CN109741173A

CN109741173A - Recognition methods, device, equipment and the computer storage medium of suspicious money laundering clique

Info

Publication number: CN109741173A
Application number: CN201811619485.7A
Authority: CN
Inventors: 李元; 汪亚男; 邱毅; 李伟杰
Original assignee: WeBank Co Ltd
Current assignee: WeBank Co Ltd
Priority date: 2018-12-27
Filing date: 2018-12-27
Publication date: 2019-05-10
Anticipated expiration: 2038-12-27
Also published as: CN109741173B

Abstract

The invention discloses a kind of recognition methods of suspicious money laundering clique.This method comprises: transaction data table and bank account information table are obtained, to obtain the first vertex table and the first side table；The division of first time clique is carried out based on the first vertex table, the first side table and default multidimensional characteristic broadcast algorithm, the clique ID in the first vertex table is updated according to the first division result, obtains the second vertex table；Merge algorithm based on the second vertex table and default clique to merge paying party outside the row in the second vertex table, and the clique ID in the second vertex table is updated according to amalgamation result, obtains third vertex table；Second of clique's division is carried out based on third vertex table, the first side table and default multidimensional characteristic broadcast algorithm, and according to the second division result and presets the suspicious index that suspicious index computation rule calculates each clique.The invention also discloses identification device, equipment and the computer storage mediums of a kind of suspicious money laundering clique.The present invention can improve the recognition accuracy of suspicious money laundering clique.

Description

Recognition methods, device, equipment and the computer storage medium of suspicious money laundering clique

Technical field

The present invention relates to technical field of data processing more particularly to a kind of recognition methods of suspicious money laundering clique, device, set Standby and computer storage medium.

Background technique

With the fast development of information technology, internet financial models are gradually risen, it has also become what financial quarters gave more sustained attention Focus.But since the features such as the inherent complexity of internet finance, concealment, variability become the height of money laundering risks Area is sent out, the normal orderly function of economy and finance order is seriously endangered.

Currently, there are many transaction between cross-bank, each user holds multiple bank accounts, but the information of bank account Be it is obstructed, transaction closed loop can not be formed.That is the trade network of oneself of each bank's building is incomplete, illegal The feature that molecule also utilizes bank information obstructed transfers accounts to isolate information in more banks, leads to the clique inside Dan Jia bank Relationship is incomplete, so that Internet company can not find in suspicious money laundering clique when carrying out the identification of suspicious clique All accounts, or even can not find suspicious money laundering clique.Therefore, the identification that suspicious money laundering clique exists in the prior art is accurate The lower problem of rate.

Summary of the invention

The main purpose of the present invention is to provide recognition methods, device, equipment and the computers of a kind of suspicious money laundering clique Storage medium, it is intended to improve the recognition accuracy of suspicious money laundering clique.

To achieve the above object, the present invention provides a kind of recognition methods of suspicious money laundering clique, the suspicious money laundering clique Recognition methods include:

Transaction data table and bank account information table are obtained, and according to the transaction data table and the bank account information Table obtains the first vertex table and the first side table；

First time clique is carried out based on first vertex table, first side table and default multidimensional characteristic broadcast algorithm to draw Point, the first division result is obtained, and the clique ID in the table of first vertex is updated according to first division result, obtains the Two vertex tables；

Based on second vertex table and default clique merge algorithm to paying party outside the row in the table of second vertex into Row merges, and updates the clique ID in the table of second vertex according to amalgamation result, obtains third vertex table；

Second is carried out based on third vertex table, first side table and the default multidimensional characteristic broadcast algorithm It group divides, obtains the second division result, and according to second division result and preset suspicious index computation rule and calculate each The suspicious index of partner.

Optionally, the acquisition transaction data table and bank account information table, and according to the transaction data table and described Bank account information table obtains the step of the first vertex table and the first side table and includes:

Transaction data table and bank account information table are obtained, the transaction data table is summarized, transaction is obtained and summarizes Tables of data, it includes paying party account and beneficiary account that the transaction, which summarizes tables of data,；

The paying party account is converted into the paying party node ID of numeric type, the beneficiary account is converted into number The beneficiary node ID of type, and the mapping table between account and the node ID of numeric type is constructed according to transformation result；

According to the paying party account, the beneficiary account, the mapping table and the bank account information table It obtains the first vertex table, and tables of data is summarized according to the transaction and the mapping table obtains the first side table.

Optionally, it further includes Transaction Information that the transaction, which summarizes tables of data, and first side table includes according to the transaction The transaction feature vector that information generates, it is described based on first vertex table, first side table and the diffusion of default multidimensional characteristic Algorithm carries out the division of first time clique, obtains the first division result, and update first top according to first division result Clique ID in point table, the step of obtaining the second vertex table include:

The clique ID for initializing each node in the table of first vertex is corresponding node ID, and the number of iterations is arranged；

The transaction feature vector is sent to corresponding beneficiary node according to first side table, and according to the receipts Transaction feature vector and default optimal vector selection rule that money side's node receives determine the optimal friendship of the beneficiary node Easy feature vector, and the corresponding clique ID of the beneficiary node is updated to the corresponding payment of the optimal transaction feature vector The clique ID of Fang Jiedian；

The number of iterations is reset, and iteration executes step: being sent out the transaction feature vector according to first side table It send to corresponding beneficiary node, and the transaction feature vector received according to the beneficiary node and default optimal vector Selection rule determines the optimal transaction feature vector of the beneficiary node, and more by the corresponding clique ID of the beneficiary node It is newly the clique ID of the corresponding paying party node of the optimal transaction feature vector, until the number of iterations reset is greater than in advance If when the number of iterations, stopping iteration, and the updated first vertex table of clique ID is denoted as the second vertex table.

Optionally, described that algorithm is merged to the row in the table of second vertex based on second vertex table and default clique Outer paying party merges, and updates the clique ID in the table of second vertex according to amalgamation result, obtains third vertex table Step includes:

The secondary clique of paying party outside the row in the table of second vertex is obtained based on second vertex table and preset rules ID；

The 4th vertex table for only including the outer paying party of row is generated according to second vertex table, and according to the 4th vertex Table and the pair clique ID generate the second side table；

Digraph is generated according to the 4th vertex table and second side table, and institute is calculated by figure calculation method State the connected subgraph of digraph；

The connected subgraph is numbered, and the clique ID of paying party outside the row in the table of second vertex is updated to The number of the affiliated connected subgraph of the outer paying party of the row, obtains third vertex table.

Optionally, described to obtain paying the bill outside the row in the table of second vertex based on second vertex table and preset rules Side secondary clique ID the step of include:

According to the clique ID and bank information statistics the second vertex Biao Zhongge clique correspondence in the table of second vertex The quantity of row interior nodes is denoted as the first quantity；

Paying party and each is counted outside the row in the table of second vertex according to second vertex table and first side table The quantity of money transfer transactions occurs for the row interior nodes of clique, is denoted as the second quantity；

The company outside the row between paying party and each clique is calculated according to first quantity and the second quantity Ratio is connect, whether the maximum value detected in the connection ratio is greater than the first preset threshold；

If the maximum value in the connection ratio is greater than the first preset threshold, by the maximum value pair in the connection ratio Secondary clique ID of the clique ID answered as paying party outside the row.

