CN116415957A

CN116415957A - Abnormal transaction object identification method, device, computer equipment and storage medium

Info

Publication number: CN116415957A
Application number: CN202310313250.XA
Authority: CN
Inventors: 陈鑫; 张雨顺; 罗秉安
Original assignee: Industrial and Commercial Bank of China Ltd ICBC
Current assignee: Industrial and Commercial Bank of China Ltd ICBC
Priority date: 2023-03-28
Filing date: 2023-03-28
Publication date: 2023-07-11

Abstract

The application relates to an abnormal transaction object identification method, an abnormal transaction object identification device, computer equipment and a storage medium. Relates to the field of financial information security. Determining marks of other account nodes in the graph model through a community positioning model containing pre-marked abnormal account nodes, identifying candidate abnormal communities according to the marks of the abnormal account nodes and the marks of other account nodes, iteratively updating the number of the abnormal account nodes of the candidate abnormal communities according to a comparison result of the marks of the abnormal nodes in the candidate abnormal account communities and the marks of adjacent account nodes, and determining abnormal transaction objects according to the updated abnormal account nodes in the target abnormal communities. Compared with the traditional mode of auditing by manpower, the method and the device for identifying the abnormal account nodes by training the community positioning model through the graph model constructed by a small amount of samples, iteratively updating the abnormal account nodes in the graph model, determining the abnormal transaction objects in the abnormal community, and improving the identification efficiency of the abnormal transaction objects.

Description

Abnormal transaction object identification method, device, computer equipment and storage medium

Technical Field

The present invention relates to the field of financial information security technologies, and in particular, to a method, an apparatus, a computer device, a storage medium, and a computer program product for identifying an abnormal transaction object.

Background

At present, the financial system has frequent transaction times, and abnormal transaction behaviors exist in multiple transaction behaviors of multiple user objects, and the abnormal transaction behaviors can cause the financial system to have security risks. In order to ensure the normal operation of the financial system, it is necessary to identify the object performing the abnormal transaction. At present, the method for identifying the object with abnormal transaction behaviors is usually to manually audit each transaction behavior so as to identify the object with abnormal transaction behaviors. However, by manually conducting the audit, the efficiency of the identification may be reduced.

Therefore, the conventional abnormal transaction object identification method has the defect of low identification efficiency.

Disclosure of Invention

In view of the foregoing, it is desirable to provide an abnormal transaction object recognition method, apparatus, computer device, computer-readable storage medium, and computer program product that can improve recognition efficiency.

In a first aspect, the present application provides a method for identifying an abnormal transaction object, the method including:

Obtaining graph models corresponding to a plurality of accounts, and training a community positioning model to be trained according to the graph models; the graph model comprises pre-marked abnormal account nodes;

determining marks of other account nodes in the graph model through a trained community positioning model, and identifying candidate abnormal communities according to the marks of the abnormal account nodes and the marks of the other account nodes; the other account nodes are account nodes except the pre-marked abnormal account nodes in the graph model; the candidate abnormal community is composed of at least one abnormal account node;

traversing adjacent account nodes of the candidate abnormal communities, and iteratively updating the number of the abnormal account nodes of the candidate abnormal communities according to a comparison result of the marks of the abnormal account nodes in the candidate abnormal communities and the marks of the adjacent account nodes until a preset condition is met, so as to obtain updated target abnormal communities;

and determining an abnormal transaction object according to the abnormal account nodes in the target abnormal community.

In one embodiment, the obtaining the graph models corresponding to the plurality of accounts includes:

acquiring historical transaction values, historical transaction types, historical transaction times and historical transaction positions among a plurality of accounts as historical transaction information among the plurality of accounts;

And constructing a graph model according to the historical transaction values, the historical transaction types, the historical transaction times and the historical transaction positions in the historical transaction information among the plurality of accounts.

In one embodiment, the building a graph model according to the historical transaction values, the historical transaction types, the historical transaction times and the historical transaction positions among the accounts includes:

the method comprises the steps of receiving anomaly tagging information for a plurality of accounts, and tagging partial anomaly accounts in the plurality of accounts;

determining the connection relation among the plurality of accounts according to the historical transaction information between each account and other accounts;

according to the historical transaction values and the historical transaction times of each account, determining the weight of the edges between each account in the connection relation;

determining node attributes of each account according to the historical transaction types and account information of each account;

and constructing a graph model according to the marked multiple accounts containing partial abnormal accounts, the connection relation among the multiple accounts, the weight of the edge and the node attribute of each account.

In one embodiment, the training the community positioning model to be trained according to the graph model includes:

Inputting the node attribute of each account and the connection relation between a plurality of accounts in the graph model into a community positioning model to be trained, and obtaining a test abnormal account node which is output by the community positioning model to be trained based on the node attribute of each account and the connection relation between the plurality of accounts;

and according to the comparison result of the test abnormal account node and the pre-marked abnormal account node, adjusting a loss function of the community positioning model to be trained through a back propagation algorithm and a gradient descent algorithm, and returning to the step of inputting the node attribute of each account in the graph model and the connection relation among a plurality of accounts into the community positioning model to be trained until the training ending condition is met, so as to obtain the trained community positioning model.

In one embodiment, the community location model to be trained comprises a multi-layer sub-model;

the obtaining the test abnormal account node output by the community positioning model to be trained based on the node attribute of each account and the connection relation among a plurality of accounts comprises the following steps:

determining a weight matrix of each layer of sub-model by the community positioning model to be trained according to the node attribute of each account, and determining the current abnormal test account node output by the current layer of sub-model according to the rectification linear unit activation function and the identification result of the previous layer of sub-model;

And if the current layer sub-model is an output layer sub-model, acquiring a test abnormal account node output by the output layer sub-model.

In one embodiment, the loss function is a binary cross entropy loss function;

according to the comparison result of the test abnormal account node and the pre-marked abnormal account node, the method adjusts the loss function of the community positioning model to be trained through a back propagation algorithm and a gradient descent algorithm, and comprises the following steps:

determining a community membership matrix of the current test abnormal account node relative to the pre-marked abnormal account node in each layer of sub-model according to a comparison result of the current test abnormal account node and the pre-marked abnormal account node output by each layer of sub-model;

aiming at each layer of sub-model, determining the gradient of the binary cross entropy loss function relative to the weight matrix of the layer of sub-model according to the community membership matrix corresponding to the layer of sub-model, the weight matrix, a preset regularization parameter and a preset learning rate;

and adjusting the weight of each layer of sub-model so as to enable the gradient of each layer of sub-model to be reduced, and obtaining an adjusted binary cross entropy loss function.

In one embodiment, before traversing the neighboring account nodes of the candidate anomalous community, further comprising:

deleting a predetermined maximum connected subgraph or minimum connected subgraph in the candidate abnormal communities to obtain adjusted candidate abnormal communities;

traversing adjacent account nodes of the adjusted candidate abnormal community.

In one embodiment, the iteratively updating the number of the abnormal account nodes of the candidate abnormal community according to the comparison result of the marks of the abnormal account nodes in the candidate abnormal community and the marks of the adjacent account nodes until the number of the abnormal account nodes of the candidate abnormal community meets the preset condition, so as to obtain the updated target abnormal community, which comprises:

adding each adjacent account node to the candidate abnormal community respectively, and acquiring the modularity increment of the candidate abnormal community when each account node is added;

changing the mark of the adjacent account node with the maximum modularity increment into the mark of the abnormal account node in the candidate abnormal community to obtain an updated candidate abnormal community;

and returning to the step of adding each adjacent account node to the candidate abnormal community until the modularity increment converges, and obtaining the updated target abnormal community.

obtaining a comparison result of the number of first abnormal account nodes in the candidate abnormal communities and the number of second account nodes in communities corresponding to the adjacent account nodes;

according to the comparison result, obtaining communities with the largest number of account nodes in the first abnormal account node number and the second abnormal account node number, and changing the labels of the abnormal account nodes in the candidate abnormal communities or the labels of the adjacent account nodes into the labels of communities with the largest number of account nodes to obtain updated candidate abnormal communities;

and returning to the step of acquiring communities with the largest number of account nodes in communities corresponding to the candidate abnormal communities and the adjacent account nodes until the labels of the abnormal account nodes in the candidate abnormal communities or the labels of the adjacent account nodes are unchanged, and acquiring updated target abnormal communities.

In a second aspect, the present application provides an abnormal transaction object identification apparatus, the apparatus comprising:

the acquisition module is used for acquiring graph models corresponding to a plurality of accounts and training a community positioning model to be trained according to the graph models; the graph model comprises pre-marked abnormal account nodes;

the identification module is used for determining marks of other account nodes in the graph model through the trained community positioning model, and identifying candidate abnormal communities according to the marks of the abnormal account nodes and the marks of the other account nodes; the other account nodes are account nodes except the pre-marked abnormal account nodes in the graph model; the candidate abnormal community is composed of at least one abnormal account node;

the updating module is used for traversing adjacent account nodes of the candidate abnormal communities, and iteratively updating the number of the abnormal account nodes of the candidate abnormal communities according to the comparison result of the marks of the abnormal account nodes in the candidate abnormal communities and the marks of the adjacent account nodes until the number of the abnormal account nodes of the candidate abnormal communities meets the preset condition, so as to obtain updated target abnormal communities;

and the determining module is used for determining an abnormal transaction object according to the abnormal account nodes in the target abnormal community.

In a third aspect, the present application provides a computer device comprising a memory storing a computer program and a processor implementing the steps of the method described above when the processor executes the computer program.

In a fourth aspect, the present application provides a computer readable storage medium having stored thereon a computer program which when executed by a processor performs the steps of the method described above.

In a fifth aspect, the present application provides a computer program product comprising a computer program which, when executed by a processor, implements the steps of the method described above.

According to the method, the device, the computer equipment, the storage medium and the computer program product for identifying the abnormal transaction object, a community positioning model containing pre-marked abnormal account nodes is obtained through training of a graph model constructed by a plurality of accounts, marks of other account nodes in the graph model are determined through the community positioning model, candidate abnormal communities are identified according to the marks of the abnormal account nodes and the marks of the other account nodes, the number of the abnormal account nodes in the candidate abnormal account communities is iteratively updated according to a comparison result of the marks of the abnormal nodes in the candidate abnormal account communities and the marks of the adjacent account nodes, which is obtained by traversing adjacent account nodes of the candidate abnormal communities, until preset conditions are met, and the abnormal transaction object is determined according to the updated abnormal account nodes in the target abnormal communities. Compared with the traditional mode of auditing through manual work, the method and the device have the advantages that the community positioning model is trained through the graph model constructed by a small amount of samples, the abnormal account nodes are identified based on the community positioning model, the abnormal communities are determined through iterative updating of the abnormal account nodes in the graph model, further, the transaction objects in the abnormal communities are determined, and the identification efficiency of the abnormal transaction objects is improved.

Drawings

FIG. 1 is a flow chart of a method for identifying abnormal transaction objects in one embodiment;

FIG. 2 is a flow diagram of the graph model building step in one embodiment;

FIG. 3 is a flow chart of a model training step in one embodiment;

FIG. 4 is a flowchart of a method for identifying abnormal transaction objects according to another embodiment;

FIG. 5 is a block diagram of an abnormal transaction object identification device in one embodiment;

fig. 6 is an internal structural diagram of a computer device in one embodiment.

Detailed Description

In order to make the objects, technical solutions and advantages of the present application more apparent, the present application will be further described in detail with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described herein are for purposes of illustration only and are not intended to limit the present application.

In one embodiment, as shown in fig. 1, there is provided an abnormal transaction object identification method, where the method is applied to a terminal to illustrate the abnormal transaction object identification method, it is understood that the method may also be applied to a server, and may also be applied to a system including the terminal and the server, and implemented through interaction between the terminal and the server, including the following steps:

Step S202, obtaining graph models corresponding to a plurality of accounts, and training a community positioning model to be trained according to the graph models; the graph model includes pre-labeled abnormal account nodes.

The plurality of accounts can be accounts of a plurality of users, and the terminal can construct a corresponding graph model according to the plurality of accounts. The graph model is provided with corresponding nodes and edges, each node in the graph model can represent an account of a user, and transaction relations exist among the accounts, so that each edge in the graph model represents the transaction relation between two accounts corresponding to two nodes connected with the edge. Among the plurality of accounts, there may be an object having an abnormal transaction behavior, which is called an abnormal transaction object, and the abnormal transaction behavior of the abnormal transaction object may cause a potential safety hazard to the transaction system, so that the abnormal transaction object needs to be identified. The abnormal transaction objects can be aggregated to form an abnormal transaction community, and nodes in the abnormal transaction community can be regarded as abnormal transaction objects participating in abnormal transactions. Abnormal trading objects often have high trading volume, unusual trading models, geographic diversity, off-shore entities, and lack of transparency. For example, hiding sources and destinations by transferring resources through multiple accounts or entities, involving integer transactions, transactions between entities without explicit business relationships, transactions outside of normal business hours, involving multiple national entities or users, hiding real ownership and control rights of resources and node opacity through offshore entities, etc.

Transaction information exists among the accounts, and the terminal can construct a graph model based on the transaction information. For example, in one embodiment, the terminal may first obtain a historical transaction value, a historical transaction type, a historical transaction number, and a historical transaction location between the plurality of accounts as historical transaction information between the plurality of accounts; and constructing a graph model according to the historical transaction values, the historical transaction types, the historical transaction times and the historical transaction positions in the historical transaction information among the accounts. The transaction information may be used to determine a connection relationship between accounts, a weight of an edge in the connection relationship, and the like. The graph model may also include a plurality of pre-labeled anomalous account nodes. The pre-marked abnormal account nodes can be marked by staff in the corresponding field, and the terminal can receive the abnormal marks of the corresponding staff on the account nodes in the graph model and determine the abnormal account nodes. The abnormal account nodes marked by the staff can be used as a training set for training the community positioning model to be trained.

Specifically, the transaction may be a resource-based transaction, and the terminal may acquire resource transaction information data of accounts corresponding to the respective users, where the data includes data of normal transactions and data of abnormal transactions. Each account has a corresponding account issuer, and the account issuers of each account can be different, so that a user can conduct transactions across account issuers, and because abnormal transaction objects can be deposited into the recollection resources through different account issuers, the terminal acquires transaction information of each account and can comprise transaction data across account issuers.

The terminal may also receive a flag for the abnormal account node in the graph model, where the marked abnormal account node may be a subset of nodes in the graph model, and the terminal may infer labels of other nodes using the marked abnormal account node. Wherein the number of pre-labeled outlier nodes may be less than the number of nodes in the graph model. Specifically, the community localization model may be a GCN (Graph Convolutional Networks, graph neural network) model. The terminal can train the GCN model to be trained through the abnormal account nodes, and identify the characteristics and modes of communities or attributes of the marked nodes through the GCN model. Thus, after training is completed, the GCN model can be used to predict the labels of the unlabeled nodes based on the characteristics and network structure of the unlabeled nodes in the graph model.

Step S204, determining marks of other account nodes in the graph model through the trained community positioning model, and identifying candidate abnormal communities according to the marks of the abnormal account nodes and the marks of the other account nodes; the other account nodes are account nodes except for the pre-marked abnormal account nodes in the graph model; the candidate anomalous community is composed of at least one anomalous account node.

After the terminal trains the graph model with the pre-marked abnormal account nodes to obtain the community positioning model, the trained community positioning model can be used for identifying marks of other account nodes in the graph model. For example, identify whether each other account node has abnormal transaction behavior, and thereby determine whether it is an abnormal account node. The other account nodes are account nodes except for the pre-marked abnormal account nodes in the graph model. The terminal can identify candidate abnormal communities according to the marks of the abnormal account nodes and the marks of other account nodes. The candidate abnormal community can be a community containing at least one abnormal account node, and the terminal can aggregate all abnormal account nodes with a connected relationship so as to obtain the candidate abnormal community.

After the terminal obtains the candidate abnormal community, the candidate abnormal community may further include some maximum connected graphs or minimum connected graphs, the maximum connected graphs are usually large and closely connected, all nodes have many connections with other nodes in the graph, the minimum connected graphs may be small but still highly connected, and many connections exist between the nodes, but deletion of any single node is also refused. The presence of these subgraphs may cause the network to split into smaller, unconnected subgraphs in the community detection. Making it more difficult to identify meaningful communities in a network. It is necessary to delete the maximum and minimum subgraphs prior to community detection. Specifically, in one embodiment, the terminal may delete a predetermined maximum connected subgraph or minimum connected subgraph in the candidate abnormal community to obtain an adjusted candidate abnormal community; after deleting the maximum connected graph and the minimum connected graph, the terminal can traverse the adjusted adjacent account nodes of the candidate abnormal community.

Specifically, the detection of the labels of other account nodes based on the community positioning model can be realized through a label propagation technology, and the terminal can propagate the labels of the label nodes to adjacent nodes in the network through the community positioning model. In addition, using the adjacency matrix of the GCN model and the graph model described above, the labels of unlabeled nodes are predicted, for example, using random walk, diffusion, or iterative methods that update the labels of nodes in each iteration until convergence.

Step S206, traversing adjacent account nodes of the candidate abnormal communities, and iteratively updating the number of the abnormal account nodes of the candidate abnormal communities according to the comparison result of the marks of the abnormal account nodes and the marks of the adjacent account nodes in the candidate abnormal communities until the preset condition is met, so as to obtain the updated target abnormal communities.

The candidate abnormal communities may have a plurality of nodes, and because some irrelevant nodes or nodes on the boundary of the communities may belong to the nodes in the communities, the terminal needs to optimize the composition of the communities by scanning the nodes, which belongs to the problem of graph combination optimization. The terminal may traverse neighboring account nodes of the candidate abnormal community and compare the labels of the abnormal account nodes in the candidate abnormal community with the labels of the neighboring account nodes, where the neighboring account nodes may include a plurality of, and the comparison includes a number comparison, a feature comparison, and the like. The terminal can iteratively update the number of the abnormal account nodes of the candidate abnormal community according to the comparison result, namely, the terminal can compare the candidate abnormal account community with the adjacent account nodes for a plurality of times, and update the nodes in the candidate abnormal community in each comparison, including updating the number of the nodes, the node characteristics and the like. Therefore, when the preset conditions are met, the terminal can obtain the updated target abnormal community. That is, the target abnormal community may be a community in which the account node cannot be updated any more based on each account node in the graph model. The terminal may update the candidate abnormal communities through various algorithms, such as a Louvain (community discovery based on modularity) algorithm or a Label Propagation (local community division based on tag propagation) algorithm.

Step S208, determining an abnormal transaction object according to the abnormal account nodes in the target abnormal community.

After determining the target abnormal community, the terminal can determine an abnormal transaction object according to the abnormal account node in the target abnormal community. For example, the target abnormal communities may include a plurality of abnormal account nodes in each target abnormal account community, and the terminal may acquire the abnormal account nodes and use the users corresponding to the abnormal account nodes as abnormal transaction objects. The terminal can also determine a set formed by the abnormal transaction objects according to the abnormal transaction objects corresponding to each target abnormal community, and further analyze the transaction behaviors of the set of the abnormal transaction objects.

According to the abnormal transaction object identification method, a community positioning model containing pre-marked abnormal account nodes is obtained through training of a graph model constructed by a plurality of accounts, marks of other account nodes in the graph model are determined through the community positioning model, candidate abnormal communities are identified according to the marks of the abnormal account nodes and the marks of the other account nodes, the number of the abnormal account nodes of the candidate abnormal communities is iteratively updated according to a comparison result of the marks of the abnormal nodes in the candidate abnormal account communities and the marks of the adjacent account nodes, which is obtained by traversing adjacent account nodes of the candidate abnormal communities, until preset conditions are met, and the abnormal transaction object is determined according to the updated abnormal account nodes in the target abnormal communities. Compared with the traditional mode of auditing through manual work, the method and the device have the advantages that the community positioning model is trained through the graph model constructed by a small amount of samples, the abnormal account nodes are identified based on the community positioning model, the abnormal communities are determined through iterative updating of the abnormal account nodes in the graph model, further, the transaction objects in the abnormal communities are determined, and the identification efficiency of the abnormal transaction objects is improved.

In one embodiment, as shown in fig. 2, fig. 2 is a schematic flow diagram of the graph model building step in one embodiment. The step of constructing the graph model comprises the following steps: the method comprises the steps of receiving anomaly marking information for a plurality of accounts, and marking partial anomaly accounts in the plurality of accounts; determining the connection relation among a plurality of accounts according to the historical transaction information between each account and other accounts; according to the historical transaction values and the historical transaction times of each account, determining the weight of the edges between each account in the connection relation; determining node attributes of each account according to the historical transaction types and account information of each account; and constructing a graph model according to the marked multiple accounts containing part of the abnormal accounts, the connection relation among the multiple accounts, the weight of the edges and the node attribute of each account.

In this embodiment, the historical transaction information between the accounts may include various information. The terminal may construct a graph model based on a variety of historical transaction information. For example, the terminal may receive abnormal marking information of the related staff for the plurality of accounts, and further determine an abnormal account to be marked in the plurality of accounts, so that the terminal may mark a part of abnormal accounts in the plurality of accounts according to the abnormal marking information. The partial abnormal account represents a partial abnormal account in the plurality of accounts, that is, other abnormal accounts may exist in the plurality of accounts. The terminal may determine a connection relationship between the plurality of accounts according to historical transaction information between each account and other accounts. For example, when there is historical transaction information between two accounts, there is a transaction relationship between the two accounts on behalf of the two accounts, so the terminal may generate a connection relationship between the two accounts.

The historical transaction information may further include a historical transaction value and a historical transaction number, and the edges between the accounts with the connection relationship have corresponding weights, so that the terminal may determine the weights of the edges between the accounts in the connection relationship according to the historical transaction value and the historical transaction number between the accounts and other accounts. The historical transaction information may further include a historical transaction type and account information, and the respective accounts may include node attributes, so that the terminal may determine the node attributes of the respective accounts according to the historical transaction type and account information of the respective accounts. After determining the plurality of accounts, the connection relation among the plurality of accounts, the weight of the edges among the plurality of accounts and the node attribute of each account, the terminal can construct a graph model based on the plurality of accounts, the connection relation among the plurality of accounts, the weight of the edges and the node attribute of each account, wherein the plurality of accounts comprise marks of partial abnormal accounts.

Specifically, the historical transaction information may include data related to transactions, the terminal may use an account of a user as a node, if it is detected that a transaction record exists between the accounts of the user, that is, there is the historical transaction information, an edge may be formed between two accounts of the user, where there is a transaction record, and the terminal may further obtain a historical transaction value and a historical transaction number between the accounts of the user, form a weight of the edge, further construct a graph model, where the graph model includes a plurality of account nodes, and the terminal may obtain a node set corresponding to the graph model and a set of edges, and may generate an adjacency matrix of the graph model based on a connection relationship between each node in the graph model. The terminal may also determine the characteristics of each node in the graph model, i.e., the node attributes. For example, the terminal may add the attributes of the above nodes, such as transaction records, account information, and transaction types, as node characteristics to the node characteristic matrix.

According to the embodiment, the terminal can determine the connection relation, the node attribute and the like among all account nodes based on various types of historical transaction information, and construct a corresponding graph model, so that the terminal can identify the abnormal transaction object based on the graph model, and the identification efficiency of the abnormal transaction object is improved.

In one embodiment, as shown in fig. 3, fig. 3 is a flow chart illustrating a model training step in one embodiment, and a process for training a community positioning model to be trained includes: inputting the node attribute of each account and the connection relation between a plurality of accounts in the graph model into a community positioning model to be trained, and obtaining a test abnormal account node which is output by the community positioning model to be trained based on the node attribute of each account and the connection relation between the plurality of accounts; according to the comparison result of the test abnormal account node and the pre-marked abnormal account node, a loss function of the community positioning model to be trained is adjusted through a back propagation algorithm and a gradient descent algorithm, and the step of inputting the node attribute of each account in the graph model and the connection relation among a plurality of accounts into the community positioning model to be trained is returned until the training ending condition is met, and the community positioning model after training is completed is obtained.

In this embodiment, after the terminal constructs the graph model, the connection relationship between the node attribute of each account and the plurality of accounts in the graph model may be input into the community positioning model to be trained, so that the community positioning model to be trained may output the corresponding test abnormal account node based on the connection relationship between the node attribute of each account and the plurality of accounts. The test anomalous account node may be an anomalous account node to be determined. In order to enable the identification of the community positioning model to be trained to be more accurate, the terminal can conduct iterative training on the community positioning model to be trained. For example, the terminal may obtain a comparison result of the test abnormal account node and the pre-marked abnormal account node, adjust a loss function of the community positioning model to be trained through a back propagation algorithm and a gradient descent algorithm, and return to a step of inputting the node attribute of each account in the graph model and the connection relationship between the plurality of accounts into the community positioning model to be trained until the training end condition is satisfied, and obtain the trained community positioning model.

The training ending condition may be that the loss function is smaller than or equal to a preset threshold, or the training times reach a preset number of times, where the community positioning model may include a multi-layer sub-model, and the community positioning model may include a forward propagation process when performing abnormal account node identification, for example, in one embodiment, after a terminal inputs a connection relationship between a node attribute of each account and a plurality of accounts in the graph model into the community positioning model to be trained, the community positioning model to be trained may determine a weight matrix of each layer of sub-model according to the node attribute of each account, and the community positioning model to be trained may include a ReLU (Rectified Linear Unit, a rectifying linear unit activation function), and the terminal may determine a current abnormal test account node output by the current layer sub-model through the community positioning model to be trained according to the rectifying linear unit activation function and an identification result of a previous layer sub-model; the terminal outputs the current abnormal account nodes in a layer-by-layer mode through the multi-layer submodel in the community positioning model to be trained, and if the current layer submodel is the output layer submodel, the terminal can acquire the abnormal account nodes in the test output by the output layer submodel.

Specifically, the data input into the community positioning model to be trained may be a node feature matrix corresponding to the node attribute and an adjacency matrix corresponding to the connection relationship between the accounts. The terminal can train the GCN community positioning model on the transaction network based on the node characteristic matrix and the adjacency matrix. The model is trained on a training set of pre-labeled outlier account nodes by back propagation and gradient descent. The forward propagation process of the back propagation in the training process may be that the terminal inputs the node feature matrix X and the adjacency matrix a into a GCN model, and the model outputs a current predicted community member matrix Z, that is, the current abnormal account node from the test, where the community member matrix Z may include a plurality of abnormal account nodes identified by the current layer. The recognition formula of each layer of submodel is as follows: z (l+1) =relu (a x Z (l) x W (l)). Wherein Z (l) is a community member matrix predicted by the first layer, W (l) is a weight matrix of the first layer, relu is a rectifying linear unit activation function, and x is matrix multiplication.

Through the embodiment, the terminal can train the community positioning model to be trained based on the modes of counter propagation, gradient descent algorithm and the like by utilizing the node attribute of each account and the connection relation among a plurality of accounts, so that the terminal can identify abnormal account nodes by utilizing the trained community positioning model, and the recognition efficiency of abnormal transaction objects is improved.

In one embodiment, according to the comparison result of the test abnormal account node and the pre-marked abnormal account node, the loss function of the community positioning model to be trained is adjusted through a back propagation algorithm and a gradient descent algorithm, and the method comprises the following steps: determining a community membership matrix of the current test abnormal account node in each layer of sub-model relative to the pre-marked abnormal account node according to the comparison result of the current test abnormal account node and the pre-marked abnormal account node output by each layer of sub-model; aiming at each layer of sub-model, determining the gradient of the binary cross entropy loss function relative to the weight matrix of the layer of sub-model according to the community membership matrix, the weight matrix, the preset regularization parameter and the preset learning rate corresponding to the layer of sub-model; and adjusting the weight of each layer of sub-model so as to enable the gradient of each layer of sub-model to be reduced, and obtaining an adjusted binary cross entropy loss function.

In this embodiment, the loss function may be a binary cross entropy loss function. In order to improve the recognition accuracy of the community positioning model, the terminal can conduct back propagation based on the loss function in the training process of the community positioning model to be trained. The community positioning model is provided with a plurality of layers of sub-models, and the terminal can compare the current test abnormal account nodes output by each layer of sub-models with the pre-marked abnormal account nodes to obtain corresponding comparison results. The comparison result indicates whether the current test abnormal account node predicted by each layer of sub-model is accurate or not. And the terminal can determine a community membership matrix of the current test abnormal account node in each layer of sub-model relative to the pre-marked abnormal account node according to the comparison result.

And each layer of sub-model corresponds to a weight matrix and a gradient of the weight matrix. For each layer of sub-model, the terminal can determine the gradient of the binary cross entropy loss function relative to the weight matrix of the layer of sub-model according to the community membership matrix, the weight matrix, the preset regularization parameter and the preset learning rate corresponding to the layer of sub-model. Therefore, the terminal can adjust the preset learning rate, so that the gradient of each layer of sub-model is reduced, and an adjusted binary cross entropy loss function is obtained, namely, the loss function is adjusted.

Specifically, the loss function measures the difference between the member matrix Z corresponding to the predicted abnormal account node and the community member matrix Y of the true abnormal account node. The comparison may be a binary classification problem, and the specific form of the binary cross entropy loss function L is: l= -sum (Y x log (Z) + (1-Y) x log (1-Z)). The terminal may adjust the loss function by a back propagation algorithm and a gradient descent algorithm based on the loss function. Wherein the purpose of the back propagation is to calculate the gradient of the loss function with respect to the model parameters, the gradient descent algorithm may be a random gradient descent algorithm when the community localization model is a GCN model. The specific formula is as follows: dL/dW ^l ＝Z ^l-1 *dZ ^l /dW ^l +lambda*W ^l W ^l ＝W ^l -learning_rate*dL/dW ^l . Wherein dL/dW ^l Z is the gradient of the loss function relative to the layer-I weight matrix ^l-1 Community membership matrix for layer I prediction, dZ ^l /dW ^l For the derivative of the community membership matrix predicted by the first layer relative to the weight matrix of the first layer, lambda is a regularization parameter, learning_rate is the learning rate of the SGD (Stochastic Gradient Descent, optimizer) of the community positioning model, and x represents matrix multiplication. The terminal can update the weight and the like of the model of each layer according to the gradient of each layer determined by the formula of the gradient descent algorithm, so that the recognition accuracy of the model is improved.

Through the embodiment, the terminal can train the community positioning model to be trained by utilizing the pre-marked abnormal account nodes through the back propagation and random gradient descent algorithm, so that the terminal can identify the abnormal account nodes based on the trained community positioning model, and the identification efficiency of abnormal transaction objects is improved.

In one embodiment, iteratively updating the number of the abnormal account nodes of the candidate abnormal community according to a comparison result of the marks of the abnormal account nodes and the marks of the adjacent account nodes in the candidate abnormal community until a preset condition is met, and obtaining the updated target abnormal community, including: each adjacent account node is added to the candidate abnormal community, and the modularity increment of the abnormal community selected when each addition is carried out is obtained; changing the label of the adjacent account node with the maximum modularity increment into the label of the abnormal account node in the candidate abnormal community to obtain an updated candidate abnormal community; and returning to the step of adding each adjacent account node to the candidate abnormal community respectively until the modularity increment converges, and obtaining the updated target abnormal community.

In this embodiment, after obtaining the trained community positioning model, the terminal may identify the labels of other account nodes based on the community positioning model. And constructing a candidate abnormal community based on the identified abnormal account nodes. The terminal can also update and iterate the account node number in each candidate abnormal community. Wherein the terminal may be updated through a variety of algorithms. Such as the Louvain algorithm or the Label Propagation algorithm, etc. In iterative updating, the terminal can consider the candidate abnormal community as an account node, and the mark of the node is determined by the mark of the abnormal account node in the candidate abnormal community.

For the Louvain algorithm, the terminal can traverse and respectively add each adjacent account node to the candidate abnormal community, and acquire the modularity increment of the abnormal community selected when each addition is performed. The modularity is a method for measuring the structural strength of the network community, and the larger the modularity is, the better the community dividing effect is. The number of the adjacent account nodes can be multiple, the terminal can acquire the marks of the adjacent account nodes with the largest module increment, and the marks of the adjacent account nodes are changed into the marks of the abnormal account nodes in the candidate abnormal communities, so that the terminal can obtain updated candidate abnormal communities. The terminal can return to the step of adding each adjacent account node to the candidate abnormal community based on the updated candidate abnormal community, and perform the next iteration update. If the terminal detects that the modularity increment converges, for example, the modularity does not increase, the terminal can determine that iteration of the candidate abnormal community is completed, so that the terminal can obtain the updated target abnormal community.

In addition, the terminal can iterate the candidate abnormal community through the Label Propagation algorithm. For example, in one embodiment, the terminal may compare the number of first abnormal account nodes in the candidate abnormal community with the number of second account nodes in the community corresponding to the adjacent account nodes, and since there may be a plurality of adjacent account nodes, and each adjacent account node may also be a node compressed by the community, the terminal may obtain a plurality of comparison results. The terminal can determine communities with the largest number of account nodes in the first abnormal account node number and the second account node number according to the comparison result, change the labels of the abnormal account nodes in the candidate abnormal communities or labels of adjacent account nodes into labels of communities with the largest number of account nodes, and obtain updated candidate abnormal communities. The terminal can determine the labels of candidate abnormal communities and adjacent nodes with connection relations through quantity comparison.

The terminal can return to the step of acquiring the community with the largest number of account nodes in communities corresponding to the candidate abnormal communities and the adjacent account nodes based on the updated candidate abnormal communities, so that the next iteration is performed until the label of the abnormal account nodes in the candidate abnormal communities or the label of the adjacent account nodes is unchanged, and the terminal can determine that the iteration of the candidate abnormal communities is completed and obtain the updated target abnormal communities.

Through the embodiment, the terminal can further refine the abnormal communities identified by the community positioning model through various algorithms, particularly under the condition that the community positioning model is difficult to identify smaller or more subtle groups in the graph model, the terminal can identify the abnormal communities according to the labels of nodes in the communities, and the optimal reconstruction of the abnormal communities is realized, so that the terminal determines the abnormal transaction objects through the target abnormal communities after the optimal reconstruction, and the recognition efficiency of the abnormal transaction objects is improved.

In one embodiment, as shown in fig. 4, fig. 4 is a flow chart of a method for identifying abnormal transaction objects in another embodiment. In this embodiment, when an abnormal community performs an abnormal transaction operation, large-amount resources are generally dispersed into small-amount deposits, the small-amount deposits are stored into account issuers through accounts of other people in the community, and then the deposits are collected and constructed, so that a terminal can construct a special network organization structure in a graph model of the user relationship by utilizing the transaction relationship among users in the transaction mode. The concept of communities may reveal information about clustering behavior in graph models and organization structures embedded in graph models, and by analyzing characteristics of these individuals or groups of entities involved in abnormal transactions, such as the type of transaction involved or the geographic location of the entity, the structure and operation of the abnormal communities may be known in depth. In an abnormal transaction network, an individual or group organization may attempt to transfer resources through multiple transactions or accounts to hide the source and destination of the resources. These transactions may be represented as a network, with nodes representing entities, e.g., accounts for each user, and edges representing transactions between entities. Transaction characteristics of the anomalous community, such as transaction type and physical location, which may be incorporated into node characteristics or edge weights of the network, are reflected in the community detection process.

As shown in fig. 4, in the specific recognition, the terminal may create a transaction network based on data related to the transaction by the user, such as transaction records, account information, transaction types, etc., to obtain a graph model. And the terminal can also extract the characteristics of transaction values, transaction types, account geographic positions and the like of the data as node characteristics of each node in the graph model, and mark a node subset in the network, for example, mark the nodes known to belong to an abnormal community with abnormal transactions in advance. The terminal uses the node characteristic matrix and the adjacent matrix as input, and the community positioning model, namely the GCN model, is obtained based on graph model training. The terminal may use the trained GCN model to predict labels for unlabeled nodes in the graph model. Finally, a community detection algorithm, such as Louvain or Label Propagation, is applied to the output of the GCN model to identify communities in the graph model, so that community reconstruction is performed, the communities identified by the GCN model are further refined, and abnormal communities are inferred and identified according to labels of nodes in the communities.

Through the embodiment, the terminal trains the community positioning model through the graph model constructed by a small amount of samples, identifies the abnormal account nodes based on the community positioning model, determines the abnormal community through iteratively updating the abnormal account nodes in the graph model, further determines the transaction objects in the abnormal community, and improves the identification efficiency of the abnormal transaction objects.

It should be understood that, although the steps in the flowcharts related to the above embodiments are sequentially shown as indicated by arrows, these steps are not necessarily sequentially performed in the order indicated by the arrows. The steps are not strictly limited to the order of execution unless explicitly recited herein, and the steps may be executed in other orders. Moreover, at least some of the steps in the flowcharts described in the above embodiments may include a plurality of steps or a plurality of stages, which are not necessarily performed at the same time, but may be performed at different times, and the order of the steps or stages is not necessarily performed sequentially, but may be performed alternately or alternately with at least some of the other steps or stages.

Based on the same inventive concept, the embodiment of the application also provides an abnormal transaction object identification device for realizing the abnormal transaction object identification method. The implementation of the solution provided by the device is similar to the implementation described in the above method, so the specific limitation in the embodiment of the device for identifying abnormal transaction objects provided below may refer to the limitation of the method for identifying abnormal transaction objects hereinabove, and will not be repeated herein.

In one embodiment, as shown in fig. 5, there is provided an abnormal transaction object recognition apparatus including: an acquisition module 500, an identification module 502, an update module 504, and a determination module 506, wherein:

the obtaining module 500 is configured to obtain graph models corresponding to a plurality of accounts, and train a community positioning model to be trained according to the graph models; the graph model includes pre-labeled abnormal account nodes.

The identifying module 502 is configured to determine, through the trained community positioning model, a flag of another account node in the graph model, and identify a candidate abnormal community according to the flag of the abnormal account node and the flag of the other account node; the other account nodes are account nodes except for the pre-marked abnormal account nodes in the graph model; the candidate anomalous community is composed of at least one anomalous account node.

And the updating module 504 is configured to traverse neighboring account nodes of the candidate abnormal community, iteratively update the number of the abnormal account nodes of the candidate abnormal community according to a comparison result of the labels of the abnormal account nodes and the labels of the neighboring account nodes in the candidate abnormal community, until a preset condition is met, and obtain an updated target abnormal community.

A determining module 506, configured to determine an abnormal transaction object according to the abnormal account node in the target abnormal community.

In one embodiment, the obtaining module 500 is configured to obtain, as the historical transaction information between the plurality of accounts, the historical transaction value, the historical transaction type, the historical transaction number, and the historical transaction location between the plurality of accounts; and constructing a graph model according to the historical transaction values, the historical transaction types, the historical transaction times and the historical transaction positions in the historical transaction information among the accounts.

In one embodiment, the obtaining module 500 is configured to receive anomaly tagging information for a plurality of accounts, and tag a portion of the plurality of accounts with anomalies; determining the connection relation among a plurality of accounts according to the historical transaction information between each account and other accounts; according to the historical transaction values and the historical transaction times of each account, determining the weight of the edges between each account in the connection relation; determining node attributes of each account according to the historical transaction types and account information of each account; and constructing a graph model according to the marked multiple accounts containing part of the abnormal accounts, the connection relation among the multiple accounts, the weight of the edges and the node attribute of each account.

In one embodiment, the obtaining module 500 is configured to input the node attribute of each account and the connection relationship between the plurality of accounts in the graph model into the community positioning model to be trained, so as to obtain a test abnormal account node that is output by the community positioning model to be trained based on the node attribute of each account and the connection relationship between the plurality of accounts; according to the comparison result of the test abnormal account node and the pre-marked abnormal account node, a loss function of the community positioning model to be trained is adjusted through a back propagation algorithm and a gradient descent algorithm, and the step of inputting the node attribute of each account in the graph model and the connection relation among a plurality of accounts into the community positioning model to be trained is returned until the training ending condition is met, and the community positioning model after training is completed is obtained.

In one embodiment, the obtaining module 500 is configured to determine, by the community positioning model to be trained, a weight matrix of each layer of sub-model according to node attributes of each account, and determine, according to the rectifying linear unit activation function and an identification result of a previous layer of sub-model, a current abnormal test account node output by a current layer of sub-model; and if the current layer sub-model is the output layer sub-model, acquiring the test abnormal account node output by the output layer sub-model.

In one embodiment, the obtaining module 500 is configured to determine a community membership matrix of the current test abnormal account node in each layer of sub-model relative to the pre-marked abnormal account node according to a comparison result of the current test abnormal account node and the pre-marked abnormal account node output by each layer of sub-model; aiming at each layer of sub-model, determining the gradient of the binary cross entropy loss function relative to the weight matrix of the layer of sub-model according to the community membership matrix, the weight matrix, the preset regularization parameter and the preset learning rate corresponding to the layer of sub-model; and adjusting the weight of each layer of sub-model so as to enable the gradient of each layer of sub-model to be reduced, and obtaining an adjusted binary cross entropy loss function.

In one embodiment, the apparatus further comprises: the deleting module is used for deleting a predetermined maximum connected subgraph or minimum connected subgraph in the candidate abnormal communities to obtain adjusted candidate abnormal communities; traversing the adjacent account nodes of the adjusted candidate abnormal community.

In one embodiment, the updating module is configured to add each neighboring account node to a candidate abnormal community, and obtain a modularity increment of the candidate abnormal community when each addition is performed; changing the label of the adjacent account node with the maximum modularity increment into the label of the abnormal account node in the candidate abnormal community to obtain an updated candidate abnormal community; and returning to the step of adding each adjacent account node to the candidate abnormal community respectively until the modularity increment converges, and obtaining the updated target abnormal community.

In one embodiment, the updating module is configured to obtain a comparison result of the number of the first abnormal account nodes in the candidate abnormal community and the number of the second account nodes in the community corresponding to the adjacent account nodes; according to the comparison result, obtaining communities with the largest number of account nodes in the first abnormal account node number and the second account node number, changing the labels of the abnormal account nodes or labels of adjacent account nodes in the candidate abnormal communities into labels of communities with the largest number of account nodes, and obtaining updated candidate abnormal communities; and returning to the step of acquiring communities with the largest number of account nodes in communities corresponding to the candidate abnormal communities and the adjacent account nodes until the labels of the abnormal account nodes or the labels of the adjacent account nodes in the candidate abnormal communities are unchanged, and obtaining the updated target abnormal communities.

The respective modules in the abnormal transaction object recognition apparatus described above may be implemented in whole or in part by software, hardware, or a combination thereof. The above modules may be embedded in hardware or may be independent of a processor in the computer device, or may be stored in software in a memory in the computer device, so that the processor may call and execute operations corresponding to the above modules.

In one embodiment, a computer device is provided, which may be a terminal, and the internal structure of which may be as shown in fig. 6. The computer device includes a processor, a memory, a communication interface, a display screen, and an input device connected by a system bus. Wherein the processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The communication interface of the computer device is used for carrying out wired or wireless communication with an external terminal, and the wireless mode can be realized through WIFI, a mobile cellular network, NFC (near field communication) or other technologies. The computer program, when executed by a processor, implements a method of abnormal transaction object identification. The display unit of the computer device is used for forming a visual picture, and can be a display screen, a projection device or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer equipment can be a touch layer covered on the display screen, can also be a key, a track ball or a touch pad arranged on the shell of the computer equipment, and can also be an external keyboard, a touch pad or a mouse and the like.

It will be appreciated by those skilled in the art that the structure shown in fig. 6 is merely a block diagram of some of the structures associated with the present application and is not limiting of the computer device to which the present application may be applied, and that a particular computer device may include more or fewer components than shown, or may combine certain components, or have a different arrangement of components.

In one embodiment, a computer device is provided that includes a memory having a computer program stored therein and a processor that implements the abnormal transaction object identification method described above when the computer program is executed.

In one embodiment, a computer readable storage medium is provided having a computer program stored thereon, which when executed by a processor implements the abnormal transaction object identification method described above.

In one embodiment, a computer program product is provided, comprising a computer program which, when executed by a processor, implements the abnormal transaction object identification method described above.

It should be noted that, user information (including but not limited to user equipment information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, presented data, etc.) referred to in the present application are information and data authorized by the user or sufficiently authorized by each party.

Those skilled in the art will appreciate that implementing all or part of the above described methods may be accomplished by way of a computer program stored on a non-transitory computer readable storage medium, which when executed, may comprise the steps of the embodiments of the methods described above. Any reference to memory, database, or other medium used in the various embodiments provided herein may include at least one of non-volatile and volatile memory. The nonvolatile Memory may include Read-Only Memory (ROM), magnetic tape, floppy disk, flash Memory, optical Memory, high density embedded nonvolatile Memory, resistive random access Memory (ReRAM), magnetic random access Memory (Magnetoresistive Random Access Memory, MRAM), ferroelectric Memory (Ferroelectric Random Access Memory, FRAM), phase change Memory (Phase Change Memory, PCM), graphene Memory, and the like. Volatile memory can include random access memory (Random Access Memory, RAM) or external cache memory, and the like. By way of illustration, and not limitation, RAM can be in the form of a variety of forms, such as static random access memory (Static Random Access Memory, SRAM) or dynamic random access memory (Dynamic Random Access Memory, DRAM), and the like. The databases referred to in the various embodiments provided herein may include at least one of relational databases and non-relational databases. The non-relational database may include, but is not limited to, a blockchain-based distributed database, and the like. The processors referred to in the embodiments provided herein may be general purpose processors, central processing units, graphics processors, digital signal processors, programmable logic units, quantum computing-based data processing logic units, etc., without being limited thereto.

The technical features of the above embodiments may be arbitrarily combined, and all possible combinations of the technical features in the above embodiments are not described for brevity of description, however, as long as there is no contradiction between the combinations of the technical features, they should be considered as the scope of the description.

The above examples only represent a few embodiments of the present application, which are described in more detail and are not to be construed as limiting the scope of the present application. It should be noted that it would be apparent to those skilled in the art that various modifications and improvements could be made without departing from the spirit of the present application, which would be within the scope of the present application. Accordingly, the scope of protection of the present application shall be subject to the appended claims.

Claims

1. A method of identifying an abnormal transaction object, the method comprising:

2. The method of claim 1, wherein the obtaining a graph model corresponding to a plurality of accounts comprises:

3. The method of claim 2, wherein constructing the graph model based on the historical transaction values, the historical transaction types, the historical transaction times, and the historical transaction locations between the plurality of accounts comprises:

4. A method according to claim 3, wherein said training a community positioning model to be trained from said graph model comprises:

5. The method of claim 4, wherein the community location model to be trained comprises a multi-layer sub-model;

6. The method of claim 5, wherein the loss function is a binary cross entropy loss function;

7. The method of claim 1, further comprising, prior to the traversing the neighboring account nodes of the candidate anomalous community:

traversing adjacent account nodes of the adjusted candidate abnormal community.

8. The method according to claim 1, wherein iteratively updating the number of the abnormal account nodes of the candidate abnormal community according to the comparison result of the marks of the abnormal account nodes and the marks of the adjacent account nodes in the candidate abnormal community until a preset condition is met, obtaining the updated target abnormal community, includes:

returning to the step of adding each of the neighboring account nodes to the candidate anomalous community, and obtaining the updated target abnormal community until the modularity increment converges.

9. The method according to claim 1, wherein iteratively updating the number of the abnormal account nodes of the candidate abnormal community according to the comparison result of the marks of the abnormal account nodes and the marks of the adjacent account nodes in the candidate abnormal community until a preset condition is met, obtaining the updated target abnormal community, includes:

10. An abnormal transaction object recognition apparatus, characterized by comprising:

11. A computer device comprising a memory and a processor, the memory storing a computer program, characterized in that the processor implements the steps of the method of any one of claims 1 to 9 when the computer program is executed.

12. A computer readable storage medium, on which a computer program is stored, characterized in that the computer program, when being executed by a processor, implements the steps of the method of any of claims 1 to 9.

13. A computer program product comprising a computer program, characterized in that the computer program, when being executed by a processor, implements the steps of the method of any one of claims 1 to 9.