CN116012152A - Method, device and equipment for identifying abnormal transaction entity and readable storage medium - Google Patents
Method, device and equipment for identifying abnormal transaction entity and readable storage medium Download PDFInfo
- Publication number
- CN116012152A CN116012152A CN202211102463.XA CN202211102463A CN116012152A CN 116012152 A CN116012152 A CN 116012152A CN 202211102463 A CN202211102463 A CN 202211102463A CN 116012152 A CN116012152 A CN 116012152A
- Authority
- CN
- China
- Prior art keywords
- transaction
- abnormal
- entity
- community
- abnormal transaction
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Images
Landscapes
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
Abstract
The invention discloses a method for identifying abnormal transaction entities, which comprises the following steps: acquiring a transaction data set, and constructing an initial transaction map based on the transaction data set; predicting each transaction data in the transaction data set by using an abnormal transaction data prediction model obtained based on the composite feature vector training; when the predicted result is that abnormal transaction data exists in the transaction data set, determining and marking an initial abnormal transaction entity set in the initial transaction map to obtain a target transaction map; carrying out transaction community division on the target transaction graph by using a Louvian community discovery algorithm to obtain a community transaction graph; and carrying out abnormal transaction entity investigation by combining the community transaction map and the initial abnormal transaction entity set to obtain a target abnormal transaction entity set. The method and the device improve the accuracy and the effectiveness of monitoring the abnormal transaction data and reduce the probability of missing the abnormal transaction entity identification. The invention also discloses a device, equipment and a storage medium, which have corresponding technical effects.
Description
Technical Field
The present invention relates to the field of artificial intelligence, and in particular, to a method, apparatus, device and computer readable storage medium for identifying abnormal transaction entities.
Background
In recent years, the amount of abnormal transactions has been increasing, and the pressure for managing transaction risk has been increasing. In this regard, financial institutions need to increase the regulatory investment for abnormal transactions.
The existing abnormal transaction entity identification method is to create a plurality of transaction monitoring standard rule models; acquiring current transaction information, calling account history information of a target entity based on entity identification of the target entity, and generating a plurality of monitoring data sets according to the current transaction information and the account history information; and inputting the monitoring data set into the corresponding transaction monitoring standard rule model, outputting whether the monitoring data set hits the abnormal transaction judgment rule set by the corresponding transaction monitoring standard rule model, and further determining whether the target entity is an abnormal transaction entity.
However, the type characteristics of the abnormal transaction are fast in change, and the information acquisition of the financial institutions is delayed, so that the monitoring standard is difficult to optimize in time, the accuracy and the effectiveness of the monitoring standard are difficult to ensure in the existing abnormal transaction entity identification method, and the identification omission of the abnormal transaction entity is easy to cause.
In summary, how to effectively solve the problems of the existing abnormal transaction entity identification method, that the accuracy and the effectiveness of the monitoring standard are difficult to be ensured, and the identification omission of the abnormal transaction entity is easy to be caused, is a problem which needs to be solved by the technicians in the field at present.
Disclosure of Invention
The invention aims to provide an abnormal transaction entity identification method, which greatly improves the accuracy and the effectiveness of monitoring abnormal transaction data, enlarges the identification range of the abnormal transaction entity and reduces the identification omission probability of the abnormal transaction entity; another object of the present invention is to provide an apparatus, a device and a computer-readable storage medium for identifying abnormal transaction entities.
In order to solve the technical problems, the invention provides the following technical scheme:
a method of identifying an abnormal transaction entity, comprising:
acquiring a transaction data set, and constructing an initial transaction map based on the transaction data set;
predicting each transaction data in the transaction data set by using an abnormal transaction data prediction model obtained based on composite feature vector training to obtain a prediction result; the composite feature vector is obtained by carrying out vector combination on a first feature vector extracted based on a Louvian community discovery algorithm, a second feature vector extracted based on an expert experience feature extraction algorithm and a third feature vector extracted based on a time sequence feature extraction algorithm;
When the predicted result is that abnormal transaction data exists in the transaction data set, determining and marking an initial abnormal transaction entity set in the initial transaction map to obtain a target transaction map;
carrying out transaction community division on the target transaction atlas by using the Louvian community discovery algorithm to obtain a community transaction atlas;
and carrying out abnormal transaction entity investigation by combining the community transaction map and the initial abnormal transaction entity set to obtain a target abnormal transaction entity set.
In one specific embodiment of the present invention, the method for conducting abnormal transaction entity investigation by combining the community transaction map and the initial abnormal transaction entity set to obtain a target abnormal transaction entity set includes:
searching other entities which have association relation with the initial abnormal transaction entity in the initial abnormal transaction entity set, and adding the searched entities to the community transaction map; the association relation comprises any one or a combination of a plurality of identity association relation, communication association relation and address association relation;
marking other entities which are added into the community transaction map and have association relation with the initial abnormal transaction entity;
And determining an entity set formed by each entity marked in the community transaction map as the target abnormal transaction entity set.
In a specific embodiment of the present invention, searching for other entities having an association relationship with the initial abnormal transaction entity in the initial abnormal transaction entity set includes:
acquiring preset time sequence characteristics and community characteristics;
and searching other entities which have association relation with the initial abnormal transaction entity in the initial abnormal transaction entity set by combining the time sequence characteristic and the community characteristic.
In one embodiment of the present invention, after determining the entity set formed by each entity marked in the community transaction map as the target abnormal transaction entity set, the method further includes:
and visually displaying the community transaction map.
In one specific embodiment of the present invention, the method for conducting abnormal transaction entity investigation by combining the community transaction map and the initial abnormal transaction entity set to obtain a target abnormal transaction entity set includes:
ranking each transaction entity in the community transaction map by using a centrality algorithm with transaction amount and transaction times as weight information according to the initial abnormal transaction entity set;
And determining the target abnormal transaction entity set according to the ranking result.
In one specific embodiment of the present invention, ranking each transaction entity in the community transaction map using a centrality algorithm with transaction amount and transaction number as weight information includes:
constructing a relative weight matrix among the centrality algorithms based on the transaction amount and the transaction times;
calculating standardized index values respectively corresponding to the centrality algorithms for each transaction entity in the community transaction map;
carrying out weighted summation on the normalized index values and the corresponding weights in the relative weight matrix to obtain a comprehensive score;
and sequencing the magnitude of the comprehensive scores to obtain ranking results of all the transaction entities in the community transaction map.
In one embodiment of the present invention, after determining the target abnormal transaction entity set according to the ranking result, the method further comprises:
marking the community transaction map with other abnormal transaction entities in the target abnormal transaction entity set except the marked initial abnormal transaction entity set.
An apparatus for identifying an abnormal transaction entity, comprising:
the map construction module is used for acquiring a transaction data set and constructing an initial transaction map based on the transaction data set;
The abnormal transaction prediction module is used for predicting each transaction data in the transaction data set by using an abnormal transaction data prediction model trained based on the composite feature vector to obtain a prediction result; the composite feature vector is obtained by carrying out vector combination on a first feature vector extracted based on a Louvian community discovery algorithm, a second feature vector extracted based on an expert experience feature extraction algorithm and a third feature vector extracted based on a time sequence feature extraction algorithm;
the entity marking module is used for determining and marking an initial abnormal transaction entity set in the initial transaction map to obtain a target transaction map when the predicted result is that abnormal transaction data exists in the transaction data set;
the transaction map obtaining module is used for dividing the transaction communities into the target transaction maps by using the Louvian community finding algorithm to obtain community transaction maps;
the abnormal transaction entity checking module is used for checking abnormal transaction entities by combining the community transaction map and the initial abnormal transaction entity set to obtain a target abnormal transaction entity set.
An apparatus for identifying an abnormal transaction entity, comprising:
A memory for storing a computer program;
a processor for implementing the steps of the method of identifying abnormal transaction entities as described above when executing the computer program.
A computer readable storage medium having stored thereon a computer program which when executed by a processor performs the steps of a method of identifying an abnormal transaction entity as described above.
The method for identifying the abnormal transaction entity acquires a transaction data set and constructs an initial transaction map based on the transaction data set; predicting each transaction data in the transaction data set by using an abnormal transaction data prediction model trained based on the composite feature vector to obtain a prediction result; the composite feature vector is obtained by carrying out vector combination on a first feature vector extracted based on a Louvian community discovery algorithm, a second feature vector extracted based on an expert experience feature extraction algorithm and a third feature vector extracted by a time sequence feature extraction algorithm; when the predicted result is that abnormal transaction data exists in the transaction data set, determining and marking an initial abnormal transaction entity set in the initial transaction map to obtain a target transaction map; carrying out transaction community division on the target transaction graph by using a Louvian community discovery algorithm to obtain a community transaction graph; and carrying out abnormal transaction entity investigation by combining the community transaction map and the initial abnormal transaction entity set to obtain a target abnormal transaction entity set.
According to the technical scheme, the first feature vector extracted based on the Louvian community discovery algorithm, the second feature vector extracted based on the expert experience feature extraction algorithm and the third feature vector extracted by the time sequence feature extraction algorithm are subjected to vector combination to obtain a composite feature vector, and model training is performed based on the composite feature vector to obtain an abnormal transaction data prediction model. And the abnormal transaction data prediction model is utilized to predict abnormal transaction data of the transaction data set, so that an initial abnormal transaction entity set is obtained, and the accuracy and the effectiveness of monitoring the abnormal transaction data are greatly improved. The target transaction map is obtained by marking the initial abnormal transaction entity of the constructed initial transaction map, the target transaction map is subjected to transaction community division by using a Louvian community discovery algorithm, the abnormal transaction entity is checked by combining the community transaction map and the initial abnormal transaction entity set, and the target abnormal transaction entity set is obtained, so that the recognition of abnormal transaction entities in units of groups from the abnormal recognition of the individual transaction entities to the recognition of the abnormal transaction entities is realized, the recognition range of the abnormal transaction entities is enlarged, and the recognition omission probability of the abnormal transaction entities is reduced.
Correspondingly, the invention also provides a device, equipment and a computer readable storage medium for identifying the abnormal transaction entity corresponding to the method for identifying the abnormal transaction entity, which have the technical effects and are not repeated herein.
Drawings
In order to more clearly illustrate the embodiments of the invention or the technical solutions in the prior art, the drawings that are required in the embodiments or the description of the prior art will be briefly described, it being obvious that the drawings in the following description are only some embodiments of the invention, and that other drawings may be obtained according to these drawings without inventive effort for a person skilled in the art.
FIG. 1 is a flowchart of an embodiment of a method for identifying abnormal transaction entities;
FIG. 2 is a flowchart of another implementation of a method for identifying abnormal transaction entities according to an embodiment of the present invention;
FIG. 3 is a flowchart of another implementation of a method for identifying abnormal transaction entities according to an embodiment of the present invention;
FIG. 4 is a block diagram illustrating an apparatus for identifying abnormal transaction entities according to an embodiment of the present invention;
FIG. 5 is a block diagram of an apparatus for identifying abnormal transaction entities according to an embodiment of the present invention;
Fig. 6 is a schematic diagram of a specific structure of an abnormal transaction entity identification device according to the present embodiment.
Detailed Description
In order to better understand the aspects of the present invention, the present invention will be described in further detail with reference to the accompanying drawings and detailed description. It will be apparent that the described embodiments are only some, but not all, embodiments of the invention. All other embodiments, which can be made by those skilled in the art based on the embodiments of the invention without making any inventive effort, are intended to be within the scope of the invention.
Referring to fig. 1, fig. 1 is a flowchart illustrating an implementation of a method for identifying abnormal transaction entities according to an embodiment of the present invention, the method may include the following steps:
s101: a transaction dataset is acquired and an initial transaction map is constructed based on the transaction dataset.
Transaction data is generated by each transaction entity in the transaction system in the transaction process, and each transaction data forms a transaction data set. A transaction dataset is acquired and an initial transaction map is constructed based on the transaction dataset. Thereby facilitating the user to view and analyze the trade relationship between the trade entities through the trade atlas.
S102: and predicting each transaction data in the transaction data set by using an abnormal transaction data prediction model trained based on the composite feature vector to obtain a prediction result.
The composite feature vector is obtained by vector combination of a first feature vector extracted based on a Louvian community discovery algorithm, a second feature vector extracted based on an expert experience feature extraction algorithm and a third feature vector extracted based on a time sequence feature extraction algorithm.
The method comprises the steps of extracting a first feature vector based on a Louvian community discovery algorithm in advance, extracting a second feature vector based on an expert experience feature extraction algorithm, extracting a third feature vector based on a time sequence feature extraction algorithm, and carrying out vector combination on the first feature vector, the second feature vector and the third feature vector to obtain a composite feature vector. The model training is carried out by utilizing the composite feature vector, and the model training can be carried out after the composite feature vector is subjected to normalization processing, so that an abnormal transaction data prediction model is obtained. After the transaction data set is obtained, predicting each transaction data in the transaction data set by using an abnormal transaction data prediction model trained based on the composite feature vector to obtain a prediction result. By training the abnormal transaction data prediction model by utilizing the composite feature vector extracted based on the multipartite feature extraction algorithm, the accuracy and the effectiveness of monitoring the abnormal transaction data are greatly improved.
S103: and when the predicted result is that abnormal transaction data exists in the transaction data set, determining and marking an initial abnormal transaction entity set in the initial transaction map to obtain a target transaction map.
When the prediction result of each transaction data is that abnormal transaction data exists in the transaction data set, determining a transaction entity corresponding to the abnormal transaction data as an abnormal transaction entity, determining an entity set formed by each abnormal transaction entity as an initial abnormal transaction entity set, namely obtaining an initial transaction entity blacklist, and marking the initial abnormal transaction entity set in the initial transaction map to obtain a target transaction map.
S104: and carrying out transaction community division on the target transaction graph by using a Louvian community discovery algorithm to obtain a community transaction graph.
After the target transaction pattern is obtained, carrying out transaction community division on the target transaction pattern by using a Louvian community discovery algorithm to obtain a community transaction pattern.
The improved Louvain community discovery algorithm is a graph algorithm model based on modularity, is very fast compared with the common graph based on modularity and modularity gain, has a particularly obvious clustering effect on graphs with few points, improves the algorithm on the basis of the original Louvain algorithm with open sources, adds business indexes including but not limited to transaction amount, transaction times, transaction rolling capacity and the like, and adds corresponding business weight values to each index data, so that the community division result is more accurate and efficient.
S105: and carrying out abnormal transaction entity investigation by combining the community transaction map and the initial abnormal transaction entity set to obtain a target abnormal transaction entity set.
After the community transaction map is obtained through division, the community transaction map and the initial abnormal transaction entity set are combined to conduct abnormal transaction entity investigation, and a target abnormal transaction entity set is obtained. If the further investigation of the abnormal transaction entity is realized by searching the transaction entity with the association relation with the abnormal transaction entity in each transaction community, the further investigation of the abnormal transaction entity can be carried out by carrying out the calculation of the abnormal score on each transaction entity in the transaction community according to the magnitude relation of the abnormal score. Therefore, the abnormal identification of the independent transaction entity to the identification of the abnormal transaction entity taking the group as a unit is realized, the identification range of the abnormal transaction entity is enlarged, and the probability of missing the abnormal transaction entity identification is reduced.
According to the technical scheme, the first feature vector extracted based on the Louvian community discovery algorithm, the second feature vector extracted based on the expert experience feature extraction algorithm and the third feature vector extracted by the time sequence feature extraction algorithm are subjected to vector combination to obtain a composite feature vector, and model training is performed based on the composite feature vector to obtain an abnormal transaction data prediction model. And the abnormal transaction data prediction model is utilized to predict abnormal transaction data of the transaction data set, so that an initial abnormal transaction entity set is obtained, and the accuracy and the effectiveness of monitoring the abnormal transaction data are greatly improved. The target transaction map is obtained by marking the initial abnormal transaction entity of the constructed initial transaction map, the target transaction map is subjected to transaction community division by using a Louvian community discovery algorithm, the abnormal transaction entity is checked by combining the community transaction map and the initial abnormal transaction entity set, and the target abnormal transaction entity set is obtained, so that the recognition of abnormal transaction entities in units of groups from the abnormal recognition of the individual transaction entities to the recognition of the abnormal transaction entities is realized, the recognition range of the abnormal transaction entities is enlarged, and the recognition omission probability of the abnormal transaction entities is reduced.
It should be noted that, based on the above embodiments, the embodiments of the present invention further provide corresponding improvements. The following embodiments relate to the same steps as those in the above embodiments or the steps corresponding to the steps may be referred to each other, and the corresponding beneficial effects may also be referred to each other, which will not be described in detail in the following modified embodiments.
Referring to fig. 2, fig. 2 is a flowchart illustrating another implementation of a method for identifying abnormal transaction entities according to an embodiment of the present invention, the method may include the following steps:
s201: a transaction dataset is acquired and an initial transaction map is constructed based on the transaction dataset.
When the transaction entity is a transaction user, transaction data of the transaction user for approximately 30-60 days can be acquired.
S202: and predicting each transaction data in the transaction data set by using an abnormal transaction data prediction model trained based on the composite feature vector to obtain a prediction result.
The composite feature vector is obtained by vector combination of a first feature vector extracted based on a Louvian community discovery algorithm, a second feature vector extracted based on an expert experience feature extraction algorithm and a third feature vector extracted based on a time sequence feature extraction algorithm.
The time sequence prediction analysis is to predict the characteristics of an event in a future period by utilizing the characteristics of the event in the past period, extract time sequence characteristics by utilizing transaction data of 30-60 days in the past, and add the time sequence characteristics into model training, so that the accuracy of model training is improved.
S203: and when the predicted result is that abnormal transaction data exists in the transaction data set, determining and marking an initial abnormal transaction entity set in the initial transaction map to obtain a target transaction map.
S204: and carrying out transaction community division on the target transaction graph by using a Louvian community discovery algorithm to obtain a community transaction graph.
The target transaction atlas is divided and integrated through an artificial intelligence algorithm and an image technology related algorithm, so that the group of the whole atlas is more focused on the community image of 'group partner'.
S205: searching other entities related to the initial abnormal transaction entity in the initial abnormal transaction entity set, and adding the searched entities to the community transaction map.
The association relationship comprises any one or a combination of a plurality of identity association relationship, communication association relationship and address association relationship.
After the community transaction map is obtained by dividing, other entities which have association relations with the initial abnormal transaction entities in the initial abnormal transaction entity set are searched, for example, other entities which have any one or a combination of several association relations of identity association relations, communication association relations, address association relations and the like with the initial abnormal transaction entities in the initial abnormal transaction entity set are searched, and the searched entities are added to the community transaction map. By further conducting abnormal transaction entity investigation, all associated persons possibly related to community transaction entities are searched, particularly transaction entities related to the initial abnormal transaction entity with high suspicious probability, and finally deeper monitoring of the abnormal transaction entity is achieved.
When the transaction entity is a transaction person, the transaction relationship among the persons in the community can be reflected on the map by combining multiparty data with the integrated community transaction map, and various relationships (including but not limited to a legal person, a beneficiary, an authorized person, an office address, a residence address, an identity card address, a company telephone, an office telephone, a private telephone and the like) of the persons are also reflected on the community transaction map, so that the social relationship among persons in the community is known more clearly. In the method, the queried associated person information is included in the same community transaction map, so that the problems of time consumption, labor consumption and low accuracy in the prior art of querying the associated person of the suspicious client are solved, and the depth and breadth of the group prediction are improved. The efficiency and convenience of inquiring suspicious client associated personnel are greatly improved by using small consumption of manpower and material resources, and the coverage and accuracy of inquiring associated personnel are obviously improved.
In a specific embodiment of the present invention, searching for other entities having an association relationship with an initial abnormal transaction entity in the initial abnormal transaction entity set may include the following steps:
Step one: acquiring preset time sequence characteristics and community characteristics;
step two: and searching other entities which have association relation with the initial abnormal transaction entity in the initial abnormal transaction entity set by combining the time sequence characteristics and the community characteristics.
For convenience of description, the above two steps may be combined for explanation.
After the community transaction map is obtained through division, acquiring preset time sequence features and community features, and searching other entities which have association relations with the initial abnormal transaction entities in the initial abnormal transaction entity set by combining the time sequence features and the community features.
The community features may include business features related to the transaction community, and the time sequence features may include transaction moments, time periods during which transactions are frequent, and the like.
S206: and marking other entities which are added to the community transaction atlas and have association relation with the initial abnormal transaction entity.
After the searched entity is added to the community transaction map, marking other entities which are added to the community transaction map and have association relation with the initial abnormal transaction entity. Thereby further screening out the abnormal transaction entity set by means of the association relation.
S207: and determining an entity set formed by each entity marked in the community transaction map as a target abnormal transaction entity set.
Marking other entities which are added into the community transaction map and have association relation with the initial abnormal transaction entity, and determining an entity set formed by each entity marked in the community transaction map as a target abnormal transaction entity set, so that abnormal entity partner is identified and obtained.
S208: and visually displaying the community trading pattern.
After the target abnormal transaction entity set is determined, the community transaction map is visually displayed, so that a user can check and check each abnormal transaction entity in the target abnormal transaction entity set and each transaction entity in the community transaction map, and further the abnormal transaction entity is located. Therefore, in the application of finding and searching suspicious users in suspicious communities in the financial industry, clients with relatively small transaction amount or no transaction records can be accurately positioned and analyzed, the detection range is expanded, and the maximum degree of monitoring of the activities and related personnel involved in the cases is achieved.
Referring to fig. 3, fig. 3 is a flowchart illustrating another implementation of a method for identifying abnormal transaction entities according to an embodiment of the present invention, the method may include the following steps:
s301: a transaction dataset is acquired and an initial transaction map is constructed based on the transaction dataset.
S302: and predicting each transaction data in the transaction data set by using an abnormal transaction data prediction model trained based on the composite feature vector to obtain a prediction result.
The composite feature vector is obtained by vector combination of a first feature vector extracted based on a Louvian community discovery algorithm, a second feature vector extracted based on an expert experience feature extraction algorithm and a third feature vector extracted based on a time sequence feature extraction algorithm.
In the model training process, different upstream data can be obtained to provide training and testing data for the model, and aiming at the problem of unbalanced proportion of positive and negative samples of different service scenes, the data distribution is changed by adopting methods of undersampling, oversampling, comprehensive sampling and the like, so that the categories are balanced from the data level.
S303: and when the predicted result is that abnormal transaction data exists in the transaction data set, determining and marking an initial abnormal transaction entity set in the initial transaction map to obtain a target transaction map.
S304: and carrying out transaction community division on the target transaction graph by using a Louvian community discovery algorithm to obtain a community transaction graph.
S305: and ranking all transaction entities in the community transaction map by using the centrality algorithm with the transaction amount and the transaction times as weight information according to the initial abnormal transaction entity set.
After the initial abnormal transaction entity set is obtained according to the prediction result, ranking each transaction entity in the community transaction map by using the centrality algorithm and taking the transaction amount and the transaction times as weight information according to the initial abnormal transaction entity set. By ranking all transaction entities in the community transaction map by taking the transaction amount and the transaction times as weight information, the fund flowing direction can be positioned succinctly and clearly, and monitoring clues are provided for actions such as crossing regions and crossing rows.
In a specific embodiment of the present invention, ranking each transaction entity in the community transaction map using a centrality algorithm with transaction amount and transaction number as weight information may include the following steps:
step one: constructing a relative weight matrix among the centrality algorithms based on the transaction amount and the transaction times;
step two: calculating standardized index values respectively corresponding to the centrality algorithms for each transaction entity in the community transaction map;
step three: weighting and summing the corresponding weights in each standardized index value and the relative weight matrix to obtain a comprehensive score;
step four: and sequencing the magnitude of the comprehensive scores to obtain ranking results of all transaction entities in the community transaction map.
For convenience of description, the above four steps may be combined for explanation.
After the community trading map is obtained, the abnormality degree of each trading entity in the trading community can be calculated by combining various centrality algorithms, for example, centrality algorithms such as PageRank (webpage ranking), centrality, intermediation centrality, tight centrality and the like can be included. Based on the transaction amount and the transaction times, constructing a relative weight matrix among the centrality algorithms, calculating standardized index values respectively corresponding to the centrality algorithms for each transaction entity in the community transaction map, carrying out weighted summation on the standardized index values and the corresponding weights in the relative weight matrix to obtain a comprehensive score, and carrying out size sorting on the comprehensive score to obtain a ranking result of each transaction entity in the community transaction map.
PageRank: the method and the device are used for measuring the ranking of the webpages, and in the embodiment of the invention, if a certain transaction entity trades more with other transaction entities, the transaction amount is higher, the PageRank value corresponding to the transaction entity is higher, and the suspicious degree of the transaction entity is higher.
Centering: the degree to which one transaction entity is associated with all other transaction entities in the community is measured. For an undirected graph with g trading entities, the centrality of trading entity i is the total number of direct contacts of i with the other g-1 trading entities. The larger the community size, the higher the maximum possible value of centrality.
Intermediate centrality: for measuring how many times a transaction entity has occurred in the shortest path between any other two transaction entity pairs, thereby characterizing the suspicious nature of the transaction entity.
Compact centrality: reflecting the proximity between a certain transaction entity and other transaction entities in the community.
In order to eliminate the influence of community scale change on centrality, the calculated centrality index value can be standardized.
The importance degree quantization values of the centrality algorithm indexes are quantized in advance according to expert experience, as shown in tables 1 and 2, table 1 is a comparison table between each importance degree and each quantization value, and table 2 is a relative weight matrix comparison table between the centrality algorithm indexes.
TABLE 1
TABLE 2
| Center of intermediation | Degree of centrality | PageRank | Index weight | |
| Center of intermediation | 1 | 1/5 | 1/7 | 0.07 |
| Degree of centrality | 5 | 1 | 1/5 | 0.22 |
| PageRank | 7 | 5 | 1 | 0.71 |
As shown in table 3, table 3 is a comprehensive score table of each transaction entity after normalization.
TABLE 3 Table 3
It should be noted that, the weights of the centrality algorithm indexes may be adjusted according to actual situations, and table 2 is a weight matrix construction process that is shown separately, table 3 is a comprehensive score calculation process that is shown separately, and the weights illustrated in table 2 have no association with the weights used for the comprehensive score calculation in table 3.
And positioning the kernel members in the transaction community by providing various centrality algorithms, fund flow, transaction rolling stock and other modes, so as to provide clues for analysis.
S306: and determining a target abnormal transaction entity set according to the ranking result.
After the ranking results of all transaction entities in the community transaction atlas are obtained, determining a target abnormal transaction entity set according to the ranking results. If each transaction entity ranked before the preset value can be preset as an abnormal transaction entity, determining an entity set formed by each abnormal transaction entity as a target abnormal transaction entity set.
S307: and marking other abnormal transaction entities in the target abnormal transaction entity set except the marked initial abnormal transaction entity set on the community transaction map.
After the target abnormal transaction entity set is determined, marking other abnormal transaction entities in the target abnormal transaction entity set except the marked initial abnormal transaction entity set on the community transaction map. Thereby exhibiting a fund context flow chart centered on the abnormal transaction entity. Therefore, more effective data mining is performed on suspicious users and suspicious transactions, and the knowledge graph visualization application is greatly improved. By monitoring the off-line excessive account, the transaction data comprise off-line customers directly transacting, and the off-line excessive account can be clearly monitored by using a graph technology, so that the cash travel re-flow condition can be monitored.
By utilizing a knowledge graph technology, the change condition of the suspicious group partner transaction funds is intuitively displayed, analysis clues are searched by matching with a graph algorithm, excessive accounts inside and outside each row are monitored, kernel members in a transaction community are positioned by providing various modes such as a centrality algorithm, a fund flow direction, a transaction rolling stock and the like, clues are provided for analysis, and the whole life cycle of customer account use is penetrated.
The transaction atlas and community transaction atlas query function can be provided according to preset rules, and related query results can be obtained according to the client number or date and other conditions. The client data set comprises client basic information and client transaction information; the customer basic information comprises account numbers, customer types, customer banks and other information; the customer transaction information includes a plurality of levels of interrelated transaction accounts, transaction times, and transaction amounts.
Corresponding to the above method embodiment, the present invention further provides an apparatus for identifying an abnormal transaction entity, where the apparatus for identifying an abnormal transaction entity described below and the method for identifying an abnormal transaction entity described above may be referred to correspondingly with each other.
Referring to fig. 4, fig. 4 is a block diagram illustrating a device for identifying abnormal transaction entities according to an embodiment of the present invention, where the device may include:
A profile construction module 41 for acquiring a transaction data set and constructing an initial transaction profile based on the transaction data set;
the abnormal transaction prediction module 42 is configured to predict each transaction data in the transaction data set by using an abnormal transaction data prediction model trained based on the composite feature vector, so as to obtain a prediction result; the composite feature vector is obtained by carrying out vector combination on a first feature vector extracted based on a Louvian community discovery algorithm, a second feature vector extracted based on an expert experience feature extraction algorithm and a third feature vector extracted based on a time sequence feature extraction algorithm;
the entity marking module 43 is configured to determine and mark an initial abnormal transaction entity set in the initial transaction map to obtain a target transaction map when the predicted result is that abnormal transaction data exists in the transaction data set;
the transaction atlas obtaining module 44 is configured to perform transaction community division on the target transaction atlas by using a louvia community discovery algorithm to obtain a community transaction atlas;
the abnormal transaction entity checking module 45 is configured to combine the community transaction map and the initial abnormal transaction entity set to perform abnormal transaction entity checking, so as to obtain a target abnormal transaction entity set.
According to the technical scheme, the first feature vector extracted based on the Louvian community discovery algorithm, the second feature vector extracted based on the expert experience feature extraction algorithm and the third feature vector extracted by the time sequence feature extraction algorithm are subjected to vector combination to obtain a composite feature vector, and model training is performed based on the composite feature vector to obtain an abnormal transaction data prediction model. And the abnormal transaction data prediction model is utilized to predict abnormal transaction data of the transaction data set, so that an initial abnormal transaction entity set is obtained, and the accuracy and the effectiveness of monitoring the abnormal transaction data are greatly improved. The target transaction map is obtained by marking the initial abnormal transaction entity of the constructed initial transaction map, the target transaction map is subjected to transaction community division by using a Louvian community discovery algorithm, the abnormal transaction entity is checked by combining the community transaction map and the initial abnormal transaction entity set, and the target abnormal transaction entity set is obtained, so that the recognition of abnormal transaction entities in units of groups from the abnormal recognition of the individual transaction entities to the recognition of the abnormal transaction entities is realized, the recognition range of the abnormal transaction entities is enlarged, and the recognition omission probability of the abnormal transaction entities is reduced.
In one embodiment of the present invention, the abnormal transaction entity checking module 45 includes:
the entity adding sub-module is used for searching other entities which have association relation with the initial abnormal transaction entity in the initial abnormal transaction entity set and adding the searched entities to the community transaction map; the association relationship comprises any one or a combination of a plurality of identity association relationship, communication association relationship and address association relationship;
the entity marking sub-module is used for marking other entities which are added into the community transaction map and have association relation with the initial abnormal transaction entity;
the target abnormal entity set determining submodule is used for determining an entity set formed by each entity marked in the community transaction map as a target abnormal transaction entity set.
In one embodiment of the present invention, the entity adding submodule includes:
the characteristic acquisition unit is used for acquiring preset time sequence characteristics and community characteristics;
the related entity searching unit is used for searching other entities which have a related relationship with the initial abnormal transaction entity in the initial abnormal transaction entity set by combining the time sequence characteristic and the community characteristic.
In one embodiment of the present invention, the apparatus may further include:
And the visual display module is used for visually displaying the community transaction map after the entity set formed by the marked entities in the community transaction map is determined to be the target abnormal transaction entity set.
In one embodiment of the present invention, the abnormal transaction entity checking module 45 includes:
the entity ranking sub-module is used for ranking each transaction entity in the community transaction map by taking the transaction amount and the transaction times as weight information by utilizing a centrality algorithm according to the initial abnormal transaction entity set;
and the target abnormal entity set determining submodule is used for determining the target abnormal transaction entity set according to the ranking result.
In one embodiment of the present invention, the entity ranking submodule includes:
the matrix construction unit is used for constructing a relative weight matrix among the centrality algorithms based on the transaction amount and the transaction times;
the standardized index value calculation unit is used for calculating standardized index values corresponding to the centrality algorithms respectively for each transaction entity in the community transaction map;
the comprehensive score obtaining unit is used for carrying out weighted summation on each standardized index value and the corresponding weight in the relative weight matrix to obtain a comprehensive score;
The ranking result obtaining unit is used for sorting the magnitude of the comprehensive scores to obtain ranking results of all transaction entities in the community transaction atlas.
In one embodiment of the present invention, the entity marking module 43 is further configured to mark other abnormal transaction entities in the target abnormal transaction entity set except the marked initial abnormal transaction entity set in the community transaction map after determining the target abnormal transaction entity set according to the ranking result.
Corresponding to the above method embodiment, referring to fig. 5, fig. 5 is a schematic diagram of an apparatus for identifying abnormal transaction entities according to the present invention, where the apparatus may include:
a memory 332 for storing a computer program;
a processor 322 for implementing the steps of the method for identifying abnormal transaction entities of the above-described method embodiment when executing a computer program.
Specifically, referring to fig. 5, fig. 5 is a schematic diagram of a specific structure of an abnormal transaction entity identification device according to the present embodiment, where the abnormal transaction entity identification device may have relatively large differences due to different configurations or performances, and may include a processor (central processing units, CPU) 322 (e.g., one or more processors) and a memory 332, where the memory 332 stores one or more computer applications 342 or data 344. Wherein the memory 332 may be transient storage or persistent storage. The program stored in memory 332 may include one or more modules (not shown), each of which may include a series of instruction operations in the data processing apparatus. Still further, the processor 322 may be configured to communicate with the memory 332 to execute a series of instruction operations in the memory 332 on the identification device 301 of the abnormal transaction entity.
The identification device 301 of the abnormal transaction entity may also include one or more power supplies 326, one or more wired or wireless network interfaces 350, one or more input output interfaces 358, and/or one or more operating systems 341.
The steps in the method of identifying an abnormal transaction entity described above may be implemented by the structure of the identification device of the abnormal transaction entity.
Corresponding to the above method embodiments, the present invention also provides a computer readable storage medium having a computer program stored thereon, which when executed by a processor, performs the steps of:
acquiring a transaction data set, and constructing an initial transaction map based on the transaction data set; predicting each transaction data in the transaction data set by using an abnormal transaction data prediction model trained based on the composite feature vector to obtain a prediction result; the composite feature vector is obtained by carrying out vector combination on a first feature vector extracted based on a Louvian community discovery algorithm, a second feature vector extracted based on an expert experience feature extraction algorithm and a third feature vector extracted by a time sequence feature extraction algorithm; when the predicted result is that abnormal transaction data exists in the transaction data set, determining and marking an initial abnormal transaction entity set in the initial transaction map to obtain a target transaction map; carrying out transaction community division on the target transaction graph by using a Louvian community discovery algorithm to obtain a community transaction graph; and carrying out abnormal transaction entity investigation by combining the community transaction map and the initial abnormal transaction entity set to obtain a target abnormal transaction entity set.
The computer readable storage medium may include: a U-disk, a removable hard disk, a Read-Only Memory (ROM), a random access Memory (Random Access Memory, RAM), a magnetic disk, or an optical disk, or other various media capable of storing program codes.
For the description of the computer-readable storage medium provided by the present invention, refer to the above method embodiments, and the disclosure is not repeated here.
In this specification, each embodiment is described in a progressive manner, and each embodiment is mainly described in a different point from other embodiments, so that the same or similar parts between the embodiments are referred to each other. The apparatus, device and computer readable storage medium of the embodiments are described more simply because they correspond to the methods of the embodiments, and the description thereof will be given with reference to the method section. The principles and embodiments of the present invention have been described herein with reference to specific examples, but the description of the examples above is only for aiding in understanding the technical solution of the present invention and its core ideas. It should be noted that it will be apparent to those skilled in the art that various modifications and adaptations of the invention can be made without departing from the principles of the invention and these modifications and adaptations are intended to be within the scope of the invention as defined in the following claims.
Claims (10)
1. A method of identifying an abnormal transaction entity, comprising:
acquiring a transaction data set, and constructing an initial transaction map based on the transaction data set;
predicting each transaction data in the transaction data set by using an abnormal transaction data prediction model obtained based on composite feature vector training to obtain a prediction result; the composite feature vector is obtained by carrying out vector combination on a first feature vector extracted based on a Louvian community discovery algorithm, a second feature vector extracted based on an expert experience feature extraction algorithm and a third feature vector extracted based on a time sequence feature extraction algorithm;
when the predicted result is that abnormal transaction data exists in the transaction data set, determining and marking an initial abnormal transaction entity set in the initial transaction map to obtain a target transaction map;
carrying out transaction community division on the target transaction atlas by using the Louvian community discovery algorithm to obtain a community transaction atlas;
and carrying out abnormal transaction entity investigation by combining the community transaction map and the initial abnormal transaction entity set to obtain a target abnormal transaction entity set.
2. The method for identifying abnormal transaction entities according to claim 1, wherein the step of conducting abnormal transaction entity investigation in combination with the community transaction map and the initial abnormal transaction entity set to obtain a target abnormal transaction entity set includes:
Searching other entities which have association relation with the initial abnormal transaction entity in the initial abnormal transaction entity set, and adding the searched entities to the community transaction map; the association relation comprises any one or a combination of a plurality of identity association relation, communication association relation and address association relation;
marking other entities which are added into the community transaction map and have association relation with the initial abnormal transaction entity;
and determining an entity set formed by each entity marked in the community transaction map as the target abnormal transaction entity set.
3. The method of claim 2, wherein searching for other entities associated with the initial abnormal transaction entity in the set of initial abnormal transaction entities, comprises:
acquiring preset time sequence characteristics and community characteristics;
and searching other entities which have association relation with the initial abnormal transaction entity in the initial abnormal transaction entity set by combining the time sequence characteristic and the community characteristic.
4. The method for identifying abnormal transaction entities according to claim 2, further comprising, after determining a set of entities constituted by entities marked in the community transaction pattern as the target abnormal transaction entity set:
And visually displaying the community transaction map.
5. The method for identifying abnormal transaction entities according to claim 1, wherein the step of conducting abnormal transaction entity investigation in combination with the community transaction map and the initial abnormal transaction entity set to obtain a target abnormal transaction entity set includes:
ranking each transaction entity in the community transaction map by using a centrality algorithm with transaction amount and transaction times as weight information according to the initial abnormal transaction entity set;
and determining the target abnormal transaction entity set according to the ranking result.
6. The method of claim 5, wherein ranking each transaction entity in the community transaction pattern with weight information of transaction amount and number of transactions using a centrality algorithm comprises:
constructing a relative weight matrix among the centrality algorithms based on the transaction amount and the transaction times;
calculating standardized index values respectively corresponding to the centrality algorithms for each transaction entity in the community transaction map;
carrying out weighted summation on the normalized index values and the corresponding weights in the relative weight matrix to obtain a comprehensive score;
And sequencing the magnitude of the comprehensive scores to obtain ranking results of all the transaction entities in the community transaction map.
7. The method of claim 5 or 6, further comprising, after determining the target set of abnormal transaction entities based on the ranking result:
marking the community transaction map with other abnormal transaction entities in the target abnormal transaction entity set except the marked initial abnormal transaction entity set.
8. An apparatus for identifying an abnormal transaction entity, comprising:
the map construction module is used for acquiring a transaction data set and constructing an initial transaction map based on the transaction data set;
the abnormal transaction prediction module is used for predicting each transaction data in the transaction data set by using an abnormal transaction data prediction model trained based on the composite feature vector to obtain a prediction result; the composite feature vector is obtained by carrying out vector combination on a first feature vector extracted based on a Louvian community discovery algorithm, a second feature vector extracted based on an expert experience feature extraction algorithm and a third feature vector extracted based on a time sequence feature extraction algorithm;
The entity marking module is used for determining and marking an initial abnormal transaction entity set in the initial transaction map to obtain a target transaction map when the predicted result is that abnormal transaction data exists in the transaction data set;
the transaction map obtaining module is used for dividing the transaction communities into the target transaction maps by using the Louvian community finding algorithm to obtain community transaction maps;
the abnormal transaction entity checking module is used for checking abnormal transaction entities by combining the community transaction map and the initial abnormal transaction entity set to obtain a target abnormal transaction entity set.
9. An apparatus for identifying an abnormal transaction entity, comprising:
a memory for storing a computer program;
a processor for implementing the steps of the method of identifying an abnormal transaction entity according to any one of claims 1 to 7 when executing said computer program.
10. A computer readable storage medium, characterized in that the computer readable storage medium has stored thereon a computer program which, when executed by a processor, implements the steps of the method of identifying an abnormal transaction entity according to any of claims 1 to 7.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202211102463.XA CN116012152A (en) | 2022-09-09 | 2022-09-09 | Method, device and equipment for identifying abnormal transaction entity and readable storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202211102463.XA CN116012152A (en) | 2022-09-09 | 2022-09-09 | Method, device and equipment for identifying abnormal transaction entity and readable storage medium |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN116012152A true CN116012152A (en) | 2023-04-25 |
Family
ID=86025503
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202211102463.XA Pending CN116012152A (en) | 2022-09-09 | 2022-09-09 | Method, device and equipment for identifying abnormal transaction entity and readable storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN116012152A (en) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN117131445A (en) * | 2023-07-28 | 2023-11-28 | 深圳市财富趋势科技股份有限公司 | Abnormal transaction detection method and system |
-
2022
- 2022-09-09 CN CN202211102463.XA patent/CN116012152A/en active Pending
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN117131445A (en) * | 2023-07-28 | 2023-11-28 | 深圳市财富趋势科技股份有限公司 | Abnormal transaction detection method and system |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN110009174B (en) | Risk recognition model training method and device and server | |
| CN110390465A (en) | Air control analysis and processing method, device and the computer equipment of business datum | |
| CN106067088A (en) | E-bank accesses detection method and the device of behavior | |
| CN107993144A (en) | Customer risk grade determines method, apparatus, equipment and readable storage medium storing program for executing | |
| CN109472626B (en) | Intelligent financial risk control method and system for mobile phone leasing service | |
| CN111292008A (en) | Privacy protection data release risk assessment method based on knowledge graph | |
| CN111127062B (en) | Group fraud identification method and device based on space search algorithm | |
| CN114580916A (en) | Enterprise risk assessment method and device, electronic equipment and storage medium | |
| CN111259952A (en) | Abnormal user identification method and device, computer equipment and storage medium | |
| CN113157536A (en) | Alarm analysis method, device, equipment and storage medium | |
| CN116128627A (en) | Risk prediction method, risk prediction device, electronic equipment and storage medium | |
| CN113706291A (en) | Fraud risk prediction method, device, equipment and storage medium | |
| CN105321113A (en) | Macroscopic factor based pressure test client | |
| CN116401379A (en) | Financial product data pushing method, device, equipment and storage medium | |
| CN116012152A (en) | Method, device and equipment for identifying abnormal transaction entity and readable storage medium | |
| CN112950359B (en) | User identification method and device | |
| CN115204881A (en) | Data processing method, device, equipment and storage medium | |
| CN107402925B (en) | Information pushing method and device | |
| CN111245815B (en) | Data processing method and device, storage medium and electronic equipment | |
| CN114626940A (en) | Data analysis method and device and electronic equipment | |
| CN114943563A (en) | Rights and interests pushing method and device, computer equipment and storage medium | |
| CN113849618A (en) | Strategy determination method and device based on knowledge graph, electronic equipment and medium | |
| CN114092216A (en) | Enterprise credit rating method, apparatus, computer device and storage medium | |
| CN111626887A (en) | Social relationship evaluation method and device | |
| CN113723522B (en) | Abnormal user identification method and device, electronic equipment and storage medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |