designated as R;

The 2.4th goes on foot: R is joined among the set U go, make e=e+1 then and changed for the 2.2nd step over to;

The 2.5th step was initialized as 0 at case library as the number of times that suspicious property set occurs with all properties subclass, promptly $\∀A\∈2^{\mathrm{\Ω}},$ F (A)=0, the number of times that f (A) representation attribute subclass A occurs as suspicious property set at case library, 2 ^ΩIt is the set of all subclass of property set Ω;

The 2.6th step judged whether set U is empty, if changed for the 2.9th step over to, otherwise entered for the 2.7th step;

The 2.7th step was got the suspicious property set Y of a transaction record correspondence among the set U, and Y is deleted from U;

The 2.8th step f (Y)=f (Y)+1 changed for the 2.6th step then over to;

The 2.9th step u=1, u is 2 ^ΩThe sequence number of middle attribute set;

The 2.10th step was judged u≤2 ^xWhether-1 set up, if entered for the 2.11st step, otherwise changed for the 2.13rd step over to; Wherein x is the number of attribute among the property set Ω;

The 2.11st step is with 2 ^ΩIn the basic reliability branch of u attribute set be configured to the frequency that it occurs in suspicious transaction case, promptly b ((2 ^Ω) [u])=f ((2 ^Ω) [u])/N, (2 ^Ω) [u] expression Ω u subclass;

The 2.12nd step made u=u+1, changed for the 2.10th step then over to;

The 2.13rd step was calculated the lower limit bel and the upper limit pl of the suspicious reliability of all single attributes respectively by formula (1) and formula (2); To i attribute A among the Ω _E ⁱCalculate, wherein 1≤i≤x, then { A _E ⁱBe the subclass of property set Ω, promptly there are 1≤u≤2 ^x-1, make $\left(2^{\mathrm{\Ω}}\right)\left[u\right]=\left\{A_E^i\right\},$ And establish $X\⊆\mathrm{\Ω};$

$\mathrm{bel}\left(A_E^i\right)=\mathrm{bel}\left(\right\{A_E^i)\}=\underset{X\⊆\left\{A_E^i\right\}}{\mathrm{\Σ}}b\left(X\right)=b\left(\right\{A_E^i)\}---\left(1\right)$

The 2.14th step was calculated the weights of all properties by formula (3)

:

4,, it is characterized in that the 3rd step specifically comprised the steps: according to the described dynamic financial network monitoring analytical method of claim 3

The 3.1st step was initialized as 1 with timeslice sequence number t;

The 3.2nd step was judged t≤T, and T is total number of timeslice, if entered for the 3.3rd step, otherwise entered for the 4th step;

The initial account sequence number i that the 3.3rd step will conclude the business is initialized as 1;

The 3.4th step judged whether i≤L sets up, and L is total number of account, if, entered for the 3.5th step, otherwise make t=t+1, changed for the 3.2nd step then over to;

The sequence number j that closes an account that the 3.5th step will conclude the business is initialized as 1;

The 3.6th step judged whether j≤L sets up, if entered for the 3.7th step, otherwise changed for the 3.12nd step over to;

The 3.7th step was judged ordered pair＜i, j〉whether belong to E (G ^t), E (G ^t) be G ^tThe set on limit, if entered for the 3.8th step, otherwise make j=j+1 change for the 3.6th step then over to;

The 3.8th step was calculated transaction＜i, j according to formula (4)〉equivalent amount EA:

$\mathrm{EA}=\mathrm{\α}*\underset{l=1}{\overset{N_A}{\mathrm{\Π}}}{\mathrm{\ω}}_{\mathrm{rl}}^t(i,j)---\left(4\right)$

γ wherein _l ^t(i, j) t timeslice transaction＜i of expression, j〉the suspicious relatively degree weights that cause of the value of the individual attribute relevant of l with the amount of money, 1≤l≤N wherein _A, α represents dealing money;

The 3.9th step is according to the suspicious degree weights of the equivalent amount correspondence that calculates more than formula (5) calculating;

The 3.10th step was calculated the interior transaction＜i of t timeslice, j according to formula (6)〉suspicious degree D _{I, j} ^t,

Wherein

The representation attribute weights, 1≤k≤N _A,

The weights of expression equivalent amount,

Represent the influence weights of the suspicious degree of last timeslice interior nodes, and satisfy current transaction

N _AThe number of other attributes of expression except that relevant attribute with the amount of money, formula (6) is corresponding to the F in the banking network model _E, the weights L of the corresponding transaction in the formula left side _E, the attribute weight vector A of the corresponding transaction in formula the right _EA COMPREHENSIVE CALCULATING, and consider suspicious degree of the timeslice both parties;

Make j=j+1 then and changed for the 3.6th step over to;

The 3.11st step was calculated the suspicious degree weights ω that t timeslice account i structure attribute on every side causes according to formula (7) _s ^t(i);

${\mathrm{\ω}}_s^t\left(i\right)=1-\min (d_{\mathrm{in}}^t\left(i\right),d_{\mathrm{out}}^t\left(i\right))/\max (d_{\mathrm{in}}^t\left(i\right),d_{\mathrm{out}}^t\left(i\right))---\left(7\right)$

D wherein _In ^t(i) be illustrated in the in-degree of timeslice t node i, d _Out ^t(i) be illustrated in the out-degree of timeslice t node i;

The 3.12nd step was calculated the suspicious degree D of account i in t the timeslice according to formula (8) _i ^t

D wherein _{I, j} ^tRepresent that account i arrives the suspicious degree of the transaction of account j in t the timeslice,

The transaction of sending of expression account is to the weights that influence of the suspicious degree of account, and

The weights of the structure attribute of expression node, and satisfy

Γ _i ^tRepresent the other side's of the transaction that the interior starting point of t timeslice is i set; Formula (8) is corresponding to the F in the banking network model _V, the weights L of formula left side corresponding sides _V, the attribute weight vector A of formula the right corresponding sides _VA COMPREHENSIVE CALCULATING.

5,, it is characterized in that the 4th step specifically comprised the steps: according to the described dynamic financial network monitoring analytical method of claim 4

The 4.1st step was designated as m with original reliability distribution ₁

The 4.2nd step is to emerging suspicious transaction data, according to the 2.1st going on foot for the 2.12nd step and calculate the reliability make new advances and distribute m in the attribute weight calculation method ₂

The 4.3rd step calculated according to formula (9) and merges basic reliability distribution m ₁And m ₂The new basic reliability that produces is distributed m ₁₂, right

Distribute m by the basic reliability that following calculating is new ₁₂(Z):

The 4.4th step went on foot with the 2.13rd in the computation attribute weights method;

The 4.5th step went on foot with the 2.14th in the computation attribute weights method.

6,, it is characterized in that the 5th step specifically comprised the steps: according to the described dynamic financial network monitoring analytical method of claim 5

The 5.1st step initialization financial transaction record sequence number c is 1, establishes the Q that adds up to of the transaction record that comprises in the New Transaction data;

The 5.2nd step was judged c≤Q, if entered for the 5.3rd step, otherwise entered for the 6th step;

The 5.3rd step was inserted into c bar transaction and relevant account thereof and goes in the financial database;

The 5.4th step defining variable time, and the exchange hour that the c bar is concluded the business deposits among the time;

The 5.5th step was judged time≤T.dl, and T.dl represents that T timeslice is the closing time of last timeslice, if entered for the 5.6th step, otherwise changed for the 5.7th step over to;

The attached oriented weighted graph G that writes T timeslice of information that the 5.6th step comprised transaction record c ^TIn, make c=c+1 then and changed for the 5.2nd step over to;

The 5.7th step T=T+1, and put G ^TBe sky, changed for the 5.5th step then over to.

Images