CN111476662A

CN111476662A - Anti-money laundering identification method and device

Info

Publication number: CN111476662A
Application number: CN202010283831.XA
Authority: CN
Inventors: 朱超
Original assignee: Industrial and Commercial Bank of China Ltd ICBC
Current assignee: Industrial and Commercial Bank of China Ltd ICBC
Priority date: 2020-04-13
Filing date: 2020-04-13
Publication date: 2020-07-31

Abstract

The embodiment of the application provides an anti-money laundering identification method and device, and the method comprises the following steps: acquiring a target fund transaction network diagram; carrying out risk community division on the target fund transaction network graph; performing risk rating on each risk community, and determining at least one target community based on a corresponding risk rating result; and determining the risk score of each node in the target community by using a preset graph volume model, and screening the target community by using the risk score of each node to obtain the community with money laundering risk corresponding to the target fund transaction network graph. The method and the device can effectively improve the reliability of the anti-money laundering identification process and the accuracy of the anti-money laundering identification result, and can effectively improve the efficiency and the intelligent degree of the anti-money laundering identification process.

Description

Anti-money laundering identification method and device

Technical Field

The application relates to the technical field of data processing, in particular to an anti-money laundering identification method and device.

Background

Money laundering activities usually wash large black money by means of legal financial network, which not only infringes financial management order, but also seriously destroys fair competition rules and free competition among economic main bodies of the market, thereby bringing certain negative influence on normal and stable economic order. The monitoring and analysis of the suspicious transactions of money laundering prevention needs to select effective data from mass data, and multi-level and diversified information of customers is deeply mined through qualitative and quantitative analysis to determine suspicious transaction behaviors of money laundering of the customers. Therefore, how to utilize self and external data information and improve the effectiveness and accuracy of anti-money laundering work becomes a new challenge and opportunity of financial institutions.

Currently, most anti-money laundering schemes are still monitored based on preset anti-money laundering rules. Although the anti-money laundering rules can help to discover some abnormal money laundering behaviors, the traditional anti-money laundering early warning method has the problems of low report rate, time and labor consumption in supervision, monitoring and early warning discrimination processing due to the fact that the traditional anti-money laundering early warning method is large in quantity; meanwhile, most anti-money laundering rules are summarized according to historical data, so that the anti-money laundering rules are too dependent on manual experience to ensure the monitoring or recognition effect of anti-money laundering.

Disclosure of Invention

Aiming at the problems in the prior art, the anti-money laundering identification method and device can effectively improve the reliability of the anti-money laundering identification process and the accuracy of an anti-money laundering identification result, and can effectively improve the efficiency and the intelligent degree of the anti-money laundering identification process.

In order to solve the technical problem, the application provides the following technical scheme:

in a first aspect, the present application provides an anti-money laundering identification method, comprising:

acquiring a target fund transaction network graph, wherein each node in the target fund transaction network graph is respectively used for representing entity data corresponding to each account, and an edge between the two nodes is used for representing relationship data between the two nodes;

carrying out risk community division on the target fund transaction network graph;

performing risk rating on each risk community, and determining at least one target community based on a corresponding risk rating result;

and determining the risk score of each node in the target community by using a preset graph volume model, and screening the target community by using the risk score of each node to obtain the community with money laundering risk corresponding to the target fund transaction network graph.

Further, before the risk community partitioning for the target fund transaction network graph, the method further includes:

and screening suspicious account nodes with money laundering risks from all the nodes of the target fund transaction network graph by using a preset graph feature filtering mode, wherein the graph feature filtering mode comprises an entrance filtering mode and/or a central point refractive index filtering mode.

Further, the risk community division of the target fund transaction network graph includes:

acquiring a subgraph with an abnormal transaction structure corresponding to the target fund transaction network graph according to preset weight and an abnormal threshold;

carrying out risk community division on each subgraph with an abnormal transaction structure by using a preset subgraph calculation mode to obtain a risk community corresponding to the target fund transaction network graph;

the subgraph calculation mode comprises a personalized PageRank algorithm and/or an L ouvain community discovery algorithm.

Further, the risk rating each risk community and determining at least one target community based on the corresponding risk rating result includes:

taking an initial transaction corresponding to an initial node in the risk community as a starting point, and acquiring a transaction time point of each transaction in the risk community;

acquiring the average transaction time of the corresponding risk community according to the transaction time point of each transaction;

determining an absolute value of a difference between a trade time point of each trade and the average trade time;

dividing each transaction into corresponding segments based on the absolute value of the difference between the transaction time point of each transaction and the average transaction time;

determining the transaction time entropy of the corresponding risk community according to the proportion of the transaction quantity in the interval to the total transaction quantity in the corresponding risk community and based on the proportion;

and determining the risk level of each risk community by applying the transaction time entropy of each risk community, and determining at least one target community according to the risk level of each risk community.

Further, the determining the risk score of each node in the target community by applying a preset graph volume model comprises:

acquiring account labels corresponding to the nodes in the target community;

inputting the target community into the graph convolution model, and spreading the account label on the graph convolution model according to the transaction relationship among the nodes of the target community and the attributes of the nodes to obtain the risk score of each node, wherein the graph convolution model is a graph neural network.

Further, the acquiring the target fund transaction network map comprises:

selecting corresponding entity data and relationship data from account transaction source data according to a preset data tag, wherein the entity data comprise unique identification of accounts, and the relationship data comprise transfer relationship data between the accounts;

preprocessing the entity data and the relationship data;

and generating a corresponding target fund transaction network diagram by applying a preset Schema model, the preprocessed entity data and the relationship data.

and performing edge attribute fusion processing on edges between the same pair of nodes in the target fund transaction network graph.

