CN105931046A - Suspected transaction node set detection method and device - Google Patents

Abstract

The invention relates to the technical field of financial security, and particularly relates to a suspected transaction node set detection method and device, aiming to solve the technical problems that the accuracy and the efficiency are low and abnormal transaction communities with good concealment are difficult to be found when suspected money laundering communities in financial network are detected in the prior art. The method includes that for the n nodes in the financial network, the n nodes are divided for p times to obtain p divided sets, and a divided set with the largest divided set modularity is obtained based on the p divided sets, and the node set with the largest node set information entropy in the divided set is regarded as a suspected transaction node set. According to the method, the relevance between the nodes and the relation of the nodes in a network topology between the nodes are fully considered, so that the suspected transaction node set in the financial network can be accurately and reliably determined, and the suspected transaction node set can be a community which allows transaction.

Description

A kind of suspicious transaction node set method for detecting and device

Technical field

The present invention relates to technical field of financial safety, particularly relate to a kind of suspicious transaction node set method for detecting And device.

Background technology

Banking network community discovery refers to those internal relations in banking network tight, and external relation is sparse Group or sub-network are detected, and form Duo Gezi community, excavate these communities, it is possible to find net The contact hidden in network and rule.To detecting, those are hidden in normal finance friendship to banking network community detection techniques Easily the money laundering clique in network plays an important role.

In prior art, mainly come transaction community abnormal in banking network by method based on comentropy Detecting, the method way is as follows: first enter the features such as the trading activity in banking network and cash flow Row is analyzed, in conjunction with process of exchange and mode feature, with reference to the specified in more detail of China's block trade report, to different Often transaction and block trade frequency analysis and identification；Then on the basis of banking network community structure is analyzed, Abnormal transaction is carried out the step such as feature extraction, quantization, according to similarity or the contact of banking network interior joint Node in network, as partitioning standards, is divided by compactness, thus at height of node in forming some Similar or contact closely, son group that the contact of external node phase XOR each other is loose or sub-network, this little group or Sub-network is referred to as community, and whole network is made up of these communities.

The shortcoming that the method is primarily present be efficiency and precision relatively low, it is difficult to find disguised the most abnormal hand over Easily corporations.

In sum, prior art, when detecting the suspicious money laundering community in banking network, exists accurately and effect Rate is relatively low, it is difficult to find the technical problem of the most abnormal disguised corporations that conclude the business.

Summary of the invention

The present invention provides a kind of suspicious transaction node set method for detecting and device, exists in order to solve prior art When detecting the suspicious money laundering community in banking network, exist accurate and inefficient, it is difficult to find disguise relatively The technical problem of good exception transaction corporations.

On the one hand, the one suspicious transaction node set method for detecting that the embodiment of the present invention provides, including:

Determining n node in banking network to be detected, wherein, a node is a bank account, n For the integer more than 1；

For a node, according to the node transfer information of described node in setting duration, determine described node Nodal information entropy；

Described n node carries out p time respectively divide, obtain p and divide set, wherein, described p Divide the arbitrary division set in set and comprise m node set, a m node divided in set Without occuring simultaneously between set, the union of a m node set divided in set is described n node, institute Any node stated in m node set is connected with at least one node in the node set belonging to this node Connecing, wherein, two nodes are connected and refer to there is money transfer transactions between two nodes, wherein, and 1≤m≤n, P is the integer more than 1；

Divide set according to described p, determine that divides the division set that collection modules degree is maximum, and will The node set dividing set interior joint aggregate information entropy maximum determined is defined as suspicious transaction node set； Wherein, each divide set division collection modules degree, be the nodal information entropy according to described n node and Connection limit number between node determines；Two nodes are connected and refer to there is money transfer transactions between two nodes.

Alternatively, determine a division collection modules degree dividing set according to following manner, including:

Divide the nodal information entropy of each node set interior joint in set according to described, determine that described division collects The node set comentropy of each node set in conjunction；

According to the connection limit number between node, determine and described divide in set between any two node set Connect limit number；

According to the described connection limit number divided in set between any two node set, determine each set of node The node set net comentropy closed；

The node set comentropy of all node set, institute in described division set in set is divided according to described There is the total connection limit number between node set net comentropy and described n the node of node set, determine institute State the division collection modules degree dividing set.

Alternatively, division collection modules degree that division gather j is determined according to the following equation:

$T_j=\frac{\underset{k=1}{\overset{m}{\Σ}}(R_k-\frac{E_k}{n_4})}{K_L};$

Wherein, T_jFor the described division collection modules degree dividing set j, R_kThe of set j is divided for described The node set comentropy of k node set, E_kFor the described kth node set divided in set j Node set net comentropy, n₄For coefficient set in advance, K_LFor always connecting limit between described n node Number, 1≤j≤p, m are the described node set quantity divided in set.

Alternatively, the node set information of described node set k that divide in set is determined according to the following equation Entropy:

$R_k=\underset{i=1}{\overset{m_k}{\Σ}}{H}_i;$

Wherein, R_kFor the node set comentropy of node set k, H_iFor i-th in described node set k The nodal information entropy of individual node, m_kFor the number of nodes of described node set k, 1≤k≤m, 1≤m_k≤n；

The node set net comentropy of described node set k be determined according to the following equation:

$E_k={\left(\underset{k^{,}=1,k^{,}\≠k}{\overset{m}{\Σ}}{l}_{{\mathrm{kk}}^{,}}\right(\frac{n_1}{m}{\log }_{n_2}^{\frac{m}{n_1}}\left)\right)}^{n_3};$

Wherein, E_kFor the node set net comentropy of described node set k, l_kk'For node set k and joint Connection limit number between some set k ', node set k ' it is except described set of node in described m node set Close any node set outside k, n₁, n₂, n₃For coefficient set in advance.

Alternatively, described for a node, according to the node transfer information of described node in setting duration, Determine the nodal information entropy of described node, including:

According to described node node transfer information in setting duration, determine that the average money laundering of described node is general Rate；

According to the average money laundering probability of described node, determine the nodal information entropy of described node.

Alternatively, the average money laundering probability of node i be determined according to the following equation:

$\stackrel{\‾}{P_i}=\frac{\underset{L}{\Σ}{P}_i}{L};$

Wherein,For the average money laundering probability of described setting duration interior nodes i, L is described setting duration, P_iFor the money laundering probability in a unit time in described setting duration, and Wherein, Q_iFor the total dealing money in the node transfer information of described unit time interior nodes i, D_iFor described Total number of transactions number in the node transfer information of unit time interior nodes i, K_iFor described unit time interior nodes Total node degree in the node transfer information of i, Q is total in described unit time of banking network to be detected Dealing money, D is the banking network to be detected total number of transactions number in described unit time, and K is to be detected The banking network total node degree in described unit time, node i is any node in described n node.

Alternatively, the nodal information entropy of node i be determined according to the following equation:

$H_i=-\stackrel{\‾}{P_i}{\log }_n^{\stackrel{\‾}{P_i}};$

Wherein, H_iFor node i at the nodal information entropy of described setting duration,For described setting duration internal segment The average money laundering probability of some i, n is coefficient set in advance.

Alternatively, determine that a division is gathered according to following manner:

M the node Centroid respectively as m node set is randomly choosed from described n node；

For one in other n-m node, if this node only with in described m Centroid One Centroid is connected, then by the node set of this node division to described Centroid place；If should Node is connected with the multiple Centroids in described m Centroid, then by this node division to this joint Point is connected and the node set at Centroid place of limit maximum weight；If this node and described m centromere Point is all not attached to, then by the collection at the node place of the limit maximum weight between this node division to this node Close.

Alternatively, the limit weights being determined according to the following equation between node i and node j:

${\mathrm{\ω}}_{ij}=\sqrt[s]{{\left(\frac{T_{ij}}{T_i}\right)}^{t1}+{\left(\frac{T_{ij}}{T_j}\right)}^{t2}+{\left(\frac{F_{ij}}{F_i}\right)}^{t3}+{\left(\frac{F_{ij}}{F_j}\right)}^{t4}};$

Wherein, ω_ijFor setting the limit weights between duration interior nodes i and node j, T_ijFor described setting duration Transaction count between interior described node Transaction Information interior joint i and node j, T_iFor in described setting duration The transaction count of described node Transaction Information interior joint i, T_jFor described node transaction letter in described setting duration The transaction count of breath interior joint j, F_ijFor node Transaction Information interior joint i described in described setting duration and joint Dealing money between some j, F_iTransaction for node Transaction Information interior joint i described in described setting duration The amount of money, F_jFor the dealing money of node Transaction Information interior joint j described in described setting duration, t1, t2, T3, t4, s are respectively the coefficient set, and node i is any node in described n node, and node j is Any node in addition to node i in described n node.

Alternatively, described division according to described p is gathered, and determines that divides maximum the drawing of collection modules degree Divide set, and the node set dividing set interior joint aggregate information entropy maximum determined is defined as suspicious friendship Easily node set, including:

Set is divided as p initial individuals using described p；

Using each divide set divisions collection modules degree as this division set corresponding individuality fitness Function；

Initialize crossover probability Pc, mutation probability Pm, select probability Pi, iterations iter；

According to genetic algorithm and described p initial individuals, determine the individuality that a fitness function value is maximum；

It is defined as dividing set by individual corresponding division set maximum for the described fitness function value determined The division set that modularity is maximum, and divide, by determine, the set of node that set interior joint aggregate information entropy is maximum Conjunction is defined as suspicious transaction node set.

On the other hand, the one suspicious transaction node set detector that the embodiment of the present invention provides, including:

Node determines unit, for determining n node in banking network to be detected, wherein, a node Being a bank account, n is the integer more than 1；

Nodal information entropy determines unit, for for a node, according to the joint of described node in setting duration Point transfer information, determines the nodal information entropy of described node；

Division unit, divides for described n node carries out p time respectively, obtains p and divides set, Wherein, described p the arbitrary division set divided in set comprises m node set, and one divides set In m node set between without occuring simultaneously, the union of m node set divided in set is institute State n node, in any node in described m node set and the node set belonging to this node at least One node is connected, and wherein, two nodes are connected and refer to there is money transfer transactions between two nodes, wherein, 1≤m≤n, p are the integer more than 1；

Suspicious transaction node set determines unit, for dividing set according to described p, determines a division The division set that collection modules degree is maximum, and divide, by determine, the joint that set interior joint aggregate information entropy is maximum Point set is defined as suspicious transaction node set；Wherein, each division collection modules degree dividing set, be Connection limit number between nodal information entropy and node according to described n node determines；Two nodes are connected Connect and refer to there is money transfer transactions between two nodes.

Alternatively, described suspicious transaction node set determines unit, specifically for:

Divide the nodal information entropy of each node set interior joint in set according to described, determine that described division collects The node set comentropy of each node set in conjunction；

According to the connection limit number between node, determine and described divide in set between any two node set Connect limit number；

According to the described connection limit number divided in set between any two node set, determine each set of node The node set net comentropy closed；

The node set comentropy of all node set, institute in described division set in set is divided according to described There is the total connection limit number between node set net comentropy and described n the node of node set, determine institute State the division collection modules degree dividing set.

Alternatively, described suspicious transaction node set determines unit, specifically for:

It is determined according to the following equation and divides the division collection modules degree gathering j:

$T_j=\frac{\underset{k=1}{\overset{m}{\Σ}}(R_k-\frac{E_k}{n_4})}{K_L};$

Wherein, T_jFor the described division collection modules degree dividing set j, R_kThe of set j is divided for described The node set comentropy of k node set, E_kFor the described kth node set divided in set j Node set net comentropy, n₄For coefficient set in advance, K_LFor always connecting limit between described n node Number, 1≤j≤p, m are the described node set quantity divided in set.

Alternatively, described suspicious transaction node set determines unit, specifically for:

The node set comentropy of node set k being determined according to the following equation in described division set:

$R_k=\underset{i=1}{\overset{m_k}{\Σ}}{H}_i;$

Wherein, R_kFor the node set comentropy of node set k, H_iFor i-th in described node set k The nodal information entropy of individual node, m_kFor the number of nodes of described node set k, 1≤k≤m, 1≤m_k≤n；

The node set net comentropy of described node set k be determined according to the following equation:

$E_k={\left(\underset{k^{,}=1,k^{,}\≠k}{\overset{m}{\Σ}}{l}_{{\mathrm{kk}}^{,}}\right(\frac{n_1}{m}{\log }_{n_2}^{\frac{m}{n_1}}\left)\right)}^{n_3};$

Wherein, E_kFor the node set net comentropy of described node set k, l_kk'For node set k and joint Connection limit number between some set k ', node set k ' it is except described set of node in described m node set Close any node set outside k, n₁, n₂, n₃For coefficient set in advance.

Alternatively, described nodal information entropy determines unit, specifically for:

According to described node node transfer information in setting duration, determine that the average money laundering of described node is general Rate；

According to the average money laundering probability of described node, determine the nodal information entropy of described node.

Alternatively, described nodal information entropy determines unit, specifically for:

The average money laundering probability of node i be determined according to the following equation:

$\stackrel{\‾}{P_i}=\frac{\underset{L}{\Σ}{P}_i}{L};$

Wherein,For the average money laundering probability of described setting duration interior nodes i, L is described setting duration, P_iFor the money laundering probability in a unit time in described setting duration, and Wherein, Q_iFor the total dealing money in the node transfer information of described unit time interior nodes i, D_iFor described Total number of transactions number in the node transfer information of unit time interior nodes i, K_iFor described unit time interior nodes Total node degree in the node transfer information of i, Q is total in described unit time of banking network to be detected Dealing money, D is the banking network to be detected total number of transactions number in described unit time, and K is to be detected The banking network total node degree in described unit time, node i is any node in described n node.

Alternatively, described nodal information entropy determines unit, specifically for:

The nodal information entropy of node i be determined according to the following equation:

$H_i=-\stackrel{\‾}{P_i}{\log }_n^{\stackrel{\‾}{P_i}};$

Wherein, H_iFor node i at the nodal information entropy of described setting duration,For described setting duration internal segment The average money laundering probability of some i, n is coefficient set in advance.

Alternatively, described division unit, specifically for:

Determine that a division is gathered according to following manner:

M the node Centroid respectively as m node set is randomly choosed from described n node；

For one in other n-m node, if this node only with in described m Centroid One Centroid is connected, then by the node set of this node division to described Centroid place；If should Node is connected with the multiple Centroids in described m Centroid, then by this node division to this joint Point is connected and the node set at Centroid place of limit maximum weight；If this node and described m centromere Point is all not attached to, then by the collection at the node place of the limit maximum weight between this node division to this node Close.

Alternatively, described division unit, it is additionally operable to:

The limit weights being determined according to the following equation between node i and node j:

${\mathrm{\ω}}_{ij}=\sqrt[s]{{\left(\frac{T_{ij}}{T_i}\right)}^{t1}+{\left(\frac{T_{ij}}{T_j}\right)}^{t2}+{\left(\frac{F_{ij}}{F_i}\right)}^{t3}+{\left(\frac{F_{ij}}{F_j}\right)}^{t4}};$

Wherein, ω_ijFor setting the limit weights between duration interior nodes i and node j, T_ijDuring for described setting Transaction count between long interior described node Transaction Information interior joint i and node j, T_iFor described setting duration The transaction count of interior described node Transaction Information interior joint i, T_jConclude the business for described node in described setting duration The transaction count of information interior joint j, F_ijFor node Transaction Information interior joint i described in described setting duration And the dealing money between node j, F_iFor node Transaction Information interior joint i's described in described setting duration Dealing money, F_jFor the dealing money of node Transaction Information interior joint j described in described setting duration, t1, T2, t3, t4, s are respectively the coefficient set, and node i is any node in described n node, node J is any node in described n node in addition to node i.

Alternatively, described suspicious transaction node set determines unit, specifically for:

Set is divided as p initial individuals using described p；

Using each divide set divisions collection modules degree as this division set corresponding individuality fitness Function；

Initialize crossover probability Pc, mutation probability Pm, select probability Pi, iterations iter；

According to genetic algorithm and described p initial individuals, determine the individuality that a fitness function value is maximum；

It is defined as dividing set by individual corresponding division set maximum for the described fitness function value determined The division set that modularity is maximum, and divide, by determine, the set of node that set interior joint aggregate information entropy is maximum Conjunction is defined as suspicious transaction node set.

The method that the embodiment of the present invention provides, for n node in banking network, by n node respectively Carry out p time to divide, obtain p and divide set, and obtain a division set according to this p division set The division set that modularity is maximum, and by set of node cooperation maximum for this division set interior joint aggregate information entropy For suspicious transaction node set.The method, has taken into full account the relatedness between node, between node Network topology structure in relation between each node, such that it is able to accurately and reliably determine banking network In suspicious transaction node set, this suspicious transaction node set is the community that can conclude the business.

Accompanying drawing explanation

For the technical scheme being illustrated more clearly that in the embodiment of the present invention, institute in embodiment being described below The accompanying drawing used is needed to briefly introduce, it should be apparent that, the accompanying drawing in describing below is only the present invention's Some embodiments, from the point of view of those of ordinary skill in the art, in the premise not paying creative work Under, it is also possible to other accompanying drawing is obtained according to these accompanying drawings.

The suspicious transaction node set method for detecting flow chart that Fig. 1 provides for the embodiment of the present invention；

The node topology structural representation that Fig. 2 provides for the embodiment of the present invention；

The suspicious transaction node set method for detecting detail flowchart that Fig. 3 provides for the embodiment of the present invention；

The suspicious transaction node set detector schematic diagram that Fig. 4 provides for the embodiment of the present invention.

Detailed description of the invention

In order to make the object, technical solutions and advantages of the present invention clearer, below in conjunction with accompanying drawing to this Bright it is described in further detail, it is clear that described embodiment is only some embodiments of the present invention, Rather than whole embodiments.Based on the embodiment in the present invention, those of ordinary skill in the art are not doing Go out all other embodiments obtained under creative work premise, broadly fall into the scope of protection of the invention.

Below in conjunction with Figure of description, the embodiment of the present invention is described in further detail.

As it is shown in figure 1, the suspicious transaction node set method for detecting method that the embodiment of the present invention provides, including:

Step 101, n the node determined in banking network to be detected；

Wherein, a node is a bank account；

Step 102, for a node, according to setting the node transfer information of described node in duration, really The nodal information entropy of fixed described node；

Step 103, described n node is carried out respectively p time divide, obtain p divide gather；

Wherein, described p the arbitrary division set divided in set comprises m node set, a division Without occuring simultaneously between m node set in set, the union of a m node set divided in set For in described n node, any node in described m node set and the node set belonging to this node At least one node is connected, and wherein, two nodes are connected and refer to there is money transfer transactions between two nodes, Wherein, 1≤m≤n, p are the integer more than 1；

Step 104, divide set according to described p, determine that divides the division that collection modules degree is maximum Set, and the node set dividing set interior joint aggregate information entropy maximum determined is defined as suspicious transaction Node set.

Wherein, each division collection modules degree dividing set, is the nodal information according to described n node Connection limit number between entropy and node determines；Two nodes are connected and refer to transfer accounts between two nodes friendship Easily.

Node in the embodiment of the present invention refers to can be used for the bank account that fund proceeds to produce with fund.As Shown in Fig. 2, the node topology structural representation provided for the embodiment of the present invention, wherein with total nodes for 9 Being illustrated, in actual application, total nodes does not limits.9 nodes represent 9 finance to be detected respectively 9 bank accounts in network, have between node with node and are connected limit, represent there is friendship between the two node Easily dealing, the limit weights size between node reflects the frequent degree of transaction between two nodes.Such as, Node 1 and node 2, the limit weights between node 1 and node 2 are 20, the limit weights between two nodes It is to determine, instead according to composite factors such as two nodes transaction count in certain time length, dealing money Having reflected the frequent degree of two internodal transaction, limit weights are the biggest, illustrate to conclude the business between node the most frequent.

In above-mentioned steps 101, it is first determined go out n node in banking network to be detected, wherein, one Node is a bank account, and n is the integer more than 1, and n node represents n the silver carrying out detecting Row account, the final purpose of the inventive method is intended to find out the set of part of nodes from this n node, this The set of a little nodes is can be with transaction node set, it is also possible to referred to as suspicious transaction community.

In above-mentioned steps 102, for a node in n node, according to described node in setting duration Node transfer information, determine the nodal information entropy of described node.

Wherein, the nodal information entropy of a node is true according to the node transfer information of this node in setting duration Fixed, wherein setting duration can be the natural law set, such as 10 days, 20 days etc., it is also possible to be to set Hourage, such as 4 hours, 8 hours etc., the concrete duration that sets was depending on being actually needed, and node is transferred accounts Information comprises node and is setting total dealing money of each node of duration, total number of transactions number, total node degree, And banking network to be detected is setting total dealing money of duration, total number of transactions number, total node degree.Wherein, Total node degree of one node refers to set the quantity of the interior node having transaction with this node of duration, such as, joint Point i has 10 transaction, node k to have 20 transaction, node l to have 5 times with node j in setting duration Transaction, node m have 6 transaction, then total node degree of node i is 4, the total number of transactions number of node i It it is 31 times.

Wherein, nodal information entropy is for representing that this node has the frequent degree participated in business.

Banking network to be detected turns as the total of all nodes in setting duration at the total dealing money setting duration Go out the amount of money and always proceed to amount of money sum, setting the total number of transactions number of duration as setting all nodes in duration Always produce number of times and always proceed to number of times sum, setting total node degree of duration as setting all nodes in duration Total node degree sum.Such as when setting a length of 2 days, then can be further when setting dividing unit in duration Long, such as unit time is 1 day, comprises 3 node A, B, C in banking network to be detected.

First day: node A transfers accounts 10,000,000 yuan to node B, and node B transfers accounts 5,000,000 yuan to node C；

Second day: node B transfers accounts 3,000,000 yuan to node A, and node A transfers accounts 4,000,000 yuan to node C；

Then in setting duration (in i.e. 2 days), total dealing money of banking network to be detected is 20,000,000 yuan, Total number of transactions number is 4 times, and total node degree is 6.

In above-mentioned steps 103, described n node is carried out respectively p time and divides, obtain p and divide set.

Wherein, described p the arbitrary division set divided in set comprises m node set, a division Without occuring simultaneously between m node set in set, the union of a m node set divided in set For in described n node, any node in described m node set and the node set belonging to this node At least one node is connected, and wherein, two nodes are connected and refer to there is money transfer transactions between two nodes, Wherein, 1≤m≤n, p are the integer more than 1.

Or illustrate as a example by Fig. 2, Fig. 2 have 9 nodes, i.e. n=9, it is assumed that m value is 3, P value is 4, i.e. carries out 4 times and divides.4 divisions obtained after carrying out 9 nodes 4 times dividing Set is respectively as follows:

Divide and gather 1:{{1,2}, { 5,3,6,8}, { 9,4,7}}；

Divide and gather 2:{{1,2,6,7}, { 4,3,9}, { 8,5}}；

Divide and gather 3:{{2,1,6}, { 3,5}, { 9,4,8,7}}；

Divide and gather 4:{{4,3,2}, { 5,8,6}, { 7,1,9}}.

Therefore, during 9 nodes divide at 4 times, having obtained 4 and divided set, wherein, each division collects Conjunction has been each divided into 3 node set, an any two node set divided in set without occuring simultaneously, The union of one all node set divided in set is described 9 nodes.

At step 104, divide set according to described p, determine that divides a collection modules degree maximum Dividing set, and divide, by determine, the node set that set interior joint aggregate information entropy is maximum, being defined as can Doubt transaction node set.Such as, determine one divide the maximum division collection of collection modules degree be combined into 2,5, 7}, 1,3,4}, 6,8,9}}, and node set therein { the nodal information entropy of 1,3,4} is Greatly, the most finally determine node set 1,3,4} is suspicious transaction node set, and i.e. node set 1,3, The collection of the bank account composition representated by 4} is combined into a suspicious transaction community.

Divide set for each, be required for calculating the division collection modules degree of this division set, specifically, It is the connection limit number between nodal information entropy and the node according to described n node, determines and divide drawing of set Diversity matched moulds lumpiness；Wherein, two nodes are connected and refer to there is money transfer transactions between two nodes, such as, Divide set for above-mentioned 4, obtain each division collection modules degree dividing set and be respectively 51,32, 42,12 etc., the size of a division collection modules degree dividing set can reflect in this division set and exist The size of the probability of suspicious transaction node set, divides collection modules degree the biggest, then exist in this division set The probability of suspicious transaction node set is the biggest.

The method that the embodiment of the present invention provides, for n node in banking network, by n node respectively Carry out p time to divide, obtain p and divide set, and obtain a division set according to this p division set The division set that modularity is maximum, and by set of node cooperation maximum for this division set interior joint aggregate information entropy For suspicious transaction node set.The method, has taken into full account the relatedness between node, between node Network topology structure in relation between each node, such that it is able to accurately and reliably determine banking network In suspicious transaction node set, this suspicious transaction node set is the community that can conclude the business.

In above-mentioned steps 102, for a node, true according to the nodal information entropy of this node in setting duration The mode of the nodal information entropy of this node fixed has a lot, specifically can determine corresponding joint according to actual needs Dot information entropy calculation, such as, in can first determining this node all unit time in setting duration Money laundering probability, then determine the nodal information entropy of this node according to maximum of which money laundering probability；Or It is the money laundering probability first determining this node in all unit time set in duration, then according to wherein the Two big money laundering probability determine the nodal information entropy of this node.Concrete mode is depending on being actually needed.

Alternatively, described for a node, according to the node transfer information of described node in setting duration, Determine the nodal information entropy of described node, including:

According to described node node transfer information in setting duration, determine that the average money laundering of described node is general Rate；

According to the average money laundering probability of described node, determine the nodal information entropy of described node.

Aforesaid way, according to the node transfer information set in duration, determines that the average money laundering of probability is general Rate, then according to average money laundering probability, determine the nodal information entropy of this node.Such as, a length of L during setting My god, unit time is one day, first calculates the money laundering probability of this node every day, then calculates this joint Point, at the average money laundering probability of L days, then according to this node at the average money laundering probability of L days, determines this The nodal information entropy of node.The method, determines that by the average money laundering probability of node the node of this node is believed Breath entropy, can more accurately reflect the size of the money laundering probability of each node in node topology network, from And can aid in and more accurately detect suspicious transaction node set.

For how determining the average money laundering probability of a node, and how to determine according to average money laundering probability Nodal information entropy, depending on being actually needed.

Alternatively, the average money laundering probability of node i be determined according to the following equation:

$\stackrel{\‾}{P_i}=\frac{\underset{L}{\Σ}{P}_i}{L};$

Wherein,For the average money laundering probability of described setting duration interior nodes i, L is described setting duration, P_iFor the money laundering probability in a unit time in described setting duration, and Wherein, Q_iFor the total dealing money in the node transfer information of described unit time interior nodes i, D_iFor described Total number of transactions number in the node transfer information of unit time interior nodes i, K_iFor described unit time interior nodes Total node degree in the node transfer information of i, Q is total in described unit time of banking network to be detected Dealing money, D is the banking network to be detected total number of transactions number in described unit time, and K is to be detected The banking network total node degree in described unit time, node i is any node in described n node.

In said method, give the concrete formula of the average money laundering probability calculating node i, wherein, set Duration can be natural law, and such as 10 days, unit time can be 1 day, first calculates according to formula The money laundering probability of node i every day, then calculates node i in this average money laundering probability of 10 days, the method When calculating the money laundering probability of unit time of a node, fully take into account this node in unit time Total dealing money, total number of transactions number, total node degree, and banking network to be detected is in unit time Total dealing money, total number of transactions number, total node degree, such that it is able to reflect current financial more all-sidedly and accurately In network, the situation of each node transaction, contributes to more accurately detecting suspicious transaction node set.

Said method has been merely given as calculating a kind of mode of node unit time money laundering probability, actual application In alternate manner can also be had to calculate, concrete depending on being actually needed.

Alternatively, the nodal information entropy of node i be determined according to the following equation:

$H_i=-\stackrel{\‾}{P_i}{\log }_n^{\stackrel{\‾}{P_i}};$

Wherein, H_iFor node i at the nodal information entropy of described setting duration,For described setting duration internal segment The average money laundering probability of some i, n is coefficient set in advance.

Said method, gives the concrete formula of a kind of nodal information entropy calculating a node, wherein sets The preferred value of coefficient n be 2, the most preferably,The nodal information of one node Entropy embodies the probability size of this node and other node generation money transfer transactions, such that it is able to reflection present node The frequent degree transferred accounts.

In above-mentioned steps 103, n node is carried out respectively p time and divides, obtain p and divide set.Its In, concrete dividing mode is not specifically limited.Can be such as that n node is randomly divided into m joint Point set, or divide according to the size of the nodal information entropy of node, a kind of concrete side is given below Formula.

Alternatively, determine that a division is gathered according to following manner:

M the node Centroid respectively as m node set is randomly choosed from described n node；

For one in other n-m node, if this node only with in described m Centroid One Centroid is connected, then by the node set of this node division to described Centroid place；If should Node is connected with the multiple Centroids in described m Centroid, then by this node division to this joint Point is connected and the node set at Centroid place of limit maximum weight；If this node and described m centromere Point is all not attached to, then by the collection at the node place of the limit maximum weight between this node division to this node Close.

Whether aforesaid way, when being m node by n node division, mainly have according between node Connect, i.e. between node, whether have transaction record, and according to the limit weights size between node.

First-selection selects m node, respectively as the centromere of m node set from n node at random Point, the most respectively by the node set of other n-m node division to one of them Centroid place, Other n-m node divides three types:

The first type: node is only connected with one of them Centroid.By this node division to this centromere The node set at some place；

The second type: node is connected with multiple Centroids.By this node division to these node limit weights The node set at maximum Centroid place；

The third type: node is not connected with any Centroid.This node division is between this node The set at the node place of limit maximum weight.

Below in conjunction with Fig. 2, give an example and illustrate.With reference to Fig. 2, one has 9 nodes, it is assumed that m Value is 3, and p value is 2, i.e. carries out twice division.

Assuming to divide for the first time, 3 Centroids selected at random are respectively 1, and 5,8, the most right Other node carries out handsome choosing.

For node 2, due to node and a Centroid, i.e. it is connected with Centroid 1, thus joint Point 2 and Centroid 1 belong to same node set；

For node 3, due to node and a Centroid, i.e. it is connected with Centroid 5, thus joint Point 2 and Centroid 5 belong to same node set；

For node 4, due to node and a Centroid, i.e. it is connected with Centroid 7, thus joint Point 2 and Centroid 8 belong to same node set；

For node 6, node 6 and Centroid 1,5,8 is the most connected, but weighs with the limit of Centroid 5 Value maximum, therefore node 6 and Centroid 5 belong to same node set；

For node 7, due to node and a Centroid, i.e. it is connected with Centroid 1, thus joint Point 7 and Centroid 1 belong to same node set；

For node 9, owing to node 9 is not connected with any one Centroid in 3 Centroids, But owing to the limit weights between node 9 and node 7 are relatively big, therefore node 9 and node 7 belong to same node Set, and node 7 and Centroid 1 belong to same node set, therefore, node 9 belongs to node 1 Same node set.

Through the division of said method, the result divided for the first time is that 9 nodes are divided into 3 nodes In set, respectively node set 1:{1,2,7,9}, node set 2:{5,3,6}, set of node Close 3:{8,4}.

Divide for second time, it is assumed that 3 Centroids randomly choosed are 3,6,9, then according to same Method, 3 node set finally determined are respectively node set 1:{3,2,4}；Node set 2: { 6,1,5}；Node set 3:{9,7,8}.

Therefore by dividing last time, according to Fig. 2, working as p=2, when n=9, m=3, obtain finally divides knot Fruit is:

Divide and gather 1:{{1,2,7,9}, { 5,3,6}, { 8,4}}.

Divide and gather 2:{{3,2,4}, { 6,1,5}, { 9,7,8}}.

Above-mentioned division methods, simple easily realizes, and employs the annexation between node and limit weights are big Little, thus all can be closely related with the node in same node set, the joint in the most same node set There is during point transaction dealing, thus can aid in and detect suspicious transaction node set exactly.

In said method, the limit weights between two nodes, wherein, the limit power between two nodes are used Value size reflects the frequent degree of the transaction between two nodes, and, limit weights are the biggest, illustrate node it Between transaction the most frequent.Calculation for the limit weights between node has a lot, and a kind of limit is given below The computational methods of weights.

Alternatively, the limit weights being determined according to the following equation between node i and node j:

${\mathrm{\ω}}_{ij}=\sqrt[s]{{\left(\frac{T_{ij}}{T_i}\right)}^{t1}+{\left(\frac{T_{ij}}{T_j}\right)}^{t2}+{\left(\frac{F_{ij}}{F_i}\right)}^{t3}+{\left(\frac{F_{ij}}{F_j}\right)}^{t4}};$

Wherein, ω_ijFor setting the limit weights between duration interior nodes i and node j, T_ijFor described setting duration Transaction count between interior described node Transaction Information interior joint i and node j, T_iFor in described setting duration The transaction count of described node Transaction Information interior joint i, T_jFor described node transaction letter in described setting duration The transaction count of breath interior joint j, F_ijFor node Transaction Information interior joint i described in described setting duration and joint Dealing money between some j, F_iTransaction for node Transaction Information interior joint i described in described setting duration The amount of money, F_jFor the dealing money of node Transaction Information interior joint j described in described setting duration, t1, t2, T3, t4, s are respectively the coefficient set, and node i is any node in described n node, and node j is Any node in addition to node i in described n node.

Said method, when calculating the limit weights between node i and node j, has used the transaction time of node i Number, dealing money, the transaction count of node j, the friendship between dealing money, and node i and node j Easily number of times, dealing money, and preferably, t1 value is 2, and t2 value is 2, and t3 value is 2, t4 Value is 2, and s value is 2, i.e. ${\mathrm{\ω}}_{ij}=\sqrt{{\left(\frac{T_{ij}}{T_i}\right)}^2+{\left(\frac{T_{ij}}{T_j}\right)}^2+{\left(\frac{F_{ij}}{F_i}\right)}^2+{\left(\frac{F_{ij}}{F_j}\right)}^2},$ The method calculates two During limit weights between individual node, fully employ the Transaction Information of two nodes self, and between node Transaction Information, such that it is able to the limit weights calculated can much reflect between two nodes transaction frequency Numerous degree, wherein, limit weights are the biggest, show that the transaction between node is the most frequent.

In above-mentioned steps 104, after obtaining p division set, can first calculate each and divide collection The division collection modules degree closed, then selects and divides the division set that collection modules degree is maximum, and from choosing Dividing of going out selects the maximum node set of a node set comentropy as suspicious transaction node in set Set, it is contemplated that so that finally can more accurately obtain suspicious transaction node set, therefore Actual application need the sample size dividing set sufficiently large.

Such as, first kind of way can be to ensure that the value of the sample size p dividing set is big as much as possible, Such as value 1000,2000 etc., but this mode that p value takes very high values simply has a problem that, It is exactly that p sample likely has significant portion generation overlap, because one divides what set is divided into The node set of sample, depends entirely on choosing of m Centroid, if m Centroid chooses one Sample, then two samples, i.e. two divide set equally.

Such as, the second way can be that m Centroid of prior regulation p sample is respectively different, should Mode can solve produced problem in first kind of way well, but which is not optimal selecting party Formula, because specifying the selection of m Centroid of each sample in advance, first adds difficulty, the numbest Tired, secondly, it is possible to the selection mode that optimal result is not specified in advance comprises, thus causes nothing Method finds out optimum.

By above-mentioned analysis, in order to expand the multiformity dividing set and comprehensive, need to combine other one A little methods, in actual application, have a lot of intelligent algorithm, can accomplish the extension to initial sample, Such as artificial fish-swarm algorithm, simulated annealing, ant group algorithm, genetic algorithm etc., below the present invention implement Example combination provides a kind of combination genetic algorithm and obtains dividing the concrete of the maximum division set of collection modules degree Realize.

Alternatively, described division according to described p is gathered, and determines that divides maximum the drawing of collection modules degree Divide set, and the node set dividing set interior joint aggregate information entropy maximum determined is defined as suspicious friendship Easily node set, including:

Set is divided as p initial individuals using described p；

Using each divide set divisions collection modules degree as this division set corresponding individuality fitness Function；

Initialize crossover probability Pc, mutation probability Pm, select probability Pi, iterations iter；

According to genetic algorithm and described p initial individuals, determine the individuality that a fitness function value is maximum；

It is defined as dividing set by individual corresponding division set maximum for the described fitness function value determined The division set that modularity is maximum, and divide, by determine, the set of node that set interior joint aggregate information entropy is maximum Conjunction is defined as suspicious transaction node set.

In said method, p division set can be as p initial individuals of genetic algorithm, each division Set divisions collection modules degree as this division set corresponding individuality fitness function, then according to something lost Propagation algorithm and described p initial individuals, determine the individuality that fitness function value is maximum, and will determine The set that divides of the individual correspondence that fitness function value is maximum is defined as dividing the division that collection modules degree is maximum Set, finally, is defined as suspicious by the node set dividing set interior joint aggregate information entropy maximum determined Transaction node set.Illustrate below in conjunction with object lesson.

Such as, p value is 3, and m value is 3, and initial 3 individualities are respectively as follows:

Divide and gather 1:{{1,2,7,9}, { 5,3,6}, { 8,4}}；

Divide and gather 2:{{3,2,4}, { 6,1,5}, { 9,7,8}}；

Divide and gather 3:{{2,1}, { 4,3,5,6,8}, { 7,9}}.

Wherein, each division gathers the initialized individuality being genetic algorithm, each division collection matched moulds Lumpiness is the fitness function of individuality, and fitness function value is the biggest, shows that individuality is the most excellent, i.e. shows individual It is the biggest that what body was corresponding divides the probability comprising suspicious transaction node set in set.

Need below, according to genetic algorithm, to divide set according to above 3, then iteration goes out more to divide collection Close such as after the iterations iter specified reaches, altogether create 2000 individualities, i.e. two divisions Set, then the result finally obtained according to genetic algorithm is that in 20000 individualities, fitness function value is maximum Individuality, after i.e. finally the iterations iter in regulation reaches, one can be obtained and divide collection modules degree Maximum division set, then using node set maximum for this division set interior joint comentropy as final Suspicious transaction node set, the most suspicious transaction community.

Firstly, it is necessary to each individuality is encoded, owing to coded system is a lot, a kind of coding is given below Mode illustrates.

After 3 division set are encoded, obtain 3 coding individualities, be respectively as follows:

The individual 1:(1 of coding, 1,2,3,2,2,1,3,1)；

The individual 2:(2 of coding, 1,1,1,2,2,3,3,3)；

The individual 3:(1 of coding, 1,2,2,2,2,3,2,3).

As a example by coding individual 1, each coding individuality comprises n coding unit, each coding unit Numeral shows that the node that this coding unit is corresponding belongs to which node set, the 1st number in coding individual 1 Word 1 represents that node 1 belongs to node set 1, and the 2nd numeral 1 shows that node 2 belongs to node set 1, 3rd numeral 2 shows that node 3 belongs to node set 2, and the 4th numeral 3 shows that node 4 belongs to node Gathering the 3, the 5th numeral 2 and show that node 5 belongs to node set 2, the 6th numeral 2 shows node 6 Belonging to node set 2, the 7th numeral 1 shows that node 7 belongs to node set 1, the 8th numeral 3 table Bright node 8 belongs to node set 3, and the 9th numeral 1 shows that node 9 belongs to node set 1.

Coding individual 2 is identical with individual 3 coded systems of coding and coding individuality 1.

Owing to genetic algorithm belongs to known algorithm, seldom repeat at this, below mainly genetic algorithm is related to To 3 operations once illustrate, i.e. select operation, intersect operation, mutation operation.

Wherein, selecting operation is therefrom to select some individuals as being iterated from p initial individuality Initial individuals, has 3 individualities in the embodiment of the present invention, the most finally select division set 1 and divide collection Close 3 as the initial individuals being iterated, i.e. 3 individualities after encoding selecting coding individual 1 and compiling Code individual 3 is as the initial individuals of further iteration；

Code segment unit between the operation that intersects refers to for two individualities swaps, such that it is able to To two new individualities, such as coding individual 1 and coding individual 3, first select a crossover location, Such as selecting crossover location is 7, will encode individual 1 and carry out with the 7th coding unit encoding individual 3 Exchange, thus it is individual to obtain two new codings, it may be assumed that

Before intersection:

The individual 1:(1 of coding, 1,2,3,2,2,1,3,1)；

The individual 3:(1 of coding, 1,2,2,2,2,3,2,3).

After intersection:

The individual 1:(1 of coding, 1,2,3,2,2,3,3,1)；

The individual 3:(1 of coding, 1,2,2,2,2,1,2,3).

Mutation operation refers to for a coding individuality, with certain mutation probability, by coding individuality The variation of some coding unit is another coding unit, such as with the individual 1:(1 of coding, and 1,2,3,2, 2,1,3,1), as a example by, first select a variable position with certain mutation probability Pm, such as select The variable position selected is 9, it is assumed that the numeral after the 9th coding unit variation is 3, then after variation Coding individual 1 is: (1,1,2,3,2,2,1,3,3).

Above be merely given as use genetic algorithm each operation an example, actually used in, concrete Select operation, mutation operation, the occupation mode of intersection operation to have a variety of, be visually actually needed and carry out phase Should convert, to this, the present invention does not do any restriction.

Thus, by above genetic algorithm, can be able to obtain more by p initial division set Division set, and therefrom select one and divide the division set that collection modules degree is maximum, and by this stroke Point node set that set interior joint aggregate information entropy is maximum is as suspicious transaction node set, thus the party Method, can detect the suspicious transaction node set in banking network to be detected accurately and efficiently.

One division collection modules degree dividing set can be used for representing in this division set suspicious transaction occur The probability size of node set, when the division collection modules degree that divides set is the biggest, shows this division Set occurring, the probability of suspicious transaction node set is the biggest.For a division collection modules dividing set The computational methods of degree, the embodiment of the present invention is the nodal information entropy according to n the node divided in set, joint Connection limit number between point, determines a division collection modules degree dividing set.

Specifically, for example, it may be first calculate according to the nodal information entropy of the node in each node set Go out the node set comentropy of each node set, then according to an each node set divided in set In the quantity of node, distribute corresponding weight for each node set, then according to node set comentropy And the weight of node set, determine a division collection modules degree dividing set, also can also is that other Mode.

Implementation that a kind of embodiment of the present invention use is given below.

Alternatively, described division for one is gathered, according to nodal information entropy and the node of described n node Between connection limit number, determine described divide set division collection modules degree；Wherein, two nodes are connected Connect and refer to there is money transfer transactions between two nodes, including:

Divide the nodal information entropy of each node set interior joint in set according to described, determine that described division collects The node set comentropy of each node set in conjunction；

According to the connection limit number between node, determine and described divide in set between any two node set Connect limit number；

According to the described connection limit number divided in set between any two node set, determine each set of node The node set net comentropy closed；

The node set comentropy of all node set, institute in described division set in set is divided according to described There is the total connection limit number between node set net comentropy and described n the node of node set, determine institute State the division collection modules degree dividing set.

Said method, divides set for one, first according to the node letter of each node divided in set Breath entropy, calculates the node set comentropy of each node set, then according to the connection limit number between node, Determine the connection limit number between any two node set in division set, wherein, between two node set The limit number of connecting refer to the summation of the limit number that the node in two node set is connected；Then according to division Connection limit number between any two node set in set, determines the node set net letter of each node set Breath entropy, finally according to the node set comentropy of all node set, divides all node set in set Node set net comentropy and the total of all nodes connect limit number, determine the described division set dividing set Modularity, thus the method is when calculating the division aggregate information entropy that divides set, fully employs joint The nodal information entropy of point, the node set comentropy of node set, the joint that the relation between node set generates Point set net comentropy, such that it is able to more accurately utilize division collection modules degree to reflect, one divides collection Conjunction occurs the probability size of suspicious transaction node set, thus contributes to detecting suspicious transaction node exactly Set.

A kind of specific formula for calculation according to said method computation partition collection modules degree is given below.

Alternatively, division collection modules degree that division gather j is determined according to the following equation:

$T_j=\frac{\underset{k=1}{\overset{m}{\Σ}}(R_k-\frac{E_k}{n_4})}{K_L};$

Wherein, T_jFor the described division collection modules degree dividing set j, R_kThe of set j is divided for described The node set comentropy of k node set, E_kFor the described kth node set divided in set j Node set net comentropy, n₄For coefficient set in advance, K_LFor always connecting limit between described n node Number, 1≤j≤p, m are the described node set quantity divided in set.

Said method, gives a kind of computing formula calculating a division collection modules degree dividing set, Wherein divide node set comentropy R of the kth node set of set j_k, and described division set j In node set net comentropy E of kth node set_kEquation below can be used respectively to calculate:

Alternatively, the node set information of described node set k that divide in set is determined according to the following equation Entropy:

$R_k=\underset{i=1}{\overset{m_k}{\Σ}}{H}_i;$

Wherein, R_kFor the node set comentropy of node set k, H_iFor i-th in described node set k The nodal information entropy of individual node, m_kFor the number of nodes of described node set k, 1≤k≤m, 1≤m_k≤n；

The node set net comentropy of described node set k be determined according to the following equation:

$E_k={\left(\underset{k^{,}=1,k^{,}\≠k}{\overset{m}{\Σ}}{l}_{{\mathrm{kk}}^{,}}\right(\frac{n_1}{m}{\log }_{n_2}^{\frac{m}{n_1}}\left)\right)}^{n_3};$

Wherein, E_kFor the node set net comentropy of described node set k, l_kk'For node set k and joint Connection limit number between some set k ', node set k ' it is except described set of node in described m node set Close any node set outside k, n₁, n₂, n₃For coefficient set in advance.

Said method, gives node set comentropy D of the kth node set of computation partition set j_k, And described node set net comentropy E of kth node set divided in set j_kThe specifically side of calculating Formula, wherein, using the sum of the nodal information entropy of all of node in a node set as this node set Node set comentropy；And a node set net comentropy is mainly with the connection limit between node set Number is relevant, and two edge fit numbers between node set refer to connect between two node set interior joint limit number Summation, as a example by Fig. 2, such as, one divides collection and is combined into: 3,2,4}, and 6,1,5}, 9,7, 8}}, wherein node set 1 is that { 3,2,4}, node set 2 is that { 6,1,5}, node set 3 is { 9,7,8}.Then the connection limit number between node set 1 and node set 2 is 2, respectively node 3 Being connected with node 5, node 2 is connected with node 1；Connection limit number between node 1 and node 3 is 1, And it is assumed that n₁, n₂, n₃Value is 1 respectively, 3,2, then $E_1={\left(\underset{k^{,}=1,k^{,}\≠k}{\overset{m}{\Σ}}{l}_{{\mathrm{kk}}^{,}}\right(\frac{n_1}{m}{\log }_{n_2}^{\frac{m}{n_1}}\left)\right)}^{n_3}={\left(\left(1+2\right)*\frac{1}{3}*{\log }_3^3\right)}^2=1,$ Therefore the joint of node set 1 Point net comentropy is 1, certainly, is more than merely given as an example, and actual application is depending on being actually needed. Additionally, in actual applications, it is preferable that above-mentioned Parameters in Formula value, it is preferable that n₁, n₂, n₃, n₄, value is 1 respectively, 2,2,2, in i.e. actual application, it is preferable that $E_k={\left(\underset{k^{,}=1,k^{,}\≠k}{\overset{m}{\Σ}}{l}_{{\mathrm{kk}}^{,}}\right(\frac{1}{m}{\log }_2^m\left)\right)}^2,T_j=\frac{\underset{k=1}{\overset{m}{\Σ}}(R_k-\frac{E_k}{2})}{K_L}.$

The suspicious transaction node set method for detecting provided the embodiment of the present invention below is described in detail.Such as figure Shown in 3, the suspicious transaction node set method for detecting detailed process schematic diagram provided for the embodiment of the present invention.

During setting a length of L days, unit time was 1 day, and node total number amount is n, total p initial division Set, each node set quantity dividing set is m.

Step 301, calculate one day in i-th (i=1,2 ..., n) total dealing money Q of individual node_i、 Total number of transactions number D_i, total node degree K_iAnd dealing money Q that in this day, whole network is total, transaction count D, Total node degree K, total connection limit number K_L；

Step 302, calculate one day in i-th (i=1,2 ..., n) the money laundering probability of individual node $P_i=\frac{Q_i}{Q}*\frac{D_i}{D}*\frac{K_i}{K};$

Step 303, calculate L days in i-th (i=1,2 ..., n) the average money laundering probability of individual node $\stackrel{\‾}{P_i}=\frac{\underset{L}{\Σ}{P}_i}{L};$

Step 304, calculate L days in i-th (i=1,2 ..., n) the nodal information entropy of individual node $H_i=-\stackrel{\‾}{P_i}{\log }_2^{\stackrel{\‾}{P_i}};$

Step 305, by p time divide, obtain p divide gather, each division set comprises m joint Point set；

Step 306, p is divided set carry out coding and obtain p initial individuals, and initialize intersection generally Rate Pc, mutation probability Pm, select probability Pi, iterations iter, by genetic algorithm, obtain division The division set that collection modules degree is maximum；

Wherein, according to the division collection modules degree of following equation computation partition set: Wherein, $R_k=\underset{i=1}{\overset{m_k}{\Σ}}{H}_1,E_k={\left(\underset{k^{,}=1,k^{,}\≠k}{\overset{m}{\Σ}}{l}_{{\mathrm{kk}}^{,}}\right(\frac{1}{m}{\log }_2^m\left)\right)}^2,$ Parameters implication is as follows: T_jFor drawing Divide the division collection modules degree of set j, R_kFor dividing the node set letter of the kth node set of set j Breath entropy, E_kFor the node set net comentropy of the described kth node set divided in set j, K_LFor Total connection limit number between described n node, 1≤j≤p, H_iSave for the i-th in node set k The nodal information entropy of point, m_kFor the number of nodes of node set k, 1≤k≤m, 1≤m_k≤n；l_kk' For node set k and node set k, ' between connection limit number, node set k ' is in m node set Any node set in addition to node set k；

Step 307, divide the maximum node set of set interior joint aggregate information entropy as can using determine Doubt transaction node set.

Based on identical technology design, the embodiment of the present invention also provides for a kind of suspicious transaction node set detecting dress Put.The suspicious transaction node set detector that the embodiment of the present invention provides is as shown in Figure 4.

Node determines unit 401, for determining n node in banking network to be detected, wherein, one Node is a bank account, and n is the integer more than 1；

Nodal information entropy determines unit 402, for for a node, according to described node in setting duration Node transfer information, determine the nodal information entropy of described node；

Division unit 403, divides for described n node carries out p time respectively, obtains p and divides collection Closing, wherein, described p the arbitrary division set divided in set comprises m node set, a division Without occuring simultaneously between m node set in set, the union of a m node set divided in set For in described n node, any node in described m node set and the node set belonging to this node At least one node is connected, and wherein, two nodes are connected and refer to there is money transfer transactions between two nodes, Wherein, 1≤m≤n, p are the integer more than 1；

Suspicious transaction node set determines unit 404, for dividing set according to described p, determines one Divide the division set that collection modules degree is maximum, and the division set interior joint aggregate information entropy maximum that will determine Node set be defined as suspicious transaction node set；Wherein, each division collection modules degree dividing set, It is that the limit number that connects between nodal information entropy and the node according to described n node determines；Two node phases Connect and refer to there is money transfer transactions between two nodes.

Alternatively, described suspicious transaction node set determines unit 404, specifically for:

Divide the nodal information entropy of each node set interior joint in set according to described, determine that described division collects The node set comentropy of each node set in conjunction；

According to the connection limit number between node, determine and described divide in set between any two node set Connect limit number；

According to the described connection limit number divided in set between any two node set, determine each set of node The node set net comentropy closed；

The node set comentropy of all node set, institute in described division set in set is divided according to described There is the total connection limit number between node set net comentropy and described n the node of node set, determine institute State the division collection modules degree dividing set.

Alternatively, described suspicious transaction node set determines unit 404, specifically for:

It is determined according to the following equation and divides the division collection modules degree gathering j:

$T_j=\frac{\underset{k=1}{\overset{m}{\Σ}}(R_k-\frac{E_k}{n_4})}{K_L};$

Wherein, T_jFor the described division collection modules degree dividing set j, R_kThe of set j is divided for described The node set comentropy of k node set, E_kFor the described kth node set divided in set j Node set net comentropy, n₄For coefficient set in advance, K_LFor always connecting limit between described n node Number, 1≤j≤p, m are the described node set quantity divided in set.

Alternatively, described suspicious transaction node set determines unit 404, specifically for:

The node set comentropy of node set k being determined according to the following equation in described division set:

$R_k=\underset{i=1}{\overset{m_k}{\Σ}}{H}_i;$

Wherein, R_kFor the node set comentropy of node set k, H_iFor i-th in described node set k The nodal information entropy of individual node, m_kFor the number of nodes of described node set k, 1≤k≤m, 1≤m_k≤n；

The node set net comentropy of described node set k be determined according to the following equation:

$E_k={\left(\underset{k^{,}=1,k^{,}\≠k}{\overset{m}{\Σ}}{l}_{{\mathrm{kk}}^{,}}\right(\frac{n_1}{m}{\log }_{n_2}^{\frac{m}{n_1}}\left)\right)}^{n_3};$

Wherein, E_kFor the node set net comentropy of described node set k, l_kk'For node set k and joint Connection limit number between some set k ', node set k ' it is except described set of node in described m node set Close any node set outside k, n₁, n₂, n₃For coefficient set in advance.

Alternatively, described nodal information entropy determines unit 402, specifically for:

According to described node node transfer information in setting duration, determine that the average money laundering of described node is general Rate；

According to the average money laundering probability of described node, determine the nodal information entropy of described node.

Alternatively, described nodal information entropy determines unit 402, specifically for:

The average money laundering probability of node i be determined according to the following equation:

$\stackrel{\‾}{P_i}=\frac{\underset{L}{\Σ}{P}_i}{L};$

Wherein,For the average money laundering probability of described setting duration interior nodes i, L is described setting duration, P_iFor the money laundering probability in a unit time in described setting duration, and Wherein, Q_iFor the total dealing money in the node transfer information of described unit time interior nodes i, D_iFor described Total number of transactions number in the node transfer information of unit time interior nodes i, K_iFor described unit time interior nodes Total node degree in the node transfer information of i, Q is total in described unit time of banking network to be detected Dealing money, D is the banking network to be detected total number of transactions number in described unit time, and K is to be detected The banking network total node degree in described unit time, node i is any node in described n node.

Alternatively, described nodal information entropy determines unit 402, specifically for:

The nodal information entropy of node i be determined according to the following equation:

$H_i=-\stackrel{\‾}{P_i}{\log }_n^{\stackrel{\‾}{P_i}};$

Wherein, H_iFor node i at the nodal information entropy of described setting duration,For described setting duration internal segment The average money laundering probability of some i, n is coefficient set in advance.

Alternatively, described division unit 403, specifically for:

Determine that a division is gathered according to following manner:

M the node Centroid respectively as m node set is randomly choosed from described n node；

For one in other n-m node, if this node only with in described m Centroid One Centroid is connected, then by the node set of this node division to described Centroid place；If should Node is connected with the multiple Centroids in described m Centroid, then by this node division to this joint Point is connected and the node set at Centroid place of limit maximum weight；If this node and described m centromere Point is all not attached to, then by the collection at the node place of the limit maximum weight between this node division to this node Close.

Alternatively, described division unit 403, it is additionally operable to:

The limit weights being determined according to the following equation between node i and node j:

${\mathrm{\ω}}_{ij}=\sqrt[s]{{\left(\frac{T_{ij}}{T_i}\right)}^{t1}+{\left(\frac{T_{ij}}{T_j}\right)}^{t2}+{\left(\frac{F_{ij}}{F_i}\right)}^{t3}+{\left(\frac{F_{ij}}{F_j}\right)}^{t4}};$

Wherein, ω_ijFor setting the limit weights between duration interior nodes i and node j, T_ijDuring for described setting Transaction count between long interior described node Transaction Information interior joint i and node j, T_iFor described setting duration The transaction count of interior described node Transaction Information interior joint i, T_jConclude the business for described node in described setting duration The transaction count of information interior joint j, F_ijFor node Transaction Information interior joint i described in described setting duration And the dealing money between node j, F_iFor node Transaction Information interior joint i's described in described setting duration Dealing money, F_jFor the dealing money of node Transaction Information interior joint j described in described setting duration, t1, T2, t3, t4, s are respectively the coefficient set, and node i is any node in described n node, node J is any node in described n node in addition to node i.

Alternatively, described suspicious transaction node set determines unit 404, specifically for:

Set is divided as p initial individuals using described p；

Using each divide set divisions collection modules degree as this division set corresponding individuality fitness Function；

Initialize crossover probability Pc, mutation probability Pm, select probability Pi, iterations iter；

According to genetic algorithm and described p initial individuals, determine the individuality that a fitness function value is maximum；

It is defined as dividing set by individual corresponding division set maximum for the described fitness function value determined The division set that modularity is maximum, and divide, by determine, the set of node that set interior joint aggregate information entropy is maximum Conjunction is defined as suspicious transaction node set.

The present invention is with reference to method, equipment (system) and computer program product according to embodiments of the present invention The flow chart of product and/or block diagram describe.It should be understood that can by computer program instructions flowchart and / or block diagram in each flow process and/or flow process in square frame and flow chart and/or block diagram and/ Or the combination of square frame.These computer program instructions can be provided to general purpose computer, special-purpose computer, embedding The processor of formula datatron or other programmable data processing device is to produce a machine so that by calculating The instruction that the processor of machine or other programmable data processing device performs produces for realizing at flow chart one The device of the function specified in individual flow process or multiple flow process and/or one square frame of block diagram or multiple square frame.

These computer program instructions may be alternatively stored in and computer or the process of other programmable datas can be guided to set In the standby computer-readable memory worked in a specific way so that be stored in this computer-readable memory Instruction produce and include the manufacture of command device, this command device realizes in one flow process or multiple of flow chart The function specified in flow process and/or one square frame of block diagram or multiple square frame.

These computer program instructions also can be loaded in computer or other programmable data processing device, makes Sequence of operations step must be performed to produce computer implemented place on computer or other programmable devices Reason, thus the instruction performed on computer or other programmable devices provides for realizing flow chart one The step of the function specified in flow process or multiple flow process and/or one square frame of block diagram or multiple square frame.

Although preferred embodiments of the present invention have been described, but those skilled in the art once know base This creativeness concept, then can make other change and amendment to these embodiments.So, appended right is wanted Ask and be intended to be construed to include preferred embodiment and fall into all changes and the amendment of the scope of the invention.

Obviously, those skilled in the art can carry out various change and modification without deviating from this to the present invention Bright spirit and scope.So, if the present invention these amendment and modification belong to the claims in the present invention and Within the scope of its equivalent technologies, then the present invention is also intended to comprise these change and modification.

Claims (20)

1. a suspicious transaction node set method for detecting, it is characterised in that including:

Determining n node in banking network to be detected, wherein, a node is a bank account, n For the integer more than 1；

For a node, according to the node transfer information of described node in setting duration, determine described node Nodal information entropy；

Described n node carries out p time respectively divide, obtain p and divide set, wherein, described p Divide the arbitrary division set in set and comprise m node set, a m node divided in set Without occuring simultaneously between set, the union of a m node set divided in set is described n node, institute Any node stated in m node set is connected with at least one node in the node set belonging to this node Connecing, wherein, two nodes are connected and refer to there is money transfer transactions between two nodes, wherein, and 1≤m≤n, P is the integer more than 1；

Divide set according to described p, determine that divides the division set that collection modules degree is maximum, and will The node set dividing set interior joint aggregate information entropy maximum determined is defined as suspicious transaction node set； Wherein, each divide set division collection modules degree, be the nodal information entropy according to described n node and Connection limit number between node determines；Two nodes are connected and refer to there is money transfer transactions between two nodes.

2. the method for claim 1, it is characterised in that determine a division according to following manner The division collection modules degree of set:

Divide the nodal information entropy of each node set interior joint in set according to described, determine that described division collects The node set comentropy of each node set in conjunction；

According to the connection limit number between node, determine and described divide in set between any two node set Connect limit number；

According to the described connection limit number divided in set between any two node set, determine each set of node The node set net comentropy closed；

The node set comentropy of all node set, institute in described division set in set is divided according to described There is the total connection limit number between node set net comentropy and described n the node of node set, determine institute State the division collection modules degree dividing set.

3. method as claimed in claim 2, it is characterised in that division set j is determined according to the following equation Division collection modules degree:

$T_j=\frac{\underset{k=1}{\overset{m}{\Σ}}(R_k-\frac{E_k}{n_4})}{K_L};$

Wherein, T_jFor the described division collection modules degree dividing set j, R_kThe of set j is divided for described The node set comentropy of k node set, E_kFor the described kth node set divided in set j Node set net comentropy, n₄For coefficient set in advance, K_LFor always connecting limit between described n node Number, 1≤j≤p, m are the described node set quantity divided in set.

4. method as claimed in claim 2, it is characterised in that described division is determined according to the following equation The node set comentropy of node set k in set:

$R_k=\underset{i=1}{\overset{m_k}{\Σ}}{H}_i;$

Wherein, R_kFor the node set comentropy of node set k, H_iFor i-th in described node set k The nodal information entropy of individual node, m_kFor the number of nodes of described node set k, 1≤k≤m, 1≤m_k≤n；

The node set net comentropy of described node set k be determined according to the following equation:

$E_k={\left(\underset{k^{,}=1,k^{,}\≠k}{\overset{m}{\Σ}}{l}_{{\mathrm{kk}}^{,}}\right(\frac{n_1}{m}{\log }_{n_2}^{\frac{m}{n_1}}\left)\right)}^{n_3};$

Wherein, E_kFor the node set net comentropy of described node set k, l_kk'For node set k and joint Connection limit number between some set k ', node set k ' it is except described set of node in described m node set Close any node set outside k, n₁, n₂, n₃For coefficient set in advance.

5. the method for claim 1, it is characterised in that described for a node, according to setting In timing is long, the node transfer information of described node, determines the nodal information entropy of described node, including:

According to described node node transfer information in setting duration, determine that the average money laundering of described node is general Rate；

According to the average money laundering probability of described node, determine the nodal information entropy of described node.

6. method as claimed in claim 5, it is characterised in that node i flat is determined according to the following equation All money laundering probability:

$\stackrel{\‾}{P_i}=\frac{\underset{L}{\Σ}{P}_i}{L};$

Wherein,For the average money laundering probability of described setting duration interior nodes i, L is described setting duration, P_iFor the money laundering probability in a unit time in described setting duration, and Wherein, Q_iFor the total dealing money in the node transfer information of described unit time interior nodes i, D_iFor described Total number of transactions number in the node transfer information of unit time interior nodes i, K_iFor described unit time interior nodes Total node degree in the node transfer information of i, Q is total in described unit time of banking network to be detected Dealing money, D is the banking network to be detected total number of transactions number in described unit time, and K is to be detected The banking network total node degree in described unit time, node i is any node in described n node.

7. method as claimed in claim 5, it is characterised in that the joint of node i is determined according to the following equation Dot information entropy:

$H_i=-\stackrel{\‾}{P_i}{\log }_0^{\stackrel{\‾}{P_i}};$

Wherein, H_iFor node i at the nodal information entropy of described setting duration,For described setting duration internal segment The average money laundering probability of some i, n is coefficient set in advance.

8. the method as according to any one of claim 1-7, it is characterised in that true according to following manner A fixed division set:

M the node Centroid respectively as m node set is randomly choosed from described n node；

For one in other n-m node, if this node only with in described m Centroid One Centroid is connected, then by the node set of this node division to described Centroid place；If should Node is connected with the multiple Centroids in described m Centroid, then by this node division to this joint Point is connected and the node set at Centroid place of limit maximum weight；If this node and described m centromere Point is all not attached to, then by the collection at the node place of the limit maximum weight between this node division to this node Close.

9. method as claimed in claim 8, it is characterised in that node i and joint are determined according to the following equation Limit weights between some j:

${\mathrm{\ω}}_{ij}=\sqrt[s]{{\left(\frac{T_{ij}}{T_i}\right)}^{t1}+{\left(\frac{T_{ij}}{T_j}\right)}^{t2}+{\left(\frac{F_{ij}}{F_i}\right)}^{t3}+{\left(\frac{F_{ij}}{F_j}\right)}^{L4}};$

Wherein, ω_ijFor setting the limit weights between duration interior nodes i and node j, T_ijFor described setting duration Transaction count between interior described node Transaction Information interior joint i and node j, T_iFor in described setting duration The transaction count of described node Transaction Information interior joint i, T_jFor described node transaction letter in described setting duration The transaction count of breath interior joint j, F_ijFor node Transaction Information interior joint i described in described setting duration and joint Dealing money between some j, F_iTransaction for node Transaction Information interior joint i described in described setting duration The amount of money, F_jFor the dealing money of node Transaction Information interior joint j described in described setting duration, t1, t2, T3, t4, s are respectively the coefficient set, and node i is any node in described n node, and node j is Any node in addition to node i in described n node.

10. the method as according to any one of claim 1-7, it is characterised in that described according to described p Individual division is gathered, and determines that one divides the division set that collection modules degree is maximum, and the division set that will determine The node set of interior joint aggregate information entropy maximum is defined as suspicious transaction node set, including:

Set is divided as p initial individuals using described p；

Using each divide set divisions collection modules degree as this division set corresponding individuality fitness Function；

Initialize crossover probability Pc, mutation probability Pm, select probability Pi, iterations iter；

According to genetic algorithm and described p initial individuals, determine the individuality that a fitness function value is maximum；

It is defined as dividing set by individual corresponding division set maximum for the described fitness function value determined The division set that modularity is maximum, and divide, by determine, the set of node that set interior joint aggregate information entropy is maximum Conjunction is defined as suspicious transaction node set.

11. 1 kinds of suspicious transaction node set detectors, it is characterised in that including:

Node determines unit, for determining n node in banking network to be detected, wherein, a node Being a bank account, n is the integer more than 1；

Nodal information entropy determines unit, for for a node, according to the joint of described node in setting duration Point transfer information, determines the nodal information entropy of described node；

Division unit, divides for described n node carries out p time respectively, obtains p and divides set, Wherein, described p the arbitrary division set divided in set comprises m node set, and one divides set In m node set between without occuring simultaneously, the union of m node set divided in set is institute State n node, in any node in described m node set and the node set belonging to this node at least One node is connected, and wherein, two nodes are connected and refer to there is money transfer transactions between two nodes, wherein, 1≤m≤n, p are the integer more than 1；

Suspicious transaction node set determines unit, for dividing set according to described p, determines a division The division set that collection modules degree is maximum, and divide, by determine, the joint that set interior joint aggregate information entropy is maximum Point set is defined as suspicious transaction node set；Wherein, each division collection modules degree dividing set, be Connection limit number between nodal information entropy and node according to described n node determines；Two nodes are connected Connect and refer to there is money transfer transactions between two nodes.

12. devices as claimed in claim 11, it is characterised in that described suspicious transaction node set is true Cell, specifically for:

Divide the nodal information entropy of each node set interior joint in set according to described, determine that described division collects The node set comentropy of each node set in conjunction；

According to the connection limit number between node, determine and described divide in set between any two node set Connect limit number；

According to the described connection limit number divided in set between any two node set, determine each set of node The node set net comentropy closed；

The node set comentropy of all node set, institute in described division set in set is divided according to described There is the total connection limit number between node set net comentropy and described n the node of node set, determine institute State the division collection modules degree dividing set.

13. devices as claimed in claim 12, it is characterised in that described suspicious transaction node set is true Cell, specifically for:

It is determined according to the following equation and divides the division collection modules degree gathering j:

$T_j=\frac{\underset{k=1}{\overset{m}{\Σ}}(R_k-\frac{E_k}{n_4})}{K_L};$

Wherein, T_jFor the described division collection modules degree dividing set j, R_kThe of set j is divided for described The node set comentropy of k node set, E_kFor the described kth node set divided in set j Node set net comentropy, n₄For coefficient set in advance, K_LFor always connecting limit between described n node Number, 1≤j≤p, m are the described node set quantity divided in set.

14. devices as claimed in claim 12, it is characterised in that described suspicious transaction node set is true Cell, specifically for:

The node set comentropy of node set k being determined according to the following equation in described division set:

$R_k=\underset{i=1}{\overset{m_k}{\Σ}}{H}_i;$

Wherein, R_kFor the node set comentropy of node set k, H_iFor i-th in described node set k The nodal information entropy of individual node, m_kFor the number of nodes of described node set k, 1≤k≤m, 1≤m_k≤n；

The node set net comentropy of described node set k be determined according to the following equation:

$E_k={\left(\underset{k^{,}=1,k^{,}\≠k}{\overset{m}{\Σ}}{l}_{{\mathrm{kk}}^{,}}\right(\frac{n_1}{m}{\log }_{n_2}^{\frac{m}{n_1}}\left)\right)}^{n_3};$

Wherein, E_kFor the node set net comentropy of described node set k, l_kk'For node set k and joint Connection limit number between some set k ', node set k ' it is except described set of node in described m node set Close any node set outside k, n₁, n₂, n₃For coefficient set in advance.

15. devices as claimed in claim 11, it is characterised in that described nodal information entropy determines unit, Specifically for:

According to described node node transfer information in setting duration, determine that the average money laundering of described node is general Rate；

According to the average money laundering probability of described node, determine the nodal information entropy of described node.

16. devices as claimed in claim 15, it is characterised in that described nodal information entropy determines unit, Specifically for:

The average money laundering probability of node i be determined according to the following equation:

$\stackrel{\‾}{P_i}=\frac{\underset{L}{\Σ}{P}_i}{L};$

Wherein,For the average money laundering probability of described setting duration interior nodes i, L is described setting duration, P_iFor the money laundering probability in a unit time in described setting duration, and Wherein, Q_iFor the total dealing money in the node transfer information of described unit time interior nodes i, D_iFor described Total number of transactions number in the node transfer information of unit time interior nodes i, K_iFor described unit time interior nodes Total node degree in the node transfer information of i, Q is total in described unit time of banking network to be detected Dealing money, D is the banking network to be detected total number of transactions number in described unit time, and K is to be detected The banking network total node degree in described unit time, node i is any node in described n node.

17. devices as claimed in claim 15, it is characterised in that described nodal information entropy determines unit, Specifically for:

The nodal information entropy of node i be determined according to the following equation:

$H_i=-\stackrel{\‾}{P_i}{\log }_n^{\stackrel{\‾}{P_i}};$

Wherein, H_iFor node i at the nodal information entropy of described setting duration,For described setting duration internal segment The average money laundering probability of some i, n is coefficient set in advance.

18. devices as according to any one of claim 11-17, it is characterised in that described division unit, Specifically for:

Determine that a division is gathered according to following manner:

M the node Centroid respectively as m node set is randomly choosed from described n node；

For one in other n-m node, if this node only with in described m Centroid One Centroid is connected, then by the node set of this node division to described Centroid place；If should Node is connected with the multiple Centroids in described m Centroid, then by this node division to this joint Point is connected and the node set at Centroid place of limit maximum weight；If this node and described m centromere Point is all not attached to, then by the collection at the node place of the limit maximum weight between this node division to this node Close.

19. devices as claimed in claim 18, it is characterised in that described division unit, are additionally operable to:

The limit weights being determined according to the following equation between node i and node j:

${\mathrm{\ω}}_{ij}=\sqrt[s]{{\left(\frac{T_{ij}}{T_i}\right)}^{t1}+{\left(\frac{T_{ij}}{T_j}\right)}^{t2}+{\left(\frac{F_{ij}}{F_i}\right)}^{t3}+{\left(\frac{F_{ij}}{F_j}\right)}^{t4}};$

Wherein, ω_ijFor setting the limit weights between duration interior nodes i and node j, T_ijDuring for described setting Transaction count between long interior described node Transaction Information interior joint i and node j, T_iFor described setting duration The transaction count of interior described node Transaction Information interior joint i, T_jConclude the business for described node in described setting duration The transaction count of information interior joint j, F_ijFor node Transaction Information interior joint i described in described setting duration And the dealing money between node j, F_iFor node Transaction Information interior joint i's described in described setting duration Dealing money, F_jFor the dealing money of node Transaction Information interior joint j described in described setting duration, t1, T2, t3, t4, s are respectively the coefficient set, and node i is any node in described n node, node J is any node in described n node in addition to node i.

20. devices as according to any one of claim 11-17, it is characterised in that described suspicious transaction Node set determines unit, specifically for:

Set is divided as p initial individuals using described p；

Using each divide set divisions collection modules degree as this division set corresponding individuality fitness Function；

Initialize crossover probability Pc, mutation probability Pm, select probability Pi, iterations iter；

According to genetic algorithm and described p initial individuals, determine the individuality that a fitness function value is maximum；

It is defined as dividing set by individual corresponding division set maximum for the described fitness function value determined The division set that modularity is maximum, and divide, by determine, the set of node that set interior joint aggregate information entropy is maximum Conjunction is defined as suspicious transaction node set.