CN113722671A

CN113722671A - Method and system for monitoring suspected illegal funding behaviors based on fund transaction data

Info

Publication number: CN113722671A
Application number: CN202010455861.4A
Authority: CN
Inventors: 陶一冉
Original assignee: Beijing Chenxin Credit Information Co ltd
Current assignee: Beijing Chenxin Credit Information Co ltd
Priority date: 2020-05-26
Filing date: 2020-05-26
Publication date: 2021-11-30

Abstract

The invention provides a method and a system for monitoring illegal funding behaviors based on fund transaction data, which realize monitoring of suspected illegal funding behaviors by analyzing fund transaction running water. The method and the system for monitoring illegal funding behaviors based on fund transaction data have the advantages of direct and effective early warning effect, accuracy and rapidness, capability of adapting to criminals to continuously renew crime skills and the like.

Description

Method and system for monitoring suspected illegal funding behaviors based on fund transaction data

Technical Field

The invention relates to a method for monitoring illegal funding behaviors, in particular to a method for monitoring illegal funding behaviors based on fund transaction data, and belongs to the field of information analysis.

Background

With the rapid development of financial science and technology and the mature modern technology represented by big data, the internet and the traditional financial business are deeply combined, so that the development of new business states is continuously promoted, risks coexist and new characteristics are presented, particularly illegal collective crime cases related to the vital interests of the masses are continuously generated, and the crime making skills are continuously renewed.

Illegal funding refers to the act of a unit or person who has not been approved by the relevant departments according to legal procedures to raise funds to the public in a manner of issuing stocks, bonds, lottery tickets, investment fund securities or other creditory documents and to commit to pay or give a return to the sponsor in money, objects or other manners within a certain period of time.

In the prior art, data such as enterprise data, internet public data, public opinion monitoring information and the like are used for carrying out illegal collective monitoring and early warning, for example, patent applications with application numbers of CN201811339775.6 and CN201910833127.4, compared with the mode of striking illegal collective resources by means of a clue obtained by mass report in the past, the use of the data can prevent and early warn the illegal collective risk, but the effect is not particularly ideal, because the risk is already exposed when the first illegal collective risk can be monitored by the internet, and the illegal collective pretightening has obvious hysteresis; secondly, the network public data is low in authenticity and low in analysis accuracy.

Therefore, it is desirable to design a method and system for monitoring illegal fundraising activities more quickly and accurately.

Disclosure of Invention

In order to solve the above problems, the present inventors have conducted intensive studies to realize monitoring of suspected illegal funding activities by analyzing fund transaction data, and thus have completed the present invention.

The object of the present invention is to provide the following:

on one hand, the invention provides a method for monitoring illegal funding behaviors based on fund transaction data, which realizes the monitoring of suspected illegal funding behaviors by analyzing fund transaction flow and comprises the following steps:

s1, establishing a fund transaction monitoring model;

s2, setting a monitoring characteristic threshold;

and S3, importing the fund transaction assembly line, and outputting the risk level by using the fund transaction monitoring model.

In step S1, a monitoring item, a monitoring feature threshold, and a risk level unit are designed in the fund transaction monitoring model, and by extracting a plurality of monitoring feature items from the monitoring item of the account, comparing the extracted monitoring feature items with the corresponding monitoring feature thresholds, it is determined whether each monitoring feature item has a suspected illegal funding feature, and the risk level is determined by counting the number of monitoring feature items of the suspected illegal funding feature of the account.

The monitoring items comprise account information, transaction opponent information and transaction flow information.

The account information comprises a name/name of a trader, a type/certification file type of an identity document of the trader, a number/certification file number of the identity document of the trader and a bank account number;

the information of the transaction opponent comprises the name/name of the transaction opponent, the type of the identity document/certification file of the transaction opponent, the number of the identity document/certification file of the transaction opponent and the account number of the transaction opponent;

the transaction flow information comprises transaction ID, transaction date, transaction time, fund receipt and payment mark, transaction amount and currency.

The monitoring characteristic items comprise daily transaction scale characteristics (called A characteristics), scatter transfer-in characteristics (called B1 characteristics), centralized transfer-out characteristics (called B2 characteristics), abnormal time transaction characteristics (called C characteristics) and 24-hour uninterrupted transaction characteristics (called D characteristics);

preferably, the daily transaction scale characteristics comprise a daily transaction stroke number characteristic (referred to as an A1 characteristic) and a daily transaction amount characteristic (referred to as an A2 characteristic);

the monitoring characteristic threshold comprises a daily transaction number threshold, a daily transaction amount threshold, a single transfer amount threshold, a monthly transaction opponent number threshold, a daily transaction opponent number threshold and an abnormal time transaction number threshold.

In step S2, the daily transaction count threshold is 40-60 strokes; the daily transaction amount threshold value is 80-150 ten thousand; the threshold value of the transferred sum of a single stroke is 3-7 ten thousand; the number threshold value of the monthly transaction opponents is 40-60; the daily transaction counter-party number threshold value is 800-1200; abnormal time transaction count thresholdIs 11 to 30 pens_Or。

In step S3, the daily transaction number characteristic (a1 characteristic) is determined by using the account number, the transaction ID and the transaction date, and when the number of different transaction IDs in the same transaction date is greater than the daily transaction number threshold value for a certain account number in the monitored item, the account number is determined to have the a1 characteristic in the suspected illegal funding characteristic;

judging daily transaction amount characteristics (A2 characteristics) by using the account number, the transaction date and the transaction amount, and when the sum of all transaction amounts in a certain account number in a monitoring project and the same transaction date is greater than a daily transaction amount threshold value, judging that the account has the A2 characteristic in the suspected illegal funding characteristics;

the method comprises the steps that a scatter transfer-in characteristic (B1 characteristic) is judged by using an account number, a transaction date, a transaction amount and a transaction opponent account number, and when the number of an adversary is larger than a monthly transaction opponent number threshold value in a certain account number in a monitoring project in the same month, the account number is judged to have the B1 characteristic in suspected illegal funding characteristics;

the account number, the transaction date and the centralized transfer characteristics (B2 characteristics) of the account number of the transaction opponents are used for judgment, and when the number threshold of the transaction opponents of a certain account number in a monitoring project on a certain day is larger than the number threshold of the transaction opponents on a certain day, the account is judged to have the B2 characteristic in the suspected illegal funding characteristics;

judging abnormal time transaction characteristics (C characteristics) by using the account number, the transaction date, the transaction time and the transaction ID, and judging that the account has the C characteristics in suspected illegal funding characteristics when the number of transaction strokes in the abnormal time is larger than the threshold value of the number of transaction times in the abnormal time within the same transaction date of a certain account number in a monitoring item;

and (3) judging 24-hour uninterrupted transaction characteristics (D characteristics) by using the account number, the transaction date, the transaction time and the transaction ID, and judging that the account has the D characteristics in the suspected illegal funding characteristics when a certain account number in the monitoring item conducts transactions every hour within continuous 24 hours.

In step S3, the risk level is divided into 4 levels, where the number of the illegal funding features related to the account is 1 or less, the number is 2 or 3, the number is medium risk, the number is 4 or 5, the number is high risk, and the number is ultra high risk.

The invention also provides a system for monitoring illegal funding behaviors based on fund transaction data, which comprises a data processing module 1, a model analysis module 2, a model parameter module 3 and an output module 4.

According to the method and the system for monitoring illegal funding behaviors based on fund transaction data, provided by the invention, the following beneficial effects are achieved:

(1) the illegal collection is monitored and early warned on the basis of the fund transaction flow, and the effect is direct and effective;

(2) the monitoring on the suspected illegal funding behaviors can be accurately and quickly realized;

(3) the monitoring characteristic threshold value is periodically updated in a mode of anonymous discussion of a plurality of case handling experts, so that the fund transaction monitoring model can adapt to crime criminals to continuously renew case handling techniques;

(4) has clear and definite flow and standard specification and can realize automatic analysis.

Drawings

FIG. 1 shows a flow diagram of monitoring illegal funding activities based on funding transaction data in a preferred embodiment.

Detailed Description

The features and advantages of the present invention will become more apparent and appreciated from the following detailed description of the invention, as illustrated in the accompanying drawings.

The word "exemplary" is used exclusively herein to mean "serving as an example, embodiment, or illustration. Any embodiment described herein as "exemplary" is not necessarily to be construed as preferred or advantageous over other embodiments. While the various aspects of the embodiments are presented in drawings, the drawings are not necessarily drawn to scale unless specifically indicated.

The most characteristic essential feature of illegal funding is embodied in the flow of funds. Although the method of illegal funding crimes is being renewed, the crimes aim at illegal acquisition of funds, and thus characteristics different from those of normal accounts are necessarily exhibited in terms of the flow of funds. Illegal collective resources crime and fund flow have direct relation, and some abnormal characteristics different from normal accounts can appear on fund flow water, so the monitoring and early warning effect of illegal collective resources by using fund transaction flow as a basis is more direct and effective, and the monitoring of suspected illegal collective resources can be more accurately and quickly realized.

In one aspect, the present invention provides a method for monitoring illegal funding based on fund transaction data, as shown in fig. 1, comprising the steps of:

s1, establishing a fund transaction monitoring model;

s2, setting a monitoring characteristic threshold;

In the invention, the suspected illegal funding risk level of the account is output through the analysis of the funding transaction flow by the funding transaction monitoring model, so that the suspected illegal funding behavior is monitored.

In step S1, how to establish a fund transaction monitoring model according to the characteristics of suspected illegal funding transactions is the difficult point of the present invention, the inventor designs a unit including monitoring items, monitoring feature thresholds and risk levels in the fund transaction monitoring model, extracts a plurality of monitoring feature items from the monitoring items of the account, compares the extracted monitoring feature items with the corresponding monitoring feature thresholds, determines whether each monitoring feature item has the suspected illegal funding characteristics, and determines the risk level by counting the number of the monitoring feature items of the suspected illegal funding characteristics of the account.

Specifically, the monitoring items comprise account information, transaction opponent information and transaction flow information.

The account information is information capable of identifying the identity of a trader, and in a preferred embodiment, the account information is set to comprise a trader name/name, a trader identity document type/certification document type, a trader identity document number/certification document number and a bank account number;

the information of the transaction opponent refers to information capable of identifying the identity of the transaction opponent, and in a preferred embodiment, the information of the transaction opponent is set to comprise the name/name of the transaction opponent, the type of the identity document/certification document of the transaction opponent, the number of the identity document/certification document of the transaction opponent and the account number of the transaction opponent;

the transaction flow information refers to information capable of identifying transaction time and transaction amount, and preferably, the transaction flow information is set to include transaction ID, transaction date, transaction time, fund receipt and payment mark, transaction amount and currency.

The inventor finds that the illegal investment-related accounts have some unique characteristics, and the inventor intensively researches and discusses and analyzes the national policy document with experts to express the unique characteristics as describable characteristics, wherein the describable characteristics are described by monitoring characteristic items and monitoring characteristic threshold values.

Further, the monitoring characteristic items comprise a daily transaction scale characteristic (called an A characteristic), a scatter transfer-in characteristic (called a B1 characteristic), a concentrated transfer-out characteristic (called a B2 characteristic), an abnormal time transaction characteristic (called a C characteristic) and a 24-hour uninterrupted transaction characteristic (called a D characteristic); the monitoring characteristic threshold comprises a daily transaction number threshold, a daily transaction amount threshold, a single transfer amount threshold, a monthly transaction opponent number threshold, a daily transaction opponent number threshold and an abnormal time transaction number threshold.

The daily transaction scale feature is used for describing the characteristic that the illegal funding account frequently flows in transaction funds, and in a preferred embodiment, the daily transaction scale feature comprises a daily transaction stroke number feature (referred to as an A1 feature) and a daily transaction amount feature (referred to as an A2 feature), when the daily transaction stroke number of a certain account is greater than a daily transaction stroke number threshold value, the account is indicated to have an A1 feature in the suspected illegal funding feature, and when the daily transaction amount of the certain account is greater than the daily transaction amount threshold value, the account is indicated to have an A2 feature in the suspected illegal funding feature.

The scatter transfer characteristic is used for describing the characteristic that the illegal funding account has more fund sources, and when the number of certain account counterparties is greater than the threshold value of the number of monthly counterparties in one month, the account is considered to have the B1 characteristic in the suspected illegal funding characteristic.

In a preferred embodiment, in the scatter-in feature, when the number of counter-parties for an account transaction is greater than the monthly transaction counter-party number threshold and the single transfer amount is greater than the single transfer amount threshold, the counter-parties for the transaction are recorded in the number of counter-parties to distinguish most of normal trade activities from illegal funding.

The inventor finds that the account fund transfer of illegal funding is mostly ten thousand by analyzing the fund transaction data of a large amount of illegal funding, and in the scattered transfer characteristic, more preferably, when the single transfer fund is ten thousand, the counter-party of the transaction is recorded into the number of the counter-parties.

The centralized transfer-out characteristic is used for describing the characteristic of centralized fund expenditure of the illegal fund collection account, and when the number threshold of a certain daily transaction opponent of an account is larger than the daily transaction opponent number threshold, the account is considered to have the characteristic of B2 in the suspected illegal fund collection characteristic, and the suspected illegal fund collection possibility is realized.

In a preferred embodiment, an account is considered to have a B2 feature when the account has a B1 feature and the date on which the daily counterparty is greater than the daily counterparty quantity threshold is the same month as the B1 feature.

The abnormal time transaction characteristic and the 24-hour uninterrupted transaction characteristic are used for describing the illegal funding account transaction time characteristic.

In the invention, the abnormal time is 0: 00-6: 00, normal fund transactions are less in the time period, and more preferably 2: 00-4: 00, and the inventor finds that the fund transaction data of illegal funding often appears in the time period by analyzing a large amount of fund transaction data of illegal funding.

And when the transaction number of an account in the abnormal time is larger than the transaction number threshold in the abnormal time, the account is considered to have the C characteristic in the suspected illegal funding characteristic.

When an account transacts every hour for 24 consecutive hours, the account is considered to have the D characteristic of the suspected illegal funding characteristics.

And the risk grade unit is provided with a corresponding relation table of the monitoring characteristic item quantity of the suspected illegal investment collection characteristic and the risk grade.

The monitoring characteristic threshold is a key value for judging whether the monitored object is suspected to be illegal funding, the threshold is set to be too low, so that a large number of normal accounts are judged to be illegal funding accounts by mistake, and the threshold is set to be too high, so that the sensitivity of the model is reduced, and part of illegal funding accounts cannot be identified.

In step S2, the inventor obtains a set of preferred monitoring feature thresholds through analysis of the million funds transaction data, wherein the daily transaction number threshold is 40-60, preferably 50; the daily transaction amount threshold value is 80-150 ten thousand, preferably 100 ten thousand; the threshold value of the transferred amount of a single pen is 3-7 ten thousand, preferably 5 ten thousand; the number threshold of the monthly transaction opponents is 40-60, preferably 50; the daily transaction counter-party number threshold is 800-1200, preferably 1000; the threshold value of the number of transactions in the abnormal time is 11-30, and preferably 20.

In another preferred embodiment, the monitoring feature threshold is determined by the negotiation of a plurality of case experts, which refer to experts having years of illegal funding research and case handling experience, including local financial affairs officers and local public security officers.

In a more preferred embodiment, multiple case handling experts determine the monitoring feature threshold value in an anonymous discussion mode, specifically, the case handling experts anonymously give proposed monitoring feature threshold values and value reasons which are respectively considered to be suitable, the results are summarized by a third person and then fed back to the case handling experts, the case handling experts modify the proposed monitoring feature threshold values and the value reasons which are given by the case handling experts according to the summarized results, the modified results are summarized by the third person and then fed back to the case handling experts again, and the process is repeated until the proposed monitoring feature threshold values given by the case handling experts are consistent.

In the invention, the consistence of the proposed monitoring feature threshold value given by each case expert means that the discrete coefficient of the proposed monitoring feature threshold value given by each case expert is less than 0.1, and when the proposed monitoring feature threshold value given by each case expert is consistent, the average value of the proposed monitoring feature threshold values given by each case expert is taken as the monitoring feature threshold value of the invention.

In a more preferred embodiment, the monitoring characteristic threshold value can be periodically updated in a mode of anonymous discussion by a plurality of case handling experts, so that the fund transaction monitoring model can adapt to the fact that criminals continuously renew case handling.

The bank flow contains a large amount of information irrelevant to the judgment of whether the account is suspected to be illegally collected, and the information needs to be removed so as to accelerate the model operation speed.

In step S3, the importing of the fund transaction flow refers to screening monitoring items from each flow record of the bank flow bill, as shown in table one, and inputting the monitoring items into the fund transaction monitoring model.

Watch 1

In a preferred embodiment, when screening bank running bills, sensitive certificates and numbers are encrypted to avoid privacy leakage and improve safety.

The fund transaction monitoring model extracts a plurality of monitoring feature items from the imported data, compares the extracted monitoring feature items with corresponding monitoring feature threshold values, and determines whether each monitoring feature item has suspected illegal funding features.

Specifically, the characteristic of daily transaction number (A1 characteristic) is determined by using the account number, the transaction ID and the transaction date, and when the number of different transaction IDs in the same transaction date in a certain account number in the monitoring item is larger than the threshold of daily transaction number, the account number is determined to have the A1 characteristic.

And (3) judging the daily transaction amount characteristic (A2 characteristic) by using the account number, the transaction date and the transaction amount, and judging that the account has the A2 characteristic when the sum of all transaction amounts in a certain account number in the monitoring item and the same transaction date is greater than the daily transaction amount threshold value.

Further, when the sum of the transaction amount is calculated, the transaction amount sum is calculated after different currencies are unified through the transaction daily currency value.

The scattered transfer-in characteristic (B1 characteristic) is judged by using an account number, a transaction date, a transaction amount and a transaction opponent account number, when the number of the easy opponents is larger than the monthly transaction opponent number threshold value in a monitoring project, the account is judged to have the B1 characteristic, and preferably, when the number of the transaction opponents is larger than the monthly transaction opponents in a certain account number and the same month, and the single transfer-in amount is larger than the single transfer-in amount threshold value, the account is judged to have the B1 characteristic. More preferably, when the number of counterparties in a certain account number is greater than the monthly counterparty number threshold in the same month, and the transfer amount per one stroke is ten thousand and greater than the transfer amount per one stroke threshold, the account number is determined to have the B1 characteristic.

The account number, the transaction date and the transaction counter account number centralized roll-out characteristic (B2 characteristic) are used for determination, when a certain account number in the monitoring item has a daily transaction counter greater than a daily transaction counter number threshold value, the account is determined to have the B2 characteristic, and more preferably, the account is determined to have the B1 characteristic only when the account has the B1 characteristic and the date when the daily transaction counter is greater than the daily transaction counter number threshold value is the same month as the B1 characteristic.

And judging the abnormal time transaction characteristics (C characteristics) by using the account number, the transaction date, the transaction time and the transaction ID, and judging that the account has the C characteristics when the number of transaction strokes in the abnormal time is larger than the abnormal time transaction number threshold value in the same transaction date of a certain account number in the monitoring item.

And (3) judging the 24-hour uninterrupted transaction characteristic (D characteristic) by using the account number, the transaction date, the transaction time and the transaction ID, and judging that the account has the D characteristic when a certain account number in the monitoring item has transactions every hour within continuous 24 hours.

After obtaining the number of the illegal collection characteristic of the account, the fund transaction monitoring model outputs the risk level of the illegal collection of the account according to the number, in a preferred embodiment, the risk level is divided into 4 levels, wherein when the number of the illegal collection characteristic of the account is 1 or less, the risk level is low, when the number is 2 or 3, the risk level is medium, when the number is 4 or 5, the risk level is high, and when the number is 6, the risk level is ultrahigh.

In a preferred embodiment, the fund transaction monitoring model outputs the risk level of different accounts from high to low according to the risk level for easy viewing.

In another aspect, the present invention provides a system for monitoring illegal funding based on fund transaction data, which comprises a data processing module 1, a model analysis module 2, a model parameter module 3 and an output module 4.

The data processing module 1 is used for screening bank running bills, and monitoring items screened in each running water are transmitted to the model analysis module 2.

Preferably, the processing module 1 stores the screened monitoring items in a database for the model analysis module 2 to call.

The monitoring items comprise account information, transaction opponent information and transaction flow information, wherein the account information comprises a trader name/name, a trader identity document type/certification document type, a trader identity document number/certification document number and a bank account number;

the transaction flow information includes transaction ID, transaction date, transaction time, fund receipt and payment mark, transaction amount and currency.

The model analysis module 2 stores a fund transaction monitoring model, and can acquire the monitoring items transmitted by the data processing module 1 and output the risk level of the account after analysis.

The model parameter module 3 can set or modify relevant parameters in the model analysis module 2, wherein the parameters comprise monitoring feature items and monitoring feature threshold values.

The monitoring characteristic items comprise daily transaction scale characteristics, scattered transfer-in characteristics, concentrated transfer-out characteristics, abnormal time transaction characteristics and 24-hour uninterrupted transaction characteristics; the monitoring characteristic threshold comprises a daily transaction number threshold, a daily transaction amount threshold, a single transfer amount threshold, a monthly transaction opponent number threshold, a daily transaction opponent number threshold and an abnormal time transaction number threshold.

In a preferred embodiment, the model parameter module 3 further has a threshold value discussion submodule 31, where the threshold value discussion submodule 31 may send a request for setting up a monitoring feature threshold value and a reason for value to multiple case handling experts through the internet, after the case handling experts finish filling the setting up the feature threshold value and the reason for value, the threshold value discussion submodule 31 checks whether the setting up monitoring feature threshold values filled by the case handling experts are consistent, and if so, uses an average value of the setting up monitoring feature threshold values filled by the multiple experts as a corresponding monitoring feature threshold parameter in the model parameter module 3; if the values are not consistent, the proposed monitoring feature threshold value and the value reason filled by each case handling expert are sent to each case handling expert through the internet, each case handling expert is required to correct the proposed monitoring feature threshold value of the case handling expert and fill the correction reason, the threshold value discussion submodule 31 checks whether the proposed monitoring feature threshold values are consistent again, the process is repeated until the monitoring feature threshold values given by each case handling expert are consistent, wherein the consistency of the monitoring feature threshold values given by each case handling expert means that the discrete coefficient of the monitoring feature threshold values given by each case handling expert is smaller than 0.1.

The output module 4 is used for outputting the analysis result of the model analysis module 2 to be displayed to a user, such as a screen, a printer, etc.

Examples

Example 1

And (4) selecting the fund transaction running water of a certain month in the bank with the most illegal fund collection and opening banks from the illegal fund collection cases confirmed in 2019 for analysis, and establishing a fund transaction monitoring model.

The monitoring characteristic items comprise daily transaction stroke number characteristics (A1 characteristics), daily transaction amount characteristics (A2 characteristics), scatter transfer-in characteristics (B1 characteristics), centralized transfer-out characteristics (B2 characteristics), abnormal time transaction characteristics (C characteristics) and 24-hour uninterrupted transaction characteristics (D characteristics).

Wherein the determination conditions of the B1 feature are as follows: in a certain account, in the same month, the number of the transaction opponents is greater than the threshold value of the number of the monthly transaction opponents, and the single transfer amount is ten thousand and is greater than the threshold value of the single transfer amount;

the determination conditions of the B1 feature are: the account number has a B1 characteristic, and the date that the daily transaction opponent is greater than the daily transaction opponent quantity threshold is in the same month as the B1 characteristic;

in the C characteristic, the abnormal time is 2: 00-4: 00.

The monitoring characteristic threshold values are shown in table two.

Watch two

Monitoring characteristic thresholds	Value taking	Unit of
			Daily transaction count threshold	50	Pen with writing-in function
Daily transaction amount threshold	100	All the details of
			Single-stroke transfer amount threshold	5	All the details of
Monthly transactionsNumber of opponents threshold	50	An
			Daily transaction opponent number threshold	1000	An
Abnormal time transaction count threshold	20	Pen with writing-in function

The fund transaction monitoring model analyzes that the conditions of the monitoring characteristic items of each account are shown in the third table.

Watch III

The risk level settings for the funding transaction monitoring model are shown in table four.

Watch four

The risk levels for the different accounts are output by the funds transaction monitoring model as shown in table five.

Watch five

And comparing the related account number of the confirmed illegal funding case with the output account of the fund transaction monitoring model, and finding that 94 percent of the account numbers of the confirmed illegal funding case correspond to high-risk and ultrahigh-risk items, and 6 percent of the account numbers of the confirmed illegal funding case correspond to medium-risk items.

Examples of the experiments

Experimental example 1

The funding transaction pipeline in example 1 was still analyzed, except that the monitoring characteristic thresholds are as shown in table six,

watch six

The risk levels of different accounts are output through a fund transaction monitoring model, and the fact that under the six parameters in the table, the number of accounts with high risk levels and ultrahigh risk levels is obviously reduced compared with that in the embodiment 1 is found, the probability of the confirmed illegal fund collection case related to the account with the high risk levels and the ultrahigh risk levels is 53%, the probability of the illegal fund collection case corresponding to the medium risk levels is 36%, and the probability of the illegal fund collection case corresponding to the low risk levels is 11%.

The monitoring characteristic threshold provided by the invention can effectively analyze suspected illegal collected resources to obtain the security levels of different accounts, and the obtained security levels of the accounts have high accuracy and can provide early warning for related personnel.

The invention has been described in detail with reference to specific embodiments and illustrative examples, but the description is not intended to be construed in a limiting sense. Those skilled in the art will appreciate that various equivalent substitutions, modifications or improvements may be made to the technical solution of the present invention and its embodiments without departing from the spirit and scope of the present invention, which fall within the scope of the present invention. The scope of the invention is defined by the appended claims.

Claims

1. A method for monitoring illegal funding behavior based on fund transaction data is characterized in that,

and monitoring suspected illegal funding collecting behaviors is realized by analyzing the fund transaction flow.

2. The method of analyzing the relationship of persons according to claim 1, comprising the steps of:

s1, establishing a fund transaction monitoring model;

s2, setting a monitoring characteristic threshold;

3. The method for monitoring illegal funding activities based on fund transaction data according to claim 2, wherein,

4. The method for monitoring illegal funding activities based on fund transaction data according to claim 3,

5. The method for monitoring illegal funding activities based on fund transaction data according to claim 4,

6. The method for monitoring illegal funding activities based on fund transaction data according to claim 3,

7. The method for monitoring illegal funding activities based on fund transaction data according to claim 2, wherein,

in step S2, the daily transaction count threshold is 40-60 strokes; the daily transaction amount threshold value is 80-150 ten thousand; the threshold value of the transferred sum of a single stroke is 3-7 ten thousand; the number threshold value of the monthly transaction opponents is 40-60; the daily transaction counter-party number threshold value is 800-1200; the threshold value of the number of transactions in the abnormal time is 11-30.

8. The method for monitoring illegal funding activities based on fund transaction data according to claim 2, wherein,

9. The method for monitoring illegal funding activities based on fund transaction data according to claim 2, wherein,

10. A system for monitoring illegal funding behaviors based on fund transaction data is characterized by comprising a data processing module 1, a model analysis module 2, a model parameter module 3 and an output module 4.