Optionally, described according to second division result and to preset suspicious index computation rule and calculate the suspicious of each clique The step of index includes:

The account of each node in each clique divided through second of clique is obtained according to second division result Information and operation note, and determine according to the account information of each node and operation note the suspicious index of each node；

The suspicious index of each node in each clique is summed up respectively, obtains the suspicious index of each clique.

Optionally, the recognition methods of the suspicious money laundering clique further include:

Whether the suspicious index for detecting each clique is greater than the second preset threshold, and the suspicious index is greater than second The clique of preset threshold is labeled as suspicious money laundering clique；

The information for obtaining the suspicious money laundering clique is suspicious according to the suspicious exponent pair of the suspicious money laundering clique to wash Money clique is ranked up, and the information of the suspicious money laundering clique is sent to default operational terminal by ranking results, so that Staff analyzes the suspicious money laundering clique according to the information of the suspicious money laundering clique.

It is described suspicious to wash the present invention also provides a kind of identification device of suspicious money laundering clique in addition, to achieve the above object The identification device of money clique includes:

Module is obtained, for obtaining transaction data table and bank account information table, and according to the transaction data table and institute It states bank account information table and obtains the first vertex table and the first side table；

Division module, for based on first vertex table, first side table and default multidimensional characteristic broadcast algorithm into Row first time clique divides, and obtains the first division result, and update in the table of first vertex according to first division result Clique ID, obtain the second vertex table；

Merging module, for merging algorithm in the table of second vertex based on second vertex table and default clique The outer paying party of row merges, and updates the clique ID in the table of second vertex according to amalgamation result, obtains third vertex table；

Computing module, based on third vertex table, first side table and the default multidimensional characteristic broadcast algorithm into Second of clique of row divides, and obtains the second division result, and according to second division result and preset suspicious index calculating rule Then calculate the suspicious index of each clique.

It is described suspicious to wash the present invention also provides a kind of identification equipment of suspicious money laundering clique in addition, to achieve the above object The identification equipment of money clique includes: memory, processor and is stored on the memory and can run on the processor Suspicious money laundering clique recognizer, realized when the recognizer of the suspicious money laundering clique is executed by the processor as above The step of recognition methods of the suspicious money laundering clique.

In addition, to achieve the above object, the present invention also provides a kind of computer storage medium, the computer storage medium On be stored with the recognizer of suspicious money laundering clique, realized such as when the recognizer of the suspicious money laundering clique is executed by processor The step of recognition methods of the upper suspicious money laundering clique.

The present invention provides recognition methods, device, equipment and the computer storage medium of a kind of suspicious money laundering clique, by obtaining Take transaction data table and bank account information table, and according to transaction data table and bank account information table obtain the first vertex table and First side table；The division of first time clique is carried out based on the first vertex table, the first side table and default multidimensional characteristic broadcast algorithm, is obtained First division result, and the clique ID in the first vertex table is updated according to the first division result, obtain the second vertex table；Based on Two vertex tables and default clique merge algorithm and merge to paying party outside the row in the second vertex table, and more according to amalgamation result Clique ID in the table of new second vertex obtains third vertex table；Based on third vertex table, the first side table updated after merging Second of clique's division is carried out with default multidimensional characteristic broadcast algorithm, obtains the second division result, and then divide and tie according to second Fruit and preset the suspicious index that suspicious index computation rule calculates each clique.Multidimensional characteristic algorithm is first passed through in the present invention carries out the Clique divides, and is then based on clique and merges algorithm and merges to the outer paying party of row, can using the information of row interior nodes come Merging rows exterior node clique leads to not find suspicious so as to solve not getting the outer account information of row in the prior art All accounts in money laundering clique, or even the problem of can not find suspicious money laundering clique, after consolidation, the present invention again by Multidimensional characteristic algorithm carries out second of clique's division, and then calculates the suspicious index of each clique, excavates suspicious money laundering with identification Clique.The recognition accuracy of suspicious money laundering clique can be improved in the present invention, while by comprehensively considering row interior nodes and row exterior node Incidence relation, can excavate and hide deeper suspicious money laundering account.

Detailed description of the invention

Fig. 1 is the device structure schematic diagram for the hardware running environment that the embodiment of the present invention is related to；

Fig. 2 is the flow diagram of the recognition methods first embodiment of the suspicious money laundering clique of the present invention；

Fig. 3 is the refinement flow diagram of step S30 in first embodiment of the invention；

Fig. 4 is the functional block diagram of the identification device first embodiment of the suspicious money laundering clique of the present invention.

The embodiments will be further described with reference to the accompanying drawings for the realization, the function and the advantages of the object of the present invention.

Specific embodiment

It should be appreciated that the specific embodiments described herein are merely illustrative of the present invention, it is not intended to limit the present invention.

Referring to Fig.1, Fig. 1 is the device structure schematic diagram for the hardware running environment that the embodiment of the present invention is related to.

The identification equipment of the suspicious money laundering clique of the embodiment of the present invention can be server, be also possible to PC (Personal Computer, personal computer), tablet computer, the terminal devices such as portable computer.

As shown in Figure 1, the identification equipment of the suspicious money laundering clique may include: processor 1001, such as CPU, communication is total Line 1002, user interface 1003, network interface 1004, memory 1005.Wherein, communication bus 1002 is for realizing these components Between connection communication.User interface 1003 may include display screen (Display), input unit such as keyboard (Keyboard), optional user interface 1003 can also include standard wireline interface and wireless interface.Network interface 1004 is optional May include standard wireline interface and wireless interface (such as Wi-Fi interface).Memory 1005 can be high speed RAM memory, It is also possible to stable memory (non-volatile memory), such as magnetic disk storage.Memory 1005 optionally may be used also To be independently of the storage device of aforementioned processor 1001.

It will be understood by those skilled in the art that the identification device structure of suspicious money laundering clique shown in Fig. 1 is not constituted Restriction to the identification equipment of suspicious money laundering clique may include than illustrating more or fewer components, or the certain portions of combination Part or different component layouts.

As shown in Figure 1, as may include that operating system, network are logical in a kind of memory 1005 of computer storage medium Believe module, Subscriber Interface Module SIM and the recognizer of suspicious money laundering clique.

In terminal shown in Fig. 1, network interface 1004 is mainly used for connecting background server, carries out with background server Data communication；User interface 1003 is mainly used for connecting client, carries out data communication with client；And processor 1001 can be with For calling the recognizer of the suspicious money laundering clique stored in memory 1005, and execute the identification of following suspicious money laundering clique Each step of method.

Based on above-mentioned hardware configuration, each embodiment of the recognition methods of the suspicious money laundering clique of the present invention is proposed.

The present invention provides a kind of recognition methods of suspicious money laundering clique.

Referring to Fig. 2, Fig. 2 is the flow diagram of the recognition methods first embodiment of the suspicious money laundering clique of the present invention.

In the present embodiment, the recognition methods of the suspicious money laundering clique includes:

Step S10 obtains transaction data table and bank account information table, and according to the transaction data table and the bank Account information table obtains the first vertex table and the first side table；

Currently, there are many transaction between cross-bank, each user holds multiple bank accounts, but the information of bank account Be it is obstructed, transaction closed loop can not be formed.That is the trade network of oneself of each bank's building is incomplete, illegal The feature that molecule also utilizes bank information obstructed transfers accounts to isolate information in more banks, leads to the clique inside Dan Jia bank Relationship is incomplete, so that Internet company can not find in suspicious money laundering clique when carrying out the identification of suspicious clique All accounts, or even can not find suspicious money laundering clique.Therefore, the identification that suspicious money laundering clique exists in the prior art is accurate Rate is lower.In this regard, the present invention provides a kind of recognition methods of suspicious money laundering clique, first passes through multidimensional characteristic algorithm and carry out for the first time Clique divides, and is then based on clique's merging algorithm and merges to the outer paying party of row, can be merged using the information of row interior nodes Row exterior node clique leads to not find suspicious money laundering so as to solve not getting the outer account information of row in the prior art All accounts in clique, or even the problem of can not find suspicious money laundering clique, after consolidation, the present invention is again by multidimensional Characteristics algorithm carries out second of clique's division, and then calculates the suspicious index of each clique, to excavate suspicious money laundering clique.This hair The bright recognition accuracy that suspicious money laundering clique can be improved, while the association by comprehensively considering row interior nodes and row exterior node is closed System can excavate and hide deeper suspicious money laundering account.

The recognition methods of the suspicious money laundering clique of the present embodiment is to realize that this sets by the identification equipment of suspicious money laundering clique It is standby to be illustrated by taking server as an example.In the present embodiment, server first obtains transaction data table and bank account information table, so The first vertex table and the first side table are obtained according to transaction data table and bank account information table afterwards, wherein the first vertex table is packet Include node ID all in a network (node ID of node ID and beneficiary node including paying party node) and node The table of attribute includes but is not limited to that clique ID and bank information (including belong in row or row external information, right in node attribute It is public or to personal letter breath etc.) etc. information；First side table is the node ID for including paying party node in a line, beneficiary node Node ID, unique ID on side and side attribute (including transaction feature vector, as in certain time period transaction stroke count and/or friendship The easy amount of money, the transaction in each period be averaged stroke count and/or transaction average amount etc.) table.For the first vertex table and The storage of one side table can be used hive (Tool for Data Warehouse based on Hadoop) data warehouse and be stored.Specifically, Step S10 includes:

Step a1 obtains transaction data table and bank account information table, summarizes to the transaction data table, handed over Easily summarize tables of data, it includes paying party account and beneficiary account that the transaction, which summarizes tables of data,；

In the present embodiment, transaction data table and bank account information table are first obtained, transaction data table is summarized, is obtained Summarize tables of data to transaction, wherein include paying party account, beneficiary account and Transaction Information in transaction data table, transaction converges Total data table is to summarize its Transaction Information according to paying party account, the beneficiary account in transaction data table, for example, summarizing transaction Total stroke count summarizes transaction stroke count, transaction amount etc. in certain time period, and corresponding, the transaction summarized summarizes data Include paying party account and beneficiary account in table, further includes Transaction Information etc..

The paying party account is converted into the paying party node ID of numeric type by step a2, and the beneficiary account is turned It changes the beneficiary node ID of numeric type into, and the mapping relations between account and the node ID of numeric type is constructed according to transformation result Table；

Due to having used spark graphx in subsequent default multidimensional characteristic broadcast algorithm, (figure in big data calculates skill Art), do not support character string as node ID, it is therefore desirable to pass through the monotonically_increasing_id of spark () method generates the node ID of numeric type, specifically, paying party account to be converted into the paying party of numeric type by the above method Beneficiary account is converted into the beneficiary node ID of numeric type, and constructs account and numeric type according to transformation result by node ID Node ID between mapping table.

Step a3, according to the paying party account, the beneficiary account, the mapping table and the bank account Information table obtains the first vertex table, and summarizes tables of data according to the transaction and the mapping table obtains the first side table.

Account is being converted into the node ID of numeric type, and is constructing the mapping relations between account and the node ID of numeric type Table obtains the first vertex table according to paying party account, beneficiary account, mapping table and bank account information table, and according to Transaction summarizes tables of data and the mapping table obtains the first side table.

It should be noted that in a particular embodiment, except using based on the spark under pregel figure Computational frame Outside graphx, other figure computing engines can also be used, such as graphlab etc. can not also replace figure computing engines, and replace Changing spark graphx is that other support the implementation patterns such as the computing engines, such as python of pregel.It is corresponding, if actually making The figure computing engines used can support character string as node, then be not necessarily to paying party account and beneficiary account corresponding conversion into number The paying party node ID and beneficiary node ID of font directly summarize tables of data according to account and bank account information table and transaction Obtain the first vertex table and the first side table.That is, the step S10 includes:

The first vertex table is obtained according to the paying party account, the beneficiary account and the bank account information table, And tables of data is summarized according to the transaction and obtains the first side table.

Step S20 carries out first based on first vertex table, first side table and default multidimensional characteristic broadcast algorithm Secondary clique divides, and obtains the first division result, and update the clique in the table of first vertex according to first division result ID obtains the second vertex table；

After obtaining the first vertex table and the first side table, it is based on the first vertex table, the first side table and default multidimensional characteristic Broadcast algorithm carries out the division of first time clique, obtains the first division result, and update the first vertex table according to the first division result In clique ID, obtain the second vertex table.Wherein, it further includes Transaction Information that the transaction, which summarizes tables of data, first side table Including the transaction feature vector generated according to the Transaction Information, step S20 includes:

Step b1, the clique ID for initializing each node in the table of first vertex is corresponding node ID, and iteration is arranged Number；

In the present embodiment, transaction is summarized tables of data in addition to including paying party account and beneficiary account, further includes transaction Information, corresponding, the first side table includes the transaction feature vector generated according to Transaction Information, when carrying out the division of the first clique, It is that the graphx interface based on pregel figure Computational frame realizes diffusion iteration, specifically, first passing through initialMsg function The clique ID of each node in the first vertex table is initialized for corresponding node ID, that is, in the nodal community for setting the first vertex table Clique ID is initially the node ID of the node, and the number of iterations M=0 is arranged.

The transaction feature vector is sent to corresponding beneficiary node, and root according to first side table by step b2 The transaction feature vector received according to the beneficiary node and default optimal vector selection rule determine the beneficiary node Optimal transaction feature vector, and the corresponding clique ID of the beneficiary node is updated to the optimal transaction feature vector pair The clique ID for the paying party node answered；

Then, transaction feature vector is sent to by corresponding beneficiary node by sendMsg function and the first side table, I.e. each paying party node is along edge direction, that is, the method paid the bill, the side being connected between paying party node and beneficiary node Vector (i.e. transaction feature vector) is sent to beneficiary node, certainly, in edge-vector in addition to including transaction feature vector, may be used also To include the clique ID of paying party node, in order to the subsequent update for carrying out clique ID.

Then, the transaction feature vector that is received by mergeMsg function and beneficiary node and preset it is optimal to Amount selection rule determines the optimal transaction feature vector of beneficiary node, wherein the default optimal vector selection rule can be Customized, the clique's feature that can identify according to actual needs is set, for example, for the money laundering clique of gambling type, The default optimal vector selection rule can be set are as follows: selection 8 points to 10 points of the maximum friendship of transaction count of evening of the first priority Easy feature vector；If transaction count is the same, the second priority 8 points to 10 points of transaction average amount of selection evening is maximum Transaction feature vector.

After determining the optimal transaction feature vector of beneficiary node, by vertexProgram function by the gathering The corresponding clique ID of Fang Jiedian is updated to the clique ID of paying party node corresponding with the optimal transaction feature vector.

Step b3, resets the number of iterations, and iteration executes step: according to first side table by the transaction feature Vector is sent to corresponding beneficiary node, and the transaction feature vector that is received according to the beneficiary node and it is default most Excellent vector selection rule determines the optimal transaction feature vector of the beneficiary node, and by the corresponding group of the beneficiary node Partner ID is updated to the clique ID of the corresponding paying party node of the optimal transaction feature vector, until the number of iterations reset When greater than default the number of iterations, stop iteration, and the updated first vertex table of clique ID is denoted as the second vertex table.

The number of iterations is reset, is set as M+1, and iteration executes above-mentioned steps: according to first side table by the friendship Easy feature vector is sent to corresponding beneficiary node, and the transaction feature vector that is received according to the beneficiary node and Default optimal vector selection rule determines the optimal transaction feature vector of the beneficiary node, and by the beneficiary node pair The clique ID answered is updated to the clique ID of the corresponding paying party node of the optimal transaction feature vector.The implementation procedure of the step It is consistent with above-described embodiment, it does not repeat herein.

Until stopping iteration when the number of iterations reset is greater than default the number of iterations, completing the first vertex at this time The update of Biao Zhong clique ID completes the division of first time clique, the updated first vertex table of clique ID is denoted as the at this time Two vertex tables.

Step S30, based on second vertex table and default clique merge algorithm to the row in the table of second vertex outside Paying party merges, and updates the clique ID in the table of second vertex according to amalgamation result, obtains third vertex table；

It divides and completes in first time clique, after obtaining the second vertex table, since diffusion is unidirectional, payment outside the row of upstream The clique ID of side is still respective node ID, needs paying party outside the row to upstream to merge at this time, will be mutually related The outer paying party of row is merged into same clique.Specifically, merging algorithm to the second vertex based on the second vertex table and default clique The outer paying party of row in table merges, and updates the clique ID in the second vertex table according to amalgamation result, obtains third vertex Table.Specific merging process can refer to following embodiments, not repeat herein.

Step S40 is carried out based on third vertex table, first side table and the default multidimensional characteristic broadcast algorithm Second of clique divides, and obtains the second division result, and according to second division result and preset suspicious index computation rule Calculate the suspicious index of each clique.

After merging, based on the third vertex table, the first side table and default multidimensional characteristic updated after merging Broadcast algorithm carries out second of clique's division, obtains the second division result, and the second division result is to be updated by third vertex table Then obtained vertex table after the clique ID of each node, and then the division result of the clique determined are divided according to second and are tied Fruit and preset the suspicious index that suspicious index computation rule calculates each clique.Wherein, the process and above-mentioned that the second clique divides The process that clique divides is almost the same, can refer to the process that above-mentioned first time clique divides, does not repeat herein.Wherein, Step " according to second division result and presetting the suspicious index that suspicious index computation rule calculates each clique " includes:

Step c1 obtains each node in each clique divided through second of clique according to second division result Account information and operation note, and determine according to the account information of each node and operation note the suspicious finger of each node Number；

After obtaining the second division result, each divided through second of clique is obtained according to the second division result The account information of each node in group and operation note, and each section is determined according to the account information and operation note of each node The suspicious index of point.Specifically, the suspicious index of each node is established rules then really, can be remembered according to the account information and operation of each node Record and mapping table between preset operation note, account information and suspicious index determine, for example, for blacklist Account, corresponding suspicious index are 10；For another example being received when repeatedly opening an account there are same client and substantial contribution occurring before cancellation When the case where paying, corresponding suspicious index is 5；In a certain period a certain account is transferred to fund in the presence of dispersion, concentrates and produces When situation, corresponding suspicious index is 2.Certainly, it above are only citing, be not used to limit the mapping in the mapping table Relationship can suggest mapping table according to specific actual conditions.According to the account information of each node and operation note and preset Mapping table between operation note, account information and suspicious index determines every account information and operations record institute It after corresponding suspicious index, sums up, corresponding addition and value is denoted as the suspicious index of the node.

Step c2 respectively sums up the suspicious index of each node in each clique, obtains the suspicious index of each clique.

Then, the suspicious index of each node in each clique is summed up respectively, obtains the suspicious index of each clique.When So, in a particular embodiment, for the calculating of the suspicious index of each clique, can also respectively to each node in each clique can After doubtful index sums up, the number of nodes of each clique is obtained, and then calculate average value, using the average value as the suspicious of clique Index.

In addition, it should be noted that, being by spreading clique's information from paying party node along transaction direction in the present invention To beneficiary node, to achieve the purpose that divide clique.In practical application, it is also an option that from beneficiary node along transaction Opposite direction diffusion clique's information in direction is extremely to paying party node.

The embodiment of the present invention provides a kind of recognition methods of suspicious money laundering clique, by obtaining transaction data table and bank's account Family information table, and the first vertex table and the first side table are obtained according to transaction data table and bank account information table；Based on the first top Point table, the first side table and default multidimensional characteristic broadcast algorithm carry out the division of first time clique, obtain the first division result, and according to First division result updates the clique ID in the first vertex table, obtains the second vertex table；Based on the second vertex table and default clique Merge algorithm to merge paying party outside the row in the second vertex table, and the group in the second vertex table is updated according to amalgamation result Partner ID, obtains third vertex table；Based on third vertex table, the first side table and default the multidimensional characteristic diffusion updated after merging Algorithm carries out second of clique's division, obtains the second division result, and then according to the second division result and preset suspicious index meter Calculate the suspicious index that rule calculates each clique.Multidimensional characteristic algorithm is first passed through in the present invention and carries out the division of first time clique, then Merge algorithm based on clique to merge the outer paying party of row, can using the information of row interior nodes come merging rows exterior node clique, Lead to not find all in suspicious money laundering clique so as to solve not getting the outer account information of row in the prior art Account, or even the problem of can not find suspicious money laundering clique, after consolidation, the present invention is carried out again by multidimensional characteristic algorithm Second of clique divides, and then calculates the suspicious index of each clique, excavates suspicious money laundering clique with identification.The present invention can be improved The recognition accuracy of suspicious money laundering clique, while the incidence relation by comprehensively considering row interior nodes and row exterior node can excavate Deeper suspicious money laundering account is hidden out.

It further, is the refinement flow diagram of step S30 in first embodiment of the invention referring to Fig. 3, Fig. 3.Step S30 includes:

Step S31 obtains paying party outside the row in the table of second vertex based on second vertex table and preset rules Secondary clique ID；

In the present embodiment, due to diffusion be it is unidirectional, after first time clique divides, the outer paying party of the row of upstream Clique ID is still respective node ID, and when paying party is excessive outside the row of upstream, the clique of generation also can be very more, is unfavorable for Subsequent further analysis, meanwhile, belong to the node of same clique, can be divided into multiple cliques.Therefore, it is rolled into a ball in first time After partner divides, paying party outside the row of upstream need to be merged, the outer paying party of row that will be mutually related is merged into same group In group.Specifically, the secondary clique ID of paying party outside the row in the second vertex table is first obtained based on the second vertex table and preset rules, Wherein, step S31 includes:

Step d1, according to each in the clique ID and bank information statistics second vertex table in the table of second vertex The quantity of the corresponding row interior nodes of partner, is denoted as the first quantity；

In the present embodiment, first according to each in the clique ID and bank information the second vertex table of statistics in the second vertex table The quantity of group corresponding row interior nodes, is denoted as the first quantity, wherein include in the nodal community of the second vertex table clique ID and Bank information, bank information include belonging to capable interior or row external information, and thus the node in statistics available same clique ID belongs in row The quantity of node is denoted as the first quantity.In addition, first quantity can also be updated and arrived after obtaining first quantity In the table of vertex, in order to subsequent calculating.

Step d2 is counted according to second vertex table and first side table and is paid the bill outside the row in the table of second vertex The square quantity that money transfer transactions occur with the row interior nodes of each clique, is denoted as the second quantity；

Then the row of paying party and each clique outside the row in the second vertex table is counted according to the second vertex table and the first side table The quantity of money transfer transactions occurs for interior nodes, is denoted as the second quantity, i.e., according to the first side table along payment transaction direction, collects and the The number of the row interior nodes of money transfer transactions occurs for the outer paying party of row in two vertex tables, and then according to ID pairs of the clique of each clique The above-mentioned row interior nodes there are money transfer transactions are counted, to obtain the row of paying party and each clique outside the row in the second vertex table The quantity of interior nodes generation money transfer transactions.

Step d3, according to first quantity and the second quantity be calculated outside the row paying party and each clique it Between connection ratio, whether the maximum value detected in the connection ratio be greater than the first preset threshold；

After statistics obtains the first quantity and the second quantity, outer pair of row is calculated according to the first quantity and the second quantity Connection ratio between money side and each clique, the connection ratio are the first quantity/second quantity, and then are detected in connection ratio Maximum value whether be greater than the first preset threshold.

Step d4 will be in the connection ratio if the maximum value in the connection ratio is greater than the first preset threshold Secondary clique ID of the corresponding clique ID of maximum value as paying party outside the row.

If the maximum value in the connection ratio is greater than the first preset threshold, illustrate the outer paying party of row and the company of the upstream The corresponding clique of ratio maximum value is met with strong correlation, at this point, then making the corresponding clique ID of maximum value in connection ratio For the secondary clique ID of the outer paying party of row.Wherein, the first preset threshold can be set as 0.5, naturally it is also possible to carry out according to actual needs Setting, is not construed as limiting herein.

If the maximum value in the connection ratio is less than or equal to the first preset threshold, illustrate the outer paying party of the row of the upstream The correlation of clique corresponding with the connection ratio maximum value is weaker, then it is assumed that unrelated between the outer paying party of the row and each clique Connection, at this point, pair clique ID is then not present, without merging.

Step S32 generates the 4th vertex table for only including the outer paying party of row according to second vertex table, and according to described 4th vertex table and the pair clique ID generate the second side table；

It is obtaining outside each row after the secondary clique ID of paying party, is being generated according to the second vertex table and only include the outer paying party of row 4th vertex table, and the second side table is generated according to the 4th vertex Biao Hefu clique ID.It pays the bill in the second side table, including outside a line The outer paying party of its corresponding another row of pair clique ID of Fang Zhixiang.

Step S33 generates digraph according to the 4th vertex table and second side table, and passes through figure calculation method meter Calculation obtains the connected subgraph of the digraph；

Then, digraph is generated according to the 4th vertex table and the second side table, and is calculated by figure calculation method oriented The connected subgraph of figure.Wherein, figure calculation method can include but is not limited to: (figure in big data calculates skill to spark graphx Art), pregel (distributed figure Computational frame), graphlab (the open source figure Computational frame based on image processing model).Specifically , the calculation method of connected subgraph is consistent with existing connected subgraph calculation method, does not repeat herein.

The connected subgraph is numbered in step S34, and by the clique of paying party outside the row in the table of second vertex ID is updated to the number of the affiliated connected subgraph of the outer paying party of the row, obtains third vertex table.

Finally, each connected subgraph is numbered, for example, number consecutively can be carried out according to the sequence that obtains of connected subgraph, Number is 1,2,3 ..., and then the clique ID of paying party outside the row in the second vertex table is updated to connection belonging to the outer paying party of row The number of subgraph obtains third vertex table.

In view of the one-way of diffusion in the present embodiment, by default clique merge algorithm to paying party outside the row of upstream into Row merges, and the outer paying party of row that will be mutually related is merged into same clique, and then is facilitated subsequent second of clique and divided, To can avoid because outside the row of upstream paying party it is excessive due to cause the clique ultimately generated very more, and influence subsequent further Analysis, also can avoid the node for belonging to same clique, can be divided into multiple cliques.Therefore, by the outer paying party of row into Row merges, and can help to the accuracy rate for further increasing suspicious money laundering clique identification.

Further, the respective embodiments described above are based on, propose that the second of the recognition methods of the suspicious money laundering clique of the present invention is real Apply example.

In the present embodiment, after the step s 40, the recognition methods of the suspicious money laundering clique further include:

Whether step A, the suspicious index for detecting each clique are greater than the second preset threshold, and the suspicious index is big Suspicious money laundering clique is labeled as in the clique of the second preset threshold；

In the present embodiment, after the suspicious index of each clique is calculated, the suspicious finger of each clique can also be detected Whether number is greater than the second preset threshold, and the clique that suspicious index is greater than the second preset threshold is labeled as suspicious money laundering clique. Wherein, which can be set according to the actual situation, be not construed as limiting herein.Further, since according to different Suspicious index computation rule, the suspicious index being calculated in step S40 may be total suspicious index, it is also possible to be average suspicious Index, at this point, the second preset threshold need to be correspondingly arranged.

Step B obtains the information of the suspicious money laundering clique, according to the suspicious exponent pair of the suspicious money laundering clique Suspicious money laundering clique is ranked up, and the information of the suspicious money laundering clique is sent to default operational terminal by ranking results, So that staff analyzes the suspicious money laundering clique according to the information of the suspicious money laundering clique.

After determining suspicious money laundering clique, the information of suspicious money laundering clique, such as Transaction Information are obtained (such as transaction pen Number, transaction total amount, the information such as trading object), bank information (belong to public affairs in private, row or row is outer etc.), and root According to the suspicious exponent pair of suspicious money laundering clique, suspicious money laundering clique is ranked up, for example, can be arranged by sequence from big to small Then the information of suspicious money laundering clique is sent to default operational terminal by ranking results by sequence, so that staff is according to can The information for doubting money laundering clique is further analyzed suspicious money laundering clique.

Suspicious money laundering clique is further marked in the present embodiment according to the size of suspicious index, and then obtains suspicious money laundering The information of clique, and the information of suspicious money laundering clique is sent to working end, so that staff is further analyzed really Recognize, to can further improve the recognition accuracy of suspicious money laundering clique, excavates real suspicious money laundering clique.

The present invention also provides a kind of identification devices of suspicious money laundering clique.

Referring to Fig. 4, Fig. 4 is the functional block diagram of the identification device of the suspicious money laundering clique of the present invention.

As shown in figure 4, the identification device of the suspicious money laundering clique includes:

Obtain module 10, for obtaining transaction data table and bank account information table, and according to the transaction data table and The bank account information table obtains the first vertex table and the first side table；

Division module 20, for being based on first vertex table, first side table and default multidimensional characteristic broadcast algorithm The division of first time clique is carried out, obtains the first division result, and first vertex table is updated according to first division result In clique ID, obtain the second vertex table；

Merging module 30, for merging algorithm in the table of second vertex based on second vertex table and default clique The outer paying party of row merge, and the clique ID in the table of second vertex is updated according to amalgamation result, obtains third vertex Table；

Computing module 40 is based on third vertex table, first side table and the default multidimensional characteristic broadcast algorithm Second of clique's division is carried out, obtains the second division result, and according to second division result and preset suspicious index calculating Rule calculates the suspicious index of each clique.

Further, the acquisition module 10 includes:

First acquisition unit carries out the transaction data table for obtaining transaction data table and bank account information table Summarize, obtains transaction and summarize tables of data, it includes paying party account and beneficiary account that the transaction, which summarizes tables of data,；

Unit is established in mapping, for the paying party account to be converted into the paying party node ID of numeric type, by the receipts Money side's account is converted into the beneficiary node ID of numeric type, and is constructed between account and the node ID of numeric type according to transformation result Mapping table；

Second acquisition unit, for according to the paying party account, the beneficiary account, the mapping table and institute It states bank account information table and obtains the first vertex table, and tables of data summarized according to the transaction and the mapping table obtains the One side table.

Further, it further includes Transaction Information that the transaction, which summarizes tables of data, and first side table includes according to the friendship The transaction feature vector that easy information generates, the division module 20 include:

Initialization unit, the clique ID for initializing each node in the table of first vertex are corresponding node ID, and The number of iterations is set；

Updating unit, for the transaction feature vector to be sent to corresponding beneficiary section according to first side table Point, and the transaction feature vector and default optimal vector selection rule that are received according to the beneficiary node determine the receipts The optimal transaction feature vector of money side's node, and the corresponding clique ID of the beneficiary node is updated to the optimal transaction spy Levy the clique ID of the corresponding paying party node of vector；

Third acquiring unit, for resetting the number of iterations, and iteration executes step: according to first side table by institute The transaction feature stated transaction feature vector and be sent to corresponding beneficiary node, and received according to the beneficiary node to Amount and default optimal vector selection rule determine the optimal transaction feature vector of the beneficiary node, and by the beneficiary The corresponding clique ID of node is updated to the clique ID of the corresponding paying party node of the optimal transaction feature vector, until setting again When the number of iterations set is greater than default the number of iterations, stop iteration, and the updated first vertex table of clique ID is denoted as second Vertex table.

Further, the merging module 30 includes:

Secondary ID acquiring unit, for obtaining the row in the table of second vertex based on second vertex table and preset rules The secondary clique ID of outer paying party；

Generation unit, for generating the 4th vertex table for only including the outer paying party of row, and root according to second vertex table The second side table is generated according to the 4th vertex table and the pair clique ID；

Subgraph computing unit for generating digraph according to the 4th vertex table and second side table, and passes through figure The connected subgraph of the digraph is calculated in calculation method；

4th acquiring unit for the connected subgraph to be numbered, and will be paid outside the row in the table of second vertex The clique ID of money side is updated to the number of the affiliated connected subgraph of the outer paying party of the row, obtains third vertex table.

Further, the secondary ID acquiring unit includes:

First statistics subelement, for according to the clique ID and bank information statistics described second in the table of second vertex Vertex Biao Zhongge clique corresponds to the quantity of row interior nodes, is denoted as the first quantity；

Second statistics subelement, for counting second vertex table according to second vertex table and first side table In the outer paying party of row and the row interior nodes of each clique the quantity of money transfer transactions occurs, be denoted as the second quantity；

First detection sub-unit, for according to first quantity and the second quantity be calculated outside the row paying party with Whether the connection ratio between each clique, the maximum value detected in the connection ratio are greater than the first preset threshold；

Secondary ID obtains subelement, will be described if being greater than the first preset threshold for the maximum value in the connection ratio Secondary clique ID of the corresponding clique ID of maximum value as paying party outside the row in connection ratio.

Further, the computing module 40 includes:

Index determination unit, for obtaining each clique divided through second of clique according to second division result In each node account information and operation note, and each node is determined according to the account information and operation note of each node Suspicious index；

Exponent calculation unit sums up for the suspicious index respectively to each node in each clique, obtains each clique Suspicious index.

Further, the identification device of the suspicious money laundering clique further include:

Whether detection module, the suspicious index for detecting each clique are greater than the second preset threshold, and can by described in It doubts index and is greater than the clique of the second preset threshold labeled as suspicious money laundering clique；

Sending module, for obtaining the information of the suspicious money laundering clique, according to the suspicious finger of the suspicious money laundering clique It is several that the suspicious money laundering clique is ranked up, and the information of the suspicious money laundering clique is sent to default work by ranking results Make terminal, so that staff analyzes the suspicious money laundering clique according to the information of the suspicious money laundering clique.

Wherein, the function of modules is realized and above-mentioned suspicious money laundering clique in the identification device of above-mentioned suspicious money laundering clique Recognition methods embodiment in each step it is corresponding, function and realization process no longer repeat one by one here.

The present invention also provides a kind of computer storage medium, suspicious money laundering clique is stored in the computer storage medium It is realized as described in any of the above item embodiment when the recognizer of recognizer, the suspicious money laundering clique is executed by processor The step of recognition methods of suspicious money laundering clique.

Each embodiment of recognition methods of the specific embodiment of computer storage medium of the present invention and above-mentioned suspicious money laundering clique Essentially identical, therefore not to repeat here.

It should be noted that, in this document, the terms "include", "comprise" or its any other variant are intended to non-row His property includes, so that the process, method, article or the system that include a series of elements not only include those elements, and And further include other elements that are not explicitly listed, or further include for this process, method, article or system institute it is intrinsic Element.In the absence of more restrictions, the element limited by sentence "including a ...", it is not excluded that including being somebody's turn to do There is also other identical elements in the process, method of element, article or system.

The serial number of the above embodiments of the invention is only for description, does not represent the advantages or disadvantages of the embodiments.

Through the above description of the embodiments, those skilled in the art can be understood that above-described embodiment side Method can be realized by means of software and necessary general hardware platform, naturally it is also possible to by hardware, but in many cases The former is more preferably embodiment.Based on this understanding, technical solution of the present invention substantially in other words does the prior art The part contributed out can be embodied in the form of software products, which is stored in one as described above In storage medium (such as ROM/RAM, magnetic disk, CD), including some instructions are used so that terminal device (it can be mobile phone, Computer, server or network equipment etc.) execute method described in each embodiment of the present invention.

The above is only a preferred embodiment of the present invention, is not intended to limit the scope of the invention, all to utilize this hair Equivalent structure or equivalent flow shift made by bright specification and accompanying drawing content is applied directly or indirectly in other relevant skills Art field, is included within the scope of the present invention.

Claims

1. a kind of recognition methods of suspicious money laundering clique, which is characterized in that the recognition methods of the suspicious money laundering clique includes:

Transaction data table and bank account information table are obtained, and is obtained according to the transaction data table and the bank account information table To the first vertex table and the first side table；

The division of first time clique is carried out based on first vertex table, first side table and default multidimensional characteristic broadcast algorithm, The first division result is obtained, and the clique ID in the table of first vertex is updated according to first division result, obtains second Vertex table；

Merge algorithm based on second vertex table and default clique to close paying party outside the row in the table of second vertex And and the clique ID in the table of second vertex is updated according to amalgamation result, obtain third vertex table；

Second of clique is carried out based on third vertex table, first side table and the default multidimensional characteristic broadcast algorithm to draw Point, obtain the second division result, and according to second division result and preset suspicious index computation rule and calculate each clique Suspicious index.

2. the recognition methods of suspicious money laundering clique as described in claim 1, which is characterized in that the acquisitions transaction data table with Bank account information table, and the first vertex table and the first side are obtained according to the transaction data table and the bank account information table The step of table includes:

Transaction data table and bank account information table are obtained, the transaction data table is summarized, transaction is obtained and summarizes data Table, it includes paying party account and beneficiary account that the transaction, which summarizes tables of data,；

The paying party account is converted into the paying party node ID of numeric type, the beneficiary account is converted into numeric type Beneficiary node ID, and the mapping table between account and the node ID of numeric type is constructed according to transformation result；

It is obtained according to the paying party account, the beneficiary account, the mapping table and the bank account information table First vertex table, and tables of data is summarized and the mapping table obtains the first side table according to the transaction.

3. the recognition methods of suspicious money laundering clique as claimed in claim 2, which is characterized in that the transaction summarizes tables of data also Including Transaction Information, first side table includes the transaction feature vector generated according to the Transaction Information, described based on described First vertex table, first side table and default multidimensional characteristic broadcast algorithm carry out the division of first time clique, obtain the first division As a result, and the step of update the clique ID in the table of first vertex according to first division result, obtain the second vertex table Include:

The transaction feature vector is sent to corresponding beneficiary node according to first side table, and according to the beneficiary The transaction feature vector and default optimal vector selection rule that node receives determine that the optimal transaction of the beneficiary node is special Vector is levied, and the corresponding clique ID of the beneficiary node is updated to the corresponding paying party section of the optimal transaction feature vector The clique ID of point；

The number of iterations is reset, and iteration executes step: being sent to the transaction feature vector according to first side table Corresponding beneficiary node, and the transaction feature vector received according to the beneficiary node and default optimal vector select Rule determines the optimal transaction feature vector of the beneficiary node, and the corresponding clique ID of the beneficiary node is updated to The clique ID of the corresponding paying party node of the optimal transaction feature vector, until the number of iterations reset be greater than it is default repeatedly When generation number, stop iteration, and the updated first vertex table of clique ID is denoted as the second vertex table.

4. the recognition methods of suspicious money laundering clique as described in claim 1, which is characterized in that described to be based on second vertex Table and default clique merge algorithm and merge to paying party outside the row in the table of second vertex, and are updated according to amalgamation result Clique ID in the table of second vertex, the step of obtaining third vertex table include:

The secondary clique ID of paying party outside the row in the table of second vertex is obtained based on second vertex table and preset rules；

Generate the 4th vertex table for only including the outer paying party of row according to second vertex table, and according to the 4th vertex table with The pair clique ID generates the second side table；

Generate digraph according to the 4th vertex table and second side table, and by figure calculation method be calculated described in have To the connected subgraph of figure；

The connected subgraph is numbered, and the clique ID of paying party outside the row in the table of second vertex is updated to described The number of the outer affiliated connected subgraph of paying party of row, obtains third vertex table.

5. the recognition methods of suspicious money laundering clique as claimed in claim 4, which is characterized in that described to be based on second vertex Table and preset rules obtain the step of secondary clique ID of the outer paying party of the row in the table of second vertex and include:

According in the table of second vertex clique ID and bank information count the second vertex Biao Zhongge clique and correspond in row The quantity of node is denoted as the first quantity；

Paying party and each clique outside the row in the table of second vertex are counted according to second vertex table and first side table Row interior nodes occur money transfer transactions quantity, be denoted as the second quantity；

The connection ratio outside the row between paying party and each clique is calculated according to first quantity and the second quantity Whether example, the maximum value detected in the connection ratio are greater than the first preset threshold；

If the maximum value in the connection ratio is greater than the first preset threshold, and the maximum value in the connection ratio is corresponding Secondary clique ID of the clique ID as paying party outside the row.

6. the recognition methods of suspicious money laundering clique as described in claim 1, which is characterized in that described to be divided according to described second As a result it and presets the step of suspicious index computation rule calculates the suspicious index of each clique and includes:

The account information of each node in each clique divided through second of clique is obtained according to second division result And operation note, and determine according to the account information of each node and operation note the suspicious index of each node；

7. such as the recognition methods of suspicious money laundering clique of any of claims 1-6, which is characterized in that described suspicious to wash The recognition methods of money clique further include:

Whether the suspicious index for detecting each clique is greater than the second preset threshold, and the suspicious index is greater than second and is preset The clique of threshold value is labeled as suspicious money laundering clique；

The information for obtaining the suspicious money laundering clique, according to suspicious money laundering group described in the suspicious exponent pair of the suspicious money laundering clique Partner is ranked up, and the information of the suspicious money laundering clique is sent to default operational terminal by ranking results, so that work Personnel analyze the suspicious money laundering clique according to the information of the suspicious money laundering clique.

8. a kind of identification device of suspicious money laundering clique, which is characterized in that the identification device of the suspicious money laundering clique includes:

Module is obtained, for obtaining transaction data table and bank account information table, and according to the transaction data table and the silver Row account information table obtains the first vertex table and the first side table；

Division module, for carrying out the based on first vertex table, first side table and default multidimensional characteristic broadcast algorithm One time clique divides, and obtains the first division result, and update the group in the table of first vertex according to first division result Partner ID, obtains the second vertex table；

Merging module, for based on second vertex table and default clique merge algorithm to the row in the table of second vertex outside Paying party merges, and updates the clique ID in the table of second vertex according to amalgamation result, obtains third vertex table；

Computing module carries out the based on third vertex table, first side table and the default multidimensional characteristic broadcast algorithm Secondary clique divides, and obtains the second division result, and according to second division result and preset suspicious index computation rule meter The suspicious index of Suan Ge clique.

9. the identification device of suspicious money laundering clique as claimed in claim 8, which is characterized in that the acquisition module includes:

First acquisition unit summarizes the transaction data table for obtaining transaction data table and bank account information table, It obtains transaction and summarizes tables of data, it includes paying party account and beneficiary account that the transaction, which summarizes tables of data,；

Unit is established in mapping, for the paying party account to be converted into the paying party node ID of numeric type, by the beneficiary Account is converted into the beneficiary node ID of numeric type, and constructs reflecting between account and the node ID of numeric type according to transformation result Penetrate relation table；

Second acquisition unit, for according to the paying party account, the beneficiary account, the mapping table and the silver Row account information table obtains the first vertex table, and summarizes tables of data according to the transaction and the mapping table obtains the first side Table.

10. the identification device of suspicious money laundering clique as claimed in claim 9, which is characterized in that the transaction summarizes tables of data It further include Transaction Information, first side table includes the transaction feature vector generated according to the Transaction Information, the division mould Block includes:

Initialization unit, the clique ID for initializing each node in the table of first vertex is corresponding node ID, and is arranged The number of iterations；

Updating unit, for the transaction feature vector to be sent to corresponding beneficiary node according to first side table, and The transaction feature vector received according to the beneficiary node and default optimal vector selection rule determine the beneficiary section The optimal transaction feature vector of point, and the corresponding clique ID of the beneficiary node is updated to the optimal transaction feature vector The clique ID of corresponding paying party node；

Third acquiring unit, for resetting the number of iterations, and iteration executes step: according to first side table by the friendship Easy feature vector is sent to corresponding beneficiary node, and the transaction feature vector that is received according to the beneficiary node and Default optimal vector selection rule determines the optimal transaction feature vector of the beneficiary node, and by the beneficiary node pair The clique ID answered is updated to the clique ID of the corresponding paying party node of the optimal transaction feature vector, until what is reset changes When generation number is greater than default the number of iterations, stop iteration, and the updated first vertex table of clique ID is denoted as the second vertex table.

11. the identification device of suspicious money laundering clique as claimed in claim 8, which is characterized in that the merging module includes:

Secondary ID acquiring unit is paid outside the row in the table of second vertex for being obtained based on second vertex table and preset rules The secondary clique ID of money side；

Generation unit, for generating the 4th vertex table for only including the outer paying party of row according to second vertex table, and according to institute It states the 4th vertex table and the pair clique ID generates the second side table；

Subgraph computing unit for generating digraph according to the 4th vertex table and second side table, and is calculated by figure The connected subgraph of the digraph is calculated in method；

4th acquiring unit, for the connected subgraph to be numbered, and by paying party outside the row in the table of second vertex Clique ID be updated to the number of the outer affiliated connected subgraph of paying party of the row, obtain third vertex table.

12. the identification device of suspicious money laundering clique as claimed in claim 11, which is characterized in that the secondary ID acquiring unit packet It includes:

First statistics subelement, for according in the table of second vertex clique ID and bank information count second vertex Biao Zhongge clique corresponds to the quantity of row interior nodes, is denoted as the first quantity；

Second statistics subelement, for being counted in the table of second vertex according to second vertex table and first side table The quantity of money transfer transactions occurs for the row interior nodes of the outer paying party of row and each clique, is denoted as the second quantity；

First detection sub-unit, for according to first quantity and the second quantity be calculated outside the row paying party with it is described Whether the connection ratio between each clique, the maximum value detected in the connection ratio are greater than the first preset threshold；

Secondary ID obtains subelement, if being greater than the first preset threshold for the maximum value in the connection ratio, by the connection Secondary clique ID of the corresponding clique ID of maximum value as paying party outside the row in ratio.

13. the identification device of suspicious money laundering clique as claimed in claim 8, which is characterized in that the computing module includes:

Index determination unit, for being obtained in each clique divided through second of clique according to second division result The account information of each node and operation note, and according to the account information of each node and operation note determine each node can Doubt index；

Exponent calculation unit is summed up for the suspicious index respectively to each node in each clique, and obtain each clique can Doubt index.

14. the identification device of the suspicious money laundering clique as described in any one of claim 8-13, which is characterized in that described suspicious The identification device of money laundering clique further include:

Whether detection module, the suspicious index for detecting each clique are greater than the second preset threshold, and by the suspicious finger The clique that number is greater than the second preset threshold is labeled as suspicious money laundering clique；

Sending module, for obtaining the information of the suspicious money laundering clique, according to the suspicious exponent pair of the suspicious money laundering clique The suspicious money laundering clique is ranked up, and the information of the suspicious money laundering clique is sent to default work end by ranking results End, so that staff analyzes the suspicious money laundering clique according to the information of the suspicious money laundering clique.

15. a kind of identification equipment of suspicious money laundering clique, which is characterized in that the identification equipment of the suspicious money laundering clique includes: Memory, processor and the identification journey of suspicious money laundering clique that is stored on the memory and can run on the processor It is realized as described in any one of claims 1 to 7 when the recognizer of sequence, the suspicious money laundering clique is executed by the processor Suspicious money laundering clique recognition methods the step of.

16. a kind of computer storage medium, which is characterized in that be stored with suspicious money laundering clique in the computer storage medium It realizes when the recognizer of recognizer, the suspicious money laundering clique is executed by processor such as any one of claims 1 to 7 institute The step of recognition methods of the suspicious money laundering clique stated.