Further, after obtaining the community with money laundering risk corresponding to the target fund transaction network diagram, the method further includes:

and visually displaying the communities with money laundering risks.

In a second aspect, the present application provides an anti-money laundering identification device comprising:

the system comprises a transaction network construction module, a transaction processing module and a transaction processing module, wherein the transaction network construction module is used for acquiring a target fund transaction network graph, each node in the target fund transaction network graph is respectively used for representing entity data corresponding to each account, and an edge between two nodes is used for representing relationship data between the two nodes;

the risk community division module is used for carrying out risk community division on the target fund transaction network graph;

the target community determining module is used for carrying out risk rating on each risk community and determining at least one target community based on a corresponding risk rating result;

and the money laundering risk community determining module is used for determining the risk score of each node in the target community by using a preset graph and volume model, and performing node screening on the target community by using the risk score of each node to obtain the community with money laundering risk corresponding to the target fund transaction network graph.

Further, still include:

and the graph feature filtering module is used for screening suspicious account nodes with money laundering risks from all the nodes of the target fund transaction network graph by applying a preset graph feature filtering mode, wherein the graph feature filtering mode comprises an entry and exit filtering mode and/or a central point refractive index filtering mode.

Further, the risk community partitioning module is configured to perform the following:

Further, the target community determination module is configured to perform the following:

Further, the money laundering risk community determining module is configured to perform the following:

acquiring account labels corresponding to the nodes in the target community;

Further, the transaction network construction module is configured to perform the following:

preprocessing the entity data and the relationship data;

Further, still include:

and the attribute fusion module is used for carrying out edge attribute fusion processing on edges between the same pair of nodes in the target fund transaction network graph.

Further, still include:

and the visual display module is used for visually displaying the communities with money laundering risks.

In a third aspect, the present application provides an electronic device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, wherein the processor implements the steps of the anti-money laundering identification method when executing the program.

In a fourth aspect, the present application provides a computer readable storage medium having stored thereon a computer program which, when executed by a processor, performs the steps of the anti-money laundering identification method described herein.

According to the technical scheme, the anti-money laundering identification method and device provided by the application comprise the following steps: acquiring a target fund transaction network graph, wherein each node in the target fund transaction network graph is respectively used for representing entity data corresponding to each account, and an edge between the two nodes is used for representing relationship data between the two nodes; carrying out risk community division on the target fund transaction network graph; performing risk rating on each risk community, and determining at least one target community based on a corresponding risk rating result; applying a preset graph volume model to determine a risk score for each of the nodes in the target community, and the risk scores of all the nodes are applied to carry out node screening on the target communities to obtain communities with money laundering risks corresponding to the target fund transaction network graph, suspicious target money laundering communities or money laundering nodes can be quickly and conveniently found, meanwhile, the suspicious target communities are subjected to further money laundering risk quantitative scoring, high-risk money laundering partners can be accurately positioned, thereby effectively improving the reliability of the anti-money laundering identification process and the accuracy of the anti-money laundering identification result, effectively improving the efficiency and the intelligent degree of the anti-money laundering identification process, and furthermore, the accuracy and efficiency of the financial machine for identifying the suspicious transaction behavior of money laundering of the client can be effectively improved, the report rate of anti-money laundering identification is effectively improved, and the time and money cost of supervision, monitoring, early warning and discrimination processing is reduced.

Drawings

In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings needed to be used in the description of the embodiments or the prior art will be briefly introduced below, and it is obvious that the drawings in the following description are some embodiments of the present application, and it is obvious for those skilled in the art to obtain other drawings based on these drawings without creative efforts.

Fig. 1 is a schematic flow chart of an anti-money laundering identification method in the embodiment of the present application.

Fig. 2 is a flowchart illustrating an anti-money laundering identification method including step 010 in the embodiment of the present application.

Fig. 3 is a schematic flow chart illustrating a specific process 200 of the anti-money laundering identification method in the embodiment of the present application.

Fig. 4 is a schematic flow chart illustrating a specific process 300 of the anti-money laundering identification method in the embodiment of the present application.

Fig. 5 is a schematic flow chart illustrating the step 400 of the anti-money laundering identification method in the embodiment of the present application.

Fig. 6 is a schematic flow chart illustrating the step 100 of the anti-money laundering identification method in the embodiment of the present application.

Fig. 7 is a flowchart illustrating an anti-money laundering identification method including step 020 according to an embodiment of the present application.

Fig. 8 is a flowchart illustrating an anti-money laundering identification method including step 500 according to an embodiment of the present application.

Fig. 9 is a flowchart of a technical solution of the anti-money laundering identification method provided by the present application example.

FIG. 10 is a schematic diagram of a process of forming a target community by the connected subgraph algorithm and the community division algorithm provided by the present application example.

FIG. 11 is a flow chart of GCN neural network model training provided by the present application example.

Fig. 12 is a first configuration diagram of the anti-money laundering identification apparatus in the embodiment of the present application.

Fig. 13 is a second construction view of the anti-money laundering identification apparatus in the embodiment of the present application.

Fig. 14 is a schematic view of a third structure of the anti-money laundering identification apparatus in the embodiment of the present application.

Fig. 15 is a schematic view showing a fourth configuration of the anti-money laundering identification device in the embodiment of the present application.

Fig. 16 is a schematic structural diagram of an electronic device in the embodiment of the present application.

Detailed Description

In order to make the objects, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application, and it is obvious that the described embodiments are some embodiments of the present application, but not all embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present application.

Aiming at the problems that the report rate is low and the time and labor are consumed in supervision, monitoring and early warning discrimination processing in the conventional anti-money laundering early warning mode due to the fact that the existing anti-money laundering early warning quantity is large; meanwhile, most anti-money laundering rules are summarized according to historical data, so that the problem that the monitoring or identification effect of anti-money laundering cannot be ensured due to the fact that the majority of anti-money laundering rules are over-dependent on manual experience exists; carrying out risk community division on the target fund transaction network graph; performing risk rating on each risk community, and determining at least one target community based on a corresponding risk rating result; the risk scores of all the nodes in the target community are determined by using a preset graph volume model, the risk scores of all the nodes are used for carrying out node screening on the target community, and the community with money laundering risk corresponding to the target fund transaction network graph is obtained, so that compared with the traditional methods of large-amount transaction reports, suspicious transaction reports, customer information authenticity evidence finding and the like in anti-money laundering transactions, the method has the advantages that the manual workload is large, the method depends on experience excessively, the knowledge graph analyzes the problems from the angle of relationship, the transaction network graph is constructed, and a plurality of graph algorithms are used for analysis, so that the labor cost and the processing efficiency of business can be greatly saved, and meanwhile, suspicious targets can be discovered more scientifically and systematically. Suspicious target money laundering communities or money laundering nodes can be found quickly and conveniently, meanwhile, the suspicious target communities are subjected to further money laundering risk quantitative scoring, high-risk money laundering teams can be accurately positioned, the reliability of the money laundering identification process and the accuracy of money laundering identification results can be effectively improved, the efficiency and the intelligent degree of the money laundering identification process can be effectively improved, the accuracy and the efficiency of a financial machine for identifying suspicious money laundering transactions of clients can be effectively improved, the report rate of money laundering identification is effectively improved, and the time and money cost of supervision, monitoring, early warning and discrimination processing are reduced.

The knowledge graph as a semantic network has extremely strong expression capability and modeling flexibility, and can be used for modeling entities, concepts, attributes and relations among the entities, the concepts and the attributes in the real world. Compared with the traditional rule of anti-money laundering work, the AI technology based on the knowledge graph can analyze the multi-link relevance of each transaction design, search the relation between individuals and behaviors, form a model learning closed loop, carry out all-round monitoring on the anti-money laundering behavior and discover money laundering teams.

Specifically, the following examples are given to illustrate the respective embodiments.

In order to effectively improve the reliability of the anti-money laundering identification process and the accuracy of the anti-money laundering identification result, and effectively improve the efficiency and the intelligent degree of the anti-money laundering identification process, the application provides an embodiment of an anti-money laundering identification method, and referring to fig. 1, the anti-money laundering identification method specifically comprises the following contents:

step 100: and acquiring a target fund transaction network graph, wherein each node in the target fund transaction network graph is respectively used for representing entity data corresponding to each account, and an edge between the two nodes is used for representing relationship data between the two nodes.

It will be appreciated that the entity data is the 'point' data in the target funds transaction network map and the relationship data is the 'edge' data in the target funds transaction network map. An 'edge' is made up of a start point and an end point and associated attributes. The relationship data may be the account A transferring account number to the account B to form a transferring relationship, and the transferring amount, time and the like may be used as attributes of the relationship data. The actual entity data and relationship data may be customized by specific business properties.

Step 200: and carrying out risk community division on the target fund transaction network graph.

In step 200, the structure of the target fund transaction network graph can be a ring structure or other forms of graph mode structures.

Step 300: and carrying out risk rating on each risk community, and determining at least one target community based on a corresponding risk rating result.

It will be appreciated that the communities with greater money laundering risks need to be focused on since not every community has a greater money laundering risk. Thus, in step 300, a quantitative measure of the transaction temporal risk may be made using the temporal entropy risk measure.

Step 400: and determining the risk score of each node in the target community by using a preset graph volume model, and screening the target community by using the risk score of each node to obtain the community with money laundering risk corresponding to the target fund transaction network graph.

In step 400, modeling may be performed using a graph neural network. Local community mining mines risky communities from fund trading relationships, and a potential problem is that mined communities may contain accounts that have some indirect fund trading relationships with money laundering accounts, but have relatively low actual risks. On the basis of community mining, the graph convolution model takes target communities divided by the communities as input, and utilizes known or predicted account labels to spread the account labels on a fund transaction network according to transaction relations among nodes and attributes of the nodes to obtain risk scores of the accounts.

In order to effectively improve the application universality and the applicability comprehensiveness of the anti-money laundering identification process, in an embodiment of the anti-money laundering identification method provided by the present application, referring to fig. 2, after step 100 and before step 200 of the anti-money laundering identification method, the following contents are further specifically included:

step 010: and screening suspicious account nodes with money laundering risks from all the nodes of the target fund transaction network graph by using a preset graph feature filtering mode, wherein the graph feature filtering mode comprises an entrance filtering mode and/or a central point refractive index filtering mode.

In order to improve the accuracy of the risk community division on the target fund transaction network graph so as to further improve the reliability of the anti-money laundering identification process and the accuracy of the anti-money laundering identification result, in an embodiment of the anti-money laundering identification method provided by the present application, referring to fig. 3, the step 200 of the anti-money laundering identification method specifically includes the following contents:

step 210: and acquiring a subgraph with an abnormal transaction structure corresponding to the target fund transaction network graph according to preset weight and an abnormal threshold.

Step 220: and carrying out risk community division on each subgraph with the abnormal transaction structure by using a preset subgraph calculation mode to obtain a risk community corresponding to the target fund transaction network graph.

In order to focus on the communities with greater money laundering risks, so as to further improve the reliability of the anti-money laundering identification process and the accuracy of the anti-money laundering identification result, in an embodiment of the anti-money laundering identification method provided by the present application, referring to fig. 4, step 300 of the anti-money laundering identification method specifically includes the following contents:

step 310: and taking the initial transaction corresponding to the initial node in the risk community as a starting point, and acquiring the transaction time point of each transaction in the risk community.

Step 320: and acquiring the average transaction time of the corresponding risk community according to the transaction time point of each transaction.

Step 330: determining an absolute value of a difference between the trade time point for each trade and the average trade time.

Step 340: and dividing each transaction into corresponding sections based on the absolute value of the difference between the transaction time point of each transaction and the average transaction time.

Step 350: and determining the transaction time entropy of the corresponding risk community based on the proportion of the transaction quantity in the interval to the total transaction quantity in the corresponding risk community.

Step 360: and determining the risk level of each risk community by applying the transaction time entropy of each risk community, and determining at least one target community according to the risk level of each risk community.

In order to effectively screen out a part of accounts having indirect fund transaction relationship with money laundering accounts but having relatively low actual risk, so as to further improve the reliability of the anti-money laundering identification process and the accuracy of the anti-money laundering identification result, in an embodiment of the anti-money laundering identification method provided by the present application, referring to fig. 5, step 400 of the anti-money laundering identification method specifically includes the following contents:

step 410: and acquiring account labels corresponding to the nodes in the target community.

Step 420: inputting the target community into the graph convolution model, and spreading the account label on the graph convolution model according to the transaction relationship among the nodes of the target community and the attributes of the nodes to obtain the risk score of each node, wherein the graph convolution model is a graph neural network.

In order to effectively improve the acquisition accuracy and the application reliability of the fund transaction network diagram so as to further improve the reliability of the anti-money laundering identification process and the accuracy of the anti-money laundering identification result, in an embodiment of the anti-money laundering identification method provided by the present application, referring to fig. 6, step 100 of the anti-money laundering identification method specifically includes the following contents:

step 110: and selecting corresponding entity data and relationship data from account transaction source data according to a preset data tag, wherein the entity data comprise unique identification of accounts, and the relationship data comprise transfer relationship data between the accounts.

Step 120: and preprocessing the entity data and the relationship data.

Step 130: and generating a corresponding target fund transaction network diagram by applying a preset Schema model, the preprocessed entity data and the relationship data.

In order to further improve the reliability of the anti-money laundering identification process and the accuracy of the anti-money laundering identification result, in an embodiment of the anti-money laundering identification method provided in the present application, referring to fig. 7, the following contents are further included after step 100 and before step 010 of the anti-money laundering identification method:

step 020: and performing edge attribute fusion processing on edges between the same pair of nodes in the target fund transaction network graph.

In order to effectively improve the application reliability of the anti-money laundering identification result and improve the user experience of the financial institution, in an embodiment of the anti-money laundering identification method provided by the present application, referring to fig. 8, the following contents are further specifically included after step 400 of the anti-money laundering identification method:

step 500: and visually displaying the communities with money laundering risks.

In order to further explain the scheme, the application also provides a specific application example of the anti-money laundering identification method, and the application example provides the anti-money laundering identification method and device. The application example is based on a Hadoop/Spark and other big data platforms, a capital transaction network of a suspicious subject in the anti-money laundering field is constructed by utilizing a Janus Graph database, a Graph analysis algorithm (including an access degree algorithm, a centrality algorithm, a subgraph, a community discovery algorithm, a Graph representation algorithm, a Graph deep learning algorithm and other algorithms) and a Graph analysis tool suitable for an anti-money laundering scene are combined, a transaction path among accounts can be accurately tracked, the account number/card number/merchant at a source and the like are correlated to a final payee, the money laundering/cash registering path and suspicious personnel are identified, and more entities such as suspicious personnel, accounts, merchants or card numbers and the like are obtained through analysis of the transaction path of the suspicious personnel through layer-by-layer correlation. Referring to fig. 9, the anti-money laundering identification method specifically includes the following contents:

the application example starts from an abnormal transaction structure of an anti-money laundering complex network, utilizes rich internal and external data, processes the data by relying on the existing technologies such as big data, a graph database and the like, establishes a fund transaction network, performs multi-angle correlation analysis, actively discovers the abnormal transaction structure in the money laundering process, and then carries out risk quantification on the abnormal transaction, thereby discovering money laundering teams with high suspiciousness. The specific technical scheme comprises the following steps:

step 1: a data tag is determined. The application example mainly analyzes the anti-money laundering network, and firstly determines a data label to be analyzed, wherein data such as account number, card number, merchant, transaction equipment IP, transaction equipment MAC address, transaction amount, transaction times, transaction time and the like are selected.

Wherein, the data label is the data (point-edge data) needed for constructing the trading network graph subsequently.

Step 2: and selecting a data source. Internal data is sourced from the data warehouse, and external data is relied on by third party data. The third-party data mainly come from personal credit data and outsourcing third-party data company data.

And 3, processing the data ET L, preprocessing the data and standardizing the data to form entity data and relationship data meeting knowledge graph construction bases, converting the data into structured data by using technologies such as N L P, OCR and the like for unstructured or semi-structured data, and performing operations such as duplication removal, filling in, structure adjustment and the like for the structured data to finally form the entity data and the relationship data.

The entity data is 'point' data in the relational network graph, and the relational data is 'edge' data in the relational network graph. An 'edge' is made up of a start point and an end point and associated attributes.

In the above tag, the entity data may be, for example, an account number, a card number, a merchant, a transaction device IP, and a transaction device MAC address. The relationship data may be the account a transferring account to the account B to form a transfer relationship, and the transfer amount, time, and the like may be attributes of the relationship data. The actual entity data and relationship data may be customized by specific business properties.

And 4, step 4: a funds transaction network is established. Firstly, constructing a Schema model of a Graph, carrying out Schema mapping on entity data and relationship data, and then establishing a fund transaction network Graph by using a Janus Graph database and HBase storage to transfer transaction relationship data and other data of transaction entities such as account numbers, card numbers, merchants and the like and funds.

The Schema model refers to a Schema definition of a relational network diagram, namely, elements related to entities, relations, attributes and the like are the basis for constructing the diagram.

And 5: and fusing the attributes. Transaction edges between the same account pair are fused, for example, the transaction amount and the frequency adopt the accumulated sum as the fused attribute, and the transaction time adopts the average value measurement.

Wherein, the transaction edge is mainly the transfer relation. The attribute fusion is carried out, and the attribute fusion comprises transaction amount, transaction times, transaction time and the like.

Step 6: and filtering graph characteristics. Mainly comprises the steps of filtering the entrance and exit and filtering the center point breakage rate (roll-out amount/roll-in amount). For central transaction nodes which are intensively transferred in/dispersedly transferred out, the degree of entry is smaller and the degree of exit is larger, and the degree of entry < theta 1& & degree of exit > theta 2 is set for filtering; for the central transaction node of the distributed transfer-out/centralized transfer-in, the entry degree is certainly large, the exit degree is small, and the entry degree > theta 3& & exit degree < theta 4 can be set for filtering. Meanwhile, in general money laundering transactions, the transfer-in amount and the transfer-out amount in the intermediate account are approximately equal, namely suspicious nodes can be screened out through the way that the breakage rate (transfer-out amount/transfer-in amount) of the central point is approximately equal to 1, and related transactions with the suspicious nodes are found out, so that related abnormal money laundering modes are possibly found. For the annular transaction structure, an annular strong connectivity subgraph is searched based on Tarjan and Kosaraju algorithms, and then corresponding abnormal structures can be obtained by combining corresponding threshold filtering.

Wherein, the fund transaction network diagram is used for describing the fund transfer process in the money laundering transaction process.

Step 5, fusing the attributes of the edges to reduce the number of the edges; and 6, screening suspicious accounts through the threshold values of the outgoing degree and the incoming degree and the center point breakage rate on the basis of the step 5. Step 7 is to further find out the risk community in the larger trading network map.

And 7: and constructing subgraphs and target communities. And setting the weight after the transaction amount and the transaction times are standardized. And setting appropriate threshold parameters for adjustment, and screening a batch of abnormal transaction structures by using a subgraph algorithm. However, sometimes the subgraph includes some money laundering transaction networks which look like normal transactions, further analysis needs to be carried out on the subgraph, each larger subgraph is subdivided into a plurality of smaller target communities with better anti-money laundering distinction degree, and if a certain subgraph includes communities with extremely high money laundering risk or a plurality of high-risk communities, the subgraph is considered to have particularly high money laundering risk. The application example analyzes the obtained subgraph through two algorithms, and the specific flow is shown in fig. 10.

Algorithm 1 is a Personalized-PageRank Personalized PageRank algorithm. For a part of subgraphs with abnormal transaction structures, an abnormal point (black seed) is taken as a starting point, and an approximate Personalized-PageRank value (PPR) is obtained in a random walk mode, wherein the level of the PPR value reflects the degree of closeness between nodes and the black seed in the network. Based on the PPR value, the sub-graphs are cut to obtain communities corresponding to the abnormal points, the communities with high overlap ratio are merged, and finally a plurality of local communities which are not overlapped almost are generated.

An algorithm 2: L ouvain community discovery algorithm L ouvain algorithm is an algorithm for optimizing Modularity based on multilevel (round-by-round heuristic iteration) and is a numerical value obtained by carrying out Modularity iteration measurement on the influence of edge weight on a community, and the specific formula is as follows:

in the L ouvain algorithm, the specific modularity of each community is not required, and only the modularity change after a certain node is added in the community needs to be compared, so that the Δ q needs to be solved.

A_ij: the weight of the edge between node i and node j;

k_i: the sum of the weights of all edges connected to node i;

C_i: the community to which the node i belongs;

m: sum of the weights of all edges in the graph.

According to the practical situation of anti-money laundering, the weight of L ouvain algorithm edges is optimized by combining the size relation between the node in-degree and out-degree, the average transaction time sequence of the in-and-out edges and the transaction amount of each edge.

And 8: risk quantification metric and rating.

And 7, dividing the communities according to the step 7 to obtain target communities, wherein not every community has a large money laundering risk, and the communities with large money laundering risks need to be focused. In the application example, the transaction time risk degree is quantitatively measured by using the time entropy risk measure. Calculating the time point of each transaction by taking the initial transaction in each community as a starting point, firstly calculating the average time of a certain community, and then calculating the absolute value of the difference between the average time and the time of each transaction in the community. Dividing each transaction into corresponding sections according to the difference of the absolute values of the differences, and finally counting the ratio Pi of the transaction number of each section to the total transactions in the community. Then, a calculation formula of the transaction time entropy of each community can be obtained, wherein "+" in the following calculation formula represents multiplication:

in a normal money laundering community, the time difference between the front and back transactions is generally very small, that is, the batch of transactions are likely to be specially planned by money laundering parties, and the related transactions are completed within a certain time. If the entropy of the transaction time within a community is smaller, the more concentrated the time representing the batch of transactions, the greater the risk of money laundering.

After the money laundering risk of each community is quantified as a score, a corresponding percentile graph can be drawn, and then the communities are graded according to different percentile ranges. Generally, communities with a ratio between 95-100%, 90-95%, and 80-90% can be labeled as

risk levels

1, 2, and 3, respectively, followed by a risk level of 4 for all communities. And a connected subgraph containing a plurality of high-risk communities has a great suspicion of money laundering, and can be handed over to an examination department for further manual investigation.

And step 9: modeling is performed using a graph neural network. In the former anti-money laundering model, local community mining mines risk communities from fund transaction relationships, and a potential problem is that mined communities may contain accounts having partial indirect fund transaction relationships with money laundering accounts but lower actual risks. On the basis of community mining, the graph convolution model takes target communities divided by the communities as input, and utilizes known or predicted account labels to spread the account labels on a fund transaction network according to transaction relations among nodes and attributes of the nodes to obtain risk scores of the accounts.

The method comprises the steps that a GNN model maps each vertex in a graph to an m-dimensional Euclidean space through a function, and then label classification is carried out through a CNN neural network model, the application example takes a target community after community division as output, each point is given with a label (1, 0 or-1) and features as output, two-degree relation of the nodes is selected to carry out field processing according to the importance degree of the relation and the calculation complexity, namely after two Hidden layers (Hidden layers) and a Relu activation function are arranged in the middle, parameters of the model can be updated reversely through a cross entropy loss function, the model is iterated until the model tends to be stable, and finally the labels of the nodes are obtained at the output layer, each node aggregates the features of the node and the node at one degree in a first Hidden layer (Hidden layer L ayer 1), relevant data are subjected to normalization processing, operation is carried out at a second Hidden layer (Hidden layer L ayer 2), operation similar to the first layer, neighbor neural network model is further trained, and neighbor information is further similar to the neighbor neural network learning process of the neighbor graph 11.

Step 10: and (6) visually displaying. And the risk communities are visually displayed through technologies such as d3.js and the like, so that business experts can intuitively judge the risk condition according to the transaction relation between accounts and the experience of the experts. The visual content comprises: 1. node and node information: the node information comprises information such as account numbers/card numbers/merchants, node labels, transaction time differences and the like; 2. directed edge and directed edge information: the side information includes a total amount of transactions and a total number of transactions.

From the above description, the anti-money laundering identification method provided by the application example of the application example mainly comprises the steps of constructing a transaction network graph, and carrying out algorithm analysis processing such as a connected subgraph, community division, graph neural network and the like on the graph, so that suspicious target money laundering communities or money laundering nodes can be quickly and conveniently found, meanwhile, further money laundering risk quantitative grading is carried out on the suspicious target communities, and high-risk money laundering parties can be accurately positioned. Compared with the traditional methods of large-amount transaction reports, suspicious transaction reports, customer information authenticity evidence finding and the like in anti-money laundering transactions, the method has the advantages that the manual workload is large, the method depends on experience excessively, the problem is analyzed from the relation point of view by the knowledge graph, the transaction network graph is constructed, and the graph algorithm is utilized for analysis, so that the labor cost and the service processing efficiency can be greatly saved, and suspicious targets can be discovered more scientifically and systematically.

In terms of software, in order to effectively improve the reliability of the anti-money laundering identification process and the accuracy of the anti-money laundering identification result, and effectively improve the efficiency and the intelligence degree of the anti-money laundering identification process, the present application further provides an embodiment of an anti-money laundering identification device for implementing all or part of the content in the anti-money laundering identification method, referring to fig. 12, the anti-money laundering identification device specifically includes the following contents:

the transaction network construction module 10 is configured to obtain a target fund transaction network graph, where each node in the target fund transaction network graph is respectively used to represent entity data corresponding to each account, and an edge between two nodes is used to represent relationship data between the two nodes.

And the risk community division module 20 is used for carrying out risk community division on the target fund transaction network graph.

And the target community determining module 30 is configured to perform risk rating on each risk community, and determine at least one target community based on a corresponding risk rating result.

And the money laundering risk community determining module 40 is configured to determine a risk score of each node in the target community by using a preset graph and volume model, and perform node screening on the target community by using the risk score of each node to obtain a community with money laundering risk corresponding to the target fund transaction network graph.

In order to effectively improve the application universality and the application comprehensiveness of the anti-money laundering identification process, in an embodiment of the anti-money laundering identification device provided by the present application, referring to fig. 13, the anti-money laundering identification device specifically includes the following contents:

and the graph feature filtering module 01 is configured to filter suspicious account nodes with money laundering risks from each node of the target fund transaction network graph by using a preset graph feature filtering manner, where the graph feature filtering manner includes an entry and exit filtering manner and/or a central point refractive index filtering manner.

In order to improve the accuracy of the risk community division on the target fund transaction network diagram, so as to further improve the reliability of the anti-money laundering identification process and the accuracy of the anti-money laundering identification result, in an embodiment of the anti-money laundering identification apparatus provided by the present application, the risk community division module 20 of the anti-money laundering identification apparatus is specifically configured to execute the following:

In order to focus on the communities with greater money laundering risks, so as to further improve the reliability of the anti-money laundering identification process and the accuracy of the anti-money laundering identification result, in an embodiment of the anti-money laundering identification apparatus provided in the present application, the target community determining module 30 of the anti-money laundering identification apparatus is specifically configured to perform the following:

In order to effectively screen out a part of accounts having indirect fund transaction relationship with the money laundering account but having relatively low actual risk, so as to further improve the reliability of the anti-money laundering identification process and the accuracy of the anti-money laundering identification result, in an embodiment of the anti-money laundering identification apparatus provided in the present application, the money laundering risk community determination module 40 of the anti-money laundering identification apparatus is specifically configured to perform the following:

acquiring account labels corresponding to the nodes in the target community;

In order to effectively improve the acquisition accuracy and the application reliability of the fund transaction network diagram, so as to further improve the reliability of the anti-money laundering identification process and the accuracy of the anti-money laundering identification result, in an embodiment of the anti-money laundering identification apparatus provided in the present application, the transaction network construction module 10 of the anti-money laundering identification apparatus is specifically configured to execute the following:

preprocessing the entity data and the relationship data;

In order to further improve the reliability of the anti-money laundering identification process and the accuracy of the anti-money laundering identification result, in an embodiment of the anti-money laundering identification device provided by the present application, referring to fig. 14, the following are further specifically included in the anti-money laundering identification device:

and the attribute fusion module 02 is used for performing edge attribute fusion processing on edges between the same pair of nodes in the target fund transaction network diagram.

In order to effectively improve the application reliability of the anti-money laundering identification result and improve the user experience of the financial institution, in an embodiment of the anti-money laundering identification device provided by the present application, referring to fig. 15, the anti-money laundering identification device further specifically includes the following contents:

and the visual display module 50 is used for visually displaying the communities with money laundering risks.

In order to effectively improve the reliability of the anti-money laundering identification process and the accuracy of the anti-money laundering identification result and effectively improve the efficiency and the intelligent degree of the anti-money laundering identification process, the application provides an embodiment of an electronic device for implementing all or part of the contents in the anti-money laundering identification method, and the electronic device specifically comprises the following contents:

a processor (processor), a memory (memory), a communication Interface (Communications Interface), and a bus; the processor, the memory and the communication interface complete mutual communication through the bus; the communication interface is used for realizing information transmission between the electronic equipment and the user terminal and relevant equipment such as a relevant database and the like; the electronic device may be a desktop computer, a tablet computer, a mobile terminal, and the like, but the embodiment is not limited thereto. In this embodiment, the electronic device may refer to the embodiments of the anti-money laundering identification method and the anti-money laundering identification apparatus in the embodiments, and the contents thereof are incorporated herein, and repeated descriptions are omitted.

Fig. 16 is a schematic block diagram of a system configuration of an electronic device 9600 according to an embodiment of the present application. As shown in fig. 16, the electronic device 9600 can include a central processor 9100 and a memory 9140; the memory 9140 is coupled to the central processor 9100. Notably, this fig. 16 is exemplary; other types of structures may also be used in addition to or in place of the structure to implement telecommunications or other functions.

In one embodiment, the anti-money laundering identification function may be integrated into the central processor. Wherein the central processor may be configured to control:

From the above description, it can be known that the electronic device provided in the embodiment of the present application can quickly and conveniently discover suspicious target money laundering communities or money laundering nodes, and can perform further money laundering risk quantitative scoring on the suspicious target communities, so that high-risk money laundering teams can be accurately located, and further, the reliability of the anti-money laundering identification process and the accuracy of the anti-money laundering identification result can be effectively improved, and the efficiency and the intelligent degree of the anti-money laundering identification process can be effectively improved, and further, the accuracy and the efficiency of the financial machine for identifying the client money laundering suspicious transaction behavior can be effectively improved, the report rate of the anti-money laundering identification can be effectively improved, and the time and money cost of supervision, monitoring, early warning and screening processing can be reduced.

In another embodiment, the anti-money laundering identification device may be configured separately from the central processor 9100, for example, the anti-money laundering identification device may be configured as a chip connected to the central processor 9100, and the anti-money laundering identification function is implemented by the control of the central processor.

As shown in fig. 16, the electronic device 9600 may further include: a communication module 9110, an input unit 9120, an audio processor 9130, a display 9160, and a power supply 9170. It is noted that the electronic device 9600 also does not necessarily include all of the components shown in fig. 16; further, the electronic device 9600 may further include components not shown in fig. 16, which can be referred to in the related art.

As shown in fig. 16, a central processor 9100, sometimes referred to as a controller or operational control, can include a microprocessor or other processor device and/or logic device, which central processor 9100 receives input and controls the operation of the various components of the electronic device 9600.

The memory 9140 can be, for example, one or more of a buffer, a flash memory, a hard drive, a removable media, a volatile memory, a non-volatile memory, or other suitable device. The information relating to the failure may be stored, and a program for executing the information may be stored. And the central processing unit 9100 can execute the program stored in the memory 9140 to realize information storage or processing, or the like.

An input unit 9120 provides input to the cpu 9100, the input unit 9120 is, for example, a key or a touch input device, a power supply 9170 supplies power to the electronic apparatus 9600, a display 9160 displays display objects such as images and characters, and the display may be, for example, an L CD display, but is not limited thereto.

The memory 9140 can be a solid state memory, e.g., Read Only Memory (ROM), Random Access Memory (RAM), a SIM card, or the like. There may also be a memory that holds information even when power is off, can be selectively erased, and is provided with more data, an example of which is sometimes called an EPROM or the like. The memory 9140 could also be some other type of device. Memory 9140 includes a buffer memory 9141 (sometimes referred to as a buffer). The memory 9140 may include an application/function storage portion 9142, the application/function storage portion 9142 being used for storing application programs and function programs or for executing a flow of operations of the electronic device 9600 by the central processor 9100.

The memory 9140 can also include a data store 9143, the data store 9143 being used to store data, such as contacts, digital data, pictures, sounds, and/or any other data used by an electronic device. The driver storage portion 9144 of the memory 9140 may include various drivers for the electronic device for communication functions and/or for performing other functions of the electronic device (e.g., messaging applications, contact book applications, etc.).

The communication module 9110 is a transmitter/receiver 9110 that transmits and receives signals via an antenna 9111. The communication module (transmitter/receiver) 9110 is coupled to the central processor 9100 to provide input signals and receive output signals, which may be the same as in the case of a conventional mobile communication terminal.

Based on different communication technologies, a plurality of communication modules 9110, such as a cellular network module, a bluetooth module, and/or a wireless local area network module, may be provided in the same electronic device. The communication module (transmitter/receiver) 9110 is also coupled to a speaker 9131 and a microphone 9132 via an audio processor 9130 to provide audio output via the speaker 9131 and receive audio input from the microphone 9132, thereby implementing ordinary telecommunications functions. The audio processor 9130 may include any suitable buffers, decoders, amplifiers and so forth. In addition, the audio processor 9130 is also coupled to the central processor 9100, thereby enabling recording locally through the microphone 9132 and enabling locally stored sounds to be played through the speaker 9131.

Embodiments of the present application also provide a computer-readable storage medium capable of implementing all steps in the anti-money laundering identification method in the above embodiments, where the computer-readable storage medium stores thereon a computer program, and when the computer program is executed by a processor, the computer program implements all steps of the anti-money laundering identification method in which an execution subject is a server or a client in the above embodiments, for example, the processor implements the following steps when executing the computer program:

As can be seen from the above description, the computer-readable storage medium provided in the embodiment of the present application can quickly and conveniently discover suspicious target money laundering communities or money laundering nodes, and can also perform further money laundering risk quantitative scoring on the suspicious target communities, so as to accurately locate high-risk money laundering teams, thereby effectively improving the reliability of the anti-money laundering identification process and the accuracy of the anti-money laundering identification result, and effectively improving the efficiency and the intelligent degree of the anti-money laundering identification process, thereby effectively improving the accuracy and efficiency of the financial machine in identifying suspicious money laundering transaction behaviors of clients, effectively improving the report rate of the anti-money laundering identification, and reducing the time and money cost of supervision, monitoring, early warning and screening.

As will be appreciated by one skilled in the art, embodiments of the present invention may be provided as a method, apparatus, or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.

The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (devices), and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flow diagrams and/or block diagrams, and combinations of flows and/or blocks in the flow diagrams and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.

These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

The principle and the implementation mode of the invention are explained by applying specific embodiments in the invention, and the description of the embodiments is only used for helping to understand the method and the core idea of the invention; meanwhile, for a person skilled in the art, according to the idea of the present invention, there may be variations in the specific embodiments and the application scope, and in summary, the content of the present specification should not be construed as a limitation to the present invention.

Claims

1. An anti-money laundering identification method, comprising:

2. The anti-money laundering identification method according to claim 1, further comprising, before said risk community partitioning of the target fund transaction network graph:

3. The anti-money laundering identification method according to claim 1, wherein the risk community partitioning of the target fund transaction network graph comprises:

4. The anti-money laundering identification method according to claim 1, wherein said risk-rating each of said risk communities and determining at least one target community based on the corresponding risk-rating result comprises:

5. The anti-money laundering identification method according to claim 1, wherein the applying a preset graph volume model to determine a risk score of each of the nodes in the target community comprises:

acquiring account labels corresponding to the nodes in the target community;

6. The anti-money laundering identification method according to claim 1, wherein the acquiring a target funds transaction network map comprises:

preprocessing the entity data and the relationship data;

7. The anti-money laundering identification method according to claim 1, further comprising, before said risk community partitioning of the target fund transaction network graph:

8. The anti-money laundering identification method according to claim 1, further comprising, after obtaining the community at risk of money laundering corresponding to the target fund transaction network map:

and visually displaying the communities with money laundering risks.

9. An anti-money laundering identification device, comprising:

10. The anti-money laundering identification device according to claim 9, further comprising:

11. The anti-money laundering identification device according to claim 9, wherein the risk community partitioning module is configured to perform the following:

12. The anti-money laundering identification apparatus according to claim 9, wherein the target community determining module is configured to perform the following:

13. The anti-money laundering identification device according to claim 9, wherein the money laundering risk community determining module is configured to perform the following:

acquiring account labels corresponding to the nodes in the target community;

14. The anti-money laundering identification device according to claim 9, wherein the transaction network construction module is configured to perform the following:

preprocessing the entity data and the relationship data;

15. The anti-money laundering identification device according to claim 9, further comprising:

16. The anti-money laundering identification device according to claim 9, further comprising:

17. An electronic device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, wherein the steps of the anti-money laundering identification method according to any one of claims 1 to 8 are implemented when the program is executed by the processor.

18. A computer-readable storage medium, on which a computer program is stored which, when being executed by a processor, carries out the steps of the anti-money laundering identification method according to any one of claims 1 to 8.