CN112561703A - Method and system for depicting local relationship network based on asynchronous network depiction and real-time feature extraction - Google Patents
Method and system for depicting local relationship network based on asynchronous network depiction and real-time feature extraction Download PDFInfo
- Publication number
- CN112561703A CN112561703A CN202011545629.6A CN202011545629A CN112561703A CN 112561703 A CN112561703 A CN 112561703A CN 202011545629 A CN202011545629 A CN 202011545629A CN 112561703 A CN112561703 A CN 112561703A
- Authority
- CN
- China
- Prior art keywords
- target
- user
- network
- risk
- relationship network
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q40/00—Finance; Insurance; Tax strategies; Processing of corporate or income taxes
- G06Q40/04—Trading; Exchange, e.g. stocks, commodities, derivatives or currency exchange
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q10/00—Administration; Management
- G06Q10/06—Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
- G06Q10/063—Operations research, analysis or management
- G06Q10/0635—Risk analysis of enterprise or organisation activities
Abstract
The present disclosure provides a method and system for real-time characterization of a local relationship network. The method analyzes the user transaction characteristics and risk levels in the funds transfer network by implementing the receiving of user operational data. And comprehensively judging the money laundering risk of the user by a money laundering transaction identification method of asynchronous network analysis and synchronous real-time characteristic calculation. Money laundering transactions can be stopped efficiently and quickly, and more money laundering accounts can be collected.
Description
Technical Field
The present disclosure relates to the field of computer technologies, and in particular, to a method and a system for real-time depicting a local relationship network, and a non-transitory storage medium.
Background
Money laundering refers to the act of a criminal transferring, exchanging, purchasing or directly investing in money illegally obtained by a bank or other financial institutions, thereby compressing and concealing illegal sources and properties thereof and legalizing illegal assets.
The rise of mobile payment has led to great improvements in people's daily life. The financial service platform is becoming more powerful, and some lawbreakers are using the financial service platform as a black money washing tool. Money laundering transaction, large fund amount and obvious aggregation of fund network. The payer is used as a third-party payment mechanism, and the presented fund network is only a subgraph in the large money laundering network. The graph calculation consumes a great deal of computing resources, and in the real-time risk identification, the current risk transaction information is obtained, and the full-amount fund transaction is difficult to analyze under the limited computing resources and the limited information; the money laundering account has few samples, and only the limited sample resources of a supervision agency or a law enforcement agency can be obtained, but the sample has obvious hysteresis.
Therefore, it is necessary to develop a backwashing money-saving system, which can effectively suppress the money-saving transaction in real time and increase the number of money-saving samples.
Disclosure of Invention
In order to solve the problem that criminals use financial platforms to wash black money, the disclosure discloses a real-time depiction method for backwashing a local relationship network of black money.
The present disclosure provides a method for real-time characterization of a new local relationship network, a system for performing the method, and a non-transitory storage medium having stored thereon instructions for performing the method. The system and method construct a money network of black money laundering according to known money transaction transactions of money laundering accounts, take the current accounts meeting conditions as money network nodes, and output risk levels of accounts in the money network accounts. And (3) combining the accounts with one or more anomalies such as transaction media, fund flow, transaction behaviors and fund aggregation with the risk level in the fund network to judge the comprehensive risk level of the accounts.
One aspect of the present disclosure provides a real-time depicting method of a local relationship network, including: identifying candidate users with target characteristics based on data of current business operation performed by a plurality of users on a target platform, wherein part of the users on the target platform are part of nodes in a target relation network; acquiring target data related to the current business operation of the candidate user in a target relational network from an asynchronous network characterization platform, wherein the asynchronous network characterization platform and the target platform run asynchronously and store local information of the target relational network; determining the candidate user as a node in the target relationship network based on the target data and the target characteristics; and taking the candidate user as a target user to send the identity information of the candidate user to the asynchronous network characterization platform.
In some embodiments, the target relationship network is constructed by the following asynchronous steps: setting nodes in a predetermined target relationship network node list as 0-layer nodes in the target relationship network; and for each node in the target relationship network: acquiring a related user which has a target service operation with the node on a target platform, and determining the related user as a node adjacent to the node when the target service operation meets a preset condition.
In some embodiments, the preset condition includes that the ratio of the target service operation to all service operations of the associated user is greater than a threshold value.
In some embodiments, the current operation of the candidate user is associated with at least one target node in the target relationship network; and the target data of the target relationship network comprises a target index of the at least one target node.
In some embodiments, the determining the candidate user as a node in the target relationship network further comprises: obtaining a white list, wherein the white list comprises a plurality of registered users on the target platform; judging that the candidate user is in the white list; and determining the candidate user as a node outside the target relationship network.
In some embodiments, said determining said candidate user as a node in said target relationship network based on said target data and target characteristics further comprises: determining a risk level of the target user, wherein the target user information comprises identity data of the target user and the risk level of the target user.
In some embodiments, the target relationship network comprises a funds transfer network; the business operation comprises a fund transfer operation of a transaction; the target characteristics include one or more of transaction media characteristics, fund flow characteristics, transaction behavior characteristics, and aggregation characteristics of the transaction.
In some embodiments, the funds-transfer network is a money laundering network; the target index is an account network fund risk level of the at least one target node; the transaction medium characteristic comprises a transaction medium anomaly; the fund flow feature comprises a fund anomaly; the transaction behavior characteristics comprise transaction behavior anomalies; and the aggregation characteristic comprises an abnormal aggregation.
In some embodiments, the determining the risk level of the target user includes determining that the transaction media characteristic is a media anomaly and the distance of the target user from a nearest node in the target relationship network is less than a first threshold, then determining that the risk level of the target user is a first-level risk; determining that the transaction medium characteristic is medium abnormality and the distance between the target user and the nearest node in the target relationship network is greater than a first threshold and smaller than a second threshold, and determining that the risk level of the target user is a secondary risk; determining that the transaction medium characteristic is medium abnormity, the transaction behavior belongs to behavior abnormity, and the distance between the target user and the nearest node in the target relationship network is greater than a second threshold and less than a third threshold, and determining that the risk level of the target user is a third-level risk; determining that the transaction medium characteristic is medium abnormity, the transaction behavior belongs to abnormal behavior, and the distance between the target user and the nearest node in the target relationship network is greater than a third threshold and less than a fourth threshold, and determining that the risk level of the target user is a four-level risk; or otherwise, determining the risk level of the target user as five-level risk.
In some embodiments, the determining that the candidate user is a node in the target relationship network comprises determining that the primary-risk user is a node in the target relationship network.
In some embodiments, the method for characterizing a local relationship network further comprises: interrupting the ongoing business operation of the user at the first-level risk, permanently limiting the business operation of the user at the first-level risk, and inputting a blacklist library by the user at the first-level risk; interrupting the business operation performed by the user at the secondary risk, and limiting the user at the secondary risk to perform the business operation within a preset time; interrupting the business operation which is carried out by the user with the third-level risk, and prompting that the business operation has risk; allowing the business operation of the user with the four-level risk to be carried out, and simultaneously pushing safety prompt information; and allowing the business operations being performed by the users with the five-level risk.
Another aspect of the present disclosure provides an apparatus for real-time depiction of a local relationship network, including: at least one storage medium comprising at least one instruction set for real-time characterization of a local relationship network; and at least one processor communicatively coupled to the at least one storage medium. When the system is in operation, the at least one processor reads the at least one instruction set and executes the method of real-time characterization of the local relationship network according to the instructions of the at least one instruction set.
According to the technical scheme, the local relationship network real-time depicting method, the system for executing the method and the non-transitory storage medium storing the instructions for executing the method are provided by the disclosure. The system and the method construct the money network for washing black money according to the known money transaction exchange of the money account for washing black money, and the transaction exchange account meeting the conditions is used as a money transfer network node. And (3) determining the comprehensive risk level of the account by combining the account in one or more anomalies such as transaction medium, fund flow, transaction behavior, fund aggregation and the like with the risk level of the transaction parties in the fund network.
Additional functions of the method, system, and storage medium for real-time characterization of local relationship networks provided by the present disclosure will be set forth in part in the description that follows. The following numerical and exemplary descriptions will be readily apparent to those of ordinary skill in the art in view of the description. The inventive aspects of the method, system, and storage medium for pushing information provided by the present disclosure may be fully explained by the practice or use of the methods, apparatus, and combinations described in the detailed examples below.
Drawings
In order to more clearly illustrate the technical solutions in the embodiments of the present disclosure, the drawings needed to be used in the description of the embodiments are briefly introduced below, and it is obvious that the drawings in the following description are only some embodiments of the present disclosure, and it is obvious for those skilled in the art to obtain other drawings based on the drawings without creative efforts.
FIG. 1 illustrates a system diagram of a local relationship network real-time depiction in accordance with some embodiments of the present disclosure;
FIG. 2 illustrates a schematic diagram of a server in real-time depiction of a local relationship network, in accordance with some embodiments of the present disclosure;
FIG. 3 illustrates a method flow diagram of a method for real-time characterization of a local relationship network, provided in accordance with some embodiments of the present disclosure;
FIG. 4 illustrates a block diagram of a relationship network provided in accordance with some embodiments of the present disclosure;
fig. 5 illustrates a system flow diagram of a method for real-time characterization of a local relationship network, provided in accordance with some embodiments of the present disclosure.
Detailed Description
The following description is presented to enable any person skilled in the art to make and use the present disclosure, and is provided in the context of a particular application and its requirements. Various local modifications to the disclosed embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other embodiments and applications without departing from the spirit and scope of the present disclosure. Thus, the present disclosure is not to be limited to the embodiments shown, but is to be accorded the widest scope consistent with the claims.
The terminology used herein is for the purpose of describing particular example embodiments only and is not intended to be limiting. For example, as used herein, the singular forms "a", "an" and "the" may include the plural forms as well, unless the context clearly indicates otherwise. The terms "comprises," "comprising," and/or "including," when used in this specification, mean that the associated integers, steps, operations, elements, and/or components are present, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and/or groups thereof.
These and other features of the present disclosure, as well as the operation and function of the related elements of the structure, and the combination of parts and economies of manufacture, may be particularly improved upon in view of the following description. All of which form a part of the present disclosure, with reference to the accompanying drawings. It is to be expressly understood, however, that the drawings are for the purpose of illustration and description only and are not intended as a definition of the limits of the disclosure. It should also be understood that the drawings are not drawn to scale.
The flow diagrams used in this disclosure illustrate system-implemented operations according to some embodiments of the disclosure. It should be clearly understood that the operations of the flow diagrams may be performed out of order. Rather, the operations may be performed in reverse order or simultaneously. In addition, one or more other operations may be added to the flowchart. One or more operations may be removed from the flowchart.
FIG. 1 illustrates a schematic diagram of a system 100 for real-time characterization of a local relationship network, in accordance with some embodiments of the present disclosure. System 100 may include target platform 120, target platform server 130, asynchronous network characterization platform server 150, and database 140.
For the target relationship network to be characterized in this disclosure, there is a portion of the activity that is accomplished by the target platform 120. For example, if the target relationship network is a money laundering network, at least a portion of the money laundering is to be done at the target platform 120. For example, a criminal may disguise eBay transactions as normal business transactions, making a clearness outlet for illegal funds, for money laundering purposes. For example, criminals put on shelves of artworks with high prices on eBay, the artworks have no market guide price, and the prices are not abnormal even if the prices are high enough in the eyes of ordinary people. And the criminal purchases the artwork again, and washes a large amount of illegal obtained funds into normal commercial profit. And then, the criminal can transfer money through Paypal or an online bank, and the money washing activity is disguised as normal transfer behavior. For example, if the target platform is a payment or transfer platform, for example, a criminal officer holds a plurality of Paypal accounts, one of which applies for a merchant, and transfers other accounts to the merchant account to disguise illegal funds into commercial profit, so as to achieve the purpose of money laundering.
Since the online transaction is performed online in real time, the target platform 120 can capture information of the transaction in real time. Thus, by monitoring transactions on the target platform 120, it is possible to determine whether the user 110 is likely to be engaged in suspicious transaction activities (e.g., black wash activities) based on the behavioral characteristics of the user. Upon sensing that a user is conducting suspicious transaction activity, the server 130 may obtain some data (referred to as target data) related to the suspicious transaction operation (i.e., the current business operation) from the asynchronous network characterization platform.
The asynchronous network description platform and the target platform operate asynchronously and store the local information of the target relation network. Asynchronous network characterization platform server 150 (hereinafter server 150) may be one or more servers of an asynchronous network characterization platform. The asynchronous network characterization platform is used for storing and processing a part which is confirmed in the target relation network. This portion of the content may be stored in a local storage medium of the server 150 or may be stored in the remote database 140.
In some embodiments, in the context of the money laundering network described above, the asynchronous network characterization platform may store the portion of the money laundering network that has been validated. For example, the asynchronous network characterization platform may obtain partial money laundering network information already held by the public security organization from a server of the public security system. Upon receiving the query request of the target platform, server 150 transmits the target data to server 130. The server 150 is called an asynchronous network characterization platform because the platform running on it stores information about the target relationship network and its contents are not updated synchronously with the target platform.
The above description and the following description of the present disclosure will describe the technical solutions related to the present disclosure by taking a money laundering network as an example. Of course, it will be understood by those skilled in the art that other relational networks for conducting transactions through a target platform are also suitable for use with the disclosed solution.
Fig. 2 is a schematic structural diagram of a computing device provided in accordance with some embodiments of the present disclosure.
The computing device 200 may be a general purpose computer or a special purpose computer. For example, the computing device 200 may be a server, a personal computer, a portable computer (such as a notebook computer, a tablet computer, etc.), or an electronic device with other computing capabilities. Of course, the computing device may be the server 130, the server 150 in fig. 1, or may be an electronic device used by the users 110A to 110C to perform transactions on the target platform 120.
As shown in fig. 2, the computing device 200 may include a COM port 250, and the COM port 250 may be connected to or taken out of a network to which it is connected to facilitate data communication. Computing device 200 may also include a processor 220, such as a Central Processing Unit (CPU), in the form of one or more processors, for executing program instructions. The computing device 200 may also include an internal communication bus 210 and various forms of program storage media and data storage media, such as a magnetic disk 270 (non-transitory memory) and Read Only Memory (ROM)230 or Random Access Memory (RAM)240, among others, for storing various data files to be processed and/or transmitted. The storage medium may be a storage medium local to the computing device 200, or may be a storage medium shared by the computing device 200 (such as the storage medium M shown in fig. 1). The computing device 200 may also include program instructions stored in the ROM 230, RAM 240, and/or other types of non-transitory storage media to be executed by the processor 220. The computing device 200 may also include I/O components 260 to support data communications with other computing devices in the local relationship network real-time characterization system 100. The computing device 200 may also receive programming and data via network communications.
For illustrative purposes only, only one processor 220 is depicted in the computing device 200. However, one of ordinary skill in the art will appreciate that the computing device 200 in the present disclosure may also include multiple processors. Thus, methods/steps/operations described in this disclosure as being performed by one processor may also be performed collectively or separately by multiple processors. For example, if in the present disclosure, the processor of the computing device 200 may perform step a and step B simultaneously. It should be understood that steps a and B may also be performed by two different processors together. For example, a first processor performs step a and a second processor performs step B, or the first processor and the second processor perform steps a and B together.
FIG. 3 illustrates a method flow diagram 300 of a method for real-time characterization of a local relationship network, provided in accordance with some embodiments of the present disclosure; FIG. 4 illustrates a block diagram 400 of a target relationship network provided in accordance with some embodiments of the present disclosure; fig. 5 illustrates a system flow diagram 500 of a method for real-time characterization of a local relationship network, provided in accordance with some embodiments of the present disclosure.
The technical solution of the present disclosure will be described below with reference to fig. 3, 4, and 5. The subject implementing the solution may be the target platform 120 and/or the server 130 described in fig. 2. Specifically, as shown in fig. 2, the server 130 may be a device for real-time depiction of a local relationship network, including: at least one storage medium, and at least one processor. The at least one storage medium includes at least one instruction set for real-time characterization of a local relationship network. The at least one processor is communicatively coupled to the at least one storage medium. When the system is running, the at least one processor may read the at least one instruction set and perform the following steps in the method described in fig. 3 according to the instructions of the at least one instruction set.
S310, based on data of current business operation performed by a plurality of users on the target platform, candidate users with target characteristics are identified.
And part of the users on the target platform are part of the nodes in the target relationship network, namely part of the nodes in the target relationship network are provided with accounts on the target platform. In actual operation, the plurality of users may be a node in the target relationship network that has been identified, may belong to a node in the target relationship network that has not been identified, and of course, may not be a node in the target relationship network.
In this step, the server 130 may acquire current business operation data of a plurality of users 110(110A, 110B, 110C) performing current business operations on the target platform 120 in real time. The business operation may be all or part of the transaction performed by the user 110 on the target platform 120. The business operation data may be any relevant data required in the business operation to characterize the target relationship network. For example, if the target platform 120 is a money transaction platform, the business operation may be one or more of a payment instruction on the target platform 120 or a series of operations that the user performs around the transaction on the target platform 120; the business operation data may be user information of both the buyer and the seller, transaction article information, the article market price data, actual transaction amount data, payment channel data, and the like. For another example, if the target platform 120 is a money transfer platform, the business operation may be a money transfer instruction of the user, one or more operations on the target platform 120 triggered by the instruction, or one or more operations on the target platform 120 around the money transfer; the business operation data may be personal information of the transferor and the transferee, account information, bank information, money transfer amount, etc. The real-time is that when the user 110 performs the business operation on the target platform 120 at the same time or at a near-same time within a predetermined time (for example, within 0.05 second, 1 second, or 10 seconds), the service provider 130 can obtain the relevant data of the business operation.
After the server 130 obtains the current business operation data in real time, the server 130 may identify a candidate user with the target feature from the current business operation data of the plurality of users. At this stage, for a user with a target feature, the current operation of the candidate user may or may not be associated with at least one target node in the target relationship network. For example, in some embodiments, the current operation of the candidate user is associated with at least one target node in the target relationship network. The target characteristics may include one or more of transaction media characteristics, fund flow characteristics, transaction behavior characteristics, and aggregation characteristics.
The transaction medium characteristic may include a transaction medium anomaly. For example, the terminal device 110 used by the current business operation of the user 110 is a terminal device that has been confirmed by the relevant department or the target platform 120 and involved in money laundering activity. In money laundering activities, criminals may use multiple accounts to perform business operations, and multiple accounts may all log in on the same terminal device to perform business operations. If one account among these accounts is identified as a money laundering account by the relevant department or target platform, the frequently used terminal devices of the account are also marked. When other account numbers are logged on the marked terminal device for business operation, the media characteristics of the account are detected as transaction media abnormality by the target platform 120 and/or the server 130.
The fund flow feature may comprise a fund anomaly. The target platform 120 and/or the server 130 detects the historical transaction operation data of the account undergoing business operation, and detects whether the fund flow which does not accord with daily life and production operation exists. Such as fast forward and fast out of funds, the account receives a large amount of funds (e.g., more than 100 ten thousand dollars) and transfers the funds to one or more accounts one or more times in a short period of time for an amount of money corresponding to the amount transferred. When such a fund flow does not conform to the rules of ordinary people or daily life, production and operation of the user, the fund flow characteristic of the account is detected as a fund flow abnormity.
The transaction behavior characteristics may include transaction behavior anomalies. The target platform 120 and/or the server 130 may detect the account information and the transaction object information of the ongoing business operation, so as to discover that there is a transaction behavior anomaly in the account. Some criminals of money laundering will disguise the flow of account funds for money laundering as a commercial transaction, but the amount of the transaction is much greater than the normal commercial transaction amount of the merchants of both parties' registered information. If the transaction object registration information is a supermarket, the transaction amount of the current business operation of the user is 100 ten thousand yuan RMB, which is far larger than the consumption amount of normal consumers in the supermarket. In this case, the transaction behavior characteristics of the user may be detected as transaction behavior anomalies.
As another example, if the user's transaction behavior is to purchase a product, such as a word or picture, on eBay for a price that exceeds a conventional price (e.g., $ 200 ten thousand), it may be detected as a transaction behavior anomaly. Because the playing calligraphy and painting with high price usually needs to be checked on site to distinguish the authenticity and artistic value. Purchasing products such as characters, pictures and the like with higher prices on eBay is often the condition that criminals want to use the products without market guiding price, and money laundering transaction is convenient. In this case, the transaction behavior characteristics of the user may also be detected as transaction behavior anomalies.
The aggregation characteristic may include an anomalous aggregation. The target platform 120 and/or the server 130 detects the historical transaction operation data of the account undergoing the business operation, and finds that the account has abnormal aggregation. The money amount involved in washing black money is large, the money has obvious aggregative property, and the money circulation speed is high. For example, the account aggregation feature may be detected as an anomalous aggregation if a large number of new account registrations occur, and a large transfer of funds immediately following the common new account registrations, and/or a large amount of funds suddenly enter after a new card bind.
S320, acquiring target data related to the current business operation of the candidate user in the target relation network from the asynchronous network description platform. The asynchronous network depiction platform and the target platform operate asynchronously and store local information of the target relational network.
The target data related to the current business operation of the candidate user includes, but is not limited to, obtaining node information of a target relational network from the asynchronous network characterization platform. For example, whether the object of the current business operation is the determined target relationship network node or not and if so, various useful information of the node are obtained from the asynchronous network description platform.
In some embodiments, the target data of the target relationship network may include target metrics of nodes in the target relationship network that are related by the candidate user's current business operations. Such as in the case of money laundering networks, the target indicator may be a fund risk level of an account network in which the account of the candidate user is located when transferring funds; in the scene of frequent dangerous wild animal trading, the target index can be the trading possibility of frequent dangerous wild animals and the like.
It should be particularly mentioned that the server 130 may obtain the target data from the asynchronous network characterization platform 150 after identifying the candidate user with the target feature, or may obtain and store the target data in a storage medium such as a local hard disk in advance.
S330, determining the candidate user to be a node in the target relation network based on the target data and the target characteristics. The target data of the target relationship network comprises a target index of the at least one target node. The target index is an account network fund risk level of the at least one target node.
After obtaining the target data and the target feature related to the current service operation of the candidate user, the server 130 may determine whether the candidate user is a node in the target relationship network based on the target data and the target feature.
First, the server 130 obtains a white list, determines whether the candidate user is in the white list, and then determines whether the candidate user is a node in the target relationship network according to a determination result. The whitelist includes a plurality of users registered on the target platform. The white list refers to trusted users that the platform has mastered, for example: government functions, certified business accounts, and the like. The trusted account has frequent fund exchange due to business relation. For example, the power bureau almost always pays the electricity fee every day, and the abnormal characteristics can be detected by the system if the amount of money is large or small. A white list needs to be established and similar accounts placed on the white list. The server 201 automatically filters a white list after receiving the operation data of the user 110, and the user in the white list is not determined as a risk account. The server 130 analyzes the operation data of the user 110, and marks the account which is not in the white list and the target feature of which is detected as abnormal as a candidate user.
After obtaining the data analysis result, the server 130 comprehensively determines the account cyber fund risk level of the user 110 based on the target data and the target characteristics, and divides the cyber fund risk level into four stages: high risk, next highest risk, medium risk, low risk, and no risk. How to divide the risk levels can be flexibly adjusted according to actual conditions, and no special provisions are made in the application. By way of example, however, a method of ranking risk provided in accordance with some embodiments of the present disclosure is described below.
The high risk decision condition may include a certain target feature anomaly (medium anomaly, transaction fund anomaly, transaction behavior anomaly, or fund aggregation anomaly) and the fund network is very small. For example, when the server 130 determines that the transaction medium characteristic is a medium abnormality and the distance between the target user and the nearest node in the target relationship network is smaller than a first threshold, it determines that the risk level of the target user is a first-level risk, i.e., a high risk.
The next highest risk decision condition may include that a certain target feature is abnormal and the capital network is next lowest. For example, when the server 130 determines that the transaction medium characteristic is a medium abnormality and the distance between the target user and the nearest node in the target relationship network is greater than a first threshold and less than a second threshold, it determines that the risk level of the target user is a secondary risk, i.e., a second highest risk.
The risk-in decision condition may include at least one target feature being abnormal and the capital network being large. For example, when the server 130 determines that the transaction medium characteristic is a medium abnormality, the transaction behavior belongs to a behavior abnormality, and the distance between the target user and the nearest node in the target relationship network is greater than a second threshold and smaller than a third threshold, it is determined that the risk level of the target user is a third-level risk, that is, a medium risk.
The low risk judgment condition may include at least one target feature being abnormal and the capital network being very large. For example, when the server 130 determines that the transaction medium characteristic is a medium abnormality, the transaction behavior belongs to a behavior abnormality, and the distance between the target user and the nearest node in the target relationship network is greater than a third threshold and smaller than a fourth threshold, it determines that the risk level of the target user is a four-level risk, that is, a low risk.
In other cases, the server 130 considers the risk level of the target user to be risk-free.
S340, taking the candidate user as a target user to send the identity information of the candidate user to the asynchronous network characterization platform.
For the high risk account, the server 130 interrupts the business operation being performed by the user at the first level risk, permanently limits the business operation of the user at the first level risk, and enters the user at the first level risk into the blacklist library. Specifically, the server 130 sends the information of transaction failure to the terminal device 110, permanently limits funds, and enters the account into the blacklist library. Meanwhile, the server 130 sends the user information of the primary risk to the server 150 of the asynchronous network characterization platform, and instructs the server 150 of the asynchronous network characterization platform to perform subsequent operations. The first-risk user information includes the identity data of the user and the risk level of the target user. And after receiving the target information, the asynchronous system constructs a target relationship network of the account corresponding to the user with the primary risk.
FIG. 4 illustrates a target relationship network provided in accordance with some embodiments of the present disclosure. Network 400 represents a validated local target relationship network stored on the asynchronous network characterization platform. A plurality of solid line nodes, such as n1, n2, n4, and n5, may be included in the local target relationship network 400. Each node may represent an account that is registered on target platform 120 and has been identified as being in the target network. The arrows between the nodes represent the relationship between the nodes that are connected at the two ends of the arrows. Network 410 represents the portion of the network to be validated that has not yet been validated as the target relationship network, but has a transaction relationship with a node user of the local target relationship network. The nodes in the network to be validated 410 are represented by dashed lines, such as n6, n7, n8, and n 9. Each node may represent an account that is registered on target platform 120 and that is not identified as being in the target network. The arrows between the nodes represent the relationship between the nodes that are connected at the two ends of the arrows.
The target relation network is constructed in an off-line mode through the following asynchronous steps: firstly, nodes in a predetermined target relationship network node list are set as 0-layer nodes in the target relationship network. For example, the server 130 first sets all the nodes n 1-n 5 in the network 400 in FIG. 4 as level 0 nodes. Then, for each node in the target relationship network 400, a directed transaction edge is established based on the relevant transactions that satisfy the condition. The method specifically comprises the following steps: and acquiring the associated users on the target platform, which have target service operation with the nodes, from the server 130. And when the target service operation meets a preset condition, determining that the associated user is a node adjacent to the node. Wherein the preset condition may include that the ratio of the target service operation to all service operations of the associated user is greater than a threshold.
In some embodiments, the target relationship network may be a funds transfer network. For example, the money transfer network may be the money laundering network described above. As another example, the money flow network may be a transaction network on an eBay platform: one party pays money and one party delivers goods. The money flow network may also be a particular network of goods transactions, such as wildlife transactions, and the like. For example, in money laundering network 400 described above, node n1 and node n2 represent two accounts that have been identified as being in the money laundering network, respectively, and arrow e1 connecting n1 and n2 indicates that n1 transferred black money to n 2. Node n6 and node n7 represent other users on the target platform 120 outside of the money laundering network. Where e9 indicates that node n1 made a transfer to node n6 and e12 indicates that node n7 made a transfer to node n 2.
For example, n6 is used as the consumption amount of general life in each month, which is about 2 ten thousand RMB, and the amount paid per consumption is not more than 30% of the 2 ten thousand RMB. If 30% is set as the threshold, when n6 collects 10 ten thousand yuan from the account of a node n1 in the target relationship network 400 or transfers the account of the node n1 at one time, the proportion of transfer exceeds 30% of the general consumption of n 6. Thus, the server 130 may determine that n6 is a neighbor node of the node n1 of the target relationship network 400. If the transfer amount n6 gives n1 is 2000 dollars, not more than 30% of 2 ten thousand dollars, the server 130 does not determine n6 as a neighbor node of the node n 1. And so on for other nodes in the relationship network 410.
Thus, if the node n1 in the target relationship network 400 really changes black money, the larger money will be inevitably spread to the surrounding nodes where business relationships occur. By tracking the black money through the method, a new associated node can be obtained, and directed transaction edges of n1 and other nodes in the relational network 410 are established, so that the target relational network 400 is expanded. The convergence condition of the target relationship network 400 expansion (i.e., when to stop the expansion) can be divided into 2 cases, 1 is based on the service experience and explanatory direct truncation; alternatively, a convergence condition is set, for example, when the number or concentration of the associated nodes of n1 is less than a certain threshold, n1 is considered to stop fund spreading.
In addition, the server 130 performs the following operations:
interrupting the business operation of the user with the secondary risk, and limiting the user with the secondary risk to perform the business operation within a preset time. Specifically, for the second highest risk account, the server 130 also sends the terminal device the information of transaction failure, and the account is limited in funds for 48 hours. The server 130 may send the user information of the secondary risk to the server 150 of the asynchronous network characterization platform, and instruct the server 150 of the asynchronous network characterization platform to perform subsequent operations. The user information of the secondary risk comprises the identity data of the target user and the risk level of the target user. And after receiving the target information, the asynchronous system constructs a target relationship network of the account corresponding to the user with the secondary risk. Of course, the server 130 may limit the secondary risk user to perform the business operation only within a preset time without sending the information to the server 150 of the asynchronous network characterization platform.
And interrupting the ongoing business operation of the user with the third-level risk, and prompting that the business operation has risk. Specifically, for the intermediate risk account, the server 130 further sends a transaction failure message to the terminal device, and prompts that the current account has a transaction risk.
And allowing the business operation of the user with the four-level risk while pushing safety prompt information. Specifically, for a low risk account, the server 130 allows the transaction and sends a message to the terminal device that the transaction was successful, while pushing the security education file.
Allowing the business operations being performed by the users with the fifth level risk. Specifically, the server 130 allows the risk-free account to normally trade, and also sends a message that the trade is successful to the terminal device.
In summary, the present disclosure provides a method and a system for real-time depicting of a local relationship network. By the money laundering transaction identification method based on the asynchronous network analysis and the synchronous real-time characteristic calculation, the transaction with money laundering risk is effectively depicted in real time under the premise of not increasing real-time calculation resources and guaranteeing the interpretability of the identification strategy. A black sample automatic updating mechanism is provided, and the problems of insufficient black list and untimely updating in the money laundering risk field are relatively effectively solved.
In conclusion, upon reading the present detailed disclosure, those skilled in the art will appreciate that the foregoing detailed disclosure can be presented by way of example only, and not limitation. Those skilled in the art will appreciate that the present disclosure is intended to encompass reasonable variations, improvements, and modifications to the embodiments, even though not explicitly stated herein. Such alterations, improvements, and modifications are intended to be suggested by this disclosure, and are within the spirit and scope of the exemplary embodiments of this disclosure.
Furthermore, certain terminology has been used in the present disclosure to describe embodiments of the present disclosure. For example, "one embodiment," "an embodiment," and/or "some embodiments" means that a particular feature, structure, or characteristic described in connection with the embodiment can be included in at least one embodiment of the present disclosure. Therefore, it is emphasized and should be appreciated that two or more references to "an embodiment" or "one embodiment" or "an alternative embodiment" in various portions of this specification are not necessarily all referring to the same embodiment. Furthermore, the particular features, structures, or characteristics may be combined as suitable in one or more embodiments of the disclosure.
It should be appreciated that in the foregoing description of embodiments of the disclosure, to facilitate an understanding of one feature, the disclosure sometimes combines various features in a single embodiment, figure, or description thereof for the purpose of simplifying the disclosure. Alternatively, the present disclosure may be used to distribute various features among multiple embodiments of the present disclosure. This is not to be construed, however, as requiring a combination of features that one of ordinary skill in the art would, upon reading this disclosure, appreciate from the disclosure that certain features may be extracted as separate embodiments. That is, embodiments in the present disclosure may also be understood as an integration of multiple sub-embodiments. And each sub-embodiment described herein is equally applicable to less than all features of a single foregoing disclosed embodiment.
Claims (12)
1. A method for describing the local relation network based on asynchronous network description and real-time feature extraction includes,
identifying candidate users with target characteristics based on data of current business operation performed by a plurality of users on a target platform, wherein part of the users on the target platform are part of nodes in a target relation network;
acquiring target data related to the current business operation of the candidate user in a target relational network from an asynchronous network characterization platform, wherein the asynchronous network characterization platform and the target platform run asynchronously and store local information of the target relational network;
determining the candidate user as a node in the target relationship network based on the target data and the target characteristics; and
and taking the candidate user as a target user to send the identity information of the candidate user to the asynchronous network characterization platform.
2. A method of characterizing a local relationship network as claimed in claim 1, wherein said target relationship network is constructed by the asynchronous steps of:
setting nodes in a predetermined target relationship network node list as 0-layer nodes in the target relationship network; and
for each node in the target relationship network:
acquiring associated users on the target platform and subjected to target service operation with the nodes, and
and when the target service operation meets a preset condition, determining that the associated user is a node adjacent to the node.
3. The method for characterizing a local relationship network as claimed in claim 2, wherein said preset condition includes that a ratio of said target service operation to all service operations of said associated subscriber is greater than a threshold.
4. A method of characterizing a local relationship network as claimed in claim 1, wherein the current operation of the candidate user is associated with at least one target node in the target relationship network; and
the target data of the target relationship network comprises a target index of the at least one target node.
5. The method for characterizing a local relationship network as claimed in claim 4, wherein said determining said candidate user as a node in said target relationship network further comprises:
obtaining a white list, wherein the white list comprises a plurality of registered users on the target platform;
judging that the candidate user is in the white list; and
and determining the candidate user as a node outside the target relational network.
6. The method for characterizing a local relationship network as claimed in claim 4, wherein said determining said candidate user as a node in said target relationship network based on said target data and target features further comprises: determining a risk level of the target user, wherein the target user information comprises identity data of the target user and the risk level of the target user.
7. The method for characterizing a local relationship network as recited in claim 6,
the target relationship network comprises a funds transfer network;
the business operation comprises a fund transfer operation of a transaction;
the target characteristics include one or more of transaction media characteristics, fund flow characteristics, transaction behavior characteristics, and aggregation characteristics of the transaction.
8. The method for characterizing a local relationship network as recited in claim 7,
the fund transfer network is a money laundering network;
the target index is an account network fund risk level of the at least one target node;
the transaction medium characteristic comprises a transaction medium anomaly;
the fund flow feature comprises a fund anomaly;
the transaction behavior characteristics comprise transaction behavior anomalies; and
the aggregation characteristic includes an anomalous aggregation.
9. The method for characterizing a local relationship network as claimed in claim 8, wherein said determining a risk level of said target user comprises,
determining that the transaction medium characteristic is medium abnormity and the distance between the target user and the nearest node in the target relationship network is smaller than a first threshold value, and determining that the risk level of the target user is a first-level risk;
determining that the transaction medium characteristic is medium abnormality and the distance between the target user and the nearest node in the target relationship network is greater than a first threshold and smaller than a second threshold, and determining that the risk level of the target user is a secondary risk;
determining that the transaction medium characteristic is medium abnormity, the transaction behavior belongs to behavior abnormity, and the distance between the target user and the nearest node in the target relationship network is greater than a second threshold and less than a third threshold, and determining that the risk level of the target user is a third-level risk;
determining that the transaction medium characteristic is medium abnormity, the transaction behavior belongs to abnormal behavior, and the distance between the target user and the nearest node in the target relationship network is greater than a third threshold and less than a fourth threshold, and determining that the risk level of the target user is a four-level risk; or
And otherwise, determining the risk grade of the target user as five-grade risk.
10. The method for characterizing a local relationship network as claimed in claim 9, wherein said determining that said candidate user is a node in said target relationship network comprises determining that said first-risk user is a node in said target relationship network.
11. A method of characterizing a local relationship network as recited in claim 10, further comprising:
interrupting the ongoing business operation of the user at the first-level risk, permanently limiting the business operation of the user at the first-level risk, and inputting a blacklist library by the user at the first-level risk;
interrupting the business operation performed by the user at the secondary risk, and limiting the user at the secondary risk to perform the business operation within a preset time;
interrupting the business operation which is carried out by the user with the third-level risk, and prompting that the business operation has risk;
allowing the business operation of the user with the four-level risk to be carried out, and simultaneously pushing safety prompt information; and
allowing the business operations being performed by the users with the fifth level risk.
12. An apparatus for characterizing a local relationship network based on asynchronous network characterization and real-time feature extraction, comprising:
at least one storage medium comprising at least one instruction set for real-time characterization of a local relationship network; and
at least one processor communicatively coupled to the at least one storage medium,
wherein when the system is running, the at least one processor reads the at least one instruction set and performs the method of any one of claims 1-11 as indicated by the at least one instruction set.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202011545629.6A CN112561703B (en) | 2020-12-23 | 2020-12-23 | Method and system for depicting local relationship network based on asynchronous network depiction and real-time feature extraction |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202011545629.6A CN112561703B (en) | 2020-12-23 | 2020-12-23 | Method and system for depicting local relationship network based on asynchronous network depiction and real-time feature extraction |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN112561703A true CN112561703A (en) | 2021-03-26 |
| CN112561703B CN112561703B (en) | 2022-10-25 |
Family
ID=75030542
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202011545629.6A Active CN112561703B (en) | 2020-12-23 | 2020-12-23 | Method and system for depicting local relationship network based on asynchronous network depiction and real-time feature extraction |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN112561703B (en) |
Citations (11)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20080301040A1 (en) * | 2007-06-01 | 2008-12-04 | The Western Union Company | Systems and methods for evaluating financial transaction risk |
| CN105427125A (en) * | 2015-10-29 | 2016-03-23 | 电子科技大学 | Goods clustering method based on goods network connection graph |
| CN108280755A (en) * | 2018-02-28 | 2018-07-13 | 阿里巴巴集团控股有限公司 | The recognition methods of suspicious money laundering clique and identification device |
| CN108985553A (en) * | 2018-06-05 | 2018-12-11 | 中国平安人寿保险股份有限公司 | A kind of recognition methods and equipment of abnormal user |
| CN109461078A (en) * | 2018-10-22 | 2019-03-12 | 中信网络科技股份有限公司 | A kind of abnormal transaction identification method and system based on funds transaction network |
| CN109615524A (en) * | 2019-01-08 | 2019-04-12 | 平安科技（深圳）有限公司 | Recognition methods, device, computer equipment and the storage medium of crime of laundering clique |
| CN109767076A (en) * | 2018-12-17 | 2019-05-17 | 平安科技（深圳）有限公司 | The generation of blacklist and screening method, device, computer equipment and storage medium |
| CN110992059A (en) * | 2019-11-22 | 2020-04-10 | 浙江招天下招投标交易平台有限公司 | Big data-based surrounding string label behavior recognition analysis method |
| CN111179089A (en) * | 2020-01-02 | 2020-05-19 | 中国银行股份有限公司 | Money laundering transaction identification method, device and equipment |
| CN111476662A (en) * | 2020-04-13 | 2020-07-31 | 中国工商银行股份有限公司 | Anti-money laundering identification method and device |
| CN112102076A (en) * | 2020-11-09 | 2020-12-18 | 成都数联铭品科技有限公司 | Comprehensive risk early warning system of platform |
-
2020
- 2020-12-23 CN CN202011545629.6A patent/CN112561703B/en active Active
Patent Citations (11)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20080301040A1 (en) * | 2007-06-01 | 2008-12-04 | The Western Union Company | Systems and methods for evaluating financial transaction risk |
| CN105427125A (en) * | 2015-10-29 | 2016-03-23 | 电子科技大学 | Goods clustering method based on goods network connection graph |
| CN108280755A (en) * | 2018-02-28 | 2018-07-13 | 阿里巴巴集团控股有限公司 | The recognition methods of suspicious money laundering clique and identification device |
| CN108985553A (en) * | 2018-06-05 | 2018-12-11 | 中国平安人寿保险股份有限公司 | A kind of recognition methods and equipment of abnormal user |
| CN109461078A (en) * | 2018-10-22 | 2019-03-12 | 中信网络科技股份有限公司 | A kind of abnormal transaction identification method and system based on funds transaction network |
| CN109767076A (en) * | 2018-12-17 | 2019-05-17 | 平安科技（深圳）有限公司 | The generation of blacklist and screening method, device, computer equipment and storage medium |
| CN109615524A (en) * | 2019-01-08 | 2019-04-12 | 平安科技（深圳）有限公司 | Recognition methods, device, computer equipment and the storage medium of crime of laundering clique |
| CN110992059A (en) * | 2019-11-22 | 2020-04-10 | 浙江招天下招投标交易平台有限公司 | Big data-based surrounding string label behavior recognition analysis method |
| CN111179089A (en) * | 2020-01-02 | 2020-05-19 | 中国银行股份有限公司 | Money laundering transaction identification method, device and equipment |
| CN111476662A (en) * | 2020-04-13 | 2020-07-31 | 中国工商银行股份有限公司 | Anti-money laundering identification method and device |
| CN112102076A (en) * | 2020-11-09 | 2020-12-18 | 成都数联铭品科技有限公司 | Comprehensive risk early warning system of platform |
Non-Patent Citations (1)
| Title |
|---|
| 范万栋: "资金查控:金融信息在侦查中的深度应用", 《山东警察学院学报》 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN112561703B (en) | 2022-10-25 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US11074350B2 (en) | Method and device for controlling data risk | |
| US10796310B2 (en) | Apparatus including data bearing medium for reducing fraud in payment transactions using a black list | |
| US9218594B2 (en) | Social network-assisted electronic payments | |
| US8504456B2 (en) | Behavioral baseline scoring and risk scoring | |
| US20120109802A1 (en) | Verifying identity through use of an integrated risk assessment and management system | |
| WO2011112981A2 (en) | Methods, computer-accessible medium and systems for construction of and inference with networked data, for example, in a financial setting | |
| CN110009365B (en) | User group detection method, device and equipment for abnormally transferring electronic assets | |
| JP6294193B2 (en) | Transaction management system and transaction management method | |
| CN112330373A (en) | User behavior analysis method and device and computer readable storage medium | |
| CN112561703B (en) | Method and system for depicting local relationship network based on asynchronous network depiction and real-time feature extraction | |
| CN111445255A (en) | Method and device for determining abnormal fund transfer relationship | |
| CN111681044A (en) | Method and device for processing point exchange cheating behaviors | |
| Adam et al. | Anomaly Detection on Distributed Ledger Using Unsupervised Machine Learning | |
| US20210326894A1 (en) | Computer-implemented system and method for isolating payment messages having deficient standard data elements | |
| WO2021262073A1 (en) | Method and system for controlling a bidding process | |
| Arifah et al. | Artificial Intelligence in Credit Risk Management of Peer-to-Peer Lending Financial Technology: Systematic Literature Review | |
| Bakar et al. | Robust outliers detection method for ethereum exchange rate: a statistical approach using high frequency data | |
| Kang | Fraud Detection in Mobile Money Transactions Using Machine Learning | |
| Urban et al. | Analysis on Off-Chain Collateralised Stablecoin Demand and Volatility | |
| US20230237493A1 (en) | Graph-based analysis framework | |
| Mon | Factors influencing consumer trust on mobile wallet in Yangon | |
| CN115375324A (en) | Excess verification method, device, storage medium and equipment | |
| Kshetri | Facilitation of Entrepreneurial Activities | |
| KR20210106593A (en) | Method, apparatus and computer program for determining cryptocurrency tax evasion using artificial intelligence | |
| KR20210122941A (en) | Method, apparatus and computer program for deciding intrinsic value of cryptocurrency using artificial intelligence |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |