CN114549006A

CN114549006A - Group mining method, device, equipment and readable storage medium

Info

Publication number: CN114549006A
Application number: CN202210168389.5A
Authority: CN
Inventors: 赵岩岩
Original assignee: Du Xiaoman Technology Beijing Co Ltd
Current assignee: Du Xiaoman Technology Beijing Co Ltd
Priority date: 2022-02-23
Filing date: 2022-02-23
Publication date: 2022-05-27

Abstract

The invention discloses a group mining method, which abandons the traditional mode of fixedly carrying out networking analysis by transaction relationship, starts from the service type to carry out analysis and determines the corresponding networking mode, wherein aiming at the condition that the transaction relationship can not be used for carrying out group drawing, the data relationship is analyzed according to the corresponding service scene to obtain the networking relationship and analyze the availability of the networking relationship, thereby screening the relationship which can be used for networking, then screening nodes of suspicious transaction, and finally mining the group of the suspicious transaction after the group drawing is formed according to the selected networking relationship. The invention also discloses a ganging digging device, equipment and a readable storage medium, which have corresponding technical effects.

Description

Group mining method, device, equipment and readable storage medium

Technical Field

The invention relates to the technical field of security guarantee, in particular to a ganged mining method, a ganged mining device, ganged mining equipment and a readable storage medium.

Background

The group mining is an important component in the anti-money laundering monitoring system, and mainly comprises the steps of identifying a group money laundering mode in money laundering and identifying close contact clients of suspicious clients. The existing group mining scheme generally applies transaction relations to carry out networking, forms a directed graph according to the payment and receipt relations, and then mines close-contact clients of various types of suspicious clients as group cases to carry out early warning.

The group partner mining scheme for networking by applying the transaction relationship is only suitable for the situation that the ratio of private transactions (number of strokes and amount of money) in a private scene or actual service is large, effective mining identification cannot be realized in other service scenes, and the application range is narrow.

In summary, how to implement effective group mining under various service scenarios is a technical problem that those skilled in the art urgently need to solve at present.

Disclosure of Invention

The invention aims to provide a group mining method, a group mining device, a group mining equipment and a readable storage medium, so as to realize effective group mining under various service scenes.

In order to solve the technical problems, the invention provides the following technical scheme:

a method of gang mining comprising:

receiving user transaction data;

determining a graph forming mode according to the transaction type in the service scene corresponding to the user transaction data;

if the graph combination mode is determined to be a transaction relation graph combination mode, constructing an association network for the user transaction data according to transaction relations;

if the group diagram mode is determined to be other relation group diagrams, extracting the client association relation in the user transaction data;

screening the customer association relation according to a networking rule to obtain a candidate networking relation;

if the candidate group gateway system is a strong relation group graph, constructing an associated network for the user transaction data according to a candidate networking relation;

if the candidate group gateway system is a weak relation group diagram, screening suspicious customers in the user transaction data according to the candidate group network relation to construct an associated network;

and performing suspicious client and group networking analysis thereof according to the association network to obtain a group mining result.

Optionally, the determining a group diagram mode according to the transaction type in the service scenario corresponding to the user transaction data includes:

if the business scene corresponding to the user transaction data only corresponds to private transactions, determining the business scene as the transaction relation group graph;

if the business scene corresponding to the user transaction data only has the public transportation easiness, determining the business scene as the other relation group diagram;

if the business scene corresponding to the user transaction data comprises private transactions and public transactions, determining a main transaction type of a risk transaction scene in the business scene; if the main transaction type is private transaction, determining the main transaction type as the transaction relationship group diagram; and if the main transaction type is the bus transaction, determining the main transaction type as the other relation group diagram.

Optionally, the screening the customer association relationship according to the networking screening rule includes:

rejecting the relation without distinction in the client association relation to obtain a first relation;

determining the transaction data volume corresponding to each first relation, and eliminating the relation that the transaction data volume is not in a first range to obtain a second relation;

determining a value set of each second relation, and eliminating the relation that the magnitude of the value set is not in a second range to obtain a third relation;

rejecting a value set without distinction in the third relation to obtain a fourth relation;

and taking the fourth relation as the candidate networking relation.

Optionally, the screening suspicious customers in the user transaction data according to the candidate networking relationship to construct an associated network includes:

screening out suspicious customers in the user transaction data to obtain a suspicious customer set;

determining whether the total amount of the set of suspicious customers is greater than a threshold;

if so, constructing the association network by using a strong relation networking mode to serve as an original group graph; carrying out community mining on the original group graph to obtain a suspicious community set; constructing an associated network by using the candidate networking relation in a suspicious community set;

if not, constructing a correlation network for the suspicious client set according to the candidate networking relation.

Optionally, after the screening the customer association relationship according to the networking rule to obtain a candidate networking relationship, the method further includes: and eliminating abnormal values in the candidate networking relations.

A gang digging implement comprising:

the data receiving unit is used for receiving user transaction data;

the group diagram mode determining unit is used for determining a group diagram mode according to the transaction type in the service scene corresponding to the user transaction data;

the transaction relation group diagram unit is used for establishing an association network for the user transaction data according to the transaction relation if the group diagram mode is determined to be a transaction relation group diagram;

the other relation determining unit is used for extracting the customer incidence relation in the user transaction data if the group diagram mode is determined to be other relation group diagrams;

the relationship screening unit is used for screening the client association relationship according to a networking rule to obtain a candidate networking relationship;

the strong relation group graph unit is used for constructing an associated network for the user transaction data according to the candidate networking relation if the candidate networking gateway is a strong relation group graph;

the weak relation group graph unit is used for screening suspicious clients in the user transaction data according to the candidate group network relation to construct an association network if the candidate group gateway system is a weak relation group graph;

and the association network analysis unit is used for performing suspicious client and group partner networking analysis thereof according to the association network to obtain a group partner mining result.

Optionally, the group diagram mode determining unit includes:

a private-oriented determining subunit, configured to determine that the transaction relationship group diagram is obtained if only private transactions exist in the service scenario corresponding to the user transaction data;

the public traffic determining subunit is used for determining the user transaction data as the other relation group diagram if only the business scene corresponding to the user transaction data is easy to the public traffic;

the mixed determining subunit is used for determining the main transaction type of the risk transaction scene in the service scene if the service scene corresponding to the user transaction data comprises private transactions and public transactions; if the main transaction type is a private-to-private transaction, determining the main transaction type as the transaction relationship group diagram; and if the main transaction type is the public transaction, determining the main transaction type as the other relationship group diagram.

Optionally, the relationship screening unit includes:

the first processing subunit is used for eliminating the relationship without distinction in the client association relationship to obtain a first relationship;

the second processing subunit is used for determining the transaction data volume corresponding to each first relation, and eliminating the relation that the transaction data volume is not in the first range to obtain a second relation;

the third processing subunit is configured to determine a value set of each second relationship, and eliminate a relationship in which the magnitude of the value set is not within a second range, so as to obtain a third relationship;

a fourth processing subunit, configured to remove a value set without distinction in the third relationship, so as to obtain a fourth relationship;

and the determining subunit is configured to use the fourth relationship as the candidate networking relationship.

A computer device, comprising:

a memory for storing a computer program;

a processor for implementing the steps of the above-described group mining method when executing the computer program.

A readable storage medium having stored thereon a computer program which, when executed by a processor, carries out the steps of the above-described group mining method.

The method provided by the embodiment of the invention provides a group digging scheme suitable for various application scenes, which abandons the traditional mode of fixedly carrying out networking analysis by transaction relationship, starts from service type analysis and determines a corresponding networking mode, wherein aiming at the condition that the transaction relationship cannot be used for grouping pictures, the data relationship is analyzed according to the corresponding service scene to obtain the networking relationship and analyze the availability of the networking relationship, further the networking relationship which can be used for networking is screened, then the nodes of suspicious transactions are screened, and finally the group of suspicious transactions is mined according to the selected relationship group pictures, the scheme explains the realization process of utilizing the selected relationship group pictures from selecting candidate networking relationship, analyzing the candidate relationship, determining the group picture relationship and digging the most effective group picture mode under different service scenes, and universal group mining networking analysis is realized.

Accordingly, the embodiment of the present invention further provides a group mining device, a device and a readable storage medium corresponding to the group mining method, which have the above technical effects and are not described herein again.

Drawings

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the related art, the drawings used in the description of the embodiments or the related art will be briefly described below, it is obvious that the drawings in the following description are only some embodiments of the present invention, and for those skilled in the art, other drawings can be obtained according to these drawings without any creative work.

FIG. 1 is a schematic diagram of an anti-money laundering architecture;

FIG. 2 is a flow chart of a group mining method according to an embodiment of the present invention;

FIG. 3 is a schematic diagram illustrating an overall design of a group mining group diagram scheme according to an embodiment of the present invention;

fig. 4 is a schematic structural diagram of a gang digging apparatus according to an embodiment of the present invention;

fig. 5 is a schematic structural diagram of a computer device according to an embodiment of the present invention.

Detailed Description

The core of the invention is to provide a group mining method, which can realize effective group mining under various service scenes.

In order that those skilled in the art will better understand the disclosure, the invention will be described in further detail with reference to the accompanying drawings and specific embodiments. It is to be understood that the described embodiments are merely exemplary of the invention, and not restrictive of the full scope of the invention. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the scope of protection of the present invention.

As shown in fig. 1, the overall anti-money laundering architecture is schematically illustrated, and the overall anti-money laundering system includes a database module, a monitoring function module, and an auditing module. In the monitoring function module, the functions mainly include list monitoring, suspicious monitoring, risk rating, large amount monitoring, due diligence investigation, risk event, data statistics, etc., wherein the suspicious monitoring is an important component in the monitoring module, and is mainly used for routinely monitoring transactions in various scenes, acquiring clients with abnormal transactions and performing early warning, and the invention belongs to one of suspicious monitoring functions in the anti-money laundering monitoring module, namely money laundering group discovery in fig. 1, which is hereinafter referred to as "group mining".

The existing group mining scheme generally applies a transaction relationship to networking, forms a directed graph (all edges are directed graphs) according to a collection and payment relationship, and then mines various types of groups, such as distributed transfer into and out of a set, centralized transfer into and out of a set, fast forward and fast out, and the like. Suspicious group cases can be found out through a community discovery technology; if the nodes or edges are filtered, a suspicious client association network can be formed, and close contact clients of the suspicious clients are found out through a graph mining algorithm to serve as a group case for early warning.

The group partner mining scheme for networking by applying the transaction relationship is only suitable for the situation that the proportion of private transactions (number of strokes and amount of money) in a private scene or actual service is large, if the business scene is large in the proportion of public transportation, when a transaction relationship group diagram is still used, a super node with a merchant as the center is formed, the final diagram is a large diagram formed by sub-diagrams with a plurality of super nodes as the centers, the relationship or the closeness degree between a user and the user cannot be obtained, no contribution degree is provided for subsequent diagram mining and other works, and at the moment, suspicious group partners cannot be obtained after the sub-diagrams are divided according to a network formed by the transaction relationship.

Based on this, in order to ensure effective group mining under various service scenarios, the present invention provides a group mining method, please refer to fig. 2, fig. 2 is a flowchart of a group mining method in an embodiment of the present invention, and the method mainly includes the following steps:

s101, receiving user transaction data;

user transaction data are obtained from the anti-money laundering data warehouse, the user transaction data mainly comprise customer attribute information, transaction data of a period of time (a period of time is 1-2 months according to daily transaction flow magnitude), and the like, and after the user transaction data are received, step S102 is started.

S102, determining a graph forming mode according to a transaction type in a service scene corresponding to user transaction data;

when group mining is carried out, the traditional scheme is to use transaction relations to carry out group drawing and construct a directed graph. However, in some service scenarios, private transactions do not exist, or the occupation ratio of private transactions is low, or money laundering of a single-node client in the private services is low, and aiming at the problem, the invention provides targeted service scenario analysis for each group mining to analyze the transaction types in the service scenarios, such as public transactions only, private transactions only, or public transactions and private transactions simultaneously, so that the corresponding group diagram mode is further matched according to the transaction types, and the adaptive adjustment of the group diagram mode is realized to meet the requirements of different application scenarios.

The transaction types can be classified into public transport transactions (which means transactions between users and merchants) and private transactions (which means transactions between users), and the graph forming mode can be classified as follows: trading relationship group diagrams, and other relationship group diagrams (which refer to the manner of relationship group diagrams in addition to trading relationships in the present invention). The trading relation group diagram is as follows: each transaction is composed of information data such as a payer and a payee, transaction time, transaction location, transaction amount and the like, two parties of the transaction can be used as nodes (vertexes), transaction relations are used as edges, the payer points to the payee, information such as kenen location, transaction amount and the like is used as attribute data of the edges, and then multiple transactions can form a network (graph); the other relationship group diagrams are: networking using relationships other than trading to mine the partnership. The group diagram is as follows: customers (users or merchants) act as nodes (vertices), some relationship between customers acts as edges, and a graph (network) of nodes and edges.

Specifically, the implementation method for determining the graph forming mode according to the transaction type in the service scenario corresponding to the user transaction data is not limited in this embodiment, and may be determined according to the risk transaction type in the risk service scenario, or the main risk transaction type in the main service scenario, or the main transaction type in the risk service scenario, or the risk transaction type in the main service scenario. The determined corresponding relation between the transaction type to be detected and the pattern combining mode is as follows: for private transaction, the corresponding transaction relation group diagram is shown, and for public transaction, the corresponding other relation group diagram is shown.

S103, if the graph forming mode is determined to be a transaction relation graph forming mode, establishing an association network for user transaction data according to the transaction relation;

the construction of the association network using the transaction relationship may refer to the implementation manner of the related art, and is not limited herein. Specifically, two schemes can be used, one scheme is that transaction data is directly used for group drawing, a transaction link diagram is obtained, and through visual analysis, subgraph division, community discovery and the like of the transaction link diagram, suspicious money laundering modes such as scattered transfer-concentrated transfer-out, concentrated transfer-scattered transfer-out, fast-in fast-out or frequent-in-transfer-out, chain transaction structures, annular transaction structures, nested annular transaction structures and other abnormal transaction structures can be discovered, pivot customers are excavated, even key suspicious customers connected with a plurality of subgraphs are connected, and fund movement and intimate contact nodes are analyzed;

the other scheme is that the transaction and the nodes (clients of the transaction) are filtered, the clients with high money washing suspicious degree are screened out from the amount, the number of times, the transaction time period, the transaction place, the transaction scene, the attributes of the clients and the like, and after the suspicious clients are combined into a graph, the closely-connected suspicious clients are mined to serve as a group case. Mining close-contact suspicious clients as a group case such as: in a formed graph (association relationship network), sub-graph division is carried out, a (strong) communication sub-graph is analyzed (wherein communication means that, for example, a path from a vertex A to a vertex B is connected, the graph is called as a communication graph, any two vertexes in the communication graph are communicated, the graph is called as a communication graph, further, the communicated directed graph is called as a strong communication graph), a preliminary suspicious group candidate set is obtained by applying a community discovery technology, and after a series of rules and strategies are used for screening the suspicious group candidate set and clients in the group, the group case is early warned.

In this embodiment, only the two above-mentioned ways of using transaction relationships to construct the association network are taken as examples for description, and all other ways of constructing the association network based on transaction relationships can refer to the description of this embodiment, which is not repeated herein.

S104, if the graph forming mode is determined to be other relation graph forming, extracting the customer incidence relation in the user transaction data;

and if the group diagram mode is determined to be other relation group diagrams, acquiring the association relation of the customers except for the transaction. The client association relationship is an intermediary that can connect two clients (nodes), and the common client association relationship includes, in addition to a transaction relationship, an equipment and equipment fingerprint, a bank card number, a mobile phone number, an IP, a place (an actual transaction place, an identity card attribution, an IP attribution, a mobile phone number attribution, a delivery address, a receiving address and the like), a transaction scene or a transaction type, a client self attribute (various addresses or places of daily use, occupation (unit), a user portrait, a person of payment, a close-related client and other attention, browsing information, an attached card or a binding card, an invitation relationship of various preferential activities) and the like. Through the analysis of data (analyzing the data obtained from the database, including customer attribute data, transaction data and the like, and extracting the relationship which can connect two customers together from the data, compared with the attribute information such as a mobile phone number, the same IP, the same receiving address and the like, and also two customers who have transacted can be connected together), the group diagram relationship candidate set in the user transaction data is selected.

S105, screening the association relation of the client according to the networking rule to obtain a candidate networking relation;

after all the customer incidence relations in the user transaction data are extracted, a set networking screening rule is called to screen the customer incidence relations, the networking screening rule in the invention refers to a rule for screening networking relations which are suitable for networking analysis and have strong distinctiveness and proper magnitude, and the networking screening rule can be specifically set according to an actual service scene, and is not limited herein.

After screening, a large number of client association relations which lack distinctiveness and are not suitable for networking can be filtered, and the screened relations are used as candidate networking relations. It should be noted that there may be one candidate networking relationship or a plurality of candidate networking relationships, and the candidate networking relationships are not limited herein.

In addition, in order to avoid interference of abnormal data on networking analysis and improve analysis accuracy, after the client association relation is screened according to the networking rule to obtain a candidate networking relation, abnormal values in the candidate networking relation can be further eliminated before the association network is constructed in the following steps, and specific values in the candidate relation are screened, for example, when a candidate networking gateway system is an IP relation, a public network IP address and a local area network address can be removed, a value with a certain client magnitude exceeding the capacity of a server is extremely high, a value with a certain client magnitude being extremely low, and the like. Of course, this step may not be performed, and this is not limited in this embodiment.

S106, if the candidate group gateway system is a strong relation group diagram, establishing an associated network for the user transaction data according to the candidate group network relation;

and judging whether the screened candidate networking relationship is a strong relationship, if so, executing the step S106, and if so, executing the step S107. The strong relationship is a relationship that can definitely connect two nodes like a transaction relationship, a relationship of relatives, and the like, and is a close relationship. If the candidate group gateway is a strong relation group diagram, which shows that the candidate networking relation has the capability of closely connecting the user transaction data for networking, the candidate networking relation can be directly utilized for group diagram. The graph forming scheme may be to directly form a directed graph or an undirected graph (all edges are undirected graphs) according to the relationship, or may be to form a directed graph or an undirected graph after the suspicious nodes are screened, and a specific scheme may be preferentially performed, which is not limited herein.

It should be noted that there may be more than one candidate networking relationship that is screened out, if the candidate networking relationship includes both the strong relationship group diagram and the weak relationship group diagram, at this time, the network may be constructed in the manner of S106 and the manner of S107 for the user transaction data, and simultaneously, the analysis of step S108 is started according to two associated networks, or multiple relationships may be simultaneously placed on one diagram, then a label is made for each relationship, and the value of the label is taken as the value of the edge attribute.

S107, if the candidate group gateway is a weak relation group graph, screening suspicious clients in the user transaction data according to the candidate group network relation to construct an associated network;

the weak relation refers to a collective relation with a large volume, such as the same company, the same province city, the same district and the like, and obviously all people in the weak relation are not closely related.

And S108, performing suspicious client and group networking analysis thereof according to the associated network to obtain a group mining result.

And carrying out subgraph division in the formed association relationship network (graph), analyzing (strongly) communicated subgraphs, applying a community discovery technology to obtain a primary suspicious group candidate set, and carrying out early warning on the suspicious group candidate set and clients in the groups by screening the suspicious group candidate set and the clients in the groups through a series of rules and strategies.

The method for screening the suspicious group candidate set and the clients in the group can be specifically screened from the aspects of the average transaction amount, the average transaction number, the risk transaction number and amount of the group, the age, occupation, account number and sales number of the group clients, the transaction number and amount of the sales clients and the like by referring to the implementation mode in the related technology; suspicious groups can be mined by using a deep learning algorithm such as GCN (graph convolutional neural network); the clustering algorithm may also be used to mine close contacts of suspicious clients to form a group, or a group with high suspicious degree and high money laundering risk is used as a group case, which is only described in the above three implementation manners, and will not be described in detail herein.

Based on the introduction, the technical scheme provided by the embodiment of the invention provides a group partner mining scheme suitable for various application scenes, which abandons the traditional fixed mode of networking analysis by transaction relationship, starts with the analysis of business types and determines the corresponding networking mode, wherein aiming at the condition that the transaction relationship cannot be used for grouping maps, the data relationship is analyzed according to the corresponding business scene to obtain the networking relationship and analyze the availability of the networking relationship, further the relationship which can be used for networking is screened, then the nodes of suspicious transactions are screened, finally the group partner of the suspicious transactions is mined according to the selected networking relationship after grouping maps, the scheme explains the implementation process of utilizing the selected relationship group maps from the selection of candidate networking relationship, the analysis of the candidate relationship and the determination of the group map relationship, and the most effective group map mode under different business scenes is mined, and universal group mining networking analysis is realized.

It should be noted that, based on the above embodiments, the embodiments of the present invention also provide corresponding improvements. The same steps as those in the above-mentioned embodiments or corresponding steps can be referred to each other in the preferred/modified embodiments, and the corresponding advantageous effects can be referred to each other, and are not described in detail in the preferred/modified embodiments herein.

In the foregoing embodiment, an implementation method for determining a group diagram mode according to a transaction type in a service scenario corresponding to user transaction data is not limited in this embodiment, and an implementation method is mainly introduced in this embodiment, and specifically includes the following steps:

(1) if only private transactions exist in the service scene corresponding to the user transaction data, determining the transaction data as a transaction relation group diagram;

(2) if the business scene corresponding to the user transaction data is only easy for public transportation, determining the business scene as other relation group diagrams;

inspecting a service scene, and if the service scene only deals with private transactions, selecting a transaction relationship to group a graph; and if the business scene is only easy for the bus, selecting to use the relation except for the transaction to form a graph.

(3) If the business scene corresponding to the user transaction data comprises private transactions and public transactions, determining the main transaction type of the risk transaction scene in the business scene; if the main transaction type is a private-to-private transaction, determining the main transaction type as a transaction relation group diagram; if the main transaction type is easy to the public transport, the main transaction type is determined as other relation group diagrams.

If the business scene corresponding to the user transaction data contains private transactions and public transactions, the main transaction type of the risk transaction scene in the business scene can be determined, specifically, the risk transaction scene can be determined by performing business analysis on the transaction data, and then, numerical analysis is performed on the transaction data in the risk transaction scene. The purpose of the business analysis is to determine risk transaction scenes, one transaction scene can include private transactions and public transport transactions, and the purpose of the numerical analysis is to analyze main transaction types in the transaction scenes.

The business analysis of the advanced industry generally comprises the steps that anti-money laundering experts evaluate the risk of money laundering scenes (whether the risk is high or strong, management and control is performed, the service is strongly supervised, whether the money laundering loopholes exist in the service, and the like), the existing audit report condition of the related business scenes is inspected, the high-risk client quantity level, the risk event client quantity level, the client quantity level hitting various risk lists and the like in the risk level of the related business scenes are inspected, and the risk business scenes are evaluated through one or more of the factors to obtain the risk business scenes.

And performing numerical analysis on the risk service scene obtained by service analysis, wherein the numerical analysis comprises the acquisition of the proportion of private transactions, the amount of historical reported clients for the private transactions, the amount of high-risk clients of the clients involved in the private transactions and the like, wherein the acquisition of the proportion of the private transactions comprises the ratio of the number of private transactions to the total number of transactions, the ratio of the amount of the private transactions to the total amount of transactions and the like, and the ratio evaluation of the amount of the private transactions is performed through one or more of the factors. If the ratio is near 0.5 (which indicates that the public transaction amount and the private transaction amount are balanced) or the report amount to the client involved in the private transaction or the client amount with high risk level reaches a set threshold (the threshold can be set by a service person or an audit specialist, or a professional anti-money laundering person is asked to judge whether the possibility of money laundering group is existed in the private business scene and the public business scene), the possibility of money laundering group existing in the private business scene and the public business scene is high, and the private business scene and the public business scene can be grouped according to different relationships. If the ratio is near 1, a transaction relationship group graph may be used; if the ratio is near 0, a relationship group graph other than trading may be selected. If only one scene has money laundering group risk, the corresponding scene is switched to, the public scene is switched to other relation group diagrams, and the private scene is switched to a trading relation group diagram.

It should be noted that, in this embodiment, only the determination method of the main transaction type of the risk transaction scenario is described as an example, the risk factors considered in the above method are complete, the transaction type analysis is comprehensive, and accurate determination of the main transaction type of the risk transaction scenario can be ensured, and other implementation manners can refer to the description of this embodiment and are not described herein again.

In the foregoing embodiment, a specific filtering rule for filtering the association relationship of the client according to the networking filtering rule is not limited, and in order to deepen understanding, a relationship filtering manner is provided in this embodiment, which may be specifically implemented according to the following steps:

(1) rejecting the relation which is indistinguishable in the client association relation to obtain a first relation;

filtering the relationship that is not differentiated means that no difference analysis can be implemented between two groups of customers through the relationship, such as a company name relationship, where all customers are connected by one or several white-listed or trusted company names, and the relationship is not differentiated and cannot judge whether a group aggregated by a company relationship has money laundering risk.

The indiscriminate specific rule definition is not limited in this embodiment, and may be defined according to experience, social relationship, and legal relationship knowledge of a technician or an anti-money laundering service person, and is not described herein again.

(2) Determining the transaction data amount corresponding to each first relation, and eliminating the relation that the transaction data amount is not in the first range to obtain a second relation;

in the selected transaction data, a relationship that the transaction data volume in the first relationship is not in a first range is obtained, wherein the first range is an artificially defined transaction data volume screening range, namely the purpose of the step is to select a relationship that the transaction data magnitude is suitable for forming a graph, too much transaction data volume brings a large analysis burden to a machine, and if the transaction data volume is too little, the distinguishing accuracy is low, a transaction proportion which is not empty is screened out, and the filtering ratio is smaller than a certain threshold value. The threshold value can be continuously detected according to the scene of actual business, the magnitude of the transaction, research and development manpower and the like, the relations can be generally sorted according to the ratio, and the relations in the front are selected according to the research manpower and the type of the relations (such as hitting a blacklist (running score betting list of a designated website) of the same user portrait, even if the transaction proportion is not very high, the relations are generally selected to be reserved) to carry out the following steps.

(3) Determining a value set of each second relation, and eliminating the relation that the magnitude of the value set is not in a second range to obtain a third relation;

in the filtered relations, for each group of relations, the size of a set of values of a certain relation owned by a single client is checked, and the size of a certain relation specific value owned by the client magnitude is checked, so that the relation with the proper size of the relation value set is screened out. Specifically, the magnitude of the value set may be determined by looking at one: a single customer has at most a magnitude of different values of the relationship; viewing a second step: each value of the relationship has a customer magnitude; the relationship is selected with magnitude in a certain interval. The boundary threshold of the interval needs to be continuously detected according to the relationship type and the calculation and storage capacity of a server (cluster) used for research and development, and the relationship exceeding the server capacity is filtered, and the relationship with less client magnitude is possessed by each value. In this embodiment, only the two viewing manners are described as an example, and other viewing manners can refer to the description of this embodiment, which is not described herein again.

(4) Rejecting a value set without distinction in the third relation to obtain a fourth relation;

(5) and taking the fourth relation as a candidate networking relation.

Most values in the filtering relationship have no distinguishing relationship. For example, the IP relationship is unavailable when most of the IP relationships are local area networks;

it should be noted that, in this embodiment, only the filtering condition is described as an example, and the rest of the filtering conditions in the actual service may be set correspondingly according to a specific service scenario, which is not described herein again.

In the foregoing embodiment, a specific implementation manner for screening suspicious clients in user transaction data according to a candidate networking relationship to construct an associated network is not limited, and for further understanding, an implementation manner is introduced in this embodiment, which specifically includes the following steps:

(1) screening out suspicious customers in the user transaction data to obtain a suspicious customer set;

and screening suspicious clients (nodes) according to set rules to form a suspicious client set. For the screening method of suspicious clients, the embodiment is not limited, and the specific method includes: 1. use of high-risk customers; using a rule model and an AI model to warn a client; 3. and screening suspicious customers from customer attribute information characteristics, transaction characteristics and the like by using processing rules. In general, in consideration of the number of suspicious customers and monitoring of many suspicious customers as much as possible, the method may be performed using scheme 3, where the screening of suspicious customers also involves work such as adjusting thresholds for features of processing, and the scheme of screening suspicious customers may be performed according to specific service scenarios, and is not described herein again.

(2) Judging whether the total amount of the suspicious customer set is larger than a threshold value; if yes, executing the following step (3); if not, executing the following step (4);

judging whether the total amount of the suspicious client set is greater than a threshold value, if so, indicating that the suspicious clients to be analyzed are large in size and needing fine mining to determine weak relation among a large amount of disordered data; if the number of suspicious clients to be analyzed is not larger than the threshold value, the number of suspicious clients to be analyzed is indicated to be small, and the mining technology difficulty is relatively low.

In this embodiment, an adaptive graph-grouping manner is adopted for different application scenarios (different suspicious client volumes) to improve the overall mining accuracy.

(3) Constructing an associated network by using a strong relation networking mode to serve as an original group graph; carrying out community mining on the original group diagram to obtain a suspicious community set; constructing an associated network in a suspicious community set by using a candidate networking relation;

if the suspicious customer set is large in magnitude, a large graph is formed by using transaction relations or other available strong relations, sub-graph division and community mining (a community mining algorithm is commonly and commonly a Louvain algorithm and the like) are carried out to obtain a suspicious community set, and then a candidate networking relation (weak relation) is used for group graph in the suspicious community set.

(4) And constructing an associated network for the suspicious client set according to the candidate networking relation.

If the suspicious client set is small in magnitude, constructing an association network in the suspicious client set by using a candidate networking relationship (weak relationship) to form an undirected graph or a directed graph (which can be an undirected graph generally).

It should be noted that, in this embodiment, only the above implementation steps are taken as an example to describe the construction of the associated network for the suspicious client in the user transaction data screened according to the candidate networking relationship, and other implementation manners may refer to the description of this embodiment, which is not described herein again.

Fig. 3 is a schematic diagram of an overall design of a group mining group diagram scheme in an embodiment of the present invention, in which a manner of screening suspicious clients in user transaction data according to a candidate group gateway system to construct an association network and a method for determining a group diagram manner in the embodiment are reused on an overall scheme architecture provided in an initial embodiment, so as to embody an overall cooperation scheme, and other specific implementation manners may refer to the description of fig. 3 and are not described herein again.

Corresponding to the above method embodiments, the embodiments of the present invention further provide a group mining apparatus, and the group mining apparatus described below and the group mining method described above may be referred to in correspondence with each other.

Referring to fig. 4, the apparatus includes the following modules:

the data receiving unit 110 is mainly used for receiving user transaction data;

the graph grouping mode determining unit 120 is mainly configured to determine a graph grouping mode according to a transaction type in a service scenario corresponding to the user transaction data;

the transaction relationship group diagram unit 130 is mainly configured to construct an association network for the user transaction data according to the transaction relationship if the diagram group mode is determined to be the transaction relationship group diagram;

the other relationship determining unit 140 is mainly configured to extract a customer association relationship in the user transaction data if it is determined that the group diagram mode is the other relationship group diagram;

the relationship screening unit 150 is mainly used for screening the association relationship of the clients according to the networking rule to obtain a candidate group gateway system;

the strong relationship group diagram unit 160 is mainly used for constructing an association network for the user transaction data according to the candidate group gateway system if the candidate group gateway system is the strong relationship group diagram;

the weak relationship group diagram unit 170 is mainly configured to, if the candidate group gateway system is a weak relationship group diagram, screen suspicious clients in the user transaction data according to the candidate group gateway system to construct an association network;

the associated network analyzing unit 180 is mainly configured to perform suspicious client and group networking analysis thereof according to the associated network, so as to obtain a group mining result.

In an embodiment of the present invention, the graph grouping mode determining unit includes:

the private-pair determining subunit is used for determining the private transaction as a transaction relation group diagram if only private transactions exist in the service scene corresponding to the user transaction data;

the public transaction determining subunit is used for determining the user transaction data as other relation group diagrams if only the business scene corresponding to the user transaction data is easy to the public transport;

the mixed determining subunit is used for determining the main transaction type of the risk transaction scene in the service scene if the service scene corresponding to the user transaction data comprises private transactions and public transport transactions; if the main transaction type is private transaction, determining the main transaction type as a transaction relation group diagram; if the main transaction type is easy to the public transport, the main transaction type is determined to be other relation group diagrams.

In one embodiment of the present invention, the relationship screening unit includes:

the first processing subunit is used for eliminating the relation without distinction in the client association relation to obtain a first relation;

the third processing subunit is used for determining a value set of each second relation, and eliminating the relation of which the magnitude of the value set is not in a second range to obtain a third relation;

the fourth processing subunit is used for eliminating the value sets without distinction in the third relation to obtain a fourth relation;

and the determining subunit is used for taking the fourth relation as a candidate networking relation.

Corresponding to the above method embodiment, the embodiment of the present invention further provides a computer device, and a computer device described below and a group mining method described above may be referred to correspondingly.

The computer device includes:

a memory for storing a computer program;

a processor for implementing the steps of the group mining method of the above method embodiments when executing a computer program.

Specifically, referring to fig. 5, a schematic diagram of a specific structure of a computer device provided in this embodiment is provided, where the computer device may generate a relatively large difference due to different configurations or performances, and may include one or more processors (CPUs) 322 (e.g., one or more processors) and a memory 332, where the memory 332 stores one or more computer applications 342 or data 344. Memory 332 may be, among other things, transient or persistent storage. The program stored in memory 332 may include one or more modules (not shown), each of which may include a sequence of instructions operating on a data processing device. Still further, the central processor 322 may be configured to communicate with the memory 332 to execute a series of instruction operations in the memory 332 on the computer device 301.

The computer apparatus 301 may also include one or more power supplies 326, one or more wired or wireless network interfaces 350, one or more input-output interfaces 358, and/or one or more operating systems 341.

The steps in the above described group mining method may be implemented by the structure of a computer device.

Corresponding to the above method embodiment, the embodiment of the present invention further provides a readable storage medium, and a readable storage medium described below and a group mining method described above may be referred to in correspondence.

A readable storage medium having stored thereon a computer program which, when executed by a processor, carries out the steps of the group mining method of the above method embodiments.

The readable storage medium may be a usb disk, a removable hard disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a magnetic disk or an optical disk, and other various readable storage media capable of storing program codes.

Those of skill would further appreciate that the various illustrative components and algorithm steps described in connection with the embodiments disclosed herein may be implemented as electronic hardware, computer software, or combinations of both, and that the various illustrative components and steps have been described above generally in terms of their functionality in order to clearly illustrate this interchangeability of hardware and software. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the implementation. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present invention.

Claims

1. A method of gang mining, comprising:

receiving user transaction data;

if the group diagram mode is determined to be other relation group diagrams, extracting the customer incidence relation in the user transaction data;

if the candidate group gateway system is a strong relation group graph, constructing an associated network for the user transaction data according to the candidate group network relation;

and performing suspicious client and group networking analysis thereof according to the associated network to obtain a group mining result.

2. The group mining method according to claim 1, wherein the determining a group diagram mode according to the transaction type in the service scenario corresponding to the user transaction data comprises:

if the business scene corresponding to the user transaction data only has private transactions, determining the business scene as the transaction relation group diagram;

if the business scene corresponding to the user transaction data is only easy for public transportation, determining the business scene as the other relation group diagram;

if the business scene corresponding to the user transaction data comprises private transactions and public transactions, determining a main transaction type of a risk transaction scene in the business scene; if the main transaction type is a private-to-private transaction, determining the main transaction type as the transaction relationship group diagram; and if the main transaction type is the bus transaction, determining the main transaction type as the other relation group diagram.

3. The method of claim 1, wherein the filtering the client association according to the networking filtering rule comprises:

and taking the fourth relation as the candidate networking relation.

4. The method of claim 1, wherein the screening suspicious clients in the user transaction data according to the candidate networking relationships to construct a correlation network comprises:

if so, constructing the association network by using a strong relation networking mode to serve as an original group graph; carrying out community mining on the original group graph to obtain a suspicious community set; constructing an associated network in a suspicious community set by using the candidate networking relationship;

5. The method of claim 1, wherein after the screening of the association relationship between the clients according to the networking rule to obtain a candidate networking relationship, the method further comprises: and eliminating abnormal values in the candidate networking relations.

6. A gang excavation apparatus, comprising:

the data receiving unit is used for receiving user transaction data;

the relationship screening unit is used for screening the client association relationship according to networking rules to obtain a candidate networking relationship;

the weak relation group graph unit is used for screening suspicious clients in the user transaction data according to the candidate networking relation to construct an associated network if the candidate networking gateway is a weak relation group graph;

and the associated network analysis unit is used for carrying out suspicious client and group networking analysis thereof according to the associated network to obtain a group mining result.

7. The gang mining device of claim 6, wherein the group pattern determining unit comprises:

the public traffic determining subunit is used for determining the user transaction data as the other relation group diagram if the business scene corresponding to the user transaction data only has public traffic easiness;

a mixed determining subunit, configured to determine a main transaction type of an insurance transaction scenario in a service scenario if a service scenario corresponding to the user transaction data includes a private transaction and a public transaction; if the main transaction type is a private-to-private transaction, determining the main transaction type as the transaction relationship group diagram; and if the main transaction type is the bus transaction, determining the main transaction type as the other relation group diagram.

8. The gang mining device of claim 6, wherein the relationship screening unit comprises:

the third processing subunit is configured to determine a value set of each second relationship, and eliminate a relationship in which the magnitude of the value set is not within a second range to obtain a third relationship;

9. A computer device, comprising:

a memory for storing a computer program;

a processor for implementing the steps of the method of gang mining as claimed in any one of claims 1 to 5 when executing the computer program.

10. A readable storage medium, having stored thereon a computer program which, when being executed by a processor, carries out the steps of the group mining method according to any one of claims 1 to 5.