CN117057934A - Method and system for identifying financial suspicious cases - Google Patents

Method and system for identifying financial suspicious cases Download PDF

Info

Publication number
CN117057934A
CN117057934A CN202311071089.6A CN202311071089A CN117057934A CN 117057934 A CN117057934 A CN 117057934A CN 202311071089 A CN202311071089 A CN 202311071089A CN 117057934 A CN117057934 A CN 117057934A
Authority
CN
China
Prior art keywords
suspicious
case
rule
ford
data
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN202311071089.6A
Other languages
Chinese (zh)
Inventor
郑莹
崔少波
张俊
管静
项伟
柳光琦
殷永强
崔华勇
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
HANKOU BANK CO Ltd
Original Assignee
HANKOU BANK CO Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by HANKOU BANK CO Ltd filed Critical HANKOU BANK CO Ltd
Priority to CN202311071089.6A priority Critical patent/CN117057934A/en
Publication of CN117057934A publication Critical patent/CN117057934A/en
Pending legal-status Critical Current

Links

Classifications

    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06QINFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q40/00Finance; Insurance; Tax strategies; Processing of corporate or income taxes
    • G06Q40/08Insurance
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F18/00Pattern recognition
    • G06F18/20Analysing
    • G06F18/26Discovering frequent patterns
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F18/00Pattern recognition
    • G06F18/20Analysing
    • G06F18/29Graphical models, e.g. Bayesian networks
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06NCOMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N5/00Computing arrangements using knowledge-based models
    • G06N5/02Knowledge representation; Symbolic representation
    • G06N5/022Knowledge engineering; Knowledge acquisition
    • G06N5/025Extracting rules from data

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Data Mining & Analysis (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Evolutionary Computation (AREA)
  • Artificial Intelligence (AREA)
  • Business, Economics & Management (AREA)
  • Evolutionary Biology (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Bioinformatics & Cheminformatics (AREA)
  • Bioinformatics & Computational Biology (AREA)
  • Computer Vision & Pattern Recognition (AREA)
  • Finance (AREA)
  • Accounting & Taxation (AREA)
  • Marketing (AREA)
  • Computational Linguistics (AREA)
  • Computing Systems (AREA)
  • Mathematical Physics (AREA)
  • Software Systems (AREA)
  • General Business, Economics & Management (AREA)
  • Technology Law (AREA)
  • Strategic Management (AREA)
  • Economics (AREA)
  • Development Economics (AREA)
  • Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)

Abstract

A method and system for identifying financial suspicious cases is disclosed. The method comprises the following steps: monitoring and early warning are carried out on batch and real-time financial related data, and related data are stored in a rule early warning result table according to early warning results; extracting characterization data from a rule early-warning result table based on each expert rule in a plurality of expert rules corresponding to the risk category, performing model calculation, storing related data triggering at least a set number of expert rules as suspicious cases, and simultaneously recording the ratio of the number of expert rules triggered by the suspicious cases to the total amount of expert rules corresponding to the risk category; judging whether the Ford distribution diagram accords with the Ford distribution rule or not; judging whether the pareto statistical graph accords with the two-eight principle or not; and calculating the suspicion based on the ratio, the conclusion of whether the Ford distribution diagram accords with the Ford distribution rule and the conclusion of whether the pareto statistical diagram accords with the two-eight principle. The accuracy of suspicious case identification can be improved through suspicious degree calculation.

Description

Method and system for identifying financial suspicious cases
Technical Field
The embodiment of the disclosure relates to the technical field of computers, in particular to a method and a system for identifying financial suspicious cases.
Background
The analysis of financial suspicious cases refers to the process of analyzing and identifying abnormal transactions, fraudulent activities, money laundering risks, etc. in the financial field. The traditional financial suspicious case analysis method mainly depends on manual experience and suspicious monitoring rules, and has certain limitations and misjudgment rate.
Disclosure of Invention
An object of an embodiment of the present disclosure is to provide a method and a system for identifying a financial suspicious case, so as to improve the identification efficiency and the automation degree of the financial suspicious case.
According to a first aspect of embodiments of the present disclosure, there is provided a method for identifying a financial suspicious case, including:
monitoring and early warning are carried out on batch and real-time financial related data according to suspicious monitoring rules, and the related data are stored in a rule early warning result table according to early warning results;
processing data in the rule early-warning result table by using a suspicious model, wherein the suspicious model extracts characterization data from the rule early-warning result table and carries out model calculation based on each expert rule in a plurality of expert rules corresponding to a risk category in an expert rule base, stores characterization data triggering at least a set number of expert rules in the plurality of rule rules and related evidence chain data as suspicious cases of a suspicious clue case table, and simultaneously records the ratio of the number of expert rules triggered by the suspicious cases to the total amount of expert rules corresponding to the risk category;
constructing a local Ford distribution diagram based on the related data of the suspicious case, and judging whether the local Ford distribution diagram accords with a local Ford distribution rule;
constructing a pareto statistical graph based on the related data of the suspicious cases, and judging whether the pareto statistical graph accords with a two-eight principle; and
and inputting the ratio, a conclusion of whether the self-ford distribution diagram accords with the self-ford distribution rule and a conclusion of whether the pareto statistical diagram accords with the two-eight principle into a quantization function to calculate the suspicious degree of whether the suspicious case is formed.
In some embodiments, further comprising: and constructing a fund network diagram based on the related data of the suspicious cases, so that suspicious case analysts find structural anomalies in the fund network diagram and analyze whether suspicious cases are in a case or not according to the suspicious degree.
In some embodiments, the quantization function assigns different weights to the ratio, the conclusion of whether the local ford distribution diagram accords with the local ford distribution rule, and the conclusion of whether the pareto statistical diagram accords with the two-eight principle, and calculates the suspicious degree of whether the suspicious case is finalized according to a mode of re-summing weighted products.
In some embodiments, the training of the suspicious model results in a plurality of expert rules corresponding to risk categories in the expert rules library.
In some embodiments, further comprising: and calculating an evaluation view of the suspicious model according to the statistical data, and optimizing a plurality of expert rules corresponding to the risk categories in the suspicious model based on the evaluation view.
In some embodiments, the statistics include at least one of a diagramming rate of the suspicious cases, an exclusion rate of the suspicious cases, and a missing report rate of the suspicious cases.
In some embodiments, the finance-related data includes business data, external industry data, and regulatory class data.
According to a second aspect of embodiments of the present disclosure, a financial suspicious case identification system includes:
the monitoring and early warning module is used for monitoring and early warning the batch and real-time financial related data according to suspicious monitoring rules and storing the related data into a rule early warning result table according to early warning results;
the model processing module is used for processing the data in the rule early-warning result table by using a suspicious model, wherein the suspicious model extracts characterization data from the rule early-warning result table and carries out model calculation based on each expert rule in a plurality of expert rules corresponding to a risk category in an expert rule base, and stores characterization data and related evidence chain data of at least a set number of expert rules in the plurality of rule rules as suspicious cases of a suspicious clue case table, and simultaneously records the ratio of the number of expert rules triggered by the suspicious cases to the total amount of expert rules corresponding to the risk category;
the suspicious degree calculation module is used for constructing a local Ford distribution diagram based on the related data of the suspicious case, judging whether the local Ford distribution diagram accords with the local Ford distribution rule, constructing a pareto statistical diagram based on the related data of the suspicious case, judging whether the pareto statistical diagram accords with the two-eight principle, and inputting the ratio, the conclusion of whether the local Ford distribution diagram accords with the local Ford distribution rule and the conclusion of whether the pareto statistical diagram accords with the two-eight principle into the quantization function to calculate the suspicious degree of whether the suspicious case is a case.
In some embodiments, the graph construction module further comprises: and the diagram construction module is used for constructing a fund network diagram based on the related data of the suspicious cases so that suspicious case analysts find structural anomalies in the fund network diagram and analyze whether suspicious cases are in a plan or not in combination with the suspicious degree.
In some embodiments, the quantization function assigns different weights to the ratio, the conclusion of whether the local ford distribution diagram accords with the local ford distribution rule, and the conclusion of whether the pareto statistical diagram accords with the two-eight principle, and calculates the suspicious degree of whether the suspicious case is finalized according to a mode of re-summing weighted products.
According to the embodiment of the disclosure, suspicious cases are screened out through expert rules, the suspicious cases are constructed around a main client, and then the suspicious degree of whether the suspicious cases are finished is calculated according to the ratio of the expert rules triggered by the suspicious cases, the conclusion that whether the local Ford distribution diagram of the main client in the suspicious cases accords with the local Ford distribution rule and the conclusion that whether the pareto statistical diagram accords with the two-eight principle, so that a more accurate prediction result is provided. The suspicious case analyst can report the suspicious case according to the suspicious degree or continue analysis with reference to the suspicious degree.
In a further embodiment, a fund network diagram is constructed, the fund network diagram takes a customer or an account as a node, and the construction side is based on transaction flow between the customer or the account, so that suspicious case analysts intuitively observe and analyze whether structural anomalies exist in the fund network diagram, and determine whether suspicious cases are finalized by referring to the mobility.
Drawings
The above and other objects, features and advantages of the embodiments of the present disclosure will become more apparent from the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:
FIG. 1 is a schematic block diagram of a training and application system for suspicious models for financial suspicious case identification;
FIG. 2 is a schematic diagram of the composition of finance-related data in an embodiment of the disclosure;
FIG. 3 is a schematic diagram of a manner of construction of expert rules in an embodiment of the present disclosure;
FIG. 4 is a schematic diagram of the relevant operations involved in machine learning modeling in FIG. 1;
FIG. 5 is a flow chart of a method of identifying a financial suspicious case according to an embodiment of the present disclosure;
FIGS. 6A-6C are exemplary funding network diagrams, pareto statistics diagrams, and present Ford diagrams;
fig. 7 is a schematic block diagram of a financial suspicious case identification system of an embodiment of the present disclosure.
Detailed Description
Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Like elements are denoted by like reference numerals throughout the various figures. For clarity, the various features of the drawings are not drawn to scale. Furthermore, some well-known portions may not be shown.
The embodiments of the present disclosure are described below based on the embodiments, but the embodiments of the present disclosure are not limited to only these embodiments. In the following detailed description of embodiments of the present disclosure, certain specific details are set forth in detail. The embodiments of the present disclosure will be fully understood by those skilled in the art without a description of these details. Well-known methods, procedures, flows, components, and circuits have not been described in detail so as not to obscure the embodiments of the disclosure.
Unless the context clearly requires otherwise, throughout the description and the claims, the words "comprise", "comprising", and the like are to be construed in an inclusive sense as opposed to an exclusive or exhaustive sense; that is, it is the meaning of "including but not limited to". In describing embodiments of the present disclosure, it should be understood that the terms "first," "second," and the like are used for descriptive purposes only and are not to be construed as indicating or implying relative importance. Furthermore, in the description of the embodiments of the present disclosure, unless otherwise indicated, the meaning of "a plurality" is two or more.
Various embodiments of the present disclosure are described in detail below with reference to the attached drawing figures.
FIG. 1 is a schematic block diagram of a training and application system for suspicious models for financial suspicious case identification. As shown in the figure, the training of suspicious models and the modeling phase of the application system mainly include sample data preparation 101, expert rules 102 and machine learning modeling 103; the model application stage mainly comprises suspicious case monitoring early warning 104 and suspicious case analysis 105. In the modeling stage, the system trains the suspicious model to be trained based on the samples of the finance related cases and expert rules to obtain a trained suspicious model. In the model application stage, financial data are monitored and early-warned in real time through a suspicious model, suspicious cases are obtained according to monitoring and early-warning results, then case analysis is carried out on the suspicious cases, meanwhile, statistical data of the suspicious case analysis results are used for evaluating the suspicious model, and the model is optimized according to evaluation results, wherein the expert rules and model parameters adopted by the optimizing model are included.
As shown in fig. 2, in an embodiment of the present disclosure, the finance-related data includes business data, external industry data, and regulatory-type data. The business data mainly comprises business transaction flow, customer information, account information and other related public information data of the financial institutions. The external industry data mainly comprises data of related industries such as industry and commerce, tax, customs and the like, and the external industry data is used for assisting in identifying and early warning main customer risks. The supervision data mainly comprise relevant data such as judicial frozen buckles, blacklists under public security and the like.
And carrying out feature quantization on risk points of the case by expert rules based on the risk identification content. In the embodiment of the disclosure, as shown in fig. 3, risk identification content performs risk identification classification of suspicious cases based on internal management system, external supervision requirements, business knowledge and history risk case experience of a financial institution. The feature quantification of the suspicious case is to extract relevant feature data according to the risk features of the suspicious case, for example, the relevant feature data comprises behavior features and transaction features, wherein the behavior features comprise transaction places, customer identity information, transaction opponent features and transaction modes, the transaction features comprise transaction amount, transaction frequency, transaction balance, transaction time and the like, risk identification classification and feature quantification are combined to form expert rules, and then an expert rule base is established based on the expert rules. Typically, one risk category corresponds to multiple expert rules. Risk categories are, for example, electrical fraud, money laundering, etc. In practice, due to the actual application results of the model and the reasons of changes of laws and regulations, government regulations, industry specifications and the like, the rules corresponding to each risk need to be changed, new risk categories are continuously generated, and new expert rules correspondingly need to be added, so that it is necessary to optimize the expert rule base periodically or aperiodically, and adjust the model according to the new expert rule base.
Although the expert rules can cover the feature points and the risk recognition points of the suspicious cases, in order to enable the model to output the suspicious cases more accurately, as shown in fig. 4, an appropriate machine learning algorithm is also required to be selected and training sample data is adopted to train the model, and the expert rules and model parameters are evaluated and optimized through verification samples to obtain the applicable suspicious model.
Fig. 5 provides a flow chart of a method of identifying a financial suspicious case according to an embodiment of the present disclosure. Which comprises the following steps.
In step S501, batch and real-time financial related data are monitored and pre-warned according to suspicious monitoring rules, and related data are stored in a rule pre-warning result table according to pre-warning results.
Wherein batch and real-time financial related data may be referenced as shown in fig. 2. The method comprises the steps of carrying out model calculation on batch and real-time business data, external industry data and supervision data according to calculation logic of suspicious monitoring rules, comparing calculation results with the suspicious monitoring rules to generate early warning results, and storing related data into a rule early warning result table based on the early warning results, wherein the related data not only comprises batch and real-time financial related data, but also comprises evidence chain data acquired from the outside based on the early warning results. Suspicious monitoring rules are, for example, files of a particular format, monitoring rules specified in accordance with external regulatory data, and so forth.
In step S502, based on each expert rule of the plurality of expert rules corresponding to the risk category in the expert rule base, extracting characterization data from the rule pre-warning result table and performing model calculation, storing characterization data triggering at least a set number of expert rules and related evidence chain data as suspicious cases of the suspicious thread case table, and simultaneously recording a ratio of the number of expert rules triggered by the suspicious cases to the total number of expert rules corresponding to the risk category.
In this step, the characterization data, such as the behavior feature and/or transaction feature data shown in fig. 3, corresponds to a risk category with a plurality of expert rules, and therefore, the characterization data and the related evidence chain data triggering N (integer greater than 0) expert rules corresponding to a risk category are stored as suspicious cases of the suspicious thread case table. The suspicious case is built around a subject client, so that the characterizing data and related evidence-chain data for a subject client may include information about the subject client and the flow of transactions that the subject client and a plurality of other clients occur, as well as information about other clients. The ratio of the expert rules triggered by a suspicious case to the total amount of expert rules corresponding to risk categories is recorded, for example, 10 expert rules for money laundering risks, and if 6 expert rules are triggered by a suspicious case, the calculated ratio is 60%.
And further illustrated. Another expert rule for money laundering is: the transaction characteristics of A accord with 'a plurality of transactions of private clients share the same MAC address', B 'money is purchased and collected after flowing into the foreign currency on the current day to get the money or purchase and collect the money', and meanwhile, the behavior characteristics accord with: and C, the address and the telephone of the customers who open accounts on the same day at the same website are the same, and D, the mobile banking business is applied to be opened when the customers open accounts. And calculating data in the rule early warning table one by one according to the expert rules, extracting the data meeting the rule A, checking whether the rule B is met, and checking whether the rule C is met if the rule B is met. If the extracted data finally meets A and C, but does not meet B and D, judging whether the data meets the requirements (for example, meets any two other data) according to the setting, and storing the corresponding data meeting the requirements as suspicious cases according to the judging result.
In step S503, a local ford distribution diagram is constructed based on the related data of the suspicious case, and it is determined whether the local ford distribution diagram conforms to the local ford distribution rule.
In step S504, a pareto statistical graph is constructed based on the related data of the suspicious cases, and it is determined whether the pareto statistical graph meets the two-eight principle.
In step S505, the ratio, the conclusion of whether the ford distribution diagram accords with the ford distribution rule and the conclusion of whether the pareto statistical diagram accords with the two-eight principle are input to the quantization function to calculate the suspicious degree of whether the suspicious case is formed.
Based on step S503, the system may rely on suspicious threadsThe characterization data and associated evidence chain data in the example table construct a "present ford graph". The ford chart is counted and the ford chart is drawn by counting the transaction amount in all transaction flows in the range of the suspicious case forming interval, and the ford chart shows the probability of occurrence of transaction data with the transaction amount beginning with numbers (1-9). The "present ford diagram" may show the distribution of transaction streamlines for a single customer or account. The system can judge whether the ' present Ford diagram ' accords with the present Ford distribution rule, if the ' present Ford distribution rule is not met, the transaction of the suspicious case has the trace and risk of manual operation, does not accord with the characteristic distribution of actual transaction data, and has high probability of case forming trend. The Ford distribution law refers to a set of data obtained from real life, wherein the occurrence probability of the number with 1 as the first digit is about three times of the total number, which is approximately 3 times of the expected value 1/9, namely in the b-carry system, the occurrence probability of the number with n as the first digit is log b (n+1)-log b n. The ford distribution feature is that the larger the number, the lower the probability of the number of the first digits. If the first digit distribution of the transaction amount in the present ford chart of transaction flow data of a certain customer or account body for a certain period of time obviously does not accord with the present ford rule, the suspicious case piece is indicated to have larger trace and risk of artificial operation, does not accord with the characteristic distribution of actual transaction data, and has higher possibility of case achievement.
Based on step S504, the system may also construct a pareto statistical graph according to the opponent-occurrence of the transaction in the fund flow direction, and determine whether there is a "two-eight principle" based on the pareto statistical graph, i.e., a minority of the staff accounts transfer most of the funds, if so, the suspicious case has a higher possibility of finalizing the case. Typically, the system will score 80% of the constant lines when generating the pareto chart.
Based on the ratio of expert rules triggered by the suspicious cases, the conclusion of whether the local ford distribution diagram of the subject client in the suspicious cases accords with the local ford distribution rule and the conclusion of whether the pareto statistical diagram accords with the two-eight principle in step S505, the suspicious degree for representing whether the suspicious cases are in a case is calculated. The suspicious case analyst can report the suspicious case according to the suspicious degree or continue analysis with reference to the suspicious degree.
In some embodiments, the quantization function assigns different weights to the ratio, the conclusion of whether the present ford distribution diagram accords with the present ford distribution rule and the conclusion of whether the pareto statistical diagram accords with the two-eight principle, and calculates the suspicious degree representing whether the suspicious case is finalized according to the weighted product and the re-summation mode.
In other embodiments, for each risk category, the ratio of a plurality of suspected cases that have been made and not made historically, the conclusion of whether the present ford distribution diagram meets the present ford distribution rule, and the conclusion of whether the pareto statistical diagram meets the second-eighth rule are collected as experimental data, and test verification is performed according to these experimental data, so as to obtain the making rule of the suspected cases for each risk category, and a quantization function for each risk category is constructed accordingly.
In a further embodiment, a fund network graph is constructed based on the relevant data of the suspicious cases, in which the account or the customer is taken as a node, and the connection edge is constructed based on the transaction flow between the accounts or the customers. Structural anomalies in terms of fund frequency, number, flow direction and the like can be found through the fund network diagram, and the occurrence possibility of suspicious cases is analyzed according to the structural anomalies. In addition, in addition to presenting the fund network diagram on the graphical interface, the system may present the subject customer's full scene image information including customer profiles (customer base information, suspicious case history information, customer survey information, customer rating information), account information, beneficiary information, customer transaction analysis (transaction period presentation, transaction time profile distribution, daily end balance change distribution, daily occurrence and debit comparison, transaction occurrence segment distribution, transaction opponent distribution, transaction channel, transaction place, transaction opponent row, opponent region), etc. Statistics for a plurality of different perspectives (e.g., subject client perspective, adversary client perspective, account perspective) may also be provided on the graphical interface.
Fig. 6A-6C are exemplary funding network diagrams, pareto statistics diagrams, and present ford diagrams. In FIG. 6A, the host client in the suspicious case is taken as the perspective to be in communication with the hostOther clients of the client occurrence transaction flow are marked in the fund network diagram, and the transaction number and the total amount between the clients are counted. The risk customers are for example customers who enter a blacklist. Also shown in the figure is that the primary client uses the same IP address as the core client 1. From fig. 6A, a preliminary determination can be made that the primary customer is transferring funds through multiple customers and multiple channels. Fig. 6B is a graph of transaction information for 10 large opponent customers transacting with a host customer, wherein the dashed line is an 80% constant line, the orange solid line represents the opponent transaction amount versus trend line, and the host customer transfers most funds through the internet connection platform as can be seen from the graph. FIG. 6C shows by bar graph the duty cycle of the occurrence of transaction flows for master customers that will be headed by 1 to 9 and the corresponding local Ford probability log, respectively b (n+1)-log b n is compared, and whether the rule accords with the Ford rule can be determined.
Embodiments of the present disclosure are described below with the example of a "exchange type underground cashier money box". The money laundering risk of the exchange type underground money laundering case can be easily analyzed by suspicious case piece analysts if analysis is carried out from a single early warning main body, so that the money laundering risk of the exchange type underground money laundering case can be easily identified.
First, referring to fig. 6A, a case analyst can see from a full perspective through a fund network relationship diagram that a primary customer transfers funds to a collected bank card in a dispersed manner, and takes the transferred funds out of the ATM in a short period of time, where the transaction relationship is more obvious at the transaction characteristic points reflected on the fund network diagram.
Secondly, the basic characteristics of the main body client can be identified and analyzed by analyzing the client view angle of the fund network relation diagram, and the main body client has the characteristics of 'the address and the telephone of the client opening account on the same day at the same website', 'the mobile banking business is applied to be opened when opening account', and the like.
Third, referring to fig. 6C, in combination with the "present ford distribution chart", it can be seen that the transaction data amount starting with a specific number in a certain period of time is very large, the transaction amount does not satisfy the present ford distribution feature at all, the trace of the manually operated transaction is obvious, and finally, in combination with the analysis of the total transaction opponent of the subject client, the characteristics that the total transaction opponent is in accordance with the pareto statistical chart are also compared, that is, the ratio of the amount of the first ten transaction opponents is relatively large, and 20% of the transaction opponents transact more than 80%.
Along with the development of banking business and the continuous change of crime risk characteristics, in order to ensure the effectiveness of a suspicious model, the identification system itself is required to perform self-evaluation analysis and optimization modeling identification on the suspicious model, and optimize the suspicious model accordingly. Specifically, by statistically analyzing the suspicious case history sample data, an evaluation view of model success is generated, the evaluation view being correlated with statistical data, the statistical data including, for example, one or more of a case rate of suspicious cases, an exclusion rate of suspicious cases, and a miss rate of suspicious cases. At intervals, expert rules in the suspicious model are optimized through the evaluation view, and the optimization result is verified by combining machine learning modeling, so that only the suspicious model passing verification can be released to the production environment for application.
Accordingly, fig. 7 provides a schematic block diagram of a financial suspicious case identification system according to an embodiment of the present disclosure. The financial suspicious case identification system comprises: a monitoring and early warning module 701, a model processing module 702 and a graph construction module 703.
The monitoring and early-warning module 701 is configured to monitor and early-warn batch and real-time financial related data according to suspicious monitoring rules, and store the related data into a rule early-warning result table according to early-warning results.
The model processing module 702 is configured to process data in the rule early-warning result table by using a suspicious model, wherein the suspicious model extracts characterization data from the rule early-warning result table based on each expert rule in a plurality of expert rules corresponding to the risk category in the expert rule base, performs model calculation, stores characterization data triggering at least a set number of expert rules in the plurality of rule rules and related evidence chain data as suspicious cases of the suspicious clue case table, and records a ratio of the expert rules triggered by the suspicious cases to the total amount of expert rules corresponding to the risk category.
The suspicious degree calculation module 703 is configured to construct a local ford distribution diagram based on the related data of the suspicious case, determine whether the local ford distribution diagram accords with the local ford distribution rule, construct a pareto statistical diagram based on the related data of the suspicious case, determine whether the pareto statistical diagram accords with the two-eight principle, and input the ratio, the conclusion of whether the local ford distribution diagram accords with the local ford distribution rule and the conclusion of whether the pareto statistical diagram accords with the two-eight principle to the quantization function to calculate the suspicious degree of whether the suspicious case is formed.
In some embodiments, the quantization function in the suspicious degree calculation module 703 assigns different weights to the ratio, the conclusion of whether the present ford distribution diagram accords with the present ford distribution rule, and the conclusion of whether the pareto statistical diagram accords with the two-eight principle, and calculates the suspicious degree of whether the suspicious case is finalized according to the way of re-summing the weighted products.
According to the system provided by the embodiment, for the suspicious cases screened through the suspicious model, the suspicious degree of whether the suspicious cases are finished is calculated according to the ratio of expert rules triggered by the suspicious cases, the conclusion that whether the Ford distribution diagram of the main client accords with the Ford distribution rule and the conclusion that whether the pareto statistical diagram accords with the two-eight principle, so that a more accurate prediction result is provided. The suspicious case analyst can report the suspicious case according to the suspicious degree or continue analysis with reference to the suspicious degree.
In some embodiments, the financial suspicious case identification system further includes a graph construction module for constructing a fund network graph based on the relevant data of the suspicious case, such that suspicious case analysts find structural anomalies in the fund network graph and analyze whether the suspicious case is a case in connection with the suspicious degree. The fund network diagram can well assist suspicious case analysis personnel in carrying out suspicious case analysis, is easy to discriminate and confirm whether the suspicious case has money laundering risks, and finally reports and rectifies the confirmed suspicious case.
In addition, the embodiment of the disclosure also provides a computer device, which comprises a memory, a processor and a computer program stored on the memory and capable of running on the processor, wherein the processor executes the computer program to realize the steps of the above embodiment.
Still further, the embodiments of the present disclosure also provide a computer-readable storage medium having stored thereon a computer program which, when executed by a processor, implements the steps of the above embodiments.
Embodiments in accordance with the present disclosure, as described above, are not intended to be exhaustive or to limit the invention to the precise embodiments disclosed. Obviously, many modifications and variations are possible in light of the above teaching. The embodiments were chosen and described in order to best explain the principles of the disclosed embodiments and the practical application, to thereby enable others skilled in the art to best utilize the disclosed embodiments and their modifications as are suited to the particular use contemplated. The disclosed embodiments are limited only by the claims and the full scope and equivalents thereof.

Claims (10)

1. A method of identifying a financial suspicious case, comprising:
monitoring and early warning are carried out on batch and real-time financial related data according to suspicious monitoring rules, and the related data are stored in a rule early warning result table according to early warning results;
processing data in the rule early-warning result table by using a suspicious model, wherein the suspicious model extracts characterization data from the rule early-warning result table and carries out model calculation based on each expert rule in a plurality of expert rules corresponding to a risk category in an expert rule base, stores characterization data triggering at least a set number of expert rules in the plurality of rule rules and related evidence chain data as suspicious cases of a suspicious clue case table, and simultaneously records the ratio of the number of expert rules triggered by the suspicious cases to the total amount of expert rules corresponding to the risk category;
constructing a local Ford distribution diagram based on the related data of the suspicious case, and judging whether the local Ford distribution diagram accords with a local Ford distribution rule;
constructing a pareto statistical graph based on the related data of the suspicious cases, and judging whether the pareto statistical graph accords with a two-eight principle; and
and inputting the ratio, a conclusion of whether the self-ford distribution diagram accords with the self-ford distribution rule and a conclusion of whether the pareto statistical diagram accords with the two-eight principle into a quantization function to calculate the suspicious degree of whether the suspicious case is formed.
2. The financial suspicious case identification method according to claim 1, further comprising: and constructing a fund network diagram based on the related data of the suspicious cases, so that suspicious case analysts find structural anomalies in the fund network diagram and analyze whether suspicious cases are in a case or not according to the suspicious degree.
3. The method according to claim 1, wherein the quantization function assigns different weights to the ratio, the conclusion of whether the present ford distribution diagram conforms to the present ford distribution law, and the conclusion of whether the pareto statistical diagram conforms to the two-eight principle, and calculates the suspicious degree of whether the suspicious case is a case according to a weighted product re-summation manner.
4. The method for identifying a financial suspicious case according to claim 1, wherein a plurality of expert rules corresponding to risk categories in the expert rules library are obtained through training of the suspicious model.
5. The method of identifying a financial suspicious case according to claim 1, further comprising: and calculating an evaluation view of the suspicious model according to the statistical data, and optimizing a plurality of expert rules corresponding to the risk categories in the suspicious model based on the evaluation view.
6. The financial suspicious case identification method according to claim 5, wherein the statistics include at least one of a case-to-case ratio of suspicious cases, an exclusion ratio of suspicious cases, and a false-negative ratio of suspicious cases.
7. The method of claim 1, the finance-related data comprising business data, external industry data, and regulatory class data.
8. A financial suspicious case identification system comprising:
the monitoring and early warning module is used for monitoring and early warning the batch and real-time financial related data according to suspicious monitoring rules and storing the related data into a rule early warning result table according to early warning results;
the model processing module is used for processing the data in the rule early-warning result table by using a suspicious model, wherein the suspicious model extracts characterization data from the rule early-warning result table and carries out model calculation based on each expert rule in a plurality of expert rules corresponding to a risk category in an expert rule base, and stores characterization data and related evidence chain data of at least a set number of expert rules in the plurality of rule rules as suspicious cases of a suspicious clue case table, and simultaneously records the ratio of the number of expert rules triggered by the suspicious cases to the total amount of expert rules corresponding to the risk category;
the suspicious degree calculation module is used for constructing a local Ford distribution diagram based on the related data of the suspicious case, judging whether the local Ford distribution diagram accords with the local Ford distribution rule, constructing a pareto statistical diagram based on the related data of the suspicious case, judging whether the pareto statistical diagram accords with the two-eight principle, and inputting the ratio, the conclusion of whether the local Ford distribution diagram accords with the local Ford distribution rule and the conclusion of whether the pareto statistical diagram accords with the two-eight principle into the quantization function to calculate the suspicious degree of whether the suspicious case is a case.
9. The financial suspicious case identification system according to claim 1, further comprising: and the diagram construction module is used for constructing a fund network diagram based on the related data of the suspicious cases so that suspicious case analysts find structural anomalies in the fund network diagram and analyze whether suspicious cases are in a plan or not in combination with the suspicious degree.
10. The financial suspicious case identification system according to claim 1, wherein the quantization function assigns different weights to the ratio, the conclusion of whether the present ford distribution diagram conforms to the present ford distribution law, and the conclusion of whether the pareto statistical diagram conforms to the twenty-eight principle, and calculates the suspicious degree of whether the suspicious case is a case in a manner of re-summing weighted products.
CN202311071089.6A 2023-08-22 2023-08-22 Method and system for identifying financial suspicious cases Pending CN117057934A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202311071089.6A CN117057934A (en) 2023-08-22 2023-08-22 Method and system for identifying financial suspicious cases

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202311071089.6A CN117057934A (en) 2023-08-22 2023-08-22 Method and system for identifying financial suspicious cases

Publications (1)

Publication Number Publication Date
CN117057934A true CN117057934A (en) 2023-11-14

Family

ID=88662400

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202311071089.6A Pending CN117057934A (en) 2023-08-22 2023-08-22 Method and system for identifying financial suspicious cases

Country Status (1)

Country Link
CN (1) CN117057934A (en)

Similar Documents

Publication Publication Date Title
Wang A comprehensive survey of data mining-based accounting-fraud detection research
Lin et al. Detecting the financial statement fraud: The analysis of the differences between data mining techniques and experts’ judgments
CN109472610A (en) A kind of bank transaction is counter to cheat method and system, equipment and storage medium
CN110728570B (en) Anti-fraud fund analysis method
CN113269629A (en) Credit limit determining method, electronic equipment and related product
CN112581271B (en) Merchant transaction risk monitoring method, device, equipment and storage medium
KR101999765B1 (en) Method and system for analyzing pattern of banking phishing loan using data mining technology
CN117829994A (en) Money laundering risk analysis method based on graph calculation
CN113393328A (en) Method and device for assessing pre-financing and pre-loan approval and computer storage medium
Reddy et al. CNN-Bidirectional LSTM based Approach for Financial Fraud Detection and Prevention System
CN110991650A (en) Method and device for training card maintenance identification model and identifying card maintenance behavior
CN114612239A (en) Stock public opinion monitoring and wind control system based on algorithm, big data and artificial intelligence
Shah et al. Comparative study of machine learning based classification techniques for credit card fraud detection
CN117057934A (en) Method and system for identifying financial suspicious cases
CN110458684A (en) A kind of anti-fraud detection method of finance based on two-way shot and long term Memory Neural Networks
CN117575595A (en) Payment risk identification method, device, computer equipment and storage medium
CN110570301B (en) Risk identification method, device, equipment and medium
CN113822751A (en) Online loan risk prediction method
Sai et al. Machine Learning Algorithms for Predicting the Loan Status
CN115293783A (en) Risk user identification method and device, computer equipment and storage medium
Ma et al. A BP neural network for identifying corporate financial fraud
CN116308370A (en) Training method of abnormal transaction recognition model, abnormal transaction recognition method and device
CN114626940A (en) Data analysis method and device and electronic equipment
CN112823502B (en) Real-time feedback service for resource access rule configuration
CN114155096A (en) Method for bank to detect illegal fund transfer of network gambling based on three-part graph

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination