CN114638704A - Illegal fund transfer identification method and device, electronic equipment and storage medium - Google Patents
Illegal fund transfer identification method and device, electronic equipment and storage medium Download PDFInfo
- Publication number
- CN114638704A CN114638704A CN202210361935.7A CN202210361935A CN114638704A CN 114638704 A CN114638704 A CN 114638704A CN 202210361935 A CN202210361935 A CN 202210361935A CN 114638704 A CN114638704 A CN 114638704A
- Authority
- CN
- China
- Prior art keywords
- account
- directed graph
- information
- accounts
- nodes
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q40/00—Finance; Insurance; Tax strategies; Processing of corporate or income taxes
- G06Q40/04—Trading; Exchange, e.g. stocks, commodities, derivatives or currency exchange
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/04—Architecture, e.g. interconnection topology
- G06N3/044—Recurrent networks, e.g. Hopfield networks
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/04—Architecture, e.g. interconnection topology
- G06N3/045—Combinations of networks
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/08—Learning methods
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q40/00—Finance; Insurance; Tax strategies; Processing of corporate or income taxes
- G06Q40/02—Banking, e.g. interest calculation or account maintenance
Abstract
The invention discloses an identification method and device for illegal fund transfer, electronic equipment and a storage medium, and relates to the field of financial technology, wherein the identification method comprises the following steps: the method comprises the steps of obtaining a plurality of account information, constructing a directed graph based on the account information, calculating similarity between nodes with connecting edges based on customer information and account attribute information, calculating weight parameters of the connecting edges based on the similarity, constructing an adjacent matrix based on the weight parameters, constructing a feature set of the directed graph based on the adjacent matrix, inputting the feature set into a preset integrated model for recognition, and obtaining a recognition result. The invention solves the technical problem that the identification accuracy of illegal fund transfer behaviors is low because proper characteristics cannot be extracted for complicated illegal fund transfer in the related technology.
Description
Technical Field
The invention relates to the field of financial science and technology, in particular to an illegal fund transfer identification method and device, electronic equipment and a storage medium.
Background
Illegal fund transfer is a process of masking illegal sources of funds obtained or generated by criminal activities to mask the link between the funds and the original criminal activity, and currently every year large amounts of illegal funds are washed away, and illegal fund transferors attempt to further separate the funds from their sources by using divisions to mask criminal clues.
In the related art, some clustering algorithms, such as clustering, Decision trees of neural networks, are used for identifying the illegal fund transfer, and most of the time, the identification of the illegal fund transfer needs the manual judgment of financial practitioners, which is time-consuming and labor-consuming. The existing method for identifying the illegal fund transfer has the following defects: (1) aiming at transferring illegal funds through frequent and complex transfer transactions, covering the source and destination of the illegal funds, and being incapable of extracting proper characteristics, the clustering and common neural network algorithm only considers the judgment of transfer information between two account numbers, and for frequent transfer transactions, deeper transaction information cannot be captured through the transaction condition between the two account numbers under the condition of longer transaction link; (2) an illegal fund transfer person can select multi-account small-amount transfer under most conditions, and the transfer records between two accounts are consistent with normal transfer, so that the problem of low accuracy in identifying illegal fund transfer behaviors is easily caused; (3) for the manual judgment of professional financial practitioners, the illegal fund transfer behavior recognition is carried out in the presence of massive financial transaction data, and the efficiency is low.
In view of the above problems, no effective solution has been proposed.
Disclosure of Invention
The embodiment of the invention provides an illegal fund transfer identification method and device, electronic equipment and a storage medium, which are used for at least solving the technical problem that the identification accuracy of illegal fund transfer behaviors is low due to the fact that appropriate characteristics cannot be extracted for complex illegal fund transfer in the related technology.
According to an aspect of an embodiment of the present invention, there is provided an illegal fund transfer identification method, including: acquiring a plurality of account information, and constructing a directed graph based on the account information, wherein the account information at least comprises: the directed graph takes accounts as nodes, and under the condition that the transfer information exists between the accounts, a connecting edge between the nodes represented by the accounts is established; calculating similarity between nodes with connecting edges based on the customer information and the account attribute information; calculating a weight parameter of the connecting edge based on the similarity, and constructing an adjacency matrix based on the weight parameter; and constructing a feature set of the directed graph based on the adjacency matrix, inputting the feature set into a preset integrated model for recognition, and obtaining a recognition result, wherein the recognition result is used for indicating whether illegal fund transfer exists between accounts.
Optionally, the step of constructing a directed graph based on the account information includes: taking an account as a node in the directed graph; judging whether transfer records exist between every two accounts or not based on the transfer information in the account information; and under the condition that transfer records exist among accounts, establishing a connecting edge among the nodes represented by the accounts to obtain the directed graph.
Optionally, the step of calculating similarity between nodes with connecting edges based on the customer information and the account attribute information includes: classifying the characteristic variables in the customer information and the characteristic variables in the account attribute information to obtain discrete variables and continuous variables; under the condition that the type of the characteristic variable is a discrete variable, calculating a first similarity between nodes with connecting edges by adopting a first calculation formula; under the condition that the type of the characteristic variable is a continuous variable, calculating a second similarity between nodes with connecting edges by adopting a second calculation formula; and combining the first similarity and the second similarity to obtain the similarity between the nodes with the connecting edges.
Optionally, after constructing the directed graph based on the account information, the method further includes: and removing the loop in the directed graph to obtain the loop-free directed graph.
Optionally, after removing the loop in the directed graph to obtain a loop-free directed graph, the method further includes: judging whether historical account transfer information exists between accounts indicated by nodes with connecting edges within a preset historical time period; under the condition that historical transfer information exists in a preset historical time period between accounts indicated by nodes with connecting edges, calculating a third similarity between current transfer information and the historical transfer information; and removing a connecting edge between the nodes represented by the account under the condition that the third similarity is greater than a first preset threshold value.
Optionally, after removing the loop in the directed graph to obtain a loop-free directed graph, the method further includes: calculating account balance differences between accounts indicated by nodes with connecting edges; and removing a connecting edge between the nodes represented by the account when the account balance difference is smaller than a second preset threshold value.
Optionally, the step of constructing the feature set of the directed graph based on the adjacency matrix includes: normalizing the adjacency matrix to obtain normalized weight parameters; multiplying the feature vector of the account indicated by each node in the directed graph by the normalized weight parameter to obtain a target feature vector; and integrating the target feature vectors of all accounts to obtain the feature set.
According to another aspect of the embodiments of the present invention, there is also provided an illegal fund transfer identification device, including: the first construction unit is used for acquiring a plurality of account information and constructing a directed graph based on the account information, wherein the account information at least comprises: the directed graph takes accounts as nodes, and under the condition that the transfer information exists between the accounts, a connecting edge between the nodes represented by the accounts is established; a first calculation unit configured to calculate a similarity between nodes having a connection edge based on the customer information and the account attribute information; the second calculation unit is used for calculating the weight parameter of the connecting edge based on the similarity and constructing an adjacent matrix based on the weight parameter; and the second construction unit is used for constructing the feature set of the directed graph based on the adjacency matrix, inputting the feature set into a preset integrated model for identification, and obtaining an identification result, wherein the identification result is used for indicating whether illegal fund transfer exists between accounts.
Optionally, the first building unit comprises: the first characterization module is used for taking an account as one node in the directed graph; the first judgment module is used for judging whether a transfer record exists between every two accounts or not based on the transfer information in the account information; and the first establishing module is used for establishing a connecting edge between the nodes represented by the accounts to obtain the directed graph under the condition that transfer records exist between the accounts.
Optionally, the first computing unit comprises: the first classification module is used for classifying the characteristic variables in the customer information and the characteristic variables in the account attribute information to obtain discrete variables and continuous variables; the first calculation module is used for calculating a first similarity between nodes with connecting edges by adopting a first calculation formula under the condition that the type of the characteristic variable is a discrete variable; the second calculation module is used for calculating a second similarity between nodes with connecting edges by adopting a second calculation formula under the condition that the type of the characteristic variable is a continuous variable; and the first combination module is used for combining the first similarity and the second similarity to obtain the similarity between the nodes with the connecting edges.
Optionally, the identification apparatus further comprises: and the first removing module is used for removing the loop in the directed graph after the directed graph is constructed based on the account information to obtain the loop-free directed graph.
Optionally, the identification apparatus further comprises: the second judgment module is used for judging whether historical account transfer information exists between accounts indicated by nodes with connecting edges in a preset historical time period after removing loops in the directed graph and obtaining a directed graph without loops; the third calculation module is used for calculating a third similarity between the current transfer information and the historical transfer information under the condition that the historical transfer information exists in a preset historical time period between accounts indicated by nodes with connecting edges; and the second removing module is used for removing the connecting edges between the nodes represented by the account under the condition that the third similarity is greater than a first preset threshold value.
Optionally, the identification apparatus further comprises: the fourth calculation module is used for calculating account balance difference between accounts indicated by nodes with connecting edges after removing loops in the directed graph to obtain a loop-free directed graph; and the third removing module is used for removing the connecting edge between the nodes represented by the account under the condition that the account balance difference is smaller than a second preset threshold value.
Optionally, the second building unit comprises: the first processing module is used for carrying out normalization processing on the adjacency matrix to obtain normalized weight parameters; the first output module is used for multiplying the feature vector of the account indicated by each node in the directed graph by the normalized weight parameter to obtain a target feature vector; and the second output module is used for integrating the target characteristic vectors of all accounts to obtain the characteristic set.
According to another aspect of the embodiments of the present invention, there is also provided a computer-readable storage medium, where the computer-readable storage medium includes a stored computer program, and when the computer program runs, the apparatus where the computer-readable storage medium is located is controlled to execute the above method for identifying an illegal fund transfer.
According to another aspect of the embodiments of the present invention, there is also provided an electronic device, including one or more processors and a memory, where the memory is used for storing one or more programs, and when the one or more programs are executed by the one or more processors, the one or more processors are enabled to implement the above-mentioned illegal fund transfer identification method.
In the method, a plurality of account information is obtained, a directed graph is constructed based on the account information, the similarity between nodes with connecting edges is calculated based on customer information and account attribute information, the weight parameters of the connecting edges are calculated based on the similarity, an adjacent matrix is constructed based on the weight parameters, the feature set of the directed graph is constructed based on the adjacent matrix, and the feature set is input into a preset integrated model for identification to obtain an identification result. According to the method and the device, a directed graph among accounts associated with transfer can be constructed, the weight parameters of the connecting edges are calculated based on account information of the accounts in the directed graph, an adjacency matrix is constructed, the feature set of the directed graph is constructed, the feature set is input into a preset integration model to identify illegal fund transfer, appropriate features in an illegal fund transfer mode of frequently transferring accounts can be extracted, the accuracy rate of identifying illegal fund transfer behaviors is improved, and the technical problem that the identification accuracy rate of the illegal fund transfer behaviors is low due to the fact that the appropriate features cannot be extracted for complicated illegal fund transfer in the related technology is solved.
Drawings
The accompanying drawings, which are included to provide a further understanding of the invention and are incorporated in and constitute a part of this application, illustrate embodiment(s) of the invention and together with the description serve to explain the invention without limiting the invention. In the drawings:
FIG. 1 is a flow chart of an alternative method of identifying an illegal fund transfer according to an embodiment of the present invention;
FIG. 2 is a schematic diagram of attribute information of an alternative account node according to an embodiment of the invention;
FIG. 3 is a schematic diagram of an alternative directed graph with loops according to an embodiment of the present invention;
FIG. 4 is a schematic diagram of an alternative directed graph of a drop loop according to an embodiment of the present invention;
FIG. 5 is a schematic illustration of an alternative sample equilibration in accordance with embodiments of the present invention;
FIG. 6 is a schematic diagram of an alternative set of build features in accordance with embodiments of the present invention;
FIG. 7 is a schematic diagram of an alternative model structure according to an embodiment of the invention;
FIG. 8 is a schematic view of an alternative illegal funds transfer identifying apparatus according to an embodiment of the present invention;
fig. 9 is a block diagram of a hardware configuration of an electronic device (or mobile device) for an illegal fund transfer recognition method according to an embodiment of the present invention.
Detailed Description
In order to make the technical solutions of the present invention better understood, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.
It should be noted that the terms "first," "second," and the like in the description and claims of the present invention and in the drawings described above are used for distinguishing between similar elements and not necessarily for describing a particular sequential or chronological order. It is to be understood that the data so used is interchangeable under appropriate circumstances such that the embodiments of the invention described herein are capable of operation in sequences other than those illustrated or described herein. Furthermore, the terms "comprises," "comprising," and "having," and any variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, system, article, or apparatus that comprises a list of steps or elements is not necessarily limited to those steps or elements expressly listed, but may include other steps or elements not expressly listed or inherent to such process, method, article, or apparatus.
It should be noted that the method and the device for identifying illegal fund transfer in the present disclosure may be used in the field of financial technology for identifying illegal fund transfer, and may also be used in any field other than the field of financial technology for identifying illegal fund transfer.
It should be noted that, the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for presentation, analyzed data, etc.) referred to in the present disclosure are information and data authorized by the user or sufficiently authorized by each party.
The embodiments of the invention described below may be applied to various systems/applications/devices that identify illegal funds transfers. Aiming at transferring illegal funds through frequent and complex transfer transactions and hiding the illegal fund transfer mode of the source and destination of the illegal funds, the illegal funds can be identified through a graph volume method and an integration algorithm, each account number is used as a node, edges are established among the account numbers with transfer actions, a directed graph is established, weight parameters of the connecting edges are calculated based on account information of the accounts in the directed graph, an adjacent matrix is established, a feature set of the directed graph is obtained, the feature set is input into a preset integration model to identify the illegal fund transfer, chain type features in the transfer can be captured by using a graph structure, the integration algorithm is used, the identification is carried out based on the obtained features, and the accuracy rate of identifying the illegal fund transfer behaviors can be effectively improved.
The present invention will be described in detail below with reference to examples.
Example one
In accordance with an embodiment of the present invention, there is provided an illegal funds transfer identification method embodiment, it should be noted that the steps illustrated in the flowchart of the accompanying drawings may be performed in a computer system such as a set of computer-executable instructions, and that while a logical order is illustrated in the flowchart, in some cases the steps illustrated or described may be performed in an order different than here.
FIG. 1 is a flow chart of an alternative method of identifying an illegal fund transfer according to an embodiment of the present invention, as shown in FIG. 1, comprising the steps of:
step S101, obtaining a plurality of account information, and constructing a directed graph based on the account information, wherein the account information at least comprises: the method comprises the steps that customer information, account attribute information, transfer information and a directed graph take accounts as nodes, and under the condition that transfer information exists between the accounts, connecting edges between the nodes represented by the accounts are established.
Step S102, calculating the similarity between the nodes with the connecting edges based on the customer information and the account attribute information.
And S103, calculating a weight parameter of the connecting edge based on the similarity, and constructing an adjacent matrix based on the weight parameter.
And step S104, constructing a feature set of the directed graph based on the adjacency matrix, inputting the feature set into a preset integrated model for identification, and obtaining an identification result, wherein the identification result is used for indicating whether illegal fund transfer exists between accounts.
Through the steps, the account information can be obtained, the directed graph is constructed on the basis of the account information, the similarity between nodes with the connecting edges is calculated on the basis of the customer information and the account attribute information, the weight parameters of the connecting edges are calculated on the basis of the similarity, the adjacent matrix is constructed on the basis of the weight parameters, the feature set of the directed graph is constructed on the basis of the adjacent matrix, and the feature set is input into the preset integrated model to be identified, so that the identification result is obtained. In the embodiment of the invention, a directed graph among accounts associated with transfer can be constructed, the weight parameters of the connecting edges are calculated based on the account information of the accounts in the directed graph, and an adjacency matrix is constructed, so that the feature set of the directed graph is constructed, the feature set is input into a preset integrated model for illegal fund transfer identification, the appropriate features in an illegal fund transfer mode for frequently transferring accounts can be extracted, the accuracy rate for identifying illegal fund transfer behaviors is improved, and the technical problem that the identification accuracy rate of the illegal fund transfer behaviors is low due to the fact that the appropriate features cannot be extracted for complicated illegal fund transfer in the related technology is solved.
The following will explain the embodiments of the present invention in detail with reference to the above steps.
Step S101, obtaining a plurality of account information, and constructing a directed graph based on the account information, wherein the account information at least comprises: the method comprises the steps that customer information, account attribute information, transfer information and a directed graph take accounts as nodes, and under the condition that transfer information exists between the accounts, connecting edges between the nodes represented by the accounts are established.
In the embodiment of the present invention, account information may be obtained first, and the account information may include: in the embodiment, accounts may be used as nodes, and in the case of transfer information between accounts, connection edges between nodes representing the accounts may be established, so as to obtain a directed graph, where the account nodes may include some attribute information.
Fig. 2 is a schematic diagram of attribute information of an optional account node according to an embodiment of the present invention, and as shown in fig. 2, the account node may include attribute information such as customer basic information, account basic information, and transfer basic information, where the customer basic information includes: gender, age, household registration location, etc., and the account basic information includes: account opening address, bank, account type, account opening time and the like, and the basic information of account transfer comprises: amount, date, route of transfer, etc.
Optionally, the step of constructing a directed graph based on the account information includes: taking the account as a node in the directed graph; judging whether transfer records exist between every two accounts or not based on transfer information in the account information; and under the condition that transfer records exist among the accounts, establishing a connecting edge among the nodes represented by the accounts to obtain a directed graph.
In the embodiment of the invention, an account can be used as a node in the directed graph, whether transfer records exist between every two accounts is judged based on the transfer information in the account information, and if the transfer records exist between the accounts, a connecting edge between the nodes represented by the account is established, so that the directed graph is obtained.
Optionally, after constructing the directed graph based on the account information, the method further includes: and removing the loop in the directed graph to obtain the loop-free directed graph.
In the embodiment of the invention, the graph is easy to generate a loop by taking the transfer action as an edge, a large amount of repeated calculation is easy to generate for the graph with the loop when the characteristic calculation is carried out by using the adjacency matrix, and the corresponding edge needs to be removed according to the transfer information characteristics among account numbers so as to avoid the generation of the loop.
In this embodiment, to avoid an invalid calculation amount caused by a loop, the loop in the directed graph is removed to obtain a loop-free directed graph.
FIG. 3 is a schematic diagram of an alternative directed graph with loops, as shown in FIG. 3, according to an embodiment of the present invention, including: accounts 1 through 7, where there is a loop between account 4 and account 3, a loop between account 3 and account 2, and connecting edges between account 5 and account 3, account 2 and account 1, account 6 and account 2, and account 7 and account 6.
Fig. 4 is a schematic diagram of an alternative directed graph of a drop loop according to an embodiment of the present invention, as shown in fig. 4, including: account 1 to account 7, where there are connecting edges between account 4 and account 3, account 3 and account 2, account 5 and account 3, account 2 and account 1, account 6 and account 2, and account 7 and account 6, fig. 4 is a loop-free directed graph obtained by removing the loops in fig. 3.
Optionally, after removing the loop in the directed graph to obtain a loop-free directed graph, the method further includes: judging whether historical account transfer information exists between accounts indicated by nodes with connecting edges within a preset historical time period; under the condition that historical transfer information exists in a preset historical time period between accounts indicated by nodes with connecting edges, calculating a third similarity between current transfer information and the historical transfer information; and under the condition that the third similarity is larger than a first preset threshold value, removing connecting edges among the nodes represented by the account.
In the embodiment of the invention, after the loop in the directed graph is removed, some suspicious transfers can be removed, and the suspicious transfers are more concerned, so that the calculation amount is reduced. In this embodiment, it may be calculated whether the current edge (the connecting edge between two account nodes currently having transfer records) has a transfer record or not at a historical time (i.e. whether historical transfer information exists between accounts indicated by the nodes having the connecting edge within a preset historical time period or not), if there is historical transfer information between accounts indicated by nodes having connected edges within a preset historical period of time, calculating the similarity (i.e., the third similarity) of the two transfers (i.e., the current transfer information and the historical transfer information), in the case that the third similarity is greater than the first preset threshold (which may be set according to actual conditions), it indicates that the two account numbers frequently have the transfer before, possibly, the account numbers are trusted, the suspiciousness of the two account numbers in the transfer is reduced, and connecting edges between nodes represented by the two account numbers can be removed.
Optionally, after removing the loop in the directed graph to obtain a loop-free directed graph, the method further includes: calculating account balance differences between accounts indicated by nodes with connecting edges; and removing a connecting edge between the nodes represented by the account under the condition that the account balance difference is smaller than a second preset threshold value.
In the embodiment of the present invention, a balance difference between two account numbers during transfer may be calculated (that is, an account balance difference between accounts indicated by nodes having a connection edge is calculated), the purpose of illegal fund transfer is to aggregate amounts, the smaller the balance difference between two accounts is, the smaller the doubtability is, and the connection edge between nodes represented by the accounts may be removed in the case that the account balance difference is smaller than a second preset threshold (which may be set according to actual circumstances).
Step S102, calculating the similarity between the nodes with the connecting edges based on the customer information and the account attribute information.
Optionally, the step of calculating the similarity between nodes with connecting edges based on the customer information and the account attribute information includes: classifying the characteristic variables in the customer information and the characteristic variables in the account attribute information to obtain discrete variables and continuous variables; under the condition that the type of the characteristic variable is a discrete variable, calculating a first similarity between nodes with connecting edges by adopting a first calculation formula; under the condition that the type of the characteristic variable is a continuous variable, calculating a second similarity between nodes with connecting edges by adopting a second calculation formula; and combining the first similarity and the second similarity to obtain the similarity between the nodes with the connecting edges.
In this embodiment of the present invention, a similarity between the customer basic information and the account basic information in the adjacent nodes may be calculated, so as to obtain a similarity between nodes having the connection edges (that is, calculating a similarity between nodes having connection edges based on the customer information and the account attribute information), specifically: the characteristic variables in the customer information and the characteristic variables in the account attribute information can be divided into discrete variables and continuous variables, the discrete variables can be discretized variables such as gender and account opening address, and the continuous variables can be quantified variables such as age. For discrete variables, the formula for calculating similarity is
(i.e. calculating a first similarity between nodes with connecting edges by using a first calculation formula, wherein x is a feature vector of one account (consisting of discrete variables of the account), y is a feature vector of another account (consisting of discrete variables of the account), and n is the length of the feature vector), and for a continuous variable, the formula for calculating the similarity can be the Euclidean distance plus the reciprocal of one
(i.e. calculating a second similarity between nodes with connecting edges by using a second calculation formula, where x is a feature vector of one account (consisting of continuous variables of the account) and y is a feature vector of another account (consisting of continuous variables of the account)), then combining the first similarity and the second similarity to obtain a similarity D between nodes with connecting edges (i.e. using a formula D ═ D)1+kD2And calculating to obtain a similarity D, wherein K is a super parameter, and the super parameter K is added in the calculation of D, so that the similarity of two accounts is smaller and the constructed edge weight is larger through training).
And S103, calculating a weight parameter of the connecting edge based on the similarity, and constructing an adjacent matrix based on the weight parameter.
In the embodiment of the present invention, the more dissimilar the account attributes are, the more likely the illegal funds transfer is (the similarity may be determined according to the account attributes, for example, whether an account opening bank is in the same city, whether basic customer information is in the same region, whether a bank is crossed, and the like).
Table 1 is an alternative adjacency matrix constructed based on accounts 1 through 4, as shown in table 1, indicating that the similarity between account 3 and account 3 is minimal.
TABLE 1
Alternatively, after constructing the adjacency matrix (i.e., the similarity matrix D), the attention matrix may be calculated by the following specific calculation formula:
wherein Z is a hidden vector matrix obtained by the similarity matrix D and the input features h,
obtained by using a nonlinear function sigma through a current node and adjacent nodes thereof, i represents an ith account node, j represents a jth account node, l represents a current layer, and
computing an attention matrix
After the attention matrix is obtained, the next layer features are calculated
n represents all adjacent account node numbers of a certain account node, k represents the current k-th adjacent account node, and w represents a shared parameter matrix.
And step S104, constructing a feature set of the directed graph based on the adjacency matrix, inputting the feature set into a preset integrated model for identification, and obtaining an identification result, wherein the identification result is used for indicating whether illegal fund transfer exists between accounts.
In the embodiment of the present invention, when nodes and edges in a graph are constructed (i.e., after a directed graph is constructed), an integrated model may be trained to identify an illegal fund transfer behavior, for example, as in fig. 4, assuming that account 2 transfers to account 1 as an illegal fund transfer behavior, a series of account characteristics (i.e., a characteristic set of accounts related to each link) obtained through a constructed directed graph structure are used to identify characteristics of a current transfer, where the series of account characteristics is obtained from account 4 to account 3 to account 2 to account 1, from account 5 to account 3 to account 2 to account 1, from account 7 to account 6 to account 2 to account 1, and the like, and then result identification may be performed through an lgb light Gradient Boosting algorithm in the integrated algorithm.
In this embodiment, the feature set of the directed graph may be constructed based on the adjacency matrix, and then the feature set is input into the preset integration model for identification, so as to identify whether an illegal fund transfer condition exists between the accounts.
Optionally, before the identification, the sample may be balanced (for example, using a boottrap algorithm) specifically: samples of correct prediction examples in the prediction model can be taken out separately, Gaussian noise is added into the data, and the data are placed into a training set again for training. The purpose of sample equilibration is mainly two: (1) in order to balance the training samples, the imbalance of precision and recall rate caused by the imbalance of the number of positive examples and negative examples is avoided; (2) and adding noise into the correct positive sample to be put into the model for retraining, so that the generalization capability of the model is increased.
Fig. 5 is a schematic diagram of an optional sample balancing according to an embodiment of the present invention, and as shown in fig. 5, the feature of the anti-money laundering data obtained by the graph convolution is input to a Boost-ing integrated prediction model for prediction (i.e., the Boost-ing integrated prediction model is an optional integrated model for recognition in a preset integrated model), whether the positive example of the correct prediction is determined, and then gaussian noise is added to perform the graph convolution again to obtain the feature of the anti-money laundering data.
Optionally, the step of constructing a feature set of the directed graph based on the adjacency matrix includes: carrying out normalization processing on the adjacency matrix to obtain normalized weight parameters; multiplying the feature vector of the account indicated by each node in the directed graph by the normalized weight parameter to obtain a target feature vector; and integrating the target feature vectors of all accounts to obtain a feature set.
In the embodiment of the invention, the adjacency matrix may be normalized to obtain normalized weight parameters, then the feature vector of the account indicated by each node in the directed graph is multiplied by the normalized weight parameters to obtain target feature vectors, then the target feature vectors of all accounts are integrated to obtain feature sets (i.e., the multidimensional vectors are compressed into one-dimensional vectors), and the obtained feature sets are input into the integrated model for identification to identify whether the current transfer behavior is an illegal fund transfer behavior. For example, the fund transfer path from account 4 to account 3 to account 2 to account 1 in fig. 4 can be taken as an example to describe in detail how to obtain the feature set of the directed graph.
Fig. 6 is a schematic diagram of an optional feature set construction according to an embodiment of the present invention, as shown in fig. 6, for a directed graph of a fund transfer path from account 4 to account 3 to account 2 to account 1 in fig. 4, a feature set of account 4 (i.e., a feature set of attribute information included in the account) may be multiplied by an edge weight 4- >3 (i.e., a weight parameter of a connecting edge between account node 4 and account node 3), a feature set of account 3 (i.e., a feature set of attribute information included in the account) may be multiplied by an edge weight 3- >2 (i.e., a weight parameter of a connecting edge between account node 3 and account node 2), a feature set of account 2 (i.e., a feature set of attribute information included in the account) may be multiplied by an edge weight 2- >1 (i.e., a weight parameter of a connecting edge between account node 2 and account node 1), the account 1 feature set (i.e. the feature set of the attribute information included in the account) is subjected to summation calculation to obtain the input features of the recognition model (i.e. the feature set, which is used for inputting to the integration model for recognition).
Alternatively, the step of constructing a predicted feature set comprises: the method comprises the steps that a fund pool among a series of accounts flows in the transfer process of anti-money washing each time, when money washing behavior is found, current transfer funds flow through a plurality of account numbers, after the construction of nodes and edges of the relationship between the accounts and the accounts is completed according to a graph structure, the characteristics of the current transfer funds are calculated through a graph attention convolution neural network to extract, account transfer characteristics obtained through the graph volume comprise account characteristics for performing a series of fund transfer operations with the account transfer characteristics, a sequence is formed among account chains for transfer, and the characteristic text based on the sequence models the money washing behavior in a modeling and prediction mode based on a Long and Short Term Model (LSTM).
FIG. 7 is a diagram illustrating an alternative model structure according to an embodiment of the present invention, as shown in FIG. 7, where the symbol σ corresponds to the s igmoid function, τIn response to the function of tanh,
in order to be a matrix addition,
for matrix dot multiplication, ft represents that a certain information function in the past is forgotten to be selected, it represents that the current information function is memorized, C-t represents a function for combining the past and the current memory, ot represents an output function, when money laundering is formed by transferring from account number-1 and account number-2 to account number-n, modeling prediction is carried out by using an LSTM model, each account number generates two variables C and h after calculation of a nonlinear function (wherein C represents transfer information of a previous account number transferred to a current account number parameter, h represents a hidden variable of the current account number characteristic passed through the nonlinear function parameter), hn of a last account number is taken as a final prediction characteristic of the current money laundering, prediction is carried out by using a simple full-connection network (namely DDIs prediction), and the feature of the money laundering sequence data can be transferred from a more important characteristic in a starting account number to a last account number for prediction by prediction of the LSTM model, the accuracy of the prediction can be improved.
In the embodiment of the invention, the directed graph constructed by the account information of the account can well capture the characteristics in the illegal fund transfer mode of frequently transferring funds, the accuracy rate of identifying the illegal fund transfer mode of frequently transferring funds can be improved by utilizing the extracted characteristics, and more financial crimes can be avoided.
Example two
The illegal fund transfer recognition device provided in this embodiment includes a plurality of implementation units, and each implementation unit corresponds to each implementation step in the first embodiment.
Fig. 8 is a schematic diagram of an alternative illegal funds transfer identifying apparatus according to an embodiment of the present invention, as shown in fig. 8, the identifying apparatus may include: a first building element 80, a first calculating element 81, a second calculating element 82, a second building element 83, wherein,
the first constructing unit 80 is configured to obtain a plurality of account information, and construct a directed graph based on the account information, where the account information at least includes: the method comprises the steps that customer information, account attribute information and transfer information are obtained, a directed graph takes accounts as nodes, and under the condition that transfer information exists between the accounts, connecting edges between the nodes represented by the accounts are established;
a first calculation unit 81 for calculating the similarity between nodes having connected edges based on the customer information and the account attribute information;
a second calculating unit 82, configured to calculate a weight parameter of the connecting edge based on the similarity, and construct an adjacency matrix based on the weight parameter;
and the second constructing unit 83 is configured to construct a feature set of the directed graph based on the adjacency matrix, and input the feature set into the preset integration model for identification to obtain an identification result, where the identification result is used to indicate whether an illegal fund transfer exists between accounts.
The identification device can acquire a plurality of account information through the first construction unit 80, construct a directed graph based on the account information, calculate the similarity between nodes with connecting edges based on the customer information and the account attribute information through the first calculation unit 81, calculate the weight parameters of the connecting edges based on the similarity through the second calculation unit 82, construct an adjacent matrix based on the weight parameters, construct the feature set of the directed graph based on the adjacent matrix through the second construction unit 83, and input the feature set into a preset integrated model for identification to obtain an identification result. In the embodiment of the invention, a directed graph among accounts associated with transfer can be constructed, the weight parameters of the connecting edges are calculated based on the account information of the accounts in the directed graph, and an adjacency matrix is constructed, so that the feature set of the directed graph is constructed, the feature set is input into a preset integrated model for illegal fund transfer identification, the appropriate features in an illegal fund transfer mode for frequently transferring accounts can be extracted, the accuracy rate for identifying illegal fund transfer behaviors is improved, and the technical problem that the identification accuracy rate of the illegal fund transfer behaviors is low due to the fact that the appropriate features cannot be extracted for complicated illegal fund transfer in the related technology is solved.
Optionally, the first building unit includes: the first characterization module is used for taking the account as a node in the directed graph; the first judgment module is used for judging whether a transfer record exists between every two accounts or not based on the transfer information in the account information; the first establishing module is used for establishing a connecting edge between nodes represented by the accounts to obtain a directed graph under the condition that transfer records exist among the accounts.
Optionally, the first calculating unit includes: the first classification module is used for classifying the characteristic variables in the customer information and the characteristic variables in the account attribute information to obtain discrete variables and continuous variables; the first calculation module is used for calculating a first similarity between nodes with connecting edges by adopting a first calculation formula under the condition that the type of the characteristic variable is a discrete variable; the second calculation module is used for calculating a second similarity between the nodes with the connecting edges by adopting a second calculation formula under the condition that the type of the characteristic variable is a continuous variable; and the first combination module is used for combining the first similarity and the second similarity to obtain the similarity between the nodes with the connecting edges.
Optionally, the identification apparatus further includes: and the first removing module is used for removing the loop in the directed graph after the directed graph is constructed based on the account information to obtain the loop-free directed graph.
Optionally, the identification apparatus further includes: the second judgment module is used for judging whether historical account transfer information exists between accounts indicated by nodes with connecting edges in a preset historical time period after a loop in the directed graph is removed and a loop-free directed graph is obtained; the third calculation module is used for calculating a third similarity between the current transfer information and the historical transfer information under the condition that the historical transfer information exists in a preset historical time period between accounts indicated by nodes with connecting edges; and the second removing module is used for removing the connecting edge between the nodes represented by the account under the condition that the third similarity is greater than the first preset threshold value.
Optionally, the identification apparatus further includes: the fourth calculation module is used for calculating account balance difference between accounts indicated by nodes with connecting edges after removing loops in the directed graph to obtain a loop-free directed graph; and the third removing module is used for removing the connecting edge between the nodes represented by the account under the condition that the account balance difference is smaller than a second preset threshold value.
Optionally, the second building unit includes: the first processing module is used for carrying out normalization processing on the adjacency matrix to obtain normalized weight parameters; the first output module is used for multiplying the feature vector of the account indicated by each node in the directed graph by the normalized weight parameter to obtain a target feature vector; and the second output module is used for integrating the target characteristic vectors of all accounts to obtain the characteristic set.
The above-mentioned identification device may further comprise a processor and a memory, and the above-mentioned first construction unit 80, the first calculation unit 81, the second calculation unit 82, the second construction unit 83, etc. are all stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to implement the corresponding functions.
The processor comprises a kernel, and the kernel calls a corresponding program unit from the memory. The kernel can be set to be one or more than one, and the feature set is input into a preset integrated model for recognition by adjusting kernel parameters to obtain a recognition result.
The memory may include volatile memory in a computer readable medium, Random Access Memory (RAM) and/or nonvolatile memory such as Read Only Memory (ROM) or flash memory (flash RAM), and the memory includes at least one memory chip.
The present application further provides a computer program product adapted to perform a program for initializing the following method steps when executed on a data processing device: the method comprises the steps of obtaining a plurality of account information, constructing a directed graph based on the account information, calculating the similarity between nodes with connecting edges based on customer information and account attribute information, calculating the weight parameters of the connecting edges based on the similarity, constructing an adjacent matrix based on the weight parameters, constructing the feature set of the directed graph based on the adjacent matrix, and inputting the feature set into a preset integrated model for identification to obtain an identification result.
According to another aspect of the embodiments of the present invention, there is also provided a computer-readable storage medium, which includes a stored computer program, wherein when the computer program runs, the apparatus where the computer-readable storage medium is located is controlled to execute the above-mentioned illegal fund transfer identification method.
According to another aspect of embodiments of the present invention, there is also provided an electronic device, including one or more processors and a memory for storing one or more programs, wherein the one or more programs, when executed by the one or more processors, cause the one or more processors to implement the above-described method of identifying an illegal fund transfer.
Fig. 9 is a block diagram of a hardware configuration of an electronic device (or mobile device) for an identification method of illegal fund transfer according to an embodiment of the present invention. As shown in fig. 9, the electronic device may include one or more (shown as 102a, 102b, … …, 102 n) processors 102 (the processors 102 may include, but are not limited to, a processing device such as a microprocessor MCU or a programmable logic device FPGA), and memory 104 for storing data. Besides, the method can also comprise the following steps: a display, an input/output interface (I/O interface), a Universal Serial Bus (USB) port (which may be included as one of the ports of the I/O interface), a network interface, a keyboard, a power supply, and/or a camera. It will be understood by those skilled in the art that the structure shown in fig. 9 is only an illustration and is not intended to limit the structure of the electronic device. For example, the electronic device may also include more or fewer components than shown in FIG. 9, or have a different configuration than shown in FIG. 9.
The above-mentioned serial numbers of the embodiments of the present invention are merely for description and do not represent the merits of the embodiments.
In the above embodiments of the present invention, the descriptions of the respective embodiments have respective emphasis, and for parts that are not described in detail in a certain embodiment, reference may be made to related descriptions of other embodiments.
In the embodiments provided in the present application, it should be understood that the disclosed technology can be implemented in other ways. The above-described embodiments of the apparatus are merely illustrative, and for example, the division of the units may be a logical division, and in actual implementation, there may be another division, for example, multiple units or components may be combined or integrated into another system, or some features may be omitted, or not executed. In addition, the shown or discussed mutual coupling or direct coupling or communication connection may be an indirect coupling or communication connection through some interfaces, units or modules, and may be in an electrical or other form.
The units described as separate parts may or may not be physically separate, and parts displayed as units may or may not be physical units, may be located in one position, or may be distributed on a plurality of units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of the embodiment.
In addition, functional units in the embodiments of the present invention may be integrated into one processing unit, or each unit may exist alone physically, or two or more units are integrated into one unit. The integrated unit can be realized in a form of hardware, and can also be realized in a form of a software functional unit.
The integrated unit, if implemented in the form of a software functional unit and sold or used as a stand-alone product, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present invention may be embodied in the form of a software product, which is stored in a storage medium and includes instructions for causing a computer device (which may be a personal computer, a server, or a network device) to execute all or part of the steps of the method according to the embodiments of the present invention. And the aforementioned storage medium includes: a U-disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a removable hard disk, a magnetic or optical disk, and other various media capable of storing program codes.
The foregoing is only a preferred embodiment of the present invention, and it should be noted that, for those skilled in the art, various modifications and amendments can be made without departing from the principle of the present invention, and these modifications and amendments should also be considered as the protection scope of the present invention.
Claims (10)
1. A method for identifying an illegal fund transfer, comprising:
acquiring a plurality of account information, and constructing a directed graph based on the account information, wherein the account information at least comprises: the directed graph takes accounts as nodes, and under the condition that the transfer information exists between the accounts, a connecting edge between the nodes represented by the accounts is established;
calculating similarity between nodes with connecting edges based on the customer information and the account attribute information;
calculating a weight parameter of the connecting edge based on the similarity, and constructing an adjacent matrix based on the weight parameter;
and constructing a feature set of the directed graph based on the adjacency matrix, inputting the feature set into a preset integrated model for recognition, and obtaining a recognition result, wherein the recognition result is used for indicating whether illegal fund transfer exists between accounts.
2. The identification method according to claim 1, wherein the step of constructing a directed graph based on the account information comprises:
taking an account as a node in the directed graph;
judging whether transfer records exist between every two accounts or not based on the transfer information in the account information;
and under the condition that transfer records exist among accounts, establishing a connecting edge among the nodes represented by the accounts to obtain the directed graph.
3. The method according to claim 1, wherein the step of calculating the similarity between nodes having connected edges based on the customer information and the account attribute information comprises:
classifying the characteristic variables in the customer information and the characteristic variables in the account attribute information to obtain discrete variables and continuous variables;
under the condition that the type of the characteristic variable is a discrete variable, calculating a first similarity between nodes with connecting edges by adopting a first calculation formula;
under the condition that the type of the characteristic variable is a continuous variable, calculating a second similarity between nodes with connecting edges by adopting a second calculation formula;
and combining the first similarity and the second similarity to obtain the similarity between the nodes with the connecting edges.
4. The identification method according to claim 1, further comprising, after constructing a directed graph based on the account information:
and removing the loop in the directed graph to obtain the loop-free directed graph.
5. The identification method according to claim 4, wherein after removing the loop in the directed graph to obtain a loop-free directed graph, further comprising:
judging whether historical transfer information exists between accounts indicated by nodes with connecting edges within a preset historical time period;
under the condition that historical transfer information exists in a preset historical time period between accounts indicated by nodes with connecting edges, calculating a third similarity between current transfer information and the historical transfer information;
and removing a connecting edge between the nodes represented by the account under the condition that the third similarity is greater than a first preset threshold value.
6. The identification method according to claim 4, wherein after removing the loop in the directed graph to obtain a loop-free directed graph, further comprising:
calculating account balance differences between accounts indicated by nodes with connecting edges;
and removing a connecting edge between the nodes represented by the account when the account balance difference is smaller than a second preset threshold value.
7. The identification method according to claim 1, wherein the step of constructing the feature set of the directed graph based on the adjacency matrix comprises:
normalizing the adjacency matrix to obtain normalized weight parameters;
multiplying the feature vector of the account indicated by each node in the directed graph by the normalized weight parameter to obtain a target feature vector;
and integrating the target feature vectors of all accounts to obtain the feature set.
8. An apparatus for identifying an illegal fund transfer, comprising:
the first construction unit is used for acquiring a plurality of account information and constructing a directed graph based on the account information, wherein the account information at least comprises: the directed graph takes accounts as nodes, and under the condition that the transfer information exists between the accounts, a connecting edge between the nodes represented by the accounts is established;
a first calculation unit configured to calculate a similarity between nodes having a connection edge based on the customer information and the account attribute information;
the second calculation unit is used for calculating the weight parameter of the connecting edge based on the similarity and constructing an adjacent matrix based on the weight parameter;
and the second construction unit is used for constructing the feature set of the directed graph based on the adjacency matrix, inputting the feature set into a preset integrated model for identification, and obtaining an identification result, wherein the identification result is used for indicating whether illegal fund transfer exists between accounts.
9. A computer-readable storage medium, comprising a stored computer program, wherein the computer program, when executed, controls a device in which the computer-readable storage medium is located to perform the method for identifying an illegal fund transfer according to any one of claims 1-7.
10. An electronic device comprising one or more processors and memory storing one or more programs, wherein the one or more programs, when executed by the one or more processors, cause the one or more processors to implement the method of identifying an illegal fund transfer of any one of claims 1 to 7.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210361935.7A CN114638704A (en) | 2022-04-07 | 2022-04-07 | Illegal fund transfer identification method and device, electronic equipment and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210361935.7A CN114638704A (en) | 2022-04-07 | 2022-04-07 | Illegal fund transfer identification method and device, electronic equipment and storage medium |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN114638704A true CN114638704A (en) | 2022-06-17 |
Family
ID=81952666
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202210361935.7A Pending CN114638704A (en) | 2022-04-07 | 2022-04-07 | Illegal fund transfer identification method and device, electronic equipment and storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN114638704A (en) |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN117035433A (en) * | 2023-10-10 | 2023-11-10 | 中国建设银行股份有限公司 | Illegal funds transfer customer identification method and device |
| CN117236721A (en) * | 2023-11-09 | 2023-12-15 | 湖南财信数字科技有限公司 | Monitoring method, system, computer equipment and storage medium for enterprise abnormal behavior |
-
2022
- 2022-04-07 CN CN202210361935.7A patent/CN114638704A/en active Pending
Cited By (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN117035433A (en) * | 2023-10-10 | 2023-11-10 | 中国建设银行股份有限公司 | Illegal funds transfer customer identification method and device |
| CN117035433B (en) * | 2023-10-10 | 2023-12-22 | 中国建设银行股份有限公司 | Illegal funds transfer customer identification method and device |
| CN117236721A (en) * | 2023-11-09 | 2023-12-15 | 湖南财信数字科技有限公司 | Monitoring method, system, computer equipment and storage medium for enterprise abnormal behavior |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| TWI709086B (en) | Neural network system and method for analyzing relationship network graph | |
| CN107133865B (en) | Credit score obtaining and feature vector value output method and device | |
| US8355896B2 (en) | Co-occurrence consistency analysis method and apparatus for finding predictive variable groups | |
| CN108898476A (en) | A kind of loan customer credit-graded approach and device | |
| US20210264448A1 (en) | Privacy preserving ai derived simulated world | |
| CN114638704A (en) | Illegal fund transfer identification method and device, electronic equipment and storage medium | |
| JP2019511037A (en) | Method and device for modeling machine learning model | |
| CN111080397A (en) | Credit evaluation method and device and electronic equipment | |
| WO2021164373A1 (en) | Directed network detection method, computer readable storage medium, and related device | |
| CN111428217B (en) | Fraudulent party identification method, apparatus, electronic device and computer readable storage medium | |
| CN111325619A (en) | Credit card fraud detection model updating method and device based on joint learning | |
| CN113159922A (en) | Data flow direction identification method, device, equipment and medium | |
| CN114187112A (en) | Training method of account risk model and determination method of risk user group | |
| Sharma et al. | Machine learning model for credit card fraud detection-a comparative analysis. | |
| Devi et al. | Fraud detection in credit card transactions by using classification algorithms | |
| CN111062444A (en) | Credit risk prediction method, system, terminal and storage medium | |
| CN110163245A (en) | Class of service prediction technique and system | |
| CN113689218A (en) | Risk account identification method and device, computer equipment and storage medium | |
| US11921821B2 (en) | System and method for labelling data for trigger identification | |
| Sharma et al. | Credit card fraud detection using deep learning based on auto-encoder | |
| CN114445210A (en) | Detection method and detection device for abnormal transaction behaviors and electronic equipment | |
| CN114240659A (en) | Block chain abnormal node identification method based on dynamic graph convolutional neural network | |
| CN107463564A (en) | The characteristic analysis method and device of data in server | |
| US20230316394A1 (en) | Pairing and grouping user profiles accessed from pre-current systems | |
| CN117350461B (en) | Enterprise abnormal behavior early warning method, system, computer equipment and storage medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |