CN109741173B - Method, device, equipment and computer storage medium for identifying suspicious money laundering teams - Google Patents
Method, device, equipment and computer storage medium for identifying suspicious money laundering teams Download PDFInfo
- Publication number
- CN109741173B CN109741173B CN201811619485.7A CN201811619485A CN109741173B CN 109741173 B CN109741173 B CN 109741173B CN 201811619485 A CN201811619485 A CN 201811619485A CN 109741173 B CN109741173 B CN 109741173B
- Authority
- CN
- China
- Prior art keywords
- group
- vertex
- suspicious
- node
- vertex table
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Abstract
The invention discloses a method for identifying a suspicious money laundering group. The method comprises the following steps: acquiring a transaction data table and a bank account information table to obtain a first vertex table and a first edge table; performing first group partner division based on the first vertex table, the first edge table and a preset multi-dimensional feature diffusion algorithm, and updating the group partner ID in the first vertex table according to a first division result to obtain a second vertex table; merging the off-line payers in the second vertex table based on the second vertex table and a preset group combining algorithm, and updating the group ID in the second vertex table according to a merging result to obtain a third vertex table; and performing second group division based on the third vertex table, the first edge table and a preset multi-dimensional feature diffusion algorithm, and calculating the suspicious index of each group according to the second division result and a preset suspicious index calculation rule. The invention also discloses a device, equipment and computer storage medium for identifying the suspicious money laundering teams. The invention can improve the identification accuracy of the suspicious money laundering gangs.
Description
Technical Field
The invention relates to the technical field of data processing, in particular to a method, a device, equipment and a computer storage medium for identifying suspicious money laundering groups.
Background
With the rapid development of information technology, the internet financial model is gradually emerging and becomes the focus of continuous attention of the financial field. But the internet finance is a high-risk area for money laundering due to the inherent characteristics of complexity, concealment, variability and the like, and the normal and orderly operation of economic financial order is seriously damaged.
At present, transactions among banks are numerous, each user holds a plurality of bank accounts, but the information of the bank accounts is not communicated, and a transaction closed loop cannot be formed. That is to say, the self transaction network constructed by each bank is incomplete, and lawless persons also utilize the characteristic that bank information is not available, transfer accounts in a plurality of banks to split information, so that the group relation in a single bank is incomplete, and further, when an internet company carries out suspicious group recognition, all accounts in suspicious money washing group can not be found, even suspicious money washing group can not be found. Therefore, the problem that the identification accuracy of the suspicious money laundering group is low exists in the prior art.
Disclosure of Invention
The invention mainly aims to provide a method, a device, equipment and a computer storage medium for identifying a suspicious money laundering group, aiming at improving the identification accuracy of the suspicious money laundering group.
In order to achieve the above object, the present invention provides a method for identifying a suspicious money laundering partner, comprising:
acquiring a transaction data table and a bank account information table, and acquiring a first vertex table and a first edge table according to the transaction data table and the bank account information table;
performing first group partner division based on the first vertex table, the first edge table and a preset multi-dimensional feature diffusion algorithm to obtain a first division result, and updating the group partner ID in the first vertex table according to the first division result to obtain a second vertex table;
merging the off-line payers in the second vertex table based on the second vertex table and a preset group-combining algorithm, and updating the group ID in the second vertex table according to a merging result to obtain a third vertex table;
and performing second grouping division based on the third vertex table, the first edge table and the preset multi-dimensional feature diffusion algorithm to obtain a second division result, and calculating the suspicious index of each group according to the second division result and a preset suspicious index calculation rule.
Optionally, the step of obtaining the transaction data table and the bank account information table, and obtaining the first vertex table and the first edge table according to the transaction data table and the bank account information table includes:
acquiring a transaction data sheet and a bank account information sheet, and summarizing the transaction data sheet to obtain a transaction summary data sheet, wherein the transaction summary data sheet comprises a payer account and a payee account;
converting the payer account into a digital payer node ID, converting the payee account into a digital payee node ID, and constructing a mapping relation table between the account and the digital payee node ID according to a conversion result;
and obtaining a first vertex table according to the payer account, the payee account, the mapping relation table and the bank account information table, and obtaining a first edge table according to the transaction summary data table and the mapping relation table.
Optionally, the transaction summary data table further includes transaction information, the first edge table includes a transaction feature vector generated according to the transaction information, the first groupware partitioning is performed based on the first vertex table, the first edge table and a preset multidimensional feature diffusion algorithm to obtain a first partitioning result, the groupware ID in the first vertex table is updated according to the first partitioning result, and the step of obtaining the second vertex table includes:
initializing the group ID of each node in the first vertex table as a corresponding node ID, and setting iteration times;
sending the transaction characteristic vector to a corresponding payee node according to the first edge table, determining an optimal transaction characteristic vector of the payee node according to the transaction characteristic vector received by the payee node and a preset optimal vector selection rule, and updating a group ID corresponding to the payee node to a group ID of a payer node corresponding to the optimal transaction characteristic vector;
resetting the iteration times, and iteratively executing the steps of: and sending the transaction characteristic vector to a corresponding payee node according to the first edge table, determining an optimal transaction characteristic vector of the payee node according to the transaction characteristic vector received by the payee node and a preset optimal vector selection rule, updating the group ID corresponding to the payee node to the group ID of the payer node corresponding to the optimal transaction characteristic vector, stopping iteration until the reset iteration times are greater than the preset iteration times, and recording the updated first vertex table of the group ID as a second vertex table.
Optionally, the step of merging the off-line payers in the second vertex table based on the second vertex table and a preset group combining algorithm, and updating the group ID in the second vertex table according to the merging result to obtain a third vertex table includes:
obtaining a secondary group ID of the out-of-line payer in the second vertex table based on the second vertex table and a preset rule;
generating a fourth vertex table from the second vertex table that includes only out-of-line payers, and generating a second edge table from the fourth vertex table and the secondary group ID;
generating a directed graph according to the fourth vertex table and the second edge table, and calculating to obtain a connected subgraph of the directed graph by a graph calculation method;
and numbering the connected subgraphs, and updating the group ID of the off-line payer in the second vertex table to the number of the connected subgraph to which the off-line payer belongs to obtain a third vertex table.
Optionally, the step of deriving a secondary group ID of the out-of-line payer in the second vertex table based on the second vertex table and a preset rule comprises:
counting the number of nodes in the corresponding row of each group in the second vertex table according to the group ID and the bank information in the second vertex table, and recording the number as a first number;
counting the number of transfer transactions between the off-line payer and the in-line node of each group in the second vertex table according to the second vertex table and the first edge table, and recording the number as a second number;
calculating connection proportions between the off-line payer and each group according to the first quantity and the second quantity, and detecting whether the maximum value of the connection proportions is larger than a first preset threshold value;
and if the maximum value in the connection proportion is larger than a first preset threshold value, taking the group ID corresponding to the maximum value in the connection proportion as a secondary group ID of the layaway payer.
Optionally, the step of calculating the suspicious index of each group according to the second division result and a preset suspicious index calculation rule includes:
obtaining account information and operation records of each node in each group obtained by the second group division according to the second division result, and determining suspicious indexes of each node according to the account information and the operation records of each node;
and respectively summing up the suspicious indexes of the nodes in each group to obtain the suspicious index of each group.
Optionally, the method for identifying a suspicious money laundering group further comprises:
detecting whether the suspicious index of each group is larger than a second preset threshold value or not, and marking the group with the suspicious index larger than the second preset threshold value as a suspicious money laundering group;
and obtaining the information of the suspicious money washing group, sequencing the suspicious money washing group according to the suspicious index of the suspicious money washing group, and sending the information of the suspicious money washing group to a preset working terminal according to the sequencing result, so that a worker analyzes the suspicious money washing group according to the information of the suspicious money washing group.
In order to achieve the above object, the present invention further provides an identification apparatus for a suspected money laundering party, comprising:
the acquisition module is used for acquiring a transaction data sheet and a bank account information sheet and acquiring a first vertex sheet and a first edge sheet according to the transaction data sheet and the bank account information sheet;
the dividing module is used for carrying out first gang division on the basis of the first vertex table, the first edge table and a preset multi-dimensional feature diffusion algorithm to obtain a first division result, and updating gang IDs in the first vertex table according to the first division result to obtain a second vertex table;
a merging module, configured to merge the off-line payers in the second vertex table based on the second vertex table and a preset partnership merging algorithm, and update the partnership ID in the second vertex table according to a merging result, to obtain a third vertex table;
and the calculation module is used for carrying out second group division on the basis of the third vertex table, the first edge table and the preset multi-dimensional feature diffusion algorithm to obtain a second division result and calculating the suspicious index of each group according to the second division result and a preset suspicious index calculation rule.
In addition, to achieve the above object, the present invention provides an identification device of a suspected money laundering partner, comprising: memory, a processor and an identification program of a suspicious money laundering group stored on the memory and executable on the processor, the identification program of the suspicious money laundering group implementing the steps of the identification method of a suspicious money laundering group as described above when executed by the processor.
In order to achieve the above object, the present invention also provides a computer storage medium having stored thereon a suspicious money laundering group identification program which, when executed by a processor, implements the steps of the suspicious money laundering group identification method as described above.
The invention provides a method, a device, equipment and a computer storage medium for identifying suspicious money laundering groups, wherein a first vertex table and a first edge table are obtained by acquiring a transaction data table and a bank account information table according to the transaction data table and the bank account information table; performing first group partner division based on the first vertex table, the first edge table and a preset multi-dimensional feature diffusion algorithm to obtain a first division result, and updating the group partner ID in the first vertex table according to the first division result to obtain a second vertex table; merging the off-line payers in the second vertex table based on the second vertex table and a preset group merging algorithm, and updating the group ID in the second vertex table according to a merging result to obtain a third vertex table; and performing second grouping division based on the third vertex table, the first edge table and the preset multi-dimensional feature diffusion algorithm which are obtained by updating after merging to obtain a second division result, and further calculating the suspicious index of each group according to the second division result and a preset suspicious index calculation rule. According to the invention, the first group division is carried out through a multi-dimensional characteristic algorithm, then the off-line payers are combined based on the group combination algorithm, and the off-line node group can be combined by utilizing the information of the on-line node, so that the problems that all accounts in the suspicious money washing group cannot be found and even the suspicious money washing group cannot be found due to the fact that the off-line account information cannot be obtained in the prior art can be solved. The invention can improve the identification accuracy of the suspicious money washing group, and can dig out the suspicious money washing account hidden deeply by comprehensively considering the incidence relation between the intra-row node and the extra-row node.
Drawings
FIG. 1 is a schematic diagram of an apparatus architecture of a hardware operating environment according to an embodiment of the present invention;
FIG. 2 is a schematic flow chart illustrating a first embodiment of a method for identifying suspicious money laundering groups in accordance with the present invention;
FIG. 3 is a detailed flowchart of step S30 in the first embodiment of the present invention;
fig. 4 is a functional module diagram of the first embodiment of the suspicious money laundering group identification apparatus of the present invention.
The implementation, functional features and advantages of the present invention will be further described with reference to the accompanying drawings.
Detailed Description
It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.
Referring to fig. 1, fig. 1 is a schematic device structure diagram of a hardware operating environment according to an embodiment of the present invention.
The identification device of the suspicious money laundering group in the embodiment of the present invention may be a server, or may be a terminal device such as a PC (Personal Computer), a tablet Computer, or a portable Computer.
As shown in fig. 1, the identification device of the suspected money laundering party may comprise: a processor 1001, e.g. a CPU, a communication bus 1002, a user interface 1003, a network interface 1004, a memory 1005. Wherein a communication bus 1002 is used to enable connective communication between these components. The user interface 1003 may include a Display screen (Display), an input unit such as a Keyboard (Keyboard), and the optional user interface 1003 may also include a standard wired interface, a wireless interface. The network interface 1004 may optionally include a standard wired interface, a wireless interface (e.g., a Wi-Fi interface). The memory 1005 may be a high-speed RAM memory or a non-volatile memory such as a disk memory. The memory 1005 may alternatively be a storage device separate from the processor 1001.
It will be appreciated by those skilled in the art that the configuration of the identification device of the suspected money laundering party shown in figure 1 does not constitute a limitation of the identification device of the suspected money laundering party and may include more or fewer components than those shown, or some components may be combined, or a different arrangement of components.
As shown in fig. 1, memory 1005, which is one type of computer storage medium, may include an operating system, a network communication module, a user interface module, and a suspicious money laundering group identification program.
In the terminal shown in fig. 1, the network interface 1004 is mainly used for connecting a background server and communicating data with the background server; the user interface 1003 is mainly used for connecting a client and performing data communication with the client; and the processor 1001 may be adapted to invoke the identification procedure of the suspected money laundering consortium stored in the memory 1005 and to perform the following steps of the identification method of the suspected money laundering consortium.
Based on the hardware structure, the invention provides various embodiments of the identification method of the suspicious money laundering group.
The invention provides a method for identifying a suspicious money laundering group.
Referring to fig. 2, fig. 2 is a flowchart illustrating a method for identifying a suspicious money laundering group according to a first embodiment of the present invention.
In this embodiment, the method for identifying a suspicious money laundering group comprises:
step S10, a transaction data sheet and a bank account information sheet are obtained, and a first vertex sheet and a first edge sheet are obtained according to the transaction data sheet and the bank account information sheet;
at present, transactions among banks are numerous, each user holds a plurality of bank accounts, but the information of the bank accounts is not communicated, and a transaction closed loop cannot be formed. That is to say, the self transaction network constructed by each bank is incomplete, and lawless persons also utilize the characteristic that bank information is not available, transfer accounts in a plurality of banks to split information, so that the group relation in a single bank is incomplete, and further, when an internet company carries out suspicious group recognition, all accounts in suspicious money washing group can not be found, even suspicious money washing group can not be found. Therefore, the identification accuracy of the suspicious money laundering groups in the prior art is low. Therefore, the invention provides a method for identifying suspicious money washing gangs, which comprises the steps of firstly carrying out first ganged division through a multidimensional characteristic algorithm, then merging the off-line payers based on the ganged merging algorithm, and merging the off-line node gangs by utilizing the information of the in-line nodes, thereby solving the problems that all accounts in the suspicious money washing gangs cannot be found due to the fact that the information of the off-line accounts cannot be obtained in the prior art, even the suspicious money washing gangs cannot be found. The invention can improve the identification accuracy of the suspicious money washing group, and can dig out the suspicious money washing account hidden deeply by comprehensively considering the incidence relation between the intra-row node and the extra-row node.
The identification method of the suspected money laundering group of the embodiment is realized by the identification device of the suspected money laundering group, which is described by taking a server as an example. In this embodiment, a server first obtains a transaction data table and a bank account information table, and then obtains a first vertex table and a first side table according to the transaction data table and the bank account information table, where the first vertex table is a table including all node IDs (including a node ID of a payer node and a node ID of a payee node) and node attributes in a network graph, where the node attributes include, but are not limited to, information such as a group ID and bank information (including information belonging to inside or outside of a line, information of public or private of a public), and the like; the first edge table is a table including the node ID of the payer node, the node ID of the payee node, the unique ID of the edge on one edge, and the edge attribute (including the transaction feature vector, such as the number of transactions and/or the transaction amount in a certain time period, the average number of transactions and/or the average transaction amount in each time period, etc.). For the storage of the first vertex table and the first edge table, a hive (data warehouse tool based on Hadoop) data warehouse may be used for storage. Specifically, step S10 includes:
step a1, acquiring a transaction data sheet and a bank account information sheet, and summarizing the transaction data sheet to obtain a transaction summary data sheet, wherein the transaction summary data sheet comprises a payer account and a payee account;
in this embodiment, a transaction data table and a bank account information table are obtained first, and the transaction data table is summarized to obtain a transaction summary data table, where the transaction data table includes a payer account number, a payee account number, and transaction information, the transaction summary data table summarizes the transaction information of the payer account number and the payee account number in the transaction data table, for example, a summary transaction total number, or a summary transaction number, a transaction amount, and the like in a certain time period, and correspondingly, the summarized transaction summary data table includes the payer account, the payee account, and the transaction information, and the like.
Step a2, converting the payer account into a digital payer node ID, converting the payee account into a digital payee node ID, and constructing a mapping relation table between the account and the digital node ID according to a conversion result;
since a spark graph x (graph computation technology on big data) is used in a subsequent preset multidimensional feature diffusion algorithm and does not support a character string as a node ID, a digital node ID needs to be generated by a spark monotonica _ involved _ ID () method.
And a3, obtaining a first vertex table according to the payer account, the payee account, the mapping relation table and the bank account information table, and obtaining a first edge table according to the transaction summary data table and the mapping relation table.
The account is converted into a digital node ID, a mapping relation table between the account and the digital node ID is constructed, a first vertex table is obtained according to a payer account, a payee account, the mapping relation table and a bank account information table, and a first edge table is obtained according to a transaction summary data table and the mapping relation table.
It should be noted that, in a specific embodiment, in addition to using the spark graph x based on the pregel graph computation framework, other graph computation engines, such as graph lab, may also be used, or the spark graph x may be replaced by other computation engines supporting pregel instead of the graph computation engine, such as python. Correspondingly, if the actually used graph calculation engine can support the character strings as the nodes, the corresponding conversion of the payer account and the payee account into digital payer node ID and digital payee node ID is not needed, and the first vertex table and the first edge table are directly obtained according to the account and bank account information table and the transaction summary data table. That is, the step S10 includes:
acquiring a transaction data table and a bank account information table, and summarizing the transaction data table to obtain a transaction summary data table, wherein the transaction summary data table comprises a payer account and a payee account;
and obtaining a first vertex table according to the payer account, the payee account and the bank account information table, and obtaining a first edge table according to the transaction summary data table.
Step S20, performing first group partner division based on the first vertex table, the first edge table and a preset multi-dimensional feature diffusion algorithm to obtain a first division result, and updating the group partner ID in the first vertex table according to the first division result to obtain a second vertex table;
after the first vertex table and the first edge table are obtained, performing first group partner division based on the first vertex table, the first edge table and a preset multi-dimensional feature diffusion algorithm to obtain a first division result, and updating the group partner ID in the first vertex table according to the first division result to obtain a second vertex table. Wherein, the transaction summary data table further includes transaction information, the first edge table includes a transaction feature vector generated according to the transaction information, and step S20 includes:
step b1, initializing the group ID of each node in the first vertex table as a corresponding node ID, and setting iteration times;
in this embodiment, the transaction summary data table further includes transaction information in addition to the payer account and the payee account, and correspondingly, the first edge table includes transaction feature vectors generated according to the transaction information, and when performing the first group division, diffusion iteration is implemented based on a graph x interface of the pregel graph computation framework, specifically, the group ID of each node in the first vertex table is initialized to be the corresponding node ID by an initiallmsg function, that is, the group ID in the node attribute of the first vertex table is initially set to be the node ID of the node, and the iteration number M =0 is set.
Step b2, the transaction characteristic vector is sent to a corresponding payee node according to the first edge table, the optimal transaction characteristic vector of the payee node is determined according to the transaction characteristic vector received by the payee node and a preset optimal vector selection rule, and a group ID corresponding to the payee node is updated to be a group ID of a payer node corresponding to the optimal transaction characteristic vector;
and then, sending the transaction characteristic vectors to corresponding payee nodes through the sendMsg function and the first edge table, namely, each payer node is along the edge direction, namely, a payment method, and sending the edge vectors (namely, the transaction characteristic vectors) connected between the payer nodes and the payee nodes to the payee nodes, wherein the edge vectors can also comprise the group ID of the payer nodes besides the transaction characteristic vectors so as to facilitate the subsequent update of the group ID.
Then, the optimal transaction feature vector of the payee node is determined through the mergeMsg function, the transaction feature vector received by the payee node and a preset optimal vector selection rule, wherein the preset optimal vector selection rule can be customized and can be set according to the team feature which needs to be identified actually, for example, for a gambling type money washing team, the preset optimal vector selection rule can be set as follows: the first priority selects the transaction characteristic vector with the maximum transaction frequency from 8 o 'clock to 10 o' clock in the evening; if the transaction times are the same, the second priority selects the transaction feature vector with the largest transaction average amount from 8 o 'clock to 10 o' clock in the evening.
After the optimal transaction feature vector of the payee node is determined, the group ID corresponding to the payee node is updated to the group ID of the payer node corresponding to the optimal transaction feature vector through a vertexProgram function.
Step b3, resetting the iteration times, and iteratively executing the steps: and sending the transaction characteristic vector to a corresponding payee node according to the first edge table, determining an optimal transaction characteristic vector of the payee node according to the transaction characteristic vector received by the payee node and a preset optimal vector selection rule, updating the group ID corresponding to the payee node to the group ID of the payer node corresponding to the optimal transaction characteristic vector, stopping iteration until the reset iteration times are greater than the preset iteration times, and recording the updated first vertex table of the group ID as a second vertex table.
Resetting the iteration times to be M +1, and iteratively executing the steps: and sending the transaction characteristic vector to a corresponding payee node according to the first edge table, determining the optimal transaction characteristic vector of the payee node according to the transaction characteristic vector received by the payee node and a preset optimal vector selection rule, and updating the group ID corresponding to the payee node to the group ID of the payer node corresponding to the optimal transaction characteristic vector. The execution process of this step is consistent with the above embodiments, and is not described herein.
And stopping iteration until the reset iteration times are larger than the preset iteration times, finishing updating the group ID in the first vertex table at the moment, namely finishing the first group division, and marking the updated first vertex table as a second vertex table at the moment.
Step S30, merging the off-line payers in the second vertex table based on the second vertex table and a preset group combining algorithm, and updating the group ID in the second vertex table according to a merging result to obtain a third vertex table;
after the first group division is completed and the second vertex table is obtained, since the diffusion is unidirectional, the group IDs of the upstream out-of-line payers are still the respective node IDs, and at this time, the upstream out-of-line payers need to be merged to merge the associated out-of-line payers into the same group. Specifically, the off-line payers in the second vertex table are merged based on the second vertex table and a preset group merger algorithm, and the group IDs in the second vertex table are updated according to the merging result to obtain a third vertex table. For a specific combining process, reference may be made to the following embodiments, which are not described herein again.
And S40, performing second group division based on the third vertex table, the first edge table and the preset multi-dimensional feature diffusion algorithm to obtain a second division result, and calculating the suspicious index of each group according to the second division result and a preset suspicious index calculation rule.
After merging, second group division is carried out on the basis of a third vertex table, a first edge table and a preset multi-dimensional feature diffusion algorithm which are obtained through updating after merging, a second division result is obtained, the second division result is the vertex table obtained after the group ID of each node is updated through the third vertex table, the division result of the groups is further determined, and then the suspicious index of each group is calculated according to the second division result and a preset suspicious index calculation rule. The second grouping division process is substantially the same as the first grouping division process, and may refer to the first grouping division process, which is not described herein again. Wherein, the step of calculating the suspicious index of each group according to the second division result and the preset suspicious index calculation rule comprises the following steps:
step c1, obtaining account information and operation records of each node in each group obtained by the second group division according to the second division result, and determining suspicious indexes of each node according to the account information and the operation records of each node;
and after the second division result is obtained, obtaining account information and operation records of each node in each group obtained by the second group division according to the second division result, and determining the suspicious index of each node according to the account information and the operation records of each node. Specifically, the rule for determining the suspicious index of each node may be determined according to the account information and the operation record of each node, and a preset mapping relationship table between the operation record, the account information, and the suspicious index, for example, for a blacklist account, the corresponding suspicious index is 10; for another example, when the same customer opens an account for multiple times and a large amount of fund is received and paid before the sale, the corresponding suspicious index is 5; when the condition that the funds are transferred into the account in a dispersed mode and the funds are transferred out in a concentrated mode exists in a certain period, the corresponding suspicious index is 2. Of course, the above is only an example, and is not used to limit the mapping relationship in the mapping relationship table, and the mapping relationship table may be suggested according to the actual situation. After determining suspicious indexes corresponding to each item of account information and each item of operation record according to the account information and the operation record of each node and a preset mapping relation table between the operation record and the account information and the suspicious index, summing, and recording the corresponding sum as the suspicious index of the node.
And c2, respectively summing up the suspicious indexes of the nodes in each group to obtain the suspicious index of each group.
And then respectively summing up the suspicious indexes of the nodes in each group to obtain the suspicious index of each group. Certainly, in a specific embodiment, for the calculation of the suspicious index of each group, the suspicious indexes of each node in each group may be respectively summed up to obtain the number of nodes in each group, and then an average value is calculated, and the average value is used as the suspicious index of the group.
In addition, it should be noted that the purpose of grouping is achieved by diffusing grouping information from the payer node to the payee node along the transaction direction. In practical application, the group information can be diffused from the payee node to the payer node along the reverse direction of the transaction direction.
The embodiment of the invention provides a method for identifying suspicious money laundering groups, which comprises the steps of obtaining a transaction data sheet and a bank account information sheet, and obtaining a first vertex sheet and a first edge sheet according to the transaction data sheet and the bank account information sheet; performing first group partner division based on the first vertex table, the first edge table and a preset multi-dimensional feature diffusion algorithm to obtain a first division result, and updating the group partner ID in the first vertex table according to the first division result to obtain a second vertex table; merging the off-line payers in the second vertex table based on the second vertex table and a preset group merging algorithm, and updating the group ID in the second vertex table according to a merging result to obtain a third vertex table; and performing second grouping division based on the third vertex table, the first edge table and the preset multi-dimensional feature diffusion algorithm which are obtained by updating after merging to obtain a second division result, and further calculating the suspicious index of each group according to the second division result and a preset suspicious index calculation rule. According to the invention, the first group division is carried out through a multidimensional characteristic algorithm, then the off-line payer is merged based on the group merging algorithm, and the information of the on-line nodes can be utilized to merge the off-line node group, so that the problems that all accounts in the suspicious money washing group cannot be found and even the suspicious money washing group cannot be found due to the fact that the information of the off-line accounts cannot be obtained in the prior art can be solved. The invention can improve the identification accuracy of the suspicious money laundering group, and can dig out the suspicious money laundering account hidden deeply by comprehensively considering the incidence relation between the intra-row node and the out-row node.
Further, referring to fig. 3, fig. 3 is a detailed flowchart of step S30 in the first embodiment of the present invention. Step S30 includes:
step S31, obtaining the secondary group partner ID of the off-line payer in the second vertex table based on the second vertex table and a preset rule;
in this embodiment, since the diffusion is unidirectional, after the first group division, the group ID of the upstream offside payer is still the respective node ID, when the upstream offside payer is too many, the generated group is too many, which is not beneficial for the subsequent further analysis, and meanwhile, the nodes belonging to the same group are divided into a plurality of groups. Therefore, after the first group division, the upstream off-line payers need to be merged to merge the associated off-line payers into the same group. Specifically, the secondary group ID of the out-of-line payer in the second vertex table is obtained based on the second vertex table and the preset rule, wherein the step S31 includes:
step d1, counting the number of nodes in the row corresponding to each group in the second vertex table according to the group ID and the bank information in the second vertex table, and recording as a first number;
in this embodiment, the number of nodes in the row corresponding to each group in the second vertex table is counted according to the group ID and the bank information in the second vertex table and recorded as the first number, wherein the node attribute of the second vertex table includes the group ID and the bank information, and the bank information includes the information of belonging to the row or not, so that the number of nodes in the row belonging to the same group ID can be counted and recorded as the first number. In addition, after the first quantity is obtained, the first quantity can be updated into the vertex table, so that the subsequent calculation is facilitated.
Step d2, counting the number of the transfer transactions between the off-line payer and the in-line node of each group in the second vertex table according to the second vertex table and the first edge table, and recording the number as a second number;
then, the number of the transfer transactions between the off-line payer and the in-line node of each group in the second vertex table is counted according to the second vertex table and the first edge table and recorded as a second number, namely, the number of the in-line node of the transfer transaction between the off-line payer and the in-line node of each group in the second vertex table is collected along the direction of the transfer transaction according to the first edge table, and then the number of the transfer transactions between the off-line payer and the in-line node of each group is counted according to the group ID of each group, so that the number of the transfer transactions between the off-line payer and the in-line node of each group in the second vertex table is obtained.
Step d3, calculating the connection proportion between the off-line payer and each group according to the first quantity and the second quantity, and detecting whether the maximum value in the connection proportion is greater than a first preset threshold value;
after the first quantity and the second quantity are obtained through statistics, the connection proportion between the off-line payer and each group is obtained through calculation according to the first quantity and the second quantity, the connection proportion is the first quantity/the second quantity, and whether the maximum value in the connection proportion is larger than a first preset threshold value or not is detected.
And d4, if the maximum value in the connection proportion is larger than a first preset threshold value, taking the group ID corresponding to the maximum value in the connection proportion as the secondary group ID of the layaway payer.
