CN111861756A - Group partner detection method based on financial transaction network and implementation device thereof - Google Patents

Abstract

The invention relates to a group partner detection method based on a financial transaction network and an implementation device thereof, wherein the detection method comprises the following steps: (1) preprocessing data; (2) generating a user feature vector: acquiring a user time sequence characteristic vector by using a sequence model, and acquiring a user space characteristic vector by using a GAE model; respectively normalizing the user time sequence feature vector and the space feature vector, and performing connection operation to generate a node expression vector; (3) group detection: and calculating the group to which each node belongs and outputting a group mark of the node. According to the method, original financial transaction flow information data is utilized, time sequence characteristics and space structure characteristics are extracted firstly, then the distance between every two nodes is calculated by using connection characteristics to serve as weight, and each user can be allocated to potential partners by using a group detection algorithm based on modularity optimization.

Description

Group partner detection method based on financial transaction network and implementation device thereof

Technical Field

The invention relates to a group partner detection method based on a financial transaction network and an implementation device thereof, belonging to the technical field of data mining.

Background

Group detection refers to detecting a node set with the same characteristics on graph data, and is also called community detection in the field of complex networks. Group detection has a wide application base. The aid decision tools in financial crime require high accuracy and interpretability. Therefore, the method has wide research and application values for mining potential suspects in massive transaction running water. At present, the work also generally depends on manual data mining and analysis, which needs to deeply understand data and criminal behaviors and deeply analyze the data, has high requirements on human experience, and provides new huge challenges for machine hardware and people along with the large outbreak of various transaction data volumes.

The community detection belongs to one of a plurality of technologies of complex networks, and the previous research mainly achieves great effect on networks in specific fields such as a scientist cooperation network, a power network, a protein interaction network and the like. From an initial GN algorithm to a label propagation algorithm which can be applied to a large-scale data set, and then to a generative model MMSB algorithm which is based on a probability statistical method and is proposed later, most of the existing community detection algorithms only utilize the space structure information of a graph, such as neighbor information. At present, an effective detection method for financial criminal parties is still lacked, and most of the algorithms based on the graph space topological structure are used, so that the accuracy of the obtained result is low, and the algorithm cannot be easily expanded to other transaction data. The existing method does not consider the time transaction sequence characteristics, and the characteristics capable of representing one node are also hidden in the time sequence. At present, no method can fully utilize the time sequence characteristics and the space characteristics of financial transaction data to detect criminal gangs.

Chinese patent document CN104867055A discloses a financial network suspicious fund tracking and identifying method, which comprises: (1) constructing a financial transaction network topological graph: the financial transaction network topological graph is a graph obtained by visualizing and displaying the original financial transaction flow after processing, and the graph contains all transaction relations and fund flow directions in the original financial transaction flow; (2) a capital flow direction analysis process; after the transaction network topological graph is constructed, carrying out fund flow direction analysis on the graph, wherein the purpose of the fund flow direction analysis is to track the specific flow direction of one or more funds; (3) transaction relationship analysis flow: and after the transaction network topological graph is constructed, carrying out fund flow direction analysis on the graph, wherein the purpose of the transaction relation analysis is to dig out the fund flow relation of the suspected gangs to obtain a high-volume high-suspicion fund path. However, the patent only utilizes the topological relation of the original transaction flow and does not deeply mine the time-space sequence characteristics in the transaction sequence; meanwhile, too many places need to be manually input and adjusted, and the automation degree is low.

Chinese patent document CN110348978A provides a risk group identification method, apparatus, device and storage medium based on graph calculation, the method includes: receiving a service request, wherein the service request comprises a service type and user attribute information; performing social network analysis on the service type, the user attribute information and historical service data corresponding to the service request to generate a corresponding social network; segmenting a sub-network corresponding to the service request from the social sub-network according to the degree of aggregation; and inputting the adjacency matrix of the sub-network into a preset prediction model to obtain a risk group identification result corresponding to the service request. The embodiment of the specification can realize the identification and detection of the risk group in the financial business. However, in the patent, 1) the biggest problem of clustering recognition based on aggregation level is that the obtained clusters are often members which are closely adjacent on the graph, and the members which are not adjacent cannot recognize; 2) the problem in the algorithm is that two nodes cannot be separated after being combined in the aggregation method, so the error fraction rate is high; 3) the use of transaction sequences remains in a simple topological relationship with unreliable results.

Disclosure of Invention

Aiming at the defects of the prior art, the invention provides a group partner detection method based on a financial transaction network, which utilizes basic characteristics of a transaction account number, a transaction counter-account number, transaction time and the like in original financial transaction stream information data, extracts time sequence characteristics and space structure characteristics through a sequence model and a GAE model in a self-adaptive manner, and finally calculates the distance between every two nodes as network weight by using connection characteristics, so that each user can be allocated to a potential group partner by using the detection method. The method can reduce the work of manually extracting the features, can automatically determine the number of the groups, and can effectively improve the accuracy and the interpretability of the existing method.

The invention also provides an implementation device of the group partner detection method based on the financial transaction network.

Interpretation of terms:

skip-gram model a neural network model for training word vectors.

GAE model: the graph self-encoder model is a neural network model which efficiently represents input graph data through unsupervised learning.

3. High frequency word sampling technique: that is, in the process of training the word vector, in order to overcome the influence of the high frequency word, the high frequency word is deleted with a certain probability.

4. Negative sampling technology: a method for increasing the training speed of a neural network. Not all parameters are updated, only a small number of neuron parameters are updated.

5, GCN: graph convolution neural network, a neural network that convolves graph structure data.

The technical scheme of the invention is as follows:

a method of group detection based on a financial transaction network, comprising:

(1) data preprocessing: performing data cleaning on the transaction data, extracting a transaction sequence of each user and constructing graph data;

(2) generating a user feature vector: acquiring a user time sequence characteristic vector by using a sequence model, and acquiring a user space characteristic vector by using a GAE model; respectively normalizing the user time sequence characteristic vector and the space characteristic vector, performing connection operation, and generating a node expression vector

d′₁，......d′_mRepresenting the normalized user timing feature vector,

representing the normalized spatial feature vector;

(3) group detection: and calculating the group to which each node belongs and outputting a group mark of the node.

According to the invention, in the step (1), the transaction data includes a user, a transaction counter account, a transaction time and a transaction amount, and the specific step of performing data cleansing on the transaction data includes:

1-1, missing value filling: if any field of a user, a transaction counter account and transaction time of certain transaction data is missing, discarding the transaction data;

if only the transaction amount in certain transaction data has field loss, filling by adopting an average filling method, namely calculating the average value of all transaction amounts of the current user, and filling the transaction amount by adopting the average value;

1-2, data inconsistency processing: when different date forms are used for representing dates, a data time library of Python is used for formatting, and all time formats are unified into date forms of year, month and day; for example: dates within the trade time are "2019/01/07" and "07/01/2019", formatted using the Python datatime library, with all time formats unified to "20190107";

1-3, feature coding: and mapping by using a map, converting the account numbers of the users and the transaction opponents with more than 15 digits into label-encoding (label-encoding), and finally obtaining a transaction sample set. For example, after 100 account numbers are mapped, the number is 0-99, and the transaction account number comprises a bank card number and an account number; the transaction sample set comprises a plurality of pieces of transaction data which are preprocessed through the steps 1-1 to 1-3.

Many fields in the original transaction data have more missing values and abnormal values, and the main purpose of data cleaning is to process dirty data into primarily usable input data.

Preferably, in step (1), the specific steps of extracting the transaction sequence of each user and constructing graph data include:

a. generating a transaction sequence for each user based on the chronological order: obtaining a user set by using unique function of a Pandas library

n is the total number of users, u_i1.... n, representing the ith transaction user; m is the total number of the counter account number of the transaction

j 1.... m, representing the jth transaction-partner account number;

for user u_iIn other words, all the counter-trade account numbers are obtained from the trade sample set, and are sorted in ascending order according to the trade time, and the sequences are recombined into a trade sequence L_i；

With user u_iIs a key, transaction sequence L_iTo build a set of key-value pairs S ═ S _i1.. n }, where s_iIs (u)_i,L_i) (ii) a The key of the key value pair set S is a user, and the value is a transaction sequence and is used for finding the transaction sequence through the user;

b. and (3) constructing graph data: the graph data comprises an adjacency matrix A and a feature matrix X of a graph node;

firstly, in a transaction sample set, a user u is extracted from the same transaction data_iAnd the account number of the transaction opponent

Form a sequence pair

i＝1,...,n，j＝1,...,m；

Then all the sequence pairs are subjected to the duplicate removal operation, and all the sequence pair sets after the duplicate removal are taken as an edge set E of the graph G, wherein E is { E {_i1., m }; all user sets U are used as a node set V, V ═ V _i1, ·, n }; generating an adjacency matrix A E R of a node through a network x library using the edge set E and the node set V^n×nThe adjacency matrix represents the topological structure of a graph by judging whether nodes of the coded graph are connected or not; the user and the transaction counter account are used as nodes, and an edge is added when a transaction exists between any two nodes;

the characteristic matrix X of the graph nodes is a degree matrix D of the nodes, the degree matrix D is a diagonal matrix, the elements on the diagonal are degrees of each node i, and the degree D of each node i_iRepresentation and node v_iNumber of associated edges, D_i＝[d_i]，D_iRepresenting a node v_iThe obtained adjacency matrix A and the feature matrix X of the graph nodes are used as training data of the GAE model.

Preferably, in step (2), the sequence model is used to obtain the user time sequence feature vector, and the transaction sequence L is obtained_iAs a result of being viewed as a sentence,

optimizing each layer of parameters by maximizing the probability of appearance of context nodes in the case of appearance of a central node, comprising the following specific steps:

2-1, preparing training data: firstly, vectorizing a node list by using an OneHotEncoder in a sklern library to obtain a node One-hot vector with a higher dimensionality, wherein the dimensionality of the node One-hot vector is equal to the number of words;

then setting window and skip step size to generate training data, and passing through transaction sequence L_iConstruction of training data, L_i＝{L_i ⁽¹⁾,...,L_i ^(k)}；L_iFor user u_iK is the transaction sequence L, and the superscript 1_iK transaction-to-hand account numbers; setting a window and skip step size, taking a certain node as a central node, constructing a (input, output) form training set, and obtaining training data, wherein output is a context node and output is the central node;

in particular, assume that both the window and step size take 2, from L_i ⁽²⁾Starting as a central node, respectively selecting two nodes on the left side and the right side as window nodes, constructing a training set in the form of (input, output), and obtaining (L) in the form of_i ⁽²⁾,L_i ⁽¹⁾)，(L_i ⁽²⁾,L_i ⁽³⁾)，(L_i ⁽²⁾,L_i ⁽⁴⁾) Three sets of training data;

2-2, constructing a Skip-gram model to obtain a node vector: the Skip-gram model comprises an input layer, a hidden layer and an output layer which are connected in sequence,

inputting a node One-Hot vector by an input layer; the dimensionality of the hidden layer is set according to the user requirement, and the dimensionality of the hidden layer is the number of the hidden layer neurons; the output layer is a softmax classifier, outputs the probability of each node,

calculating a cross entropy loss function, updating model weight parameters by using a gradient descent method, and finally using a weight matrix from an input layer to a hidden layer as a time sequence characteristic R of a node_{Sequence of}＝{d′₁，......d′_m}；

Preferably, in the process of generating the training set in step 2-1, a high-frequency word sampling technique is used to sample vector sequence pairs (input, output) in the training samples, so as to reduce the number of the training samples and solve the problem of overlarge scale of the weight matrix and the training samples;

and by adopting a negative sampling technology, only the weight of each part of the model is updated when each sample is trained, so that the calculation load is reduced.

Preferably, in step (2), the user space feature vector is obtained by using a GAE model, where the GAE model includes an encoder and a decoder; the encoder comprises two layers of GCNs, and the decoder is used for calculating the probability of edges existing between any two nodes and then generating edges to form a reconstructed picture; the method comprises the following specific steps:

a. inputting an adjacency matrix A and a feature matrix X of a graph node at an input layer of the GAE model;

b. two layers of GCN of an encoder perform feature extraction on an adjacency matrix A and a feature matrix X of a graph node to obtain a node embedding vector Z, wherein it is assumed that each input sample adjacency matrix A obeys Gaussian distribution, feature extraction is performed on the adjacency matrix A and the feature matrix X of the graph node through the two layers of GCN, a mean value and a variance are determined, namely a distribution function of the Gaussian distribution is determined, and a reconstructed adjacency matrix is obtained through the distribution function of the Gaussian distribution

The node embedding vector Z satisfies:

Z＝GCN(X，A) (I)，

in the formula (I), GCN represents a graph convolution neural network model, X is a characteristic matrix of a graph node, and A is an adjacent matrix;

c. inputting the node embedding vector Z into a decoder, generating the connection probability of edges by using the decoder, and reconstructing a picture; finally, the reconstructed adjacency matrix is output by the output layer

The calculation formula is as follows:

in formula (II), the superscript T represents transposition, sigma (-) represents sigmoid function, namely output activation function of neuron, which is a common expression symbol in neural network,

representing the reconstructed adjacency matrix;

adopting a loss function L to measure the difference between the reconstructed image and the original image, and enabling the reconstructed image to be closest to the original image by minimizing the loss function L;

inputting an adjacency matrix A of a graph and a feature matrix X of nodes, extracting features of the adjacency matrix A and the feature matrix X of the graph nodes by an encoder with a two-layer GCN structure, calculating the probability of edges existing between any two nodes by using a decoder to generate the graph, measuring the difference between the input graph and the graph generated by GAE by a loss function L, and optimizing W₀，W₁The loss function L is minimized so that the reconstructed graph is closest to the original graph, resulting in a node-embedded vector matrix Z having the spatial characteristics of the graph,

z is a matrix of n rows, and the row vector corresponds to a node;

further preferably, in step b, the two layers of GCN are defined as follows:

in formula (III), ReLU (. cndot.) represents a linear rectification function,

d represents degree matrix, superscript-1/2 represents exponentiation, W₀Representing a first weight matrix, W₁Representing a second weight matrix;

further preferably, in step c, the decoder reconstructs the graph by calculating the probability between nodes, i.e. reconstructs the adjacency matrix:

in formula (IV), Sigmoid (. cndot.) is an activation function, which maps variables between 0 and 1, and if the probability exceeds a threshold, A_ijIs 1, represents that two nodes are connected to finally obtain an adjacency matrix

A_ijRepresenting nodes embedded in elements of the vector matrix Z located in the ith row and jth column, Z_iAnd z_jRespectively embedding nodes into i rows and j rows of a vector matrix;

representing the probability of reconstructing the connection between any two nodes i and j by embedding the vector matrix Z into the known nodes; sigmoid (-) is an activation function, maps variables between 0 and 1, and if the probability exceeds a threshold value, represents that two nodes are connected and corresponds to an adjacency matrix

The middle element is set to be 1,

is a decomposed representation of matrix a;

the loss function is a measure of the distance between the reconstructed picture by the encoder-decoder structure and the original picture:

L＝E_q(Z|X，A)[logp(A|Z) (V)

in formula (V), L represents a loss function, and Eq (. cndot.) represents a desired distribution;

training GAE by using random gradient descent, finishing the loss function convergence training, and finally obtaining a low-dimensional node embedding vector matrix Z of the nodes;

by optimizing W₀，W₁And minimizing the loss function L, so that the reconstructed graph is closest to the original graph to obtain a low-dimensional node embedding vector matrix Z, and the low-dimensional node embedding vector matrix Z has the spatial characteristics of the graph.

Minimizing L by W requires a gradient of L to W, and then optimizing L using a gradient descent method to minimize L.

In the data preprocessing stage, an adjacency matrix A of a transaction graph and a feature matrix X of a node are generated, the feature matrix X contains degree information of the node, and the module encodes a space representation vector of the node through a GAE model, namely the space representation vector contains the feature of the node and the feature of a neighbor node.

Preferably, in step (3), the distance between each two nodes is calculated and used as the weight of the edge to obtain the group of each node, and the group mark of the node is output, and the method specifically comprises the following steps:

3-1, first, the vector R is represented by the nodes generated in step 2_iCalculating the distance between any two nodes in the graph data structure, and taking the calculated distance as the weight of the edge, wherein the larger the distance is, the farther the distance between the two nodes is; then each node in the graph data structure is distributed to a single group, the nodes in the network are continuously traversed, the change situation of the module degree caused by the node joining the neighbor group is compared, the node is selected to be joined to the group which can increase the compactness to the maximum,

the modularity Q defines a function as:

in the formula (VI), Q represents the modularity, m is the sum of the weights of all sides, W_ijRepresents the weight between node i and node j, k_iRepresents the sum of the weights, k, of the edges connected to node i_jRepresents the sum of the weights of the edges connected to node j, c_iAs a group to which node i belongs, c_jIs the group to which node j belongs, (c)_i，c_j) For an illustrative function, if ci and cj are the same group, 1, otherwise 0;

3-2, merging all nodes belonging to the same group into a new node to construct a hypergraph;

3-3, repeating the step 3-1 and the step 3-2 to obtain the final grouping and generating (u)_i，c_i) Party mark of c_iIs the group to which the node i belongs.

The realization device of the group partner detection method based on the financial transaction network comprises the following steps:

the data preprocessing module is used for carrying out data cleaning on transaction data, extracting a transaction sequence of each user and constructing graph data, and is used for executing the step (1);

the user characteristic vector generation module is used for acquiring a user time sequence characteristic vector by using a sequence model, acquiring a user space characteristic vector by using a GAE model, normalizing the user time sequence characteristic vector and the space characteristic vector respectively and connecting the user time sequence characteristic vector and the space characteristic vector for executing the step (2);

and the group detection module is used for calculating the group of each node and outputting the group mark of the node for executing the step (3).

The invention has the beneficial effects that:

1. the invention mainly provides a group detection method based on the combination of time series characteristics and space structure characteristics of nodes. The method utilizes basic characteristics of users, counter-trading account numbers, trading time and the like in original financial trading flow information data, extracts time sequence characteristics and space structure characteristics in a self-adaptive mode through a sequence model and a GAE model, finally calculates the distance between every two nodes as weight through connection characteristics, and can allocate each user to potential groups through a group detection algorithm based on modularity optimization.

2. The invention mainly aims to provide an auxiliary decision making system for case handling personnel, features are automatically extracted based on a Skip-gram model and a GAE model, manpower is greatly released, and the generated ganging marks can also be used for tracking potential suspects.

3. The group partner detection method based on the financial transaction network provided by the invention has the advantages that the flow is full-automatic, any person can obtain a final desired result by inputting original data with few fields, the working efficiency is improved, and a large amount of time is saved. Along with the improvement of the input transaction data quantity, the quantity of automatically constructed training data is increased, and the accuracy of the model is further improved.

Drawings

Fig. 1 is a data flow diagram of a group partner detection method based on a financial transaction network according to the present invention.

FIG. 2 is a schematic diagram of the structure of a sequence model.

FIG. 3 is a schematic diagram of the structure of the GAE model.

Fig. 4 is a flowchart of a group partner detection method based on a financial transaction network according to the present invention.

Detailed Description

The invention is further described below, but not limited thereto, with reference to the following examples and the accompanying drawings.

Example 1

A group detection method based on financial transaction network, as shown in fig. 1 and 4, comprising:

(1) data preprocessing: performing data cleaning on the transaction data, extracting a transaction sequence of each user and constructing graph data;

in the step (1), the transaction data includes a user, a transaction counter account, transaction time and transaction amount, and the specific steps of performing data cleaning on the transaction data include:

1-1, missing value filling: if any field of a user, a transaction counter account and transaction time of certain transaction data is missing, discarding the transaction data;

if only the transaction amount in certain transaction data has field loss, filling by adopting an average filling method, namely calculating the average value of all transaction amounts of the current user, and filling the transaction amount by adopting the average value;

1-2, data inconsistency processing: when different date forms are used for representing dates, a data time library of Python is used for formatting, and all time formats are unified into date forms of year, month and day; for example: dates within the trade time are "2019/01/07" and "07/01/2019", formatted using the Python datatime library, with all time formats unified to "20190107";

1-3, feature coding: and mapping by using a map, converting the account numbers of the users and the transaction opponents with more than 15 digits into label-encoding (label-encoding), and finally obtaining a transaction sample set. For example, after 100 account numbers are mapped, the number is 0-99, and the transaction account number comprises a bank card number and an account number; the transaction sample set comprises a plurality of pieces of transaction data which are preprocessed through the steps 1-1 to 1-3.

Many fields in the original transaction data have more missing values and abnormal values, and the main purpose of data cleaning is to process dirty data into primarily usable input data.

In the step (1), the specific steps of extracting the transaction sequence of each user and constructing graph data include:

a. generating a transaction sequence for each user based on the chronological order: obtaining a user set by using unique function of a Pandas library

n is the total number of users, u _i1.... n, representing the ith transaction user; m is the total number of the counter account number of the transaction

j 1.... m, representing the jth transaction-partner account number;

for user u_iIn other words, all the counter-trade account numbers are obtained from the trade sample set, and are sorted in ascending order according to the trade time, and the sequences are recombined into a trade sequence L_i；

With user u_iIs a key, transaction sequence L_iTo build a set of key-value pairs S ═ S _i1.. n }, where s_iIs (u)_i,L_i) (ii) a The key of the key value pair set S is a user, and the value is a transaction sequence and is used for finding the transaction sequence through the user;

b. and (3) constructing graph data: the graph data comprises an adjacency matrix A and a feature matrix X of a graph node;

firstly, in a transaction sample set, a user u is extracted from the same transaction data_iAnd the account number of the transaction opponent

Form a sequence pair

i＝1,...,n，j＝1,...,m；

Then all the sequence pairs are subjected to duplicate removal operationAll the order pair sets after the duplication removal are used as an edge set E of the graph G, and E is equal to { E {_i1., m }; all user sets U are used as a node set V, V ═ V _i1, ·, n }; generating an adjacency matrix A E R of a node through a network x library using the edge set E and the node set V^n×nThe adjacency matrix represents the topological structure of a graph by judging whether nodes of the coded graph are connected or not; the user and the transaction counter account are used as nodes, and an edge is added when a transaction exists between any two nodes;

the characteristic matrix X of the graph nodes is a degree matrix D of the nodes, the degree matrix D is a diagonal matrix, the elements on the diagonal are degrees of each node i, and the degree D of each node i_iRepresentation and node v_iNumber of associated edges, D_i＝[d_i]，D_iRepresenting a node v_iDegree of (c).

The obtained adjacency matrix A and the feature matrix X of the graph nodes are used as training data of the GAE model.

(2) Generating a user feature vector: acquiring a user time sequence characteristic vector by using a sequence model, and acquiring a user space characteristic vector by using a GAE model; respectively normalizing the user time sequence characteristic vector and the space characteristic vector, performing connection operation, and generating a node expression vector

d′₁，......d′_mRepresenting the normalized user timing feature vector,

representing the normalized spatial feature vector;

in the step (2), the sequence model is used for obtaining the user time sequence characteristic vector, and the transaction sequence L is processed_iAs a result of being viewed as a sentence,

optimizing each layer of parameters by maximizing the probability of occurrence of context nodes in the case of occurrence of a central node, the specific steps comprising:

2-1, preparing training data: firstly, vectorizing a node list by using an OneHotEncoder in a sklern library to obtain a node One-hot vector with a higher dimensionality, wherein the dimensionality of the node One-hot vector is equal to the number of words;

then setting window and skip step size to generate training data, and passing through transaction sequence L_iConstruction of training data, L_i＝{L_i ⁽¹⁾,...,L_i ^(k)}；L_iFor user u_iK is the transaction sequence L, and the superscript 1_iK transaction-to-hand account numbers; setting a window and skip step size, taking a certain node as a central node, constructing a training set in an (input, output) form, and obtaining training data;

in particular, assume that both the window and step size take 2, from L_i ⁽²⁾Starting as a central node, respectively selecting two nodes on the left side and the right side as window nodes, constructing a training set in the form of (input, output), and obtaining (L) in the form of_i ⁽²⁾,L_i ⁽¹⁾)，(L_i ⁽²⁾,L_i ⁽³⁾)，(L_i ⁽²⁾,L_i ⁽⁴⁾) Three sets of training data;

in the process of generating the training set in the step 2-1, a high-frequency word sampling technology is used for sampling vector sequence pairs (input, output) in the training samples so as to reduce the number of the training samples and solve the problem that the weight matrix and the training samples are overlarge in scale;

and by adopting a negative sampling technology, only the weight of each part of the model is updated when each sample is trained, so that the calculation load is reduced.

2-2, constructing a Skip-gram model to obtain a node vector: the Skip-gram model comprises an input layer, a hidden layer and an output layer which are connected in sequence,

inputting a node One-Hot vector by an input layer; the dimensionality of the hidden layer is set according to the user requirement, and the dimensionality of the hidden layer is the number of the hidden layer neurons; the output layer is a softmax classifier, outputs the probability of each node,

calculating cross entropy loss function, updating model weight parameters by using gradient descent method, and finally using inputLayer-to-hidden layer weight matrix as timing characteristic R of node_{Sequence of}＝{d′₁，......d′_m}；

In the step (2), a GAE model is used to obtain the user space feature vector, wherein the GAE model comprises an encoder and a decoder; the encoder comprises two layers of GCNs, and the decoder is used for calculating the probability of edges existing between any two nodes and then generating edges to form a reconstructed picture; the method comprises the following specific steps:

a. inputting an adjacency matrix A and a feature matrix X of a graph node at an input layer of the GAE model;

b. two layers of GCN of an encoder perform feature extraction on an adjacency matrix A and a feature matrix X of a graph node to obtain a node embedding vector Z, wherein it is assumed that each input sample adjacency matrix A obeys Gaussian distribution, feature extraction is performed on the adjacency matrix A and the feature matrix X of the graph node through the two layers of GCN, a mean value and a variance are determined, namely a distribution function of the Gaussian distribution is determined, and a reconstructed adjacency matrix is obtained through the distribution function of the Gaussian distribution

The node embedding vector Z satisfies:

Z＝GCN(X，A) (I)，

in the formula (I), GCN represents a graph convolution neural network model, X is a characteristic matrix of a graph node, and A is an adjacent matrix;

c. inputting the node embedding vector Z into a decoder, generating the connection probability of edges by using the decoder, and reconstructing a picture; finally, the reconstructed adjacency matrix is output by the output layer

The calculation formula is as follows:

in formula (II), the superscript T represents transposition, sigma (-) represents sigmoid function, namely output activation function of neuron, which is a common expression symbol in neural network,

representing the reconstructed adjacency matrix;

adopting a loss function L to measure the difference between the reconstructed image and the original image, and enabling the reconstructed image to be closest to the original image by minimizing the loss function L;

inputting an adjacency matrix A of a graph and a feature matrix X of nodes, extracting features of the adjacency matrix A and the feature matrix X of the graph nodes by an encoder with a two-layer GCN structure, calculating the probability of edges existing between any two nodes by using a decoder to generate the graph, measuring the difference between the input graph and the graph generated by GAE by a loss function L, and optimizing W₀，W₁The loss function L is minimized so that the reconstructed graph is closest to the original graph, resulting in a node-embedded vector matrix Z having the spatial characteristics of the graph,

z is a matrix of n rows, and the row vector corresponds to a node;

further, in step b, the definition of the two layers of GCN is as follows:

in formula (III), ReLU (. cndot.) represents a linear rectification function,

d represents degree matrix, superscript-1/2 represents exponentiation, W₀Representing a first weight matrix, W₁Representing a second weight matrix;

further, in step c, the decoder reconstructs the graph by calculating the probability between the nodes, i.e. reconstructs the adjacency matrix:

in formula (IV), Sigmoid (. cndot.) is an activation function and will changeThe quantity maps between 0 and 1, if the probability exceeds a threshold, then A_ijIs 1, represents that two nodes are connected to finally obtain an adjacency matrix

A_ijRepresenting nodes embedded in elements of the vector matrix Z located in the ith row and jth column, Z_iAnd z_jRespectively embedding nodes into i rows and j rows of a vector matrix;

representing the probability of reconstructing the connection between any two nodes i and j by embedding the vector matrix Z into the known nodes; sigmoid (-) is an activation function, maps variables between 0 and 1, and if the probability exceeds a threshold value, represents that two nodes are connected and corresponds to an adjacency matrix

The middle element is set to be 1,

is a decomposed representation of matrix a;

the loss function is a measure of the distance between the reconstructed picture by the encoder-decoder structure and the original picture:

L＝E_q(Z|x，A)[logp(A|Z) (V)

in formula (V), L represents a loss function, and Eq (. cndot.) represents a desired distribution;

training GAE by using random gradient descent, finishing the loss function convergence training, and finally obtaining a low-dimensional node embedding vector matrix Z of the nodes;

by optimizing W₀，W₁And minimizing the loss function L, so that the reconstructed graph is closest to the original graph to obtain a low-dimensional node embedding vector matrix Z, and the low-dimensional node embedding vector matrix Z has the spatial characteristics of the graph.

Minimizing L by W requires a gradient of L to W, and then optimizing L using a gradient descent method to minimize L.

In the data preprocessing stage, an adjacency matrix A of a transaction graph and a feature matrix X of a node are generated, the feature matrix X contains degree information of the node, and the module encodes a space representation vector of the node through a GAE model, namely the space representation vector contains the feature of the node and the feature of a neighbor node.

(3) Group detection: and calculating the group to which each node belongs and outputting a group mark of the node.

The step can be applied to the existing algorithms such as K-means, KNN and the like based on clustering and community detection algorithms of characteristic space distance;

in this example, in the step (3), the distance between each two nodes is calculated based on the euclidean distance, and the calculated distance is used as the weight of the edge to obtain the group to which each node belongs, and the specific steps include:

3-1, first, the vector R is represented by the nodes generated in step 2_iCalculating the distance between any two nodes in the graph data structure, and taking the calculated distance as the weight of the edge, wherein the larger the distance is, the farther the distance between the two nodes is; then each node in the graph data structure is distributed to a single group, the nodes in the network are continuously traversed, the change situation of the module degree caused by the node joining the neighbor group is compared, the node is selected to be joined to the group which can increase the compactness to the maximum,

the modularity Q defines a function as:

in the formula (VI), Q represents the modularity, m is the sum of the weights of all sides, W_ijRepresents the weight between node i and node j, k_iRepresents the sum of the weights, k, of the edges connected to node i_jRepresents the sum of the weights of the edges connected to node j, c_iAs a group to which node i belongs, c_jIs the group to which node j belongs, (c)_i，c_j) For an illustrative function, if ci and cj are the same group, 1, otherwise 0;

3-2, merging all nodes belonging to the same group into a new node to construct a hypergraph;

3-3, repeating the step 3-1 and the step 3-2 to obtain the final grouping and generating (u)_i，c_i) Party mark of c_iIs the group to which the node i belongs.

The invention mainly provides a group detection method based on the combination of time sequence characteristics and space structure characteristics of nodes. The method utilizes basic characteristics of a transaction account number, a transaction counter account number, transaction time and the like in original financial transaction flow information data, extracts time sequence characteristics and space structure characteristics in a self-adaptive mode through a sequence skip-gram model and a GAE model, calculates the distance between every two nodes as weight by using connection characteristics, and can distribute each user to potential groups by using a group detection algorithm based on modularity optimization. The method reduces the workload of artificial characteristic engineering and fully utilizes the time sequence and spatial characteristics of the transaction diagram.

Example 2

An implementation apparatus of a group partner detection method for a financial transaction network provided in embodiment 1 includes:

the data preprocessing module is used for carrying out data cleaning on transaction data, extracting a transaction sequence of each user and constructing graph data, and is used for executing the step (1);

the user characteristic vector generation module is used for acquiring a user time sequence characteristic vector by using a sequence model, acquiring a user space characteristic vector by using a GAE model, normalizing the user time sequence characteristic vector and the space characteristic vector respectively and connecting the user time sequence characteristic vector and the space characteristic vector for executing the step (2);

and the group detection module is used for calculating the group of each node and outputting the group mark of the node for executing the step (3).

Claims (10)

1. A group partner detection method based on a financial transaction network, comprising:

(1) data preprocessing: performing data cleaning on the transaction data, extracting a transaction sequence of each user and constructing graph data;

(2) generating a user feature vector: using sequential modesAcquiring a user time sequence characteristic vector, and acquiring a user space characteristic vector by using a GAE model; respectively normalizing the user time sequence characteristic vector and the space characteristic vector, performing connection operation, and generating a node expression vector

d′₁,……d′_mRepresenting the normalized user timing feature vector,

representing the normalized spatial feature vector;

(3) group detection: and calculating the group to which each node belongs and outputting a group mark of the node.

2. The group partner detecting method based on the financial transaction network as claimed in claim 1, wherein in the step (1), the transaction data includes a user, a counter-party account number, a transaction time and a transaction amount, and the step of performing data cleansing on the transaction data includes:

1-1, missing value filling: if any field of a user, a transaction counter account and transaction time of certain transaction data is missing, discarding the transaction data;

if only the transaction amount in certain transaction data has field loss, filling by adopting an average filling method, namely calculating the average value of all transaction amounts of the current user, and filling the transaction amount by adopting the average value;

1-2, data inconsistency processing: when different date forms are used for representing dates, a data time library of Python is used for formatting, and all time formats are unified into date forms of year, month and day;

1-3, feature coding: and mapping by using a map, converting the account numbers of the users and the transaction opponents with more than 15 digits into label-encoding (label-encoding), and finally obtaining a transaction sample set.

3. The group detection method based on financial transaction network as claimed in claim 1, wherein in the step (1), the specific steps of extracting the transaction sequence and constructing graph data of each user comprise:

a. generating a transaction sequence for each user based on the chronological order: obtaining a user set by using unique function of a Pandas library

n is the total number of users, u_i1, … …, n, representing the ith trading user; m is the total number of the counter account number of the transaction

Represents the jth transaction partner account number;

for user u_iIn other words, all the counter-trade account numbers are obtained from the trade sample set, and are sorted in ascending order according to the trade time, and the sequences are recombined into a trade sequence L_i；

With user u_iIs a key, transaction sequence L_iTo build a set of key-value pairs S ═ S_i1.. n }, where s_iIs (u)_i,L_i) (ii) a The key of the key-value pair set S is a user, and the value is a transaction sequence and is used for finding the transaction sequence through the user;

b. and (3) constructing graph data: the graph data comprises an adjacency matrix A and a feature matrix X of a graph node;

firstly, in a transaction sample set, a user u is extracted from the same transaction data_iAnd the account number of the transaction opponent

Form a sequence pair

Then all the sequence pairs are subjected to the duplicate removal operation, and all the sequence pair sets after the duplicate removal are taken as an edge set E of the graph G, wherein E is { E {_i1., m }; all user sets U are used as a node set V, V ═ V_i1, ·, n }; generating an adjacency matrix A E R of a node through a network x library using the edge set E and the node set V^n×nThe adjacency matrix represents the topological structure of a graph by judging whether nodes of the coded graph are connected or not; the user and the transaction counter account are used as nodes, and an edge is added when a transaction exists between any two nodes;

the characteristic matrix X of the graph nodes is a degree matrix D of the nodes, the degree matrix D is a diagonal matrix, the elements on the diagonal are degrees of each node i, and the degree D of each node i_iRepresentation and node v_iNumber of associated edges, D_i＝[d_i]，D_iRepresenting a node v_iThe obtained adjacency matrix A and the feature matrix X of the graph nodes are used as training data of the GAE model.

4. The method as claimed in claim 1, wherein in the step (2), the user time sequence feature vector is obtained by using a sequence model, and the transaction sequence L is converted into the transaction sequence L_iAs a result of being viewed as a sentence,

optimizing each layer of parameters by maximizing the probability of occurrence of context nodes in the case of occurrence of a central node, the specific steps comprising:

2-1, preparing training data: firstly, vectorizing a node list by using an OneHotEncoder in a sklern library to obtain a node One-hot vector with a higher dimensionality, wherein the dimensionality of the node One-hot vector is equal to the number of words;

then setting window and skip step size to generate training data, and passing through transaction sequence L_iConstruction of training data, L_i＝{L_i ⁽¹⁾,...,L_i ^(k)}；L_iFor user u_iK is the transaction sequence L, and the superscript 1_iK transaction partner account numbers; setting a window and skip step size, taking a certain node as a central node, and constructing a training set in an (input, output) form to obtain training data;

2-2, constructing a Skip-gram model to obtain a node vector: the Skip-gram model comprises an input layer, a hidden layer and an output layer which are connected in sequence,

inputting a node One-Hot vector by an input layer; the dimension of the hidden layer is the number of neurons of the hidden layer; the output layer is a softmax classifier, outputs the probability of each node,

calculating a cross entropy loss function, updating model weight parameters by using a gradient descent method, and finally using a weight matrix from an input layer to a hidden layer as a time sequence characteristic R of a node_{Sequence of}＝{d′₁,……d′_m}。

5. The method for group detection based on financial transaction network as claimed in claim 4, wherein in the step 2-1, the vector order pairs (input, output) in the training samples are sampled by using high frequency word sampling technique; with the negative sampling technique, only each partial model weight is updated as each sample is trained.

6. The financial transaction network-based group partner detecting method according to claim 1, wherein in the step (2), the user space feature vector is obtained by using a GAE model, the GAE model comprises an encoder and a decoder; the encoder comprises two layers of GCNs, and the decoder is used for calculating the probability of edges existing between any two nodes and then generating edges to form a reconstructed picture; the method comprises the following specific steps:

a. inputting an adjacency matrix A and a feature matrix X of a graph node at an input layer of the GAE model;

b. two layers of GCN of the encoder extract the characteristics of the adjacent matrix A and the characteristic matrix X of the graph nodes to obtain a node embedding vector Z, and the node embedding vector Z meets the following requirements:

Z＝GCN(X,A) (I)，

in the formula (I), GCN represents a graph convolution neural network model, X is a characteristic matrix of a graph node, and A is an adjacent matrix;

c. the node embedding vector Z is input to a decoder, and the graph is reconstructed using the connection probability of the decoder generated edges(ii) a Finally, outputting the reconstructed adjacency matrix by the output layer

The calculation formula is as follows:

in formula (II), the superscript T denotes transpose, σ (-) denotes sigmoid function, i.e. the output activation function of the neuron,

representing the reconstructed adjacency matrix;

adopting a loss function L to measure the difference between the reconstructed image and the original image, and enabling the reconstructed image to be closest to the original image by minimizing the loss function L;

inputting an adjacency matrix A of a graph and a feature matrix X of nodes, performing feature extraction on the adjacency matrix A and the feature matrix X of the graph nodes through an encoder with a two-layer GCN structure, calculating the probability of edges existing between any two nodes by using a decoder to generate the graph, measuring the difference between the input graph and the graph generated by GAE through a loss function L, and optimizing W₀，W₁So as to minimize the loss function L and obtain a node embedded vector matrix Z having the spatial characteristics of the graph,

z is a matrix of n rows, the row vector corresponding to a node.

7. The method as claimed in claim 6, wherein in the step b, the two-layer GCN is defined as follows:

in the formula (III), ReLU (. smallcircle.) represents a lineA function of a linear rectification,

d represents degree matrix, superscript-1/2 represents exponentiation, W₀Representing a first weight matrix, W₁Representing a second weight matrix.

8. The method as claimed in claim 6, wherein the decoder reconstructs the graph by calculating the probability between nodes, i.e. reconstructs the adjacency matrix:

in formula (IV), Sigmoid (. cndot.) is an activation function, which maps variables between 0 and 1, and if the probability exceeds a threshold, A_ijIs 1, represents that two nodes are connected to obtain the adjacency matrix

A_ijRepresenting the node embedded in an element of the vector matrix Z located in the ith row and jth column, Z_iAnd z_jRespectively embedding nodes into i rows and j rows of a vector matrix;

representing the probability of reconstructing the connection between any two nodes i and j by embedding the vector matrix Z into the known nodes; sigmoid (-) is an activation function, maps variables between 0 and 1, and if the probability exceeds a threshold value, represents that two nodes are connected and corresponds to an adjacency matrix

The middle element is set to be 1,

is a decomposed representation of matrix a;

the loss function is a measure of the distance between the reconstructed picture by the encoder-decoder structure and the original picture:

L＝E_q(Z|X,A)[logp(A|Z) (V)

in formula (V), L represents a loss function, and Eq (. cndot.) represents a desired distribution;

training GAE by using random gradient descent, finishing the loss function convergence training, and finally obtaining a low-dimensional node embedding vector matrix Z of the nodes;

by optimizing W₀，W₁And minimizing the loss function L, so that the reconstructed graph is closest to the original graph to obtain a low-dimensional node embedding vector matrix Z, and the low-dimensional node embedding vector matrix Z has the spatial characteristics of the graph.

9. The group detection method based on the financial transaction network as claimed in claim 1, wherein in the step (3), the distance between each two nodes is calculated and used as the weight of the edge to obtain the group to which each node belongs, and the group mark of the node is output, and the specific steps include:

3-1, first, the vector R is represented by the nodes generated in step 2_iCalculating the distance between any two nodes in the graph data structure, taking the calculated distance as the weight of an edge, then distributing each node in the graph data structure to a single group, continuously traversing the nodes in the network, comparing the modularity change condition caused by the node joining the neighbor group, selecting the node to join the group which can increase the compactness to the maximum,

the modularity Q defines a function as:

in the formula (VI), Q represents the modularity, m is the sum of the weights of all sides, W_ijRepresents the weight between node i and node j, k_iRepresents the sum of the weights, k, of the edges connected to node i_jRepresents the sum of the weights of the edges connected to node j, c_iAs a group to which node i belongs, c_jIs the group to which node j belongs, (c)_i,c_j) For an illustrative function, if ci and cj are the same group, 1, otherwise 0;

3-2, merging all nodes belonging to the same group into a new node to construct a hypergraph;

3-3, repeating the step 3-1 and the step 3-2 to obtain the final grouping and generating (u)_i,c_j) Party mark of c_iIs the group to which the node i belongs.

10. An apparatus for implementing a group partner detection method of a financial transaction network as claimed in any one of claims 1 to 9, comprising:

the data preprocessing module is used for carrying out data cleaning on transaction data, extracting a transaction sequence of each user and constructing graph data, and is used for executing the step (1);

the user characteristic vector generation module is used for acquiring a user time sequence characteristic vector by using a sequence model, acquiring a user space characteristic vector by using a GAE model, normalizing the user time sequence characteristic vector and the space characteristic vector respectively and connecting the user time sequence characteristic vector and the space characteristic vector for executing the step (2);

and the group detection module is used for calculating the group of each node and outputting the group mark of the node for executing the step (3).

Images