CN117689460A - Backwash money risk clue analysis management method, backwash money risk clue analysis management system and electronic equipment - Google Patents

Abstract

The embodiment of the disclosure provides a money laundering risk cue analysis management method, a money laundering risk cue analysis management system and electronic equipment, which comprise the following steps: acquiring characteristic data, performing running batch of the characteristic data based on a risk monitoring model, and performing analysis mining of the characteristic data; scheduling various risk monitoring models based on a scheduling management tool of the directed acyclic graph, generating a scheduling strategy corresponding to the characteristic data, mining hidden risk clues, and determining a risk monitoring model corresponding to the risk clues; and extracting a risk cue by using cue display, cue investigation and expert marking, carrying out investigation analysis on the risk cue to obtain suspicious information, and determining the money laundering transaction of hidden suspicious clients and partners. In this way, by using an artificial intelligence model, the partner risk is automatically pre-warned, and the anti-money laundering personnel is helped to quickly locate and intelligently analyze the anti-money laundering clues. Compared with the traditional money laundering rule model, the money laundering rule model is more scientific, comprehensive and accurate in identifying complex, important and important group risk problems.

Description

Backwash money risk clue analysis management method, backwash money risk clue analysis management system and electronic equipment

Technical Field

The disclosure relates to the field of money laundering, in particular to a money laundering risk cue analysis management method, a money laundering risk cue analysis management system and electronic equipment.

Background

The main identification mode of the bank anti-money laundering suspicious transaction is based on rule filtering, massive transactions are subjected to rule filtering every day, suspicious transaction packages based on accounts are generated, a large number of workers are arranged for rechecking, and the determined suspicious transactions are selected for reporting.

The increase in the number of bulk suspicious transactions detected by the banking rules system far exceeds the increase in personnel, the extraction amount is increasing, but the quality is decreasing, and the pressure of manual auditing is increasing. The adjustment of the threshold value of the rule system has difficulty and has ceilings, and can not be effectively solved for a long time.

Meanwhile, the rule system cannot realize the optimal configuration of the auditing resources. The suspicious file is randomly allocated to the auditing specialist, and the best specialist cannot be placed at the most needed position. Such as by personnel ability level and difficulty level of suspicious cases.

Money laundering groups or underground money villages are very aware of suspicious rules of anti-money laundering transactions, which are usually masked by non-financial means such as massive transaction accounts, complex transaction means, investment trade, gambling, artwork auctions, etc. The operation mode is often to adopt multiple identities, a large number of accounts, low-frequency transaction and complex transaction paths, and the method is mixed with normal transaction to avoid suspicious transaction rule screening.

The rule engine cannot effectively identify suspicious behaviors hidden in normal trade transactions and low-frequency transfer transactions, cannot identify money laundering behaviors using massive transactions and complex transaction means, cannot identify money laundering partners and latent money laundering partners, and causes that the reported suspicious transaction accounts occupy a large proportion to be separate accounts instead of partner crimes, which is not in accordance with the main characteristic partner crimes of money laundering crimes, and is one of the challenges facing the current bank anti-money laundering work.

Disclosure of Invention

In order to solve the problems, the present disclosure provides a method, a system and an electronic device for analyzing and managing money laundering risk clues, which automatically pre-warn the partner risk by using an artificial intelligent model, and help money laundering personnel to quickly locate and intelligently analyze the money laundering clues. Compared with the traditional money laundering rule model, the money laundering rule model is more scientific, comprehensive and accurate in identifying complex, important and important group risk problems.

According to a first aspect of the present disclosure, there is provided a money laundering risk cue analysis management method, the method comprising: acquiring characteristic data, performing running batch of the characteristic data based on a risk monitoring model, and performing analysis mining of the characteristic data; scheduling various risk monitoring models based on a scheduling management tool of the directed acyclic graph, generating a scheduling strategy corresponding to the characteristic data, mining hidden risk clues, and determining a risk monitoring model corresponding to the risk clues; and extracting a risk cue by using cue display, cue investigation and expert marking, carrying out investigation analysis on the risk cue to obtain suspicious information, and determining the money laundering transaction of hidden suspicious clients and partners.

According to a second aspect of the present disclosure, there is provided a money laundering risk cue analysis management system, performing the money laundering risk cue analysis management method described above, the system comprising:

the analysis mining module is used for acquiring the characteristic data, carrying out running batch of the characteristic data based on the risk monitoring model, and carrying out analysis mining of the characteristic data;

the scheduling management module is used for scheduling various risk monitoring models based on a scheduling management tool of the directed acyclic graph, generating a scheduling strategy corresponding to the characteristic data, mining hidden risk clues, and determining a risk monitoring model corresponding to the risk clues;

and the cue management module is used for extracting risk cues by cue display, cue investigation and expert marking, and carrying out investigation analysis on the risk cues to obtain suspicious information.

According to a third aspect of the present disclosure, an electronic device is provided. The electronic device includes: a memory and a processor, the memory storing a computer program thereon, the processor implementing the method as above when executing the program.

Compared with the traditional money laundering rule model, the invention can greatly reduce false alarm rate, improve the work efficiency of money laundering, save cost, dig out complex money laundering partners, especially latent money laundering partners, which can not be identified by more rule engines, and simultaneously utilize the self-learning capability of artificial intelligence technology to continuously adapt to the improvement of social environment complexity, exercise specialized personnel teams and deal with the technical challenges of external money laundering groups.

It should be understood that what is described in this summary is not intended to limit the critical or essential features of the embodiments of the disclosure nor to limit the scope of the disclosure. Other features of the present disclosure will become apparent from the following description.

Drawings

The above and other features, advantages and aspects of embodiments of the present disclosure will become more apparent by reference to the following detailed description when taken in conjunction with the accompanying drawings. For a better understanding of the present disclosure, and without limiting the disclosure thereto, the same or similar reference numerals denote the same or similar elements, wherein:

FIG. 1 illustrates a flow chart of a money laundering risk cue analysis management method according to an embodiment of the present disclosure;

FIG. 2 illustrates a block diagram of a money laundering risk cue analysis management system according to an embodiment of the present disclosure;

fig. 3 illustrates a block diagram of an exemplary electronic device capable of implementing embodiments of the present disclosure.

Detailed Description

For the purposes of making the objects, technical solutions and advantages of the embodiments of the present disclosure more apparent, the technical solutions of the embodiments of the present disclosure will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present disclosure, and it is apparent that the described embodiments are some embodiments of the present disclosure, but not all embodiments. All other embodiments, which can be made by one of ordinary skill in the art based on the embodiments in this disclosure without inventive faculty, are intended to be within the scope of this disclosure.

In addition, the term "and/or" herein is merely an association relationship describing an association object, and means that three relationships may exist, for example, a and/or B may mean: a exists alone, A and B exist together, and B exists alone. In addition, the character "/" herein generally indicates that the front and rear associated objects are an "or" relationship.

In the method, the semi-supervised artificial intelligence algorithm and expert experience are fused, the precedent of the semi-supervised algorithm in the anti-money laundering suspicious transaction risk monitoring application is opened, and the feasibility of the artificial intelligence algorithm in the anti-money laundering suspicious transaction risk monitoring is proved.

As shown in fig. 1, in a first aspect of the present disclosure, there is provided a money laundering risk cue analysis management method, the method including the steps of:

s1: acquiring characteristic data, performing running batch of the characteristic data based on a risk monitoring model, and performing analysis mining of the characteristic data;

s2: scheduling various risk monitoring models based on a scheduling management tool of the directed acyclic graph, generating a scheduling strategy corresponding to the characteristic data, mining hidden risk clues, and determining a risk monitoring model corresponding to the risk clues;

s3: and extracting a risk cue by using cue display, cue investigation and expert marking, carrying out investigation analysis on the risk cue to obtain suspicious information, and determining the money laundering transaction of hidden suspicious clients and partners.

In the embodiment, the feature data is automatically run in the full-class risk model, and the semi-supervised artificial intelligence algorithm is adopted, so that the run in the full-class risk model can be rapidly performed, the data processing efficiency and accuracy are improved, the feature data are transmitted according to the run in the selected feature data, the related data are marked, the related data are accurately found, the data are marked in the same way as the selected feature data, and the analysis mining of the feature data is realized.

In the above embodiment, the feature data is transaction data processed by the feature by performing standardized processing according to the original data of the bank. Specifically, the financial industry data acquired from the data warehouse of the financial industry is referred to as bank raw data. The bank raw data includes, for example, but is not limited to: a customer information table, a customer transaction information table, an online banking operation information table and a historical suspicious case table. The raw data tables, such as the following tables, are as follows:

in practical application, the original data of the bank contains data fields of different types, and data processing is required to be performed to obtain standardized data. In order to perform data processing well, at least one data management of data cleaning, data processing, data conversion and data integration is required to be performed on the original data of the bank, so that standardized financial industry data is obtained.

In this embodiment, data cleansing primarily formats fields of some of the data, and some of the unneeded or out of specification data is checked and filtered. Data cleansing includes, for example, but is not limited to: missing value cleaning, format and content cleaning, and logical error cleaning.

Cleaning for missing values: missing values are the most common data problems, and many processing methods exist, and common missing value cleaning methods are as follows:

(1) Determining a range of missing values

And calculating the missing value proportion for each field, and then formulating different strategies according to the missing value proportion and the field importance.

(2) Removing unwanted fields

Unwanted fields are deleted directly but backed up. The deleting operation is preferably not directly operated on the original data, partial data is extracted to perform model construction, the model effect is checked, and if the effect can be popularized to all the data.

(3) Filling missing value content

This step is the most important one and generally comprises the following ways: filling with calculation results of the same field index, such as average number, median, etc.; filling with calculation results of different indexes, such as deducing age through identity card number.

For format and content cleansing, cleansing is required, for example, for several cases: (1) inconsistent display formats of time date, numerical value and the like; (2) Characters which are not present in the content, such as letters in the identification card number, numbers in the name, and the like; (3) The content is not in accordance with the content of the field, such as the name is written into gender, the identification card number is written into the mobile phone number, etc.

For logic error cleaning, the following cleaning is mainly performed: (1) data deduplication; (2) Removing unreasonable values, such as 200 years of age, or-20 years of age; (3) Unreliable fields such as 20000101 for the birth year and month of the identification number are removed, and the age is filled with 80 years.

In the present description embodiments, data processing includes, for example, but is not limited to: data computation, field merging, field grouping, column-row switching (i.e., switching of rows and columns in a data table), data normalization. Data computation such as summing, averaging, maximum, minimum, median, variance, standard deviation, etc. is performed on the data according to model requirements. Some fields are filled, for example some null values, illegal values are filled); some fields are calculated, e.g. some new values are calculated from the original data, such as: statistics, etc.; data normalization, for example, retains decimal places, percentiles, kilobit separators, and the like.

In the present description embodiment, data conversion includes, for example, but is not limited to: converting data from one form to another. Typically, data is converted using a specific language such as SQL (Structured Query Language ) or a scripting language such as Python, and ETL (Extract-Transform-Load) tools may also be used alternatively, which may automate the data conversion process. There are different types of data transformations, such as moving, renaming and combining columns in a database, adding, copying and copying data, etc.

In the present description embodiment, data integration includes, for example, but is not limited to: and integrating a plurality of intermediate results generated in the data processing process to form one or more data width tables.

In the embodiment of the present specification, feature processing refers to a process of analyzing and calculating data from raw data to form an index required for modeling a risk model and iterating repeatedly, and specifically includes:

combining the features included in the original data with the feature indexes of the SQL to obtain new features;

and carrying out feature combination based on the statistical feature value, the category feature value and the period feature value corresponding to the new feature to obtain a high-dimensional feature index set.

Aiming at a bank money back-washing monitoring scene, the following characteristic indexes are summarized from client background and identity information, transaction information, behavior information and partner association:

the high-dimensional characteristic index is compared with the characteristic index of SQL, and the characteristic represented by the high-dimensional characteristic index can reflect the risk characteristic. In this embodiment of the present disclosure, based on the statistical feature value, the class feature value, and the period feature value corresponding to the new feature, feature combination is performed to obtain the high-dimensional feature index set, which specifically includes:

combining any two discrete values of the statistical characteristic value, the category characteristic value and the period characteristic value corresponding to the new characteristic through Cartesian products to obtain a first characteristic combination; and/or

Combining any discrete value and any continuous value of the statistical feature value, the category feature value and the periodic feature value corresponding to the new feature based on the category feature to obtain a second feature combination; and/or

Combining any two continuous values of the statistical characteristic value, the category characteristic value and the period characteristic value corresponding to the new characteristic by a second-order difference method to obtain a third characteristic combination;

the first feature combination, and/or the second feature combination, and/or the third feature combination form the high-dimensional feature index set.

In particular embodiments, the statistical characteristic values may be quartiles, medians, averages, standard deviations, skewness, discrete systems, and weights. The category characteristic value is numerical data obtained by converting character characteristics by adopting a preset coding mode, and the preset coding mode can be a label_encoder coding mode. The labelencoder encodes different characters into integers, for example, if a column contains 8 different characters, the labelencoder encodes them into a set of integers from 0 to 8. The cycle characteristic values are the same ratio, the ring ratio and the like.

In this embodiment of the present disclosure, based on the statistical feature value, the class feature value, and the period feature value corresponding to the new feature, feature combination is performed to obtain the high-dimensional feature index set, and further includes:

and according to the divergence of the features, scoring each feature in the first feature combination, the second feature combination and/or the third feature combination, and taking the feature with the score larger than a preset value as the high-dimensional feature index set.

By the method for generating the high-dimensional feature index set provided by the embodiment of the specification, the feature interpretable by the virtual resource risk identification service can be generated, and in one embodiment of the specification, based on the summary of the feature indexes, the feature interpretable by the service is generated, and a representative list of important features is as follows:

in the above embodiment, the risk monitoring model is a model training based on the feature data to obtain various risk monitoring models; each risk monitoring model is provided with a plurality of subtasks, and the subtasks are associated and set through the directed acyclic graph. The risk monitoring model is obtained through training of common machine learning models including Random Forest, GBDT, lightGBM, logistic Regression and the like, and aiming at the same problem, different types of machine learning models are tried to carry out model training, and then the model with the best effect is selected. The analysis and management of the money laundering risk clues are combined with artificial intelligence, so that the money laundering monitoring model has the characteristics of high risk recognition degree and stable detection effect, the risk clue results can be accurately positioned under the complex data environment, the money laundering departments can be helped to recognize the undiscovered risks and problems, and the money laundering efficiency is improved.

In the above embodiment, performing running batch of feature data based on the risk monitoring model, performing analysis mining of the feature data, includes: the risk monitoring model carries out the association propagation of the characteristic data through the directed acyclic graph; marking a plurality of subtasks which sequentially transmit the characteristic data by the same label; and classifying the characteristic data according to the identification information matched with the label marks. The label marks respectively correspond to the marks of different risks for identification, the marks of the same risk are of the same type, corresponding identification information is matched, and the risk type is determined through the identification information. The same feature data are respectively run in different risk monitoring models to obtain a plurality of tag marks corresponding to the feature data, the risk model to which the feature data should belong is determined according to the risk types matched by the tag marks, and the accuracy of feature data classification is realized through running of a large amount of data. In a large number of algorithm floor practices, a method of applying semi-supervised active machine learning is summarized, and under the condition of few tags or even no tags, the method can furthest refer to the existing suspicious cases in the past, automatically learn the experience of the senior anti-money laundering expert, and classify the suspicious cases in grades and grade the risks.

In the above embodiment, the scheduling management tool based on the directed acyclic graph schedules various risk monitoring models, and generates a scheduling policy corresponding to the feature data, including: determining a task execution sequence based on tasks preset by a dispatching management tool of the directed acyclic graph and the dependency relationship among the tasks; and scheduling various risk monitoring models according to the identification information corresponding to the characteristic data and the task execution sequence, and generating a scheduling strategy. And obtaining a risk monitoring model matched with the selected feature data through running batches of the feature data in various risk monitoring models, and generating a corresponding scheduling strategy in the model. Hidden risk cues are mined out through a scheduling strategy, which helps to find backwash money transactions. After feature data is batched by the risk monitoring model, a corresponding risk monitoring model is determined, namely the selected feature data is determined to be a risk cue, the risk cue related to the feature data is mined out according to a scheduling strategy, a series of money laundering transactions are determined, and the risk cue related to the money laundering transactions is found out and the corresponding risk monitoring model is determined. Wherein, a money-back transaction may include a plurality of unit tasks, each unit task being distributed and different in form, and the relevant unit task is found out through a scheduling strategy to form a complete transaction, and a risk monitoring model is determined. I.e. excavating the associated unit tasks by a unit task based dispatch tool of the directed acyclic graph, and finally forming a finished money laundering transaction.

A directed acyclic graph is a data structure that represents the dependencies between tasks. In a directed acyclic graph based task orchestration platform, a user can define tasks and their dependencies through a programming interface, and then the platform will automatically schedule the execution order and concurrency of the tasks to maximize the throughput and efficiency of the system.

In this embodiment of the present disclosure, the preset task is a task related to risk monitoring.

To further understand the dependencies between tasks, specific examples are described below. For example, three task legs A, B, C are provided, wherein task a and task B can run in parallel, then task C depends on the running results of task a and task B, the whole process can be equivalent to a directed acyclic graph, and a running rule can be defined for all task runs to be understood as task scheduling.

The A task depends on the B and C tasks, and then an A- > B side and an A- > C side need to be established.

We need to perform tasks that are dependent on OK or root not dependent, here, B and C, and finally a.

In the above embodiment, determining the task execution order based on the task and the dependency relationship between the tasks preset by the scheduling management tool of the directed acyclic graph includes: based on the task and the dependency relationship between the tasks preset by the dispatching management tool of the directed acyclic graph, determining the task execution sequence by taking the degree=0 and the task state as 'not executed' as the execution condition.

The risk monitoring model is operated in a batch processing mode, the operation is flexible, the platform provides the capability of managing the dependence relationship of the directed acyclic graph (Directed Acyclic Graph, DAG) and the dependence relationship of the tasks on data among the tasks of the risk monitoring model, and the requirements of the running frequency and the data autonomous control of different risk monitoring models are met.

In practical application, the execution of the scheduling task can be controlled autonomously, and a user can set an automatic timing trigger task through a system and can trigger the task manually.

The flexible scheduling configuration management can be used for customizing the scheduling period according to the requirements of the scene risk monitoring model, and the scheduling period can be refined to different task levels according to days/weeks/months.

The monitoring of the task running state is monitored, and once abnormality occurs, relevant personnel can be actively notified, so that problems can be timely checked.

Supporting retry and failure handling of tasks, the framework/platform automatically retries or executes failure handling logic when task execution fails.

The risk monitoring model is more flexible and various in composition, and the obtained risk monitoring model is more in accordance with the actual demands of users, so that a better clue mining effect can be obtained.

In the embodiment, the expert marking is to extract the risk clues according to the expert experience, and label the risk clues to form label data; specifically, the tag data sets historical tag data and model output tag data; specifically, the historical tag data is bank original data, and is set according to expert experience; the model output tag data is tag data obtained by auditing and feeding back according to the risk monitoring model output experience expert. The two parts of label data can be reused in an analysis management system, the distribution characteristics or the label characteristics of the label data are obtained by analyzing the label data in the system, whether the label data are suspicious information is determined, suspicious transactions are found out according to the suspicious information, the suspicious transactions are set as new characteristic data, and a risk monitoring model of a corresponding service scene is adjusted. The suspicious information is determined by comparing the suspicious information which is analyzed according to expert experience or original accumulated data characteristics and has a certain rule with new tag data, and also determining new suspicious information so as to find new suspicious clients or transactions.

In the embodiment, in order to enable the money laundering expert to visually check the risk clue information, conveniently expand the investigation, conduct clue identification and marking, and provide the functions of visual clue display, analysis, investigation, marking and the like for the management system setting. These functions support the expert in exposing risk cue content in a three-level page structure of risk cue list, partner details.

The thread analysis management function is described below taking telecommunication fraud suspected team threads as an example.

1) Batch risk cue list

The telecommunication fraud suspected team clue mining and discovery model periodically (for example, in a monthly period) runs a batch by a preset scheduler, calculates all business related data in the time period on a big data calculation platform, mines and discovers risk clues, generates a plurality of risk clues of one batch, and presents the risk clues in a form of a group partner list. The money back-washing expert can automatically select a batch with a specific time period according to the risk cue type and the batch running result summary information to obtain a partner list of the risk cue.

2) Group list

In network gambling suspicious team risk cues, the partners are mostly high risk to private customers and associated enterprises. The expert can obtain the basic information of the group partner, such as the name of the group partner, the number of the group partner members and the amount of money involved, and can obtain the outline of clues dug by various models, such as suspicious total funds, posting information, endorsement information and the score of the risk of the group partner. Based on the above-mentioned information, expert can automatically develop a specific partner to make detailed investigation of the partner.

3) Details of the group partner

In order to support the more convenient investigation of suspicious supply chain false financing partner clues by experts, the following functional points are provided in the partner detail function:

suspicious group partner information: the relationship structure and the association information among suspicious clients, sharing transaction opponents, associated IP and associated MAC are displayed to the expert most intuitively in the form of a relationship network map; and explaining the reason of agglomeration of the group partner through a histogram of the association information table and the degree of synergy of the group partner, and finally improving the efficiency of agglomeration analysis of the group partner.

Suspicious client information: and an expert can check the client information, account information, risk information and associated person information through suspicious static basic information to quickly see whether the client has various bad records and other risk information in history. And then various models are used for monitoring and generating abundant visual investigation tools such as suspicious dynamic transaction running water, upstream and downstream transactions, fund flow diagrams, historical transaction amount analysis diagrams, transaction opponent distribution diagrams, associated suspicious body transaction time sequence analysis diagrams and the like, so that the suspicious client analysis efficiency is finally improved.

4) Thread marking

After the analysis and investigation are completed, an expert can perform marking of the service tag, a more subjective message leaving function is provided, the service tag and the message can flow back to a data warehouse of a banking party together, the effect of feature index and model clue mining is positively influenced, and the method is also an important knowledge of a sediment asset of a banking party.

In the above embodiment, the suspicious information and the risk monitoring model are combined and applied, the distribution of the suspicious information is analyzed, the updated feature data is obtained, and the corresponding risk monitoring model is optimized and adjusted. Because the money back-washing modeling scene often lacks labels, the man-machine cooperation method and system are used, and learning and optimizing the model from expert experience and feedback is an effective method and a necessary way for the artificial intelligence to land in money back-washing application.

And providing rich visual risk display tools, risk investigation tools and label management tools based on the model detection results. Expert experience is integrated into the models, on the basis of risk scoring of the lines, the characteristics with strong correlation with the service are output, the interpretation of the fitting service is carried out, the risk line results mined by a plurality of models can be flexibly configured, model result pages are generated in real time, and the risk line release is carried out dynamically, so that a money back washing expert can carry out various tasks such as analysis, verification, marking, message leaving and the like on the results. The verification information and results of the anti-money laundering experts can be fed back to the module for feature processing and risk monitoring model construction, so that the system is helped to iterate and optimize in the aspects of index processing, selection and model construction.

The risk monitoring model for back money laundering supports crime-related types including, but not limited to: telecommunication fraud, network gambling, illegal funding, suspected POS cashing, suspected marketing, underground money, suspected RMB transactions, suspected cashing, money laundering with recharging business, transitional funds with payment mechanisms, etc.

Aiming at the identification and monitoring performance indexes of the AI model improved by different crime related types, different types of characteristic index systems need to be constructed, including customer identity characteristics, transaction mode characteristics, time space characteristics, accessory language key word characteristics and the like, the crime related characteristics are effectively managed, developed and applied, and various requirements of back money laundering are effectively supported.

Take the telecom fraud type as an example:

/>

according to the embodiment of the disclosure, the following technical effects are achieved:

the method has the advantages that various artificial intelligence algorithms are deeply applied, the tags are fewer, the method has a good effect, and the method is suitable for recognition of abnormal association and abnormal transaction, and has good recognizability and interpretability for underground black products, money laundering crime groups and complex network money laundering;

the interpretability of the result, in the money laundering modeling, expert experience is integrated into the model, so that the risk can be scored, the result can be interpreted, the output has the characteristic of strong correlation with the business, and particularly, the pioneering achievement is made in the aspect of the interpretability of the group result;

the result is flexibly displayed, because the anti-money laundering work involves a large number of recognition models, the cost for customizing and developing each model result is high, and a risk display and analysis tool is developed by combining the characteristics of the anti-money laundering service, so that the risk clue results mined by a plurality of models can be flexibly configured, a model result page can be generated in real time, and the risk clues can be dynamically released for an anti-money laundering expert to analyze and verify the results;

the active machine learning iterative loop carries out deep analysis and verification on the risk clues of model excavation, feeds back abundant verification labels, features and model optimization directions, and helps a model system to realize the next optimization iterative loop;

the method and the system for monitoring the suspicious money laundering transactions continuously identify and monitor the suspicious money laundering transactions, and combine a big data platform and a scheduling technology, the scheme is used for scheduling the risk monitoring model regularly, and related risk clue mining and model discovery can be continuously operated.

It should be noted that, for simplicity of description, the foregoing method embodiments are all described as a series of acts, but it should be understood by those skilled in the art that the present disclosure is not limited by the order of acts described, as some steps may be performed in other orders or concurrently in accordance with the present disclosure. Further, those skilled in the art will also appreciate that the embodiments described in the specification are all alternative embodiments, and that the acts and modules referred to are not necessarily required by the present disclosure.

The foregoing is a description of embodiments of the method, and the following further describes embodiments of the present disclosure through examples of apparatus.

Fig. 2 shows a block diagram of a money laundering risk cue analysis management system 200 according to an embodiment of the present disclosure, the system 200 comprising:

the analysis mining module 201 is configured to obtain feature data, perform running batch of the feature data based on the risk monitoring model, and perform analysis mining of the feature data;

the scheduling management module 202 is configured to schedule various risk monitoring models based on a scheduling management tool of the directed acyclic graph, generate a scheduling policy corresponding to the feature data, mine hidden risk clues, and determine a risk monitoring model corresponding to the risk clues;

the thread management module 203 extracts the risk threads using thread display, thread investigation and expert marking, and performs investigation analysis on the risk threads to obtain suspicious information.

In the above embodiment, the method further includes an optimization management module 204, configured to combine and apply the suspicious information and the risk monitoring model, analyze the distribution of the suspicious information, obtain updated feature data, and optimally adjust the corresponding risk monitoring model.

The money laundering risk clue analysis management system provided by the disclosure adopts high-dimensional data to enter a model, combines the experience design characteristic variables of money laundering specialists, processes complex association relations and detects high-risk results; the system has the characteristics of high risk recognition degree and stable detection effect, can accurately position risk clue results under a complex data environment, helps the anti-money laundering department to recognize undiscovered risks and problems, and improves the anti-money laundering efficiency.

It will be clear to those skilled in the art that, for convenience and brevity of description, specific working procedures of the described modules may refer to corresponding procedures in the foregoing method embodiments, which are not described herein again.

In the technical scheme of the disclosure, the acquisition, storage, application and the like of the related user personal information all conform to the regulations of related laws and regulations, and the public sequence is not violated.

According to embodiments of the present disclosure, the present disclosure also provides an electronic device, a readable storage medium and a computer program product.

Fig. 3 shows a schematic block diagram of an electronic device 300 that may be used to implement embodiments of the present disclosure. Electronic devices are intended to represent various forms of digital computers, such as laptops, desktops, workstations, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. The electronic device may also represent various forms of mobile devices, such as personal digital processing, cellular telephones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions, are meant to be exemplary only, and are not meant to limit implementations of the disclosure described and/or claimed herein.

The electronic device 300 includes a computing unit 301 that can perform various appropriate actions and processes according to a computer program stored in a ROM302 or a computer program loaded from a storage unit 303 into a RAM 303. In the RAM303, various programs and data required for the operation of the electronic device 300 may also be stored. The computing unit 301, the ROM302, and the RAM303 are connected to each other by a bus 304. I/O interface 305 is also connected to bus 304.

Various components in the electronic device 300 are connected to the I/O interface 305, including: an input unit 306 such as a keyboard, a mouse, etc.; an output unit 307 such as various types of displays, speakers, and the like; a storage unit 308 such as a magnetic disk, an optical disk, or the like; and a communication unit 309 such as a network card, modem, wireless communication transceiver, etc. The communication unit 309 allows the electronic device 300 to exchange information/data with other devices through a computer network such as the internet and/or various telecommunication networks.

The computing unit 301 may be a variety of general and/or special purpose processing components having processing and computing capabilities. Some examples of computing unit 301 include, but are not limited to, a Central Processing Unit (CPU), a Graphics Processing Unit (GPU), various specialized Artificial Intelligence (AI) computing chips, various computing units running machine learning model algorithms, a Digital Signal Processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 301 performs the respective methods and processes described above, such as the money back-washing risk cue analysis management method. For example, in some embodiments, the money laundering risk cue analysis management method may be implemented as a computer software program tangibly embodied on a machine-readable medium, such as storage unit 308. In some embodiments, part or all of the computer program may be loaded and/or installed onto the electronic device 300 via the ROM302 and/or the communication unit 309. When the computer program is loaded into RAM303 and executed by computing unit 301, one or more steps of the money laundering risk cue analysis management method described above may be performed. Alternatively, in other embodiments, the computing unit 301 may be configured to perform the backwash risk cue analysis management method in any other suitable way (e.g. by means of firmware).

Various implementations of the systems and techniques described here above may be implemented in digital electronic circuitry, integrated circuitry, field Programmable Gate Arrays (FPGAs), application Specific Integrated Circuits (ASICs), application Specific Standard Products (ASSPs), systems-on-chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and/or combinations thereof. These various embodiments may include: implemented in one or more computer programs, the one or more computer programs may be executed and/or interpreted on a programmable system including at least one programmable processor, which may be a special purpose or general-purpose programmable processor, that may receive data and instructions from, and transmit data and instructions to, a storage system, at least one input device, and at least one output device.

Program code for carrying out methods of the present disclosure may be written in any combination of one or more programming languages. These program code may be provided to a processor or controller of a general purpose computer, special purpose computer, or other programmable data processing apparatus such that the program code, when executed by the processor or controller, causes the functions/operations specified in the flowchart and/or block diagram to be implemented. The program code may execute entirely on the machine, partly on the machine, as a stand-alone software package, partly on the machine and partly on a remote machine or entirely on the remote machine or server.

In the context of this disclosure, a machine-readable medium may be a tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. The machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. The machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of a machine-readable storage medium would include an electrical connection based on one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

To provide for interaction with a user, the systems and techniques described here can be implemented on a computer having: display means for displaying information to a user; and a keyboard and pointing device (e.g., a mouse or trackball) by which a user can provide input to the computer. Other kinds of devices may also be used to provide for interaction with a user; for example, feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form, including acoustic input, speech input, or tactile input.

The systems and techniques described here can be implemented in a computing system that includes a background component (e.g., as a data server), or that includes a middleware component (e.g., an application server), or that includes a front-end component (e.g., a user computer having a graphical user interface or a web browser through which a user can interact with an implementation of the systems and techniques described here), or any combination of such background, middleware, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: local Area Networks (LANs), wide Area Networks (WANs), and the internet.

The computer system may include a client and a server. The client and server are typically remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other. The server may be a cloud server, a server of a distributed system, or a server incorporating a blockchain.

It should be appreciated that various forms of the flows shown above may be used to reorder, add, or delete steps. For example, the steps recited in the present disclosure may be performed in parallel, sequentially, or in a different order, provided that the desired results of the disclosed aspects are achieved, and are not limited herein.

The above detailed description should not be taken as limiting the scope of the present disclosure. It will be apparent to those skilled in the art that various modifications, combinations, sub-combinations and alternatives are possible, depending on design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present disclosure are intended to be included within the scope of the present disclosure.

Claims (10)

1. A method for analyzing and managing money laundering risk cues, the method comprising:

acquiring characteristic data, performing running batch of the characteristic data based on a risk monitoring model, and performing analysis mining of the characteristic data;

scheduling various risk monitoring models based on a scheduling management tool of a directed acyclic graph, generating a scheduling strategy corresponding to the characteristic data, mining hidden risk clues, and determining the risk monitoring models corresponding to the risk clues;

and extracting a risk cue by using cue display, cue investigation and expert marking, carrying out investigation analysis on the risk cue to obtain suspicious information, and determining the money laundering transaction of hidden suspicious clients and the group partner.

2. The method of claim 1, wherein the characteristic data is transaction data processed by characteristics, which is normalized based on raw data of a bank.

3. The method of claim 1, wherein the step of determining the position of the substrate comprises,

the risk monitoring model is based on the characteristic data to perform model training to obtain various risk monitoring models; each risk monitoring model is provided with a plurality of subtasks, and the subtasks are arranged in an associated mode through a directed acyclic graph.

4. A method according to claim 3, wherein the running of the feature data based on the risk monitoring model and the analytical mining of the feature data comprise:

the risk monitoring model carries out the association propagation of the characteristic data through a directed acyclic graph;

marking the same label for a plurality of subtasks which sequentially transmit the characteristic data;

and classifying the characteristic data according to the identification information matched with the label mark.

5. The method of claim 4, wherein the directed acyclic graph based scheduling management tool schedules the various risk monitoring models, generating a corresponding scheduling policy for the characteristic data, comprising:

determining a task execution sequence based on tasks preset by a dispatching management tool of the directed acyclic graph and the dependency relationship among the tasks;

and scheduling various risk monitoring models according to the identification information corresponding to the characteristic data and the task execution sequence, and generating the scheduling strategy.

6. The method of claim 5, wherein determining the task execution order based on the task and the dependency relationship between the tasks preset by the directed acyclic graph based scheduling management tool comprises:

and determining the task execution sequence by taking the degree=0 and the task state as 'not executed' as execution conditions based on the task and the dependency relationship among the tasks preset by the scheduling management tool of the directed acyclic graph.

7. The method according to claim 1, wherein the expert marking is to extract the risk cues according to expert experience, and label to form label data; in particular, the method comprises the steps of,

the tag data is provided with historical tag data and model output tag data; in particular, the method comprises the steps of,

the history tag data are bank original data and are set according to expert experience; and the model output tag data is tag data obtained by auditing and feeding back according to the risk monitoring model output experience expert.

8. The method as recited in claim 1, further comprising:

and combining and applying the suspicious information and the risk monitoring model, analyzing the distribution of the suspicious information, obtaining updated characteristic data, and optimizing and adjusting the corresponding risk monitoring model.

9. A money back risk cue analysis management system, characterized in that the money back risk cue analysis management method according to any one of claims 1 to 8 is performed, the system comprising:

the analysis mining module is used for acquiring the characteristic data, carrying out running batch of the characteristic data based on the risk monitoring model, and carrying out analysis mining of the characteristic data;

the scheduling management module is used for scheduling various risk monitoring models based on a scheduling management tool of the directed acyclic graph, generating a scheduling strategy corresponding to the characteristic data, mining hidden risk clues, and determining the risk monitoring models corresponding to the risk clues;

the clue management module is used for extracting risk clues by clue display, clue investigation and expert marking, and carrying out investigation analysis on the risk clues to obtain suspicious information;

and the optimization management module is used for combining and applying the suspicious information and the risk monitoring model and optimizing the risk monitoring model.

10. An electronic device, comprising:

at least one processor; and

a memory communicatively coupled to the at least one processor; wherein,

the memory stores instructions executable by the at least one processor to enable the at least one processor to perform the method of any one of claims 1-8.