CN116957770A - Method and device for identifying financial fraud - Google Patents

Abstract

The invention provides a method for identifying financial fraud, which relates to the technical field of Internet application, and comprises the following steps: acquiring user data; preprocessing user data to obtain a user relationship network, wherein each user in the user relationship network is used as a node; inputting a model for identifying financial fraud into a user relationship network, and outputting fraud probability of a user; the model for identifying financial fraud determines the information of communities to which each user belongs by taking the module degree variation as an evaluation index according to the user relation network, and determines the fraud probability of the user in the communities according to the determined information of communities; the modularity is the weighted average of probability expectations obtained by subtracting edges from the proportion of the edges of the same community where the nodes fall, and the relationship strength between two nodes of different communities. According to the invention, the algorithm is realized, the large community and the small community are simultaneously considered, additional super parameters are required to be added, the algorithm accuracy is high, and the use is simple and convenient.

Description

A method and device for identifying financial fraud

Technical field

The present invention relates to the field of Internet application technology, and in particular, to a method and device for identifying financial fraud.

Background technique

In the existing technology, there are two situations in the community discovery algorithm based on modularity optimization: in some cases, our common sense believes that there should be multiple small communities, which tends to merge multiple small communities into a large community, and In other cases, our common sense believes that cases of large communities should be synthesized, but it tends not to be synthesized; this problem will become more obvious for operators or large Internet companies, and it is impossible to do relationship mining targeting companies or schools. .

Contents of the invention

Embodiments of the present invention provide a method and device for identifying financial fraud, which are used to solve the problem in the prior art that for complex parts in industrial environments or patients in the medical field, rigid constraints can easily cause parts wear or personnel injuries.

In order to solve the above problems, the present invention is implemented as follows:

In a first aspect, the present invention provides a method for identifying financial fraud, including:

Get user data;

Preprocess the user data to obtain a user relationship network, in which each user serves as a node;

The user relationship network is input into a model for identifying financial fraud, and the user's fraud probability is output; the model for identifying financial fraud uses the user relationship network to determine information about the community to which each user belongs, using the modularity change as an evaluation index. , determine the fraud probability of users in the community based on the information of the determined community; where the modularity is the proportion of edges where the node falls in the same community minus the probability expectation obtained by randomly assigning edges plus A weighted average of the relationship strengths between two nodes in different communities.

Optionally, the modularity is calculated using the following formula:

Among them, A _ij is the weight of the edge between node i and node j; k _i is the sum of the weights of all edges connected to node i; k _j is the sum of the weights of all edges connected to node j; c _i is the node The community i belongs to; m is the sum of the weights of all edges; The closeness of the connection between the two communities.

Optionally, inputting the user relationship network into a model for identifying financial fraud and outputting the user's fraud probability includes:

Step 1: Construct a first network graph according to the user relationship network, with each user in the first network graph serving as a node;

Step 2: Calculate the community to which each node in the first network graph belongs;

Step 3: Obtain the change in modularity of each node i when it moves from one community to each of its adjacent communities;

Step 4: Calculate the community c′ _i =argmaxΔQ(c _i ) with the largest change in modularity when dividing node i into communities, and use the community with the largest change as the community to which node i currently belongs;

Step 5: For each node i, obtain the community information to which it currently belongs and the community information to which all nodes connected to node i belong, as a set S;

Step 6: Perform steps 3 to 5 again according to the preset number of times; after the preset number of times, divide the iterative calculation rounds into odd-numbered rounds and even-numbered rounds; connect the node i to the node v _j , where the node v _j Belongs to the community that maximizes the change in node i; when the iteration round is an odd-numbered round and the change in the current community is less than the change in the community after the transfer, the community information is updated; or the iteration round is an even-numbered round and the change in the current community When the change amount is greater than the change amount of the transferred community, the community information is updated;

Step 7: Determine whether all nodes will no longer change the community they belong to;

Step 8: If all nodes no longer change their belonging communities, reconstruct the second network graph according to the current community information, where each vertex in the second network graph corresponds to a community in the first network graph; second The internal weight of a vertex in the network graph is the sum of the weights of all edges in the community in the first network graph;

Step 9: Perform steps 3 to 8 again for iterative updates until all nodes no longer change their belonging communities;

Step 10: Calculate the probability of community fraud based on the number of users in the community information, and evaluate the fraud risk of a single user based on the community information.

Optionally, obtaining the change in modularity of each node i when it moves from one community to another community includes:

Calculate the change of the modularity, and the change of the modularity is:

Among them,/> is the sum of the edge weights of each node in community c _i , including the edges with nodes within the community and the edges with nodes outside the community; c _i is the i-th community; k _i is the sum of the weights of all edges connected to node i; k _j is the sum of the weights of all edges connected to node j; k _i,in : the sum of the edge weights of node i and the community; k _j,in : the sum of the edge weights of node j and the community; m is the sum of all edge weights in the graph The sum of edge weights.

Optionally, calculating the probability of defrauding the community based on the number of users in the community information includes:

The probability calculation formula of the fraud community is: Among them, |c _i | is the total number of users in the c _i community; y _j is the personal marked data of the jth user stored in the database.

Optionally, the assessment of the fraud risk of an individual user based on the community information includes:

Identify common fraudulent users and core fraudulent users through the betweenness centrality algorithm, and assess individual user fraud risks.

In a second aspect, the present invention provides a device for identifying financial fraud, including:

Obtain module, used to obtain user data;

A preprocessing module, used to preprocess the user data to obtain a user relationship network, with each user in the user relationship network serving as a node;

An identification module, configured to input the user relationship network into a model for identifying financial fraud, and output the user's fraud probability; the model for identifying financial fraud determines each user based on the user relationship network, using the change in modularity as an evaluation index. The information of the community to which it belongs is used to determine the fraud probability of users in the community based on the information of the determined community; where the modularity is the proportion of the edges of the node falling in the same community minus the random allocation of edges. The probabilistic expectation is coupled with a weighted average of the relationship strengths between two nodes in different communities.

Optionally, the modularity is calculated using the following formula:

Among them, A _ij is the weight of the edge between node i and node j; k _i is the sum of the weights of all edges connected to node i; k _j is the sum of the weights of all edges connected to node j; c _i is the node The community i belongs to; m is the sum of the weights of all edges; The closeness of the connection between the two communities.

Optionally, inputting the user relationship network into a model for identifying financial fraud and outputting the user's fraud probability includes:

Step 1: Construct a first network graph according to the user relationship network, with each user in the first network graph serving as a node;

Step 2: Calculate the community to which each node in the first network graph belongs;

Step 3: Obtain the change in modularity of each node i when it moves from one community to each of its adjacent communities;

Step 4: Calculate the community c′ _i =argmaxΔQ(c _i ) with the largest change in modularity when dividing node i into communities, and use the community with the largest change as the community to which node i currently belongs;

Step 5: For each node i, obtain the community information to which it currently belongs and the community information to which all nodes connected to node i belong, as a set S;

Step 6: Perform steps 3 to 5 again according to the preset number of times; after the preset number of times, divide the iterative calculation rounds into odd-numbered rounds and even-numbered rounds; connect the node i to the node v _j , where the node v _j Belongs to the community that maximizes the change in node i; when the iteration round is an odd-numbered round and the change in the current community is less than the change in the community after the transfer, the community information is updated; or the iteration round is an even-numbered round and the change in the current community When the change amount is greater than the change amount of the transferred community, the community information is updated;

Step 7: Determine whether all nodes will no longer change the community they belong to;

Step 8: If all nodes no longer change their belonging communities, reconstruct the second network graph according to the current community information, where each vertex in the second network graph corresponds to a community in the first network graph; second The internal weight of a vertex in the network graph is the sum of the weights of all edges in the community in the first network graph;

Step 9: Perform steps 3 to 8 again for iterative updates until all nodes no longer change their belonging communities;

Step 10: Calculate the probability of community fraud based on the number of users in the community information, and evaluate the fraud risk of a single user based on the community information.

Optionally, obtaining the change in modularity of each node i when it moves from one community to another community includes:

Calculate the change of the modularity, and the change of the modularity is:

Among them,/> is the sum of the edge weights of each node in community c _i , including the edges with nodes within the community and the edges with nodes outside the community; _ci is the i-th community; k _i is the sum of the weights of all edges connected to node i; k _j is the sum of the weights of all edges connected to node j; k _i,in : the sum of the edge weights of node i and the community; k _j,in : the sum of the edge weights of node j and the community; m is all the edges in the graph The sum of the weights.

Optionally, calculating the probability of defrauding the community based on the number of users in the community information includes:

The probability calculation formula of the fraud community is: Among them, |c _i | is the total number of users in the c _i community; y _j is the personal marked data of the jth user stored in the database.

Optionally, the assessment of the fraud risk of an individual user based on the community information includes:

Identify common fraudulent users and core fraudulent users through the betweenness centrality algorithm, and assess individual user fraud risks.

In a third aspect, the present invention provides a server, including: a processor, a memory, and a program stored on the memory and executable on the processor. When the program is executed by the processor, the following is implemented: The steps of the method of identifying financial fraud according to any one of the aspects.

In a fourth aspect, the present invention provides a computer-readable storage medium. A computer program is stored on the computer-readable storage medium. When the computer program is executed by a processor, the method described in any one of the first aspects is implemented. Steps in the method of identifying financial fraud.

In the present invention, by modifying the definition of modularity and improving the community discovery algorithm, the problem of being unable to take into account both large communities and small communities is solved. At the same time, large communities such as companies and small communities such as families can be identified without adding additional ones. Hyperparameters require no manual intervention, the algorithm is highly accurate and easy to use.

Description of the drawings

Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiments. The drawings are for the purpose of illustrating preferred embodiments only and are not to be construed as limiting the invention. Also throughout the drawings, the same reference characters are used to designate the same components. In the attached picture:

Figure 1 is a schematic flow chart of a method for identifying financial fraud provided by an embodiment of the present invention;

Figure 2 is an overall flow diagram of a method for identifying financial fraud provided by an embodiment of the present invention;

Figure 3 is a schematic structural diagram of a device for identifying financial fraud provided by an embodiment of the present invention;

Figure 4 is a schematic structural diagram of another server provided by an embodiment of the present invention.

Detailed ways

The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without making creative efforts fall within the scope of protection of the present invention.

Please refer to Figure 1. An embodiment of the present invention provides a method for identifying financial fraud, including:

Step 11: Obtain user data;

Step 12: Preprocess the user data to obtain a user relationship network, with each user in the user relationship network serving as a node;

Step 13: Input the user relationship network into a model for identifying financial fraud, and output the user's fraud probability; the model for identifying financial fraud uses the modularity change as an evaluation index to determine the model to which each user belongs based on the user relationship network. Community information, based on the determined community information, determines the fraud probability of users in the community; where the modularity is the proportion of edges where the node falls in the same community minus the probability expectation obtained by randomly assigning edges. Plus a weighted average of the relationship strengths between two nodes in different communities.

In the embodiment of the present invention, by modifying the definition of modularity, the community discovery algorithm is improved, which solves the problem of being unable to take into account both large communities and small communities. At the same time, it is possible to identify large communities such as companies and small communities such as families, without joining. Additional hyperparameters require no manual intervention, the algorithm is highly accurate and easy to use.

In the embodiment of the present invention, in step 11, the base station side collects data on the user's calls, text messages, equipment, APP usage, website visits and other data through the embedded data collection device; in step 12, the collected data is classified, Check, correct or delete erroneous data, mark unreliable data, and import it into the production database; analyze and process the collected data, unify the data to the same level through normalization, standardization and other methods, and obtain the relationship between users Network, each user in the user relationship network serves as a node.

In the embodiment of the present invention, in step 13, after obtaining the user's relationship network, a user community with strong correlations is mined through a model for identifying financial fraud, the fraud situation of users in the community is analyzed, and a result is obtained for each user. Fraud probability; and the deployment method of Nebula+Plato is used to facilitate external financial institutions to call the results output by the model. The deployment method can accommodate large amounts of data, has fast search speed, and is suitable for environment deployment in the case of big data; among them, the model The calling process includes: the external financial institution calls the model for identifying financial fraud through the interface provided by the Nebula database; when the external financial institution inputs the user's name, mobile phone number and ID card, the user's fraud probability can be correspondingly output.

In the embodiment of the present invention, optionally, the modularity is calculated using the following formula:

Among them, A _ij is the weight of the edge between node i and node j; k _i is the sum of the weights of all edges connected to node i; k _j is the sum of the weights of all edges connected to node j; c _i is the node The community i belongs to; m is the sum of the weights of all edges; The closeness of the connection between the two communities.

In the embodiment of the present invention, the modularity is also called the modularity metric value, which is used to measure the strength of the network community structure. The modularity is: Its modularity formula in the prior art/> On the basis of this, a correction item is added, that is, a penalty item:/> Modularity formula in the prior art/> The meaning is the proportion of edges falling within the same community minus the probability expectation obtained by randomly assigning these edges; the correction term/> The meaning of is the weighted average of the relationship strength between two nodes in different communities; where, /> Represents the average relationship strength between two nodes in different communities. This term makes it so that if there are many connected edges between two small communities, then the correction term between them will be very small, that is, a smaller absolute value. A large negative number, so in the next iteration, the two small communities will tend to be merged, so that the two small communities are merged into one large community and added with weights/> This makes it so that when the connection between two small communities is not close, the weight will be very small, and the correction term will tend to 0. Whether to merge or not will not change the value of the correction term, and /> There will be a slight decrease, so the next iteration will not merge these two small communities, so that the closely related communities will be merged, and the less closely related communities will not be merged, taking into account both large communities and small communities.

In the embodiment of the present invention, the modularity formula is transformed into: Among them,/> is the sum of edge weights within community c _i ;/> is the sum of the edge weights of each node in community c _i , including the edges with nodes within the community and the edges with nodes outside the community; c _i is the i-th community; m is the sum of the weights of all edges in the user relationship network;/> is the sum of edge weights between nodes in community c _i and nodes in community c _j ;/> The closeness of connection between the nodes in community c _i and the nodes in community c _j ; where, /> |c _i | is the number of nodes in community c _i , |c _j | is the number of nodes in community c _j ;

Calculate the first change in modularity when a node joins a community as: Among them,/> is the sum of edge weights within community c _i ;/> is the sum of the edge weights of each node in community c _i , including the edges with nodes within the community and the edges with nodes outside the community; c _i is the i-th community; k _i is the sum of the weights of all edges connected to node i; k _i,in is the sum of the edge weights of nodes and communities; m is the sum of the weights of all edges in the user relationship network; the first change in modularity is simplified as:

Calculating the second change in modularity when a node moves from one community to another is: Simplified to: In actual calculation, you only need to determine whether the value in the square brackets is greater than 0.

In the embodiment of the present invention, optionally, inputting the user relationship network into a model for identifying financial fraud and outputting the user's fraud probability includes:

Step 1: Construct a first network graph G(V,E) based on the user relationship network, with each user in the first network graph serving as a node; where V is a set of vertices and E is a set of edges; and The first network graph G(V,E) is distributed and stored;

Step 2: Calculate the community to which each node in the first network graph belongs;

Step 3: Call the second change formula of modularity to obtain the change in modularity of each node i when it moves from one community to each of its adjacent communities;

Step 4: Calculate the community c′ _i =argmaxΔQ(c _i ) with the largest change in modularity when dividing node i into communities, and use the community with the largest change as the community to which node i currently belongs; where, ΔQ(c _i ) is the change in modularity when node i is divided into community c _i ;

Step 5: For each node i, obtain the community information to which it currently belongs and the community information to which all nodes connected to node i belong, as a set S;

Step 6: Perform steps 3 to 5 again according to the preset number of times; after the preset number of times, divide the iterative calculation rounds into odd-numbered rounds and even-numbered rounds; connect the node i to the node v _j , where the node v _j Belongs to the community that maximizes the change in node i; when the iteration round is an odd-numbered round and the change in the current community is less than the change in the community after the transfer, the community information is updated; or the iteration round is an even-numbered round and the change in the current community When the change amount is greater than the change amount of the transferred community, the community information is updated;

Step 7: Determine whether all nodes will no longer change the community they belong to;

Step 8: If all nodes no longer change their belonging communities, reconstruct the second network graph G′(V′,E′) according to the current community information, where each vertex in the second network graph corresponds to the first A community in the network graph; the internal weight of the vertices in the second network graph is the sum of the weights of all edges in the community in the first network graph; where V′ is the set of vertices and E′ is the set of edges; second Each vertex in the network graph G′(V′,E′) corresponds to a community in the first network graph G(V,E), and the community identity in the first network graph G(V,E) is used as the The identity of the vertex in the second network graph G′(V′,E′); the internal weight of the vertex in the second network graph G′(V′,E′) is the community in the first network graph G(V,E) The sum of the weights of all edges; the edges in the second network graph G′(V′,E′) are the edges between communities in the first network graph G(V,E);

Step 9: Perform steps 3 to 8 again for iterative updates until all nodes no longer change their belonging communities;

Step 10: Calculate the probability of community fraud based on the number of users in the community information, and evaluate the fraud risk of a single user based on the community information.

In the embodiment of the present invention, based on the redefinition of modularity, a new community discovery algorithm is proposed, which divides communities through iterative calculations, and combines existing black sample data and community division results, so that whether it is a small financial company or hundreds of This method can be used to calculate whether the user volume is 10,000 or the data volume of a large Internet company is more than one billion to avoid serious aggregation phenomena that may occur when the data volume is large.

In the embodiment of the present invention, optionally, obtaining the change in modularity of each node i when it moves from one community to another community includes:

Calculate the change of the modularity, and the change of the modularity is:

Among them,/> is the sum of the edge weights of each node in community c _i , including the edges with nodes within the community and the edges with nodes outside the community; c _i is the i-th community; k _i is the sum of the weights of all edges connected to node i; k _j is the sum of the weights of all edges connected to node j; k _i,in : the sum of the edge weights of node i and the community; k _j,in : the sum of the edge weights of node j and the community; m is the sum of all edge weights in the graph The sum of edge weights.

In this embodiment of the present invention, optionally, calculating the probability of defrauding a community based on the number of users in the community information includes:

The probability calculation formula of the fraud community is: Among them, |c _i | is the total number of users in the c _i community; y _j is the personal marked data of the jth user stored in the database.

In this embodiment of the present invention, optionally, the assessment of a single user's fraud risk based on the community information includes:

Identify common fraudulent users and core fraudulent users through the betweenness centrality algorithm, and assess individual user fraud risks.

In the embodiment of the present invention, the users and relationships in the fraud community are extracted into a separate subgraph, and the betweenness centrality algorithm is used to calculate the risk of a single user in the fraud community; first, the importance of each user in the fraud community is calculated, The importance of each user in the fraud community is: where r is the number of shortest paths between node s and node t; r(v _j ) is the number of shortest paths between node s and node t through v _j ; c _i is the community to which node v _j belongs;

According to the overall fraud probability of the community and the importance of each user in the community, the specific fraud probability of each user is: Among them, |c _i | is the number of users in the community; P(c _i ) is the overall risk level of the community;/> is the normalization coefficient.

In the embodiment of the present invention, common fraudulent users and core fraudulent users are further identified through the intermediary centrality algorithm, and the fraud risk of a single user is accurately assessed. By monitoring core fraudulent users, risks are prevented and risk control accuracy is improved.

In the embodiment of the present invention, based on the redefinition of modularity, a new community discovery algorithm is proposed, which divides communities through iterative calculations, and combines existing black sample data and community division results to use betweenness centrality to specifically evaluate communities. Risks of each user are eliminated, achieving industrial implementation in the field of financial risk control.

Please refer to Figure 2. In the embodiment of the present invention, based on the new modularity definition method, an iterative algorithm that maximizes modularity is obtained. With this iterative algorithm as the core, financial fraud is identified; first, edge device data collection is performed, including : On the base station side, the user's data such as calls, text messages, equipment, APP usage and website visits are collected through embedded data collection equipment; secondly, the data is cleaned and stored in the database, including: classifying, checking, correcting or deleting the collected data. Wrong data, marked unreliable data, are imported into the production database; again, data preprocessing is performed, including: analyzing and processing relational data, and unifying the data to the same level through normalization, standardization and other methods to obtain user The relationship network is convenient for further calculations; thirdly, model training is carried out, including: after obtaining the user's relationship network, use the community discovery algorithm to mine user communities with strong relationships, analyze the fraud situation of users in the community, and analyze the fraud situation of each user. Each user obtains a fraud probability; among them, the model training is to use the model for identifying financial fraud; finally, the model is deployed, including: using the Nebula+Plato deployment method to facilitate external financial institutions to call the results output by the model , the deployment method can accommodate large amounts of data, has fast search speed, and is suitable for environmental deployment in the case of big data; wherein, the calling process of the model includes: external financial institutions call the financial fraud identification method through the interface provided by the Nebula database Model; when an external financial institution inputs the user's name, mobile phone number and ID card, it can output the user's fraud probability accordingly.

In the embodiment of the present invention, small communities are punished based on the existing technology through a new definition of modularity, and at the same time, relatively obvious small communities are retained by adjusting the penalty coefficient, effectively solving the community discovery algorithm based on modularity. It cannot take into account the problems of large communities and small communities; and deduces a new community discovery algorithm, making the resulting community more accurate; it can be applied to different scenarios with large amounts of data, whether it is a small financial company with millions of users or a large The data volume of more than one billion Internet companies can be calculated using this technical solution; and through the intermediary centrality method, we can further discover core fraud users and edge fraud users in the fraud community, accurately identify fraud organizers, and improve risk control. Accuracy, convenience and speed.

Please refer to Figure 3. The present invention provides a device for identifying financial fraud, including:

Acquisition module 31, used to obtain user data;

The preprocessing module 32 is used to preprocess the user data to obtain a user relationship network, with each user in the user relationship network serving as a node;

The identification module 33 is used to input the user relationship network into a model for identifying financial fraud, and output the user's fraud probability; the model for identifying financial fraud uses the change in modularity as an evaluation index to determine each individual user based on the user relationship network. The information of the community to which the user belongs is used to determine the fraud probability of users in the community based on the information of the determined community; where the modularity is the proportion of edges where the node falls in the same community minus the random allocation of edges. The probability expectation of , plus the weighted average of the relationship strengths between two nodes in different communities.

In the embodiment of the present invention, optionally, the modularity is calculated using the following formula:

Among them, A _ij is the weight of the edge between node i and node j; k _i is the sum of the weights of all edges connected to node i; k _j is the sum of the weights of all edges connected to node j; c _i is the node The community i belongs to; m is the sum of the weights of all edges; The closeness of the connection between the two communities.

In the embodiment of the present invention, optionally, inputting the user relationship network into a model for identifying financial fraud and outputting the user's fraud probability includes:

Step 1: Construct a first network graph according to the user relationship network, with each user in the first network graph serving as a node;

Step 2: Calculate the community to which each node in the first network graph belongs;

Step 3: Obtain the change in modularity of each node i when it moves from one community to each of its adjacent communities;

Step 4: Calculate the community c′ _i =argmaxΔQ(c _i ) with the largest change in modularity when dividing node i into communities, and use the community with the largest change as the community to which node i currently belongs;

Step 5: For each node i, obtain the community information to which it currently belongs and the community information to which all nodes connected to node i belong, as a set S;

Step 6: Perform steps 3 to 5 again according to the preset number of times; after the preset number of times, divide the iterative calculation rounds into odd-numbered rounds and even-numbered rounds; connect the node i to the node v _j , where the node v _j Belongs to the community that maximizes the change in node i; when the iteration round is an odd-numbered round and the change in the current community is less than the change in the community after the transfer, the community information is updated; or the iteration round is an even-numbered round and the change in the current community When the change amount is greater than the change amount of the transferred community, the community information is updated;

Step 7: Determine whether all nodes will no longer change the community they belong to;

Step 8: If all nodes no longer change their belonging communities, reconstruct the second network graph according to the current community information, where each vertex in the second network graph corresponds to a community in the first network graph; second The internal weight of a vertex in the network graph is the sum of the weights of all edges in the community in the first network graph;

Step 9: Perform steps 3 to 8 again for iterative updates until all nodes no longer change their belonging communities;

Step 10: Calculate the probability of community fraud based on the number of users in the community information, and evaluate the fraud risk of a single user based on the community information.

In the embodiment of the present invention, optionally, obtaining the change in modularity of each node i when it moves from one community to another community includes:

Calculate the change of the modularity, and the change of the modularity is:

Among them,/> is the sum of edge weights of each node in community _c , including the edges with nodes within the community and the edges with nodes outside the community; c _i is the i-th community; k _i is the sum of the weights of all edges connected to node i; k _j is the sum of the weights of all edges connected to node j; k _i,in : the sum of the edge weights of node i and the community; k _j,in : the sum of the edge weights of node j and the community; m is all the edges in the graph The sum of the weights.

In this embodiment of the present invention, optionally, calculating the probability of defrauding a community based on the number of users in the community information includes:

The probability calculation formula of the fraud community is: Among them, |c _i | is the total number of users in the c _i community; y _j is the personal marked data of the jth user stored in the database.

In this embodiment of the present invention, optionally, the assessment of a single user's fraud risk based on the community information includes:

Identify common fraudulent users and core fraudulent users through the betweenness centrality algorithm, and assess individual user fraud risks.

The network side device provided by the embodiment of the present invention can implement each process of the method for identifying financial fraud in the method embodiment of Figure 1. To avoid duplication, details will not be described here.

Please refer to Figure 4. This embodiment of the present invention also provides a server 40, which includes a processor 41, a memory 42, and a computer program stored on the memory 42 and executable on the processor 41. The computer program is processed by the processor 41. During execution, each process of the above embodiment of the method for identifying financial fraud is realized, and the same technical effect can be achieved. To avoid repetition, details will not be described here.

Embodiments of the present invention also provide a computer-readable storage medium. A computer program is stored on the computer-readable storage medium. When the computer program is executed by a processor, each process of the above-mentioned method embodiment for identifying financial fraud is implemented, and can To achieve the same technical effect, to avoid repetition, we will not repeat them here. Wherein, the computer-readable storage medium is such as read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), magnetic disk or optical disk, etc.

It should be noted that, in this document, the terms "comprising", "comprises" or any other variations thereof are intended to cover a non-exclusive inclusion, such that a process, method, article or device that includes a series of elements not only includes those elements, It also includes other elements not expressly listed or inherent in the process, method, article or apparatus. Without further limitation, an element defined by the statement "comprises a..." does not exclude the presence of additional identical elements in a process, method, article or apparatus that includes that element.

Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus the necessary general hardware platform. Of course, it can also be implemented by hardware, but in many cases the former is better. implementation. Based on this understanding, the technical solution of the present invention can be embodied in the form of a software product in essence or the part that contributes to the existing technology. The computer software product is stored in a storage medium (such as ROM/RAM, disk, CD), including several instructions to cause a terminal (which can be a mobile phone, computer, server, air conditioner, or terminal, etc.) to execute the methods described in various embodiments of the present invention.

The embodiments of the present invention have been described above in conjunction with the accompanying drawings. However, the present invention is not limited to the above-mentioned specific implementations. The above-mentioned specific implementations are only illustrative and not restrictive. Those of ordinary skill in the art will Under the inspiration of the present invention, many forms can be made without departing from the spirit of the present invention and the scope protected by the claims, all of which fall within the protection of the present invention.

Claims (10)

1. A method for identifying financial fraud, characterized by: Get user data; Preprocess the user data to obtain a user relationship network, in which each user serves as a node; The user relationship network is input into a model for identifying financial fraud, and the user's fraud probability is output; the model for identifying financial fraud uses the user relationship network to determine information about the community to which each user belongs, using the modularity change as an evaluation index. , determine the fraud probability of users in the community based on the information of the determined community; where the modularity is the proportion of edges where the node falls in the same community minus the probability expectation obtained by randomly assigning edges plus A weighted average of the relationship strengths between two nodes in different communities. 2. The method for identifying financial fraud according to claim 1, characterized in that, The modularity is calculated using the following formula: Among them, A _ij is the weight of the edge between node i and node j; k _i is the sum of the weights of all edges connected to node i; k _j is the sum of the weights of all edges connected to node j; c _i is the node The community i belongs to; m is the sum of the weights of all edges; The closeness of the connection between the two communities. 3. The method for identifying financial fraud according to claim 2, characterized in that said inputting the user relationship network into a model for identifying financial fraud and outputting the user's fraud probability includes: Step 1: Construct a first network graph according to the user relationship network, with each user in the first network graph serving as a node; Step 2: Calculate the community to which each node in the first network graph belongs; Step 3: Obtain the change in modularity of each node i when it moves from one community to each of its adjacent communities; Step 4: Calculate the community c′ _i =arg maxΔQ(c _i ) with the largest change in modularity when dividing node i into communities, and use the community with the largest change as the community to which node i currently belongs; Step 5: For each node i, obtain the community information to which it currently belongs and the community information to which all nodes connected to node i belong, as a set S; Step 6: Perform steps 3 to 5 again according to the preset number of times; after the preset number of times, divide the iterative calculation rounds into odd-numbered rounds and even-numbered rounds; connect the node i to the node v _j , where the node v _j Belongs to the community that maximizes the change in node i; when the iteration round is an odd-numbered round and the change in the current community is less than the change in the community after the transfer, the community information is updated; or the iteration round is an even-numbered round and the change in the current community When the change amount is greater than the change amount of the transferred community, the community information is updated; Step 7: Determine whether all nodes will no longer change the community they belong to; Step 8: If all nodes no longer change their belonging communities, reconstruct the second network graph according to the current community information, where each vertex in the second network graph corresponds to a community in the first network graph; second The internal weight of a vertex in the network graph is the sum of the weights of all edges in the community in the first network graph; Step 9: Perform steps 3 to 8 again for iterative updates until all nodes no longer change their belonging communities; Step 10: Calculate the probability of community fraud based on the number of users in the community information, and evaluate the fraud risk of a single user based on the community information. 4. The method for identifying financial fraud according to claim 3, characterized in that obtaining the change in modularity of each node i when it moves from one community to another community includes: Calculate the change of the modularity, and the change of the modularity is: Among them,/> is the sum of the edge weights of each node in community c _i , including the edges with nodes within the community and the edges with nodes outside the community; c _i is the i-th community; k _i is the sum of the weights of all edges connected to node i; k _j is the sum of the weights of all edges connected to node j; k _i,in : the sum of the edge weights of node i and the community; k _j,in : the sum of the edge weights of node j and the community; m is the sum of all edge weights in the graph The sum of edge weights. 5. The method for identifying financial fraud according to claim 3, wherein calculating the probability of a fraudulent community based on the number of users in the community information includes: The probability calculation formula of the fraud community is: Among them, |c _i | is the total number of users in the c _i community; y _j is the personal marked data of the jth user stored in the database. 6. The method for identifying financial fraud according to claim 3, characterized in that said assessing the fraud risk of a single user based on the community information includes: Identify common fraudulent users and core fraudulent users through the betweenness centrality algorithm, and assess individual user fraud risks. 7. A device for identifying financial fraud, characterized by including: Obtain module, used to obtain user data; A preprocessing module, used to preprocess the user data to obtain a user relationship network, with each user in the user relationship network serving as a node; An identification module, configured to input the user relationship network into a model for identifying financial fraud, and output the user's fraud probability; the model for identifying financial fraud determines each user based on the user relationship network, using the change in modularity as an evaluation index. The information of the community to which it belongs is used to determine the fraud probability of users in the community based on the information of the determined community; where the modularity is the proportion of the edges of the node falling in the same community minus the random allocation of edges. The probabilistic expectation is coupled with a weighted average of the relationship strengths between two nodes in different communities. 8. The device for identifying financial fraud according to claim 7, characterized in that, The modularity is calculated using the following formula: Among them, A _ij is the weight of the edge between node i and node j; k _i is the sum of the weights of all edges connected to node i; k _j is the sum of the weights of all edges connected to node j; c _i is the node The community i belongs to; m is the sum of the weights of all edges; The closeness of the connection between the two communities. 9. A server, characterized in that it includes: a processor, a memory, and a program stored on the memory and executable on the processor. When the program is executed by the processor, it implements claim 1 -The steps of the method of identifying financial fraud described in any of 6. 10. A computer-readable storage medium, characterized in that a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, the method of any one of claims 1-6 is implemented. Steps in the method of identifying financial fraud.