If the maximum value of the connection proportion is larger than the first preset threshold value, the upstream off-line payer is indicated to have strong correlation with the group corresponding to the maximum value of the connection proportion, and at the moment, the group ID corresponding to the maximum value of the connection proportion is used as the secondary group ID of the off-line payer. The first preset threshold may be set to 0.5, and may be set according to actual needs, which is not limited herein.
If the maximum value in the connection ratio is less than or equal to a first preset threshold value, the correlation between the upstream off-line payer and the group corresponding to the maximum value of the connection ratio is weak, the off-line payer is considered to be not associated with each group, and at this moment, no secondary group ID exists, and merging is not needed.
Step S32, generating a fourth vertex table only comprising an off-line payer according to the second vertex table, and generating a second edge table according to the fourth vertex table and the secondary group partner ID;
after obtaining the secondary group IDs for each of the offside payers, a fourth vertex table is generated from the second vertex table that includes only the offside payers, and a second edge table is generated from the fourth vertex table and the secondary group IDs. The second edge list includes one foreign payer referring to another foreign payer corresponding to the secondary group ID.
Step S33, generating a directed graph according to the fourth vertex table and the second edge table, and calculating by a graph calculation method to obtain a connected subgraph of the directed graph;
and then, generating a directed graph according to the fourth vertex table and the second edge table, and calculating by a graph calculation method to obtain a connected subgraph of the directed graph. The graph calculation method may include, but is not limited to: spark graph x (graph computation technique on big data), pregel (distributed graph computation framework), graph lab (open source graph computation framework based on image processing model). Specifically, the computation method of the connected subgraph is the same as that of the existing connected subgraph computation method, and details are not described here.
And step S34, numbering the connected subgraphs, and updating the group ID of the off-line payer in the second vertex table to the number of the connected subgraph to which the off-line payer belongs to obtain a third vertex table.
Finally, each connected subgraph is numbered, for example, the numbers are 1, 2, 3 and 8230in turn according to the obtaining sequence of the connected subgraphs, and the group ID of the off-line payer in the second vertex table is updated to the number of the connected subgraph to which the off-line payer belongs to obtain a third vertex table.
In the embodiment, considering the single direction of diffusion, upstream off-line payers are merged through a preset group merging algorithm, and the associated off-line payers are merged into the same group, so that the subsequent second group division is facilitated, and therefore the situation that the final generated group is too many due to the excessive upstream off-line payers to influence the subsequent further analysis can be avoided, and the situation that nodes belonging to the same group are divided into a plurality of groups can also be avoided. Therefore, by merging the out-of-line payers, the accuracy of the suspicious money laundering party identification can be further improved.
Further, based on the above embodiments, a second embodiment of the identification method of the suspicious money laundering group is provided.
In this embodiment, after step S40, the method for identifying a suspected money laundering group further comprises:
step A, detecting whether the suspicious index of each group is larger than a second preset threshold value or not, and marking the group with the suspicious index larger than the second preset threshold value as a suspicious money washing group;
in this embodiment, after the suspicious index of each group is calculated, it may be further detected whether the suspicious index of each group is greater than a second preset threshold, and the group whose suspicious index is greater than the second preset threshold is marked as a suspicious money laundering group. The second preset threshold may be set according to actual conditions, and is not limited herein. In addition, since the suspicious index calculated in step S40 may be a total suspicious index or an average suspicious index according to different suspicious index calculation rules, at this time, a second preset threshold needs to be correspondingly set.
And step B, obtaining the information of the suspicious money washing group, sequencing the suspicious money washing group according to the suspicious index of the suspicious money washing group, and sending the information of the suspicious money washing group to a preset working terminal according to the sequencing result, so that working personnel can analyze the suspicious money washing group according to the information of the suspicious money washing group.
After the suspicious money washing group is determined, the information of the suspicious money washing group is obtained, for example, transaction information (such as information of transaction number, total transaction amount, transaction object and the like), bank information (belonging to a public or private, in-line or out-of-line) and the suspicious money washing group is sorted according to the suspicious index of the suspicious money washing group, for example, the suspicious money washing group can be sorted from big to small, and then the information of the suspicious money washing group is sent to a preset working terminal according to the sorting result, so that a worker can further analyze the suspicious money washing group according to the information of the suspicious money washing group.
In the embodiment, the suspicious money washing group is further marked according to the size of the suspicious index, so that the information of the suspicious money washing group is obtained, and the information of the suspicious money washing group is sent to the working end, so that the staff can further analyze and confirm, the identification accuracy of the suspicious money washing group can be further improved, and the real suspicious money washing group is excavated.
The invention also provides a device for identifying the suspicious money laundering teams.
Referring to fig. 4, fig. 4 is a functional module diagram of the identification device of the suspected money laundering group of the present invention.
As shown in fig. 4, the suspicious money laundering group identification device comprises:
the system comprises an acquisition module 10, a first vertex table and a first edge table, wherein the acquisition module is used for acquiring a transaction data table and a bank account information table and obtaining the first vertex table and the first edge table according to the transaction data table and the bank account information table;
a dividing module 20, configured to perform first group division based on the first vertex table, the first edge table, and a preset multidimensional feature diffusion algorithm to obtain a first division result, and update a group ID in the first vertex table according to the first division result to obtain a second vertex table;
a merging module 30, configured to merge the off-line payers in the second vertex table based on the second vertex table and a preset group merging algorithm, and update the group ID in the second vertex table according to a merging result, so as to obtain a third vertex table;
and the calculating module 40 is used for performing second group division based on the third vertex table, the first edge table and the preset multi-dimensional feature diffusion algorithm to obtain a second division result, and calculating the suspicious index of each group according to the second division result and a preset suspicious index calculation rule.
Further, the obtaining module 10 includes:
the first acquisition unit is used for acquiring a transaction data table and a bank account information table, summarizing the transaction data table and acquiring a transaction summary data table, wherein the transaction summary data table comprises a payer account and a payee account;
the mapping establishing unit is used for converting the payer account into a digital payer node ID, converting the payee account into a digital payee node ID and establishing a mapping relation table between the account and the digital node ID according to a conversion result;
and the second acquisition unit is used for acquiring a first vertex table according to the payer account, the payee account, the mapping relation table and the bank account information table, and acquiring a first edge table according to the transaction summary data table and the mapping relation table.
Further, the transaction summary data table further includes transaction information, the first edge table includes transaction feature vectors generated according to the transaction information, and the partitioning module 20 includes:
an initialization unit, configured to initialize the group ID of each node in the first vertex table as a corresponding node ID, and set iteration times;
the updating unit is used for sending the transaction characteristic vector to a corresponding payee node according to the first edge table, determining the optimal transaction characteristic vector of the payee node according to the transaction characteristic vector received by the payee node and a preset optimal vector selection rule, and updating the group ID corresponding to the payee node into the group ID of the payer node corresponding to the optimal transaction characteristic vector;
a third obtaining unit, configured to reset the iteration number, and iteratively perform the steps of: and sending the transaction characteristic vector to a corresponding payee node according to the first edge table, determining an optimal transaction characteristic vector of the payee node according to the transaction characteristic vector received by the payee node and a preset optimal vector selection rule, updating the group ID corresponding to the payee node to the group ID of the payer node corresponding to the optimal transaction characteristic vector, stopping iteration until the reset iteration times are greater than the preset iteration times, and recording the updated first vertex table of the group ID as a second vertex table.
Further, the merging module 30 includes:
a secondary ID obtaining unit, configured to obtain a secondary group ID of an out-of-line payer in the second vertex table based on the second vertex table and a preset rule;
a generating unit, configured to generate a fourth vertex table including only the out-of-line payer according to the second vertex table, and generate a second edge table according to the fourth vertex table and the secondary group partner ID;
the subgraph calculation unit is used for generating a directed graph according to the fourth vertex table and the second edge table and calculating a connected subgraph of the directed graph by a graph calculation method;
and the fourth acquisition unit is used for numbering the connected subgraphs, updating the group ID of the off-line payer in the second vertex table to the number of the connected subgraph to which the off-line payer belongs, and acquiring a third vertex table.
Further, the sub ID acquisition unit includes:
a first counting subunit, configured to count, according to the ganged ID and the bank information in the second vertex table, the number of nodes in the row corresponding to each ganged group in the second vertex table, which is recorded as a first number;
the second counting subunit is used for counting the number of the transfer transactions between the off-line payer and the in-line node of each group in the second vertex table according to the second vertex table and the first edge table, and recording the number as a second number;
the first detection subunit is used for calculating connection ratios between the off-line payer and the various groups according to the first quantity and the second quantity, and detecting whether the maximum value in the connection ratios is larger than a first preset threshold value;
and the secondary ID acquisition subunit is used for taking the group ID corresponding to the maximum value in the connection proportion as the secondary group ID of the layaway payer if the maximum value in the connection proportion is greater than a first preset threshold value.
Further, the calculating module 40 includes:
the index determining unit is used for acquiring the account information and the operation record of each node in each group obtained by the second group division according to the second division result, and determining the suspicious index of each node according to the account information and the operation record of each node;
and the index calculation unit is used for respectively summing up the suspicious indexes of the nodes in each group to obtain the suspicious index of each group.
Further, the identification device of the suspected money laundering group comprises:
the detection module is used for detecting whether the suspicious index of each group is larger than a second preset threshold value or not and marking the group with the suspicious index larger than the second preset threshold value as a suspicious money washing group;
and the sending module is used for obtaining the information of the suspicious money washing group, sequencing the suspicious money washing group according to the suspicious index of the suspicious money washing group, and sending the information of the suspicious money washing group to a preset working terminal according to a sequencing result so that a worker analyzes the suspicious money washing group according to the information of the suspicious money washing group.
The function implementation of each module in the identification device of the suspicious money laundering group corresponds to each step in the embodiment of the identification method of the suspicious money laundering group, and the function and implementation process are not described in detail herein.
The invention further provides a computer storage medium having stored thereon a suspicious money washing group identification program, which when executed by a processor, carries out the steps of the method of suspicious money washing group identification as described in any of the above embodiments.
The specific embodiment of the computer storage medium of the present invention is substantially the same as the above embodiments of the method for identifying a suspicious money laundering group, and will not be described herein again.
It should be noted that, in this document, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or system that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or system. Without further limitation, an element defined by the phrases "comprising one of 8230; \8230;" 8230; "does not exclude the presence of additional like elements in a process, method, article, or system that comprises the element.
The above-mentioned serial numbers of the embodiments of the present invention are only for description, and do not represent the advantages and disadvantages of the embodiments.
Through the above description of the embodiments, those skilled in the art will clearly understand that the method of the above embodiments can be implemented by software plus a necessary general hardware platform, and certainly can also be implemented by hardware, but in many cases, the former is a better implementation manner. Based on such understanding, the technical solutions of the present invention or portions thereof contributing to the prior art may be embodied in the form of a software product, which is stored in a storage medium (such as ROM/RAM, magnetic disk, optical disk) as described above and includes several instructions for enabling a terminal device (which may be a mobile phone, a computer, a server, or a network device) to execute the method according to the embodiments of the present invention.
The above description is only a preferred embodiment of the present invention, and is not intended to limit the scope of the present invention, and all equivalent structures or equivalent processes performed by the present invention or directly or indirectly applied to other related technical fields are also included in the scope of the present invention.
Claims (8)
1. A method of identifying a suspected money laundering party, the method comprising:
acquiring a transaction data sheet and a bank account information sheet, and acquiring a first vertex sheet and a first edge sheet according to the transaction data sheet and the bank account information sheet;
performing first gang division based on the first vertex table, the first edge table and a preset multi-dimensional feature diffusion algorithm to obtain a first division result, and updating gang IDs in the first vertex table according to the first division result to obtain a second vertex table;
merging off-line payers in the second vertex table based on the second vertex table and a preset group merging algorithm, and updating the group ID in the second vertex table according to a merging result to obtain a third vertex table;
performing second grouping division based on the third vertex table, the first edge table and the preset multi-dimensional feature diffusion algorithm to obtain a second division result, and calculating the suspicious index of each group according to the second division result and a preset suspicious index calculation rule;
the step of obtaining a transaction data sheet and a bank account information sheet and obtaining a first vertex sheet and a first side sheet according to the transaction data sheet and the bank account information sheet comprises the following steps:
acquiring a transaction data table and a bank account information table, and summarizing the transaction data table to obtain a transaction summary data table, wherein the transaction summary data table comprises a payer account and a payee account;
converting the payer account into a digital payer node ID, converting the payee account into a digital payee node ID, and constructing a mapping relation table between the account and the digital node ID according to a conversion result;
obtaining a first vertex table according to the payer account, the payee account, the mapping relation table and the bank account information table, and obtaining a first edge table according to the transaction summary data table and the mapping relation table;
the transaction summary data table further includes transaction information, the first edge table includes transaction feature vectors generated according to the transaction information, first ganged division is performed based on the first vertex table, the first edge table and a preset multi-dimensional feature diffusion algorithm to obtain a first division result, ganged IDs in the first vertex table are updated according to the first division result, and a second vertex table is obtained through the steps of:
initializing the group ID of each node in the first vertex table as a corresponding node ID, and setting iteration times;
sending the transaction characteristic vector to a corresponding payee node according to the first edge table, determining an optimal transaction characteristic vector of the payee node according to the transaction characteristic vector received by the payee node and a preset optimal vector selection rule, and updating a group ID corresponding to the payee node to a group ID of a payer node corresponding to the optimal transaction characteristic vector;
resetting the iteration times, and iteratively executing the steps of: sending the transaction characteristic vector to a corresponding payee node according to the first edge table, determining an optimal transaction characteristic vector of the payee node according to the transaction characteristic vector received by the payee node and a preset optimal vector selection rule, updating a group ID corresponding to the payee node to a group ID of a payer node corresponding to the optimal transaction characteristic vector, stopping iteration until the reset iteration number is greater than the preset iteration number, and recording a first vertex table after updating the group ID as a second vertex table;
the step of merging the off-line payers in the second vertex table based on the second vertex table and a preset group combining algorithm, and updating the group ID in the second vertex table according to a merging result to obtain a third vertex table comprises:
obtaining a secondary group ID of the out-of-line payer in the second vertex table based on the second vertex table and a preset rule;
generating a fourth vertex table from the second vertex table that includes only offside payers, and generating a second edge table from the fourth vertex table and the secondary group partner ID;
generating a directed graph according to the fourth vertex table and the second edge table, and calculating to obtain a connected subgraph of the directed graph by a graph calculation method;
numbering the connected subgraphs, and updating the group ID of the off-line payer in the second vertex table to the number of the connected subgraph to which the off-line payer belongs to obtain a third vertex table;
the step of deriving a secondary group ID of an out-of-line payer in the second vertex table based on the second vertex table and a preset rule includes:
counting the number of nodes in the row corresponding to each group in the second vertex table according to the group ID and the bank information in the second vertex table, and recording the number as a first number;
counting the number of transfer transactions between the off-line payer and the in-line node of each group in the second vertex table according to the second vertex table and the first edge table, and recording the number as a second number;
calculating connection proportions between the off-line payer and each group partner according to the first quantity and the second quantity, and detecting whether the maximum value of the connection proportions is larger than a first preset threshold value;
and if the maximum value in the connection proportion is larger than a first preset threshold value, taking the group ID corresponding to the maximum value in the connection proportion as a secondary group ID of the layaway payer.
2. The method for identifying suspicious money laundering party according to claim 1, wherein the step of calculating suspicious index of each party according to the second division result and preset suspicious index calculation rule comprises:
obtaining account information and operation records of each node in each group obtained by the second group division according to the second division result, and determining suspicious indexes of each node according to the account information and the operation records of each node;
and respectively summing up the suspicious indexes of the nodes in each group to obtain the suspicious index of each group.
3. A method of identification of a suspected money laundering group according to any of claims 1-2, characterized in that the method of identification of a suspected money laundering group further comprises:
detecting whether the suspicious index of each group is larger than a second preset threshold value or not, and marking the group with the suspicious index larger than the second preset threshold value as a suspicious money laundering group;
and obtaining the information of the suspicious money washing group, sequencing the suspicious money washing group according to the suspicious index of the suspicious money washing group, and sending the information of the suspicious money washing group to a preset working terminal according to the sequencing result, so that a worker analyzes the suspicious money washing group according to the information of the suspicious money washing group.
4. An identification device of a suspected money laundering party, characterized in that the identification device of the suspected money laundering party comprises:
the acquisition module is used for acquiring a transaction data sheet and a bank account information sheet and acquiring a first vertex sheet and a first edge sheet according to the transaction data sheet and the bank account information sheet;
the dividing module is used for carrying out first gang division on the basis of the first vertex table, the first edge table and a preset multi-dimensional feature diffusion algorithm to obtain a first division result, and updating gang IDs in the first vertex table according to the first division result to obtain a second vertex table;
a merging module, configured to merge the off-line payers in the second vertex table based on the second vertex table and a preset partnership merging algorithm, and update the partnership ID in the second vertex table according to a merging result, to obtain a third vertex table;
the calculation module is used for carrying out second group division on the basis of the third vertex table, the first edge table and the preset multi-dimensional feature diffusion algorithm to obtain a second division result, and calculating the suspicious index of each group according to the second division result and a preset suspicious index calculation rule;
the acquisition module comprises:
the system comprises a first acquisition unit, a second acquisition unit and a third acquisition unit, wherein the first acquisition unit is used for acquiring a transaction data sheet and a bank account information sheet, summarizing the transaction data sheet to obtain a transaction summary data sheet, and the transaction summary data sheet comprises a payer account and a payee account;
the mapping establishing unit is used for converting the payer account into a digital payer node ID, converting the payee account into a digital payee node ID and establishing a mapping relation table between the account and the digital node ID according to a conversion result;
the second acquisition unit is used for acquiring a first vertex table according to the payer account, the payee account, the mapping relation table and the bank account information table, and acquiring a first edge table according to the transaction summary data table and the mapping relation table;
the dividing module includes:
an initialization unit, configured to initialize the group ID of each node in the first vertex table as a corresponding node ID, and set iteration times;
the updating unit is used for sending the transaction characteristic vector to the corresponding payee node according to the first edge table, determining the optimal transaction characteristic vector of the payee node according to the transaction characteristic vector received by the payee node and a preset optimal vector selection rule, and updating the group ID corresponding to the payee node into the group ID of the payer node corresponding to the optimal transaction characteristic vector;
a third obtaining unit, configured to reset the number of iterations, and iteratively perform the steps of: sending the transaction characteristic vector to a corresponding payee node according to the first edge table, determining an optimal transaction characteristic vector of the payee node according to the transaction characteristic vector received by the payee node and a preset optimal vector selection rule, updating a group ID corresponding to the payee node to a group ID of a payer node corresponding to the optimal transaction characteristic vector, stopping iteration until the reset iteration number is greater than the preset iteration number, and recording a first vertex table after updating the group ID as a second vertex table;
the merging module comprises:
a secondary ID obtaining unit, configured to obtain a secondary group ID of an out-of-line payer in the second vertex table based on the second vertex table and a preset rule;
a generating unit, configured to generate a fourth vertex table including only the out-of-line payer according to the second vertex table, and generate a second edge table according to the fourth vertex table and the secondary group partner ID;
the subgraph calculation unit is used for generating a directed graph according to the fourth vertex table and the second edge table and calculating a connected subgraph of the directed graph through a graph calculation method;
a fourth obtaining unit, configured to number the connected sub-graph, and update the group ID of the off-line payer in the second vertex table to the number of the connected sub-graph to which the off-line payer belongs, so as to obtain a third vertex table;
the sub ID acquisition unit includes:
the first counting subunit is used for counting the number of nodes in the row corresponding to each group in the second vertex table according to the group ID and the bank information in the second vertex table, and recording the number as a first number;
the second counting subunit is used for counting the number of the transfer transactions between the off-line payers and the on-line nodes of each group in the second vertex table according to the second vertex table and the first edge table, and recording the number as a second number;
the first detection subunit is used for calculating connection ratios between the off-line payer and the various groups according to the first quantity and the second quantity, and detecting whether the maximum value in the connection ratios is larger than a first preset threshold value;
and the secondary ID acquisition subunit is used for taking the group ID corresponding to the maximum value in the connection proportion as the secondary group ID of the off-line payer if the maximum value in the connection proportion is greater than a first preset threshold value.
5. The suspicious money laundering group identification apparatus according to claim 4, wherein the calculation module comprises:
the index determining unit is used for acquiring the account information and the operation record of each node in each group obtained by the second group division according to the second division result and determining the suspicious index of each node according to the account information and the operation record of each node;
and the index calculation unit is used for respectively summing up the suspicious indexes of the nodes in each group to obtain the suspicious index of each group.
6. An identification arrangement of a suspected money laundering partner according to any of claims 4-5, characterized in that the identification arrangement of a suspected money laundering partner further comprises:
the detection module is used for detecting whether the suspicious index of each group is larger than a second preset threshold value or not and marking the group with the suspicious index larger than the second preset threshold value as a suspicious money washing group;
and the sending module is used for obtaining the information of the suspicious money washing group, sequencing the suspicious money washing group according to the suspicious index of the suspicious money washing group, and sending the information of the suspicious money washing group to a preset working terminal according to a sequencing result so that a worker analyzes the suspicious money washing group according to the information of the suspicious money washing group.
7. An identification device of a suspected money laundering party, characterized in that the identification device of a suspected money laundering party comprises: memory, a processor and a suspicious money laundering group identification program stored on the memory and executable on the processor, the suspicious money laundering group identification program when executed by the processor implementing the steps of the suspicious money laundering group identification method according to any of claims 1 to 3.
8. A computer storage medium, characterized in that the computer storage medium has stored thereon a suspicious money laundering group identification program which, when being executed by a processor, carries out the steps of a suspicious money laundering group identification method according to any of claims 1 to 3.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811619485.7A CN109741173B (en) | 2018-12-27 | 2018-12-27 | Method, device, equipment and computer storage medium for identifying suspicious money laundering teams |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811619485.7A CN109741173B (en) | 2018-12-27 | 2018-12-27 | Method, device, equipment and computer storage medium for identifying suspicious money laundering teams |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN109741173A CN109741173A (en) | 2019-05-10 |
| CN109741173B true CN109741173B (en) | 2022-11-29 |
Family
ID=66361735
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201811619485.7A Active CN109741173B (en) | 2018-12-27 | 2018-12-27 | Method, device, equipment and computer storage medium for identifying suspicious money laundering teams |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN109741173B (en) |
Families Citing this family (10)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110245875A (en) * | 2019-06-21 | 2019-09-17 | 深圳前海微众银行股份有限公司 | Risk of fraud appraisal procedure, device, equipment and storage medium |
| CN110717758B (en) * | 2019-10-10 | 2021-04-13 | 支付宝(杭州)信息技术有限公司 | Abnormal transaction identification method and device |
| CN110852881B (en) * | 2019-10-14 | 2021-04-27 | 支付宝(杭州)信息技术有限公司 | Risk account identification method and device, electronic equipment and medium |
| CN110766091B (en) * | 2019-10-31 | 2024-02-27 | 上海观安信息技术股份有限公司 | Method and system for identifying trepanning loan group partner |
| CN110852884A (en) * | 2019-11-15 | 2020-02-28 | 成都数联铭品科技有限公司 | Data processing system and method for anti-money laundering recognition |
| CN111242781A (en) * | 2019-12-27 | 2020-06-05 | 立旃（上海）科技有限公司 | Transaction management method and device based on block chain |
| CN111784320B (en) * | 2020-07-27 | 2022-07-26 | 支付宝(杭州)信息技术有限公司 | Data association method and device and electronic equipment |
| CN112256769B (en) * | 2020-11-13 | 2024-04-12 | 北京海致星图科技有限公司 | Pregel-based method for realizing fund circle distribution of mining business banking transaction data |
| CN112463065A (en) * | 2020-12-10 | 2021-03-09 | 恩亿科(北京)数据科技有限公司 | Account number getting-through calculation method and system |
| CN113570379B (en) * | 2021-08-04 | 2024-02-13 | 工银科技有限公司 | Abnormal transaction group partner identification method and device |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107194623A (en) * | 2017-07-20 | 2017-09-22 | 深圳市分期乐网络科技有限公司 | A kind of discovery method and device of clique's fraud |
| CN108038778A (en) * | 2017-12-05 | 2018-05-15 | 深圳信用宝金融服务有限公司 | Clique's fraud recognition methods of the small micro- loan of internet finance and device |
| CN108053087A (en) * | 2017-10-20 | 2018-05-18 | 深圳前海微众银行股份有限公司 | Anti money washing monitoring method, equipment and computer readable storage medium |
| CN108280755A (en) * | 2018-02-28 | 2018-07-13 | 阿里巴巴集团控股有限公司 | The recognition methods of suspicious money laundering clique and identification device |
| WO2018164635A1 (en) * | 2017-03-08 | 2018-09-13 | Jewel Paymentech Pte Ltd | Apparatus and method for real-time detection of fraudulent digital transactions |
Family Cites Families (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20120239557A1 (en) * | 2010-12-14 | 2012-09-20 | Early Warning Services, Llc | System and method for detecting fraudulent account access and transfers |
-
2018
- 2018-12-27 CN CN201811619485.7A patent/CN109741173B/en active Active
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2018164635A1 (en) * | 2017-03-08 | 2018-09-13 | Jewel Paymentech Pte Ltd | Apparatus and method for real-time detection of fraudulent digital transactions |
| CN107194623A (en) * | 2017-07-20 | 2017-09-22 | 深圳市分期乐网络科技有限公司 | A kind of discovery method and device of clique's fraud |
| CN108053087A (en) * | 2017-10-20 | 2018-05-18 | 深圳前海微众银行股份有限公司 | Anti money washing monitoring method, equipment and computer readable storage medium |
| CN108038778A (en) * | 2017-12-05 | 2018-05-15 | 深圳信用宝金融服务有限公司 | Clique's fraud recognition methods of the small micro- loan of internet finance and device |
| CN108280755A (en) * | 2018-02-28 | 2018-07-13 | 阿里巴巴集团控股有限公司 | The recognition methods of suspicious money laundering clique and identification device |
Non-Patent Citations (3)
| Title |
|---|
| 基于社交网络分析的诈骗团体挖掘方法研究;贾志娟;《计算机技术与发展》;20180531(第5期);全文 * |
| 基于资金交易的金融领域犯罪团伙识别系统的设计与实现;周韬;《中国优秀博硕士学位论文全文数据库(硕士) 社会科学Ⅰ辑》;20181115(第11期);全文 * |
| 犯罪团伙网络关系模型及分析方法;王钢;《中国人民公安大学学报(社会科学版)》;20150615(第3期);全文 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN109741173A (en) | 2019-05-10 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN109741173B (en) | Method, device, equipment and computer storage medium for identifying suspicious money laundering teams | |
| CN108009915B (en) | Marking method and related device for fraudulent user community | |
| US20210035126A1 (en) | Data processing method, system and computer device based on electronic payment behaviors | |
| CN113360580B (en) | Abnormal event detection method, device, equipment and medium based on knowledge graph | |
| CN112215616B (en) | Method and system for automatically identifying abnormal fund transaction based on network | |
| CN111371767A (en) | Malicious account identification method, malicious account identification device, medium and electronic device | |
| WO2020177450A1 (en) | Information merging method, transaction query method and apparatus, computer and storage medium | |
| US11222270B2 (en) | Using learned application flow to predict outcomes and identify trouble spots in network business transactions | |
| CN111930366B (en) | Rule engine implementation method and system based on JIT real-time compilation | |
| CN114187112A (en) | Training method of account risk model and determination method of risk user group | |
| CN109993538A (en) | Identity theft detection method based on probability graph model | |
| US20210312485A1 (en) | Methods and systems using and constructing merchant communities based on financial transaction data | |
| CN114691932A (en) | System, method and computer program product for generating synthetic data | |
| US20180189612A1 (en) | System and method for learning from the images of raw data | |
| CN117094764A (en) | Bank integral processing method and device | |
| CN106779899A (en) | The recognition methods of malice order and device | |
| CN110830515A (en) | Flow detection method and device and electronic equipment | |
| US11030673B2 (en) | Using learned application flow to assist users in network business transaction based apps | |
| Sahu et al. | Mining approximate frequent subgraph with sampling techniques | |
| CN115204888A (en) | Target account identification method and device, storage medium and electronic equipment | |
| CN112950290A (en) | Mining method and device for economic dependence clients, storage medium and electronic equipment | |
| CN110909777A (en) | Multi-dimensional feature map embedding method, device, equipment and medium | |
| CN110992109A (en) | Real estate customer analysis method, device and storage medium based on association rule | |
| CN109034732A (en) | Attendance data treating method and apparatus, equipment, computer program and storage medium | |
| US20240054356A1 (en) | Systems and methods for generating multipurpose graph node embeddings for machine learning |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |