CN118154292A - Money back-flushing identification method based on BiLSTM and graph convolution neural network combination - Google Patents

Abstract

The invention is applicable to the technical field of data processing, and provides a money laundering identification method based on BiLSTM and graph convolution neural network combination, which comprises the following steps: step S1, performing long-cut short-patch on user transaction time sequence data, and feeding the processed data into BiLSTM networks; s2, respectively extracting statistical math of transaction data of each user and forming a vector by taking the statistical math as an element; step S3, splicing the vectors output in the step S1 and the step S2 into new vectors; and S4, taking the user as a node and the payment flow as an edge to form a graph, taking the vector output in the step S3 as the attribute characteristic of the graph convolution neural network node, and training and outputting the classification result of the node. The invention can better capture the dynamic characteristics in the transaction network under the condition of small time expenditure during training, and has the recall rate of up to 0.963; the rich node features can be extracted for more granular pattern recognition.

Description

Money back-flushing identification method based on BiLSTM and graph convolution neural network combination

Technical Field

The invention belongs to the technical field of data processing, and particularly relates to a money laundering identification method based on BiLSTM and graph convolution neural network combination.

Background

The traditional money laundering technology carries out money laundering identification of single transaction behaviors by using a logistic regression or clustering algorithm, however, the current transaction network is increasingly huge, the money laundering behaviors tend to be complicated and collective, and the traditional pattern identification cannot meet the current requirements on money laundering behavior identification.

The advent of graph roll-up networks solves the difficult problem of difficult access to data correlation and data structure features in the money laundering field, but when applied to the money laundering field, there are several problems: (1) The graph rolling network research is mostly applied to the static graph problem, but in the digital currency transaction research, the graph structure is dynamically changed, the dynamics is one of the characteristics which need to be focused, and the traditional static graph rolling network cannot well capture the dynamic characteristics in the transaction network, so that the recall rate is always at a low level. (2) Existing dynamic graph rolling networks such as EvolveGCN have time overhead for training. (3) The increasingly collective money laundering behavior requires richer node features to enable finer granularity pattern recognition. Therefore, we propose a money laundering identification method based on BiLSTM and graph convolution neural network combination.

Disclosure of Invention

The invention aims to provide a money laundering identification method based on BiLSTM and graph convolution neural network combination, which aims to solve the problems in the background technology.

In order to achieve the above purpose, the present invention provides the following technical solutions:

A money laundering identification method based on BiLSTM and graph convolution neural network combination comprises the following steps:

step S1, performing long-cut short-patch on user transaction time sequence data, wherein the time sequence length is the average value of all data lengths, and feeding the long-cut short-patch data into BiLSTM networks;

s2, respectively extracting statistical mathematical quantity of each user transaction data, and forming a vector by taking the statistical mathematical quantity as an element;

Step S3, splicing the vectors output in the step S1 and the step S2 to form a new vector;

and S4, taking the user as a node and the payment flow as an edge to form a graph, taking the vector output in the step S3 as the attribute characteristic of the graph convolution neural network node, and training and outputting the classification result of the node.

Further, the specific operation of step S1 is as follows:

suppose that the transaction data for user v _i is A _i represents the transaction flow quantity of the user i, the quantity of the original transaction data of each user is subjected to long-cut short-patch, and the processed data is/>

Wherein the method comprises the steps ofF _p is a long-cut short-patch function indicating when the amount of user transaction data is greater than/>When the number of the user transaction data is less than/>, the excess data is cut offAt this time, the missing data is padded with 0 until the amount of transaction data is equal toWhen the amount of user transaction data is equal to/>When the transaction data is processed, the original transaction data is processed;

Data after cutting long and short Feeding BiLSTM a network f _R, taking the vector output by the hidden layer of the last layer as output, and generating a vector V ₁ with a dimension of b after the vector is subjected to a linear layer and an activation function:

Wherein V ₁＝{[x₁,x₂,…,x_b]}∈R^b,V₁ is obtained by long-cut short-patch processing of the original transaction data.

Further, the specific operation in step S2 is as follows:

the original transaction data of each user is extracted with mathematical quantity statistical characteristics, and a vector V ₂＝[y₁,y₂,…,y_d]∈R^d is formed by the mathematical quantity based on statistics.

Further, the vector output in the step S3 is a feature matrix V _i of each node V _i, which is defined as follows:

V_i＝concat(V₁+V₂)＝[x₁,x₂,…x_b,y₁,y₂,…,y_d].

further, the specific operation in step S4 is as follows:

Define graph g= (V, E), where V represents the set of all nodes V _i in the graph, where V represents the set of all users, i.e. V _i E V; e represents the set of all edges E _ij in the graph, here representing the set of all payment flows, i.e., E _ij＝(V_i,V_j) ε E, representing the transfer or payment of V _i to V _j; the adjacency matrix of the graph is denoted as a:

The set of neighbor nodes N (v _i)＝{u_i∈V|(v_i,u_i) ∈E) of node v _i, where u _i represents the node directly connected to node v _i, i.e., the neighbor node of node v _i;

The graph convolution neural network aggregates information from adjacent nodes, a convolution layer is overlapped, and a layer 2 node v _i embedding vector h _i is:

Wherein the method comprises the steps of Adjacency matrix representing undirected graph self-join,/>Is an identity matrix; /(I)Is a diagonal matrix, each/>I.e., the degree of node v _i; σ (·) is a ReLU activation function, specifically defined as ReLU (x) =max (0, x); /(I)Is a hierarchical linear transformation matrix optimized during training, where F and F' represent the node feature dimensions of layers 1 and 2, respectively;

For a node v _i, the node update formula is expressed as follows:

The convolution neural network outputs a feature vector h _i of each node V _i with a dimension of 32, and finally, the vector V _out expressed by the binary probability of the node is output through a linear layer and the Log_Softmax activation function:

V_out＝log_softmax(linear(h_i))。

compared with the prior art, the invention has the beneficial effects that:

According to the money back-flushing identification method based on BiLSTM and the graph convolution neural network, only one layer of convolution structure design is adopted, dynamic characteristics in a transaction network can be better captured under the condition of small time cost in training, and the recall rate is as high as 0.963; before the graph convolution neural network is trained, rich node characteristics can be extracted to perform more granular pattern recognition.

Drawings

Fig. 1 is a schematic structural view of the present invention.

Detailed Description

The present invention will be described in further detail with reference to the drawings and examples, in order to make the objects, technical solutions and advantages of the present invention more apparent. It should be understood that the specific embodiments described herein are for purposes of illustration only and are not intended to limit the scope of the invention.

Specific implementations of the invention are described in detail below in connection with specific embodiments.

As shown in fig. 1, in the method for identifying money back on the basis of BiLSTM and graph convolution neural network, the description of the method is performed by taking real bank transaction flow data as an example, and the method comprises the following steps:

step S1, performing long-cut short-patch on user transaction time sequence data, wherein the time sequence length is the average value of all data lengths, and feeding the long-cut short-patch data into BiLSTM networks;

the specific operation of the step S1 is as follows:

suppose that the transaction data for user v _i is A _i represents the transaction running number of user i, and in order to facilitate the subsequent time series processing, the number of the original transaction data of each user is subjected to long-cut short-patch, and the processed data is/>

Wherein the method comprises the steps ofF _p is a long-cut short-patch function indicating when the amount of user transaction data is greater than/>When the number of the user transaction data is less than/>, the excess data is cut offAt this time, the missing data is padded with 0 until the amount of transaction data is equal toWhen the amount of user transaction data is equal to/>When the transaction data is processed, the original transaction data is processed;

Then the data after the long and short complements are cut Feeding BiLSTM a network f _R, taking the vector output by the hidden layer of the last layer as output, and generating a vector V ₁ with a dimension of b after the vector is subjected to a linear layer and an activation function:

V ₁＝{[x₁,x₂,...,x_b]}∈R^b,V₁ is obtained by long-cut short-patch processing of the original transaction data, is irrelevant to the cut data in the original transaction data, and is used for extracting mathematical quantity statistical characteristics from the original transaction data of each user in order to make up for the missing data.

S2, respectively extracting statistical mathematical quantity of each user transaction data, and forming a vector by taking the statistical mathematical quantity as an element;

The specific operation of the step S2 is as follows:

Extracting mathematical quantity statistical characteristics from the original transaction data of each user, wherein the extracted mathematical quantity is as follows based on experience: the transaction time, the transaction amount, the average value, the median, the maximum value, the minimum value, the standard deviation, the proportion of the transaction amount to the total transaction amount, the proportion of the number of times of ten occurrences of the transaction amount to the total transaction amount, the number of transaction sites and the proportion of receipt and payment identifications (account giving, account entering, loan and borrowing) to the total transaction amount of c opponent users with the largest transaction times of the user i; the number of all transaction opponents, the number of transaction card numbers, the standard deviation of transaction time, the average value of transaction amount, the average value of transaction balance, the proportion of the times of ten times of occurrence of transaction amount to the total transaction times, and the like of the user i. The statistical-based mathematical quantities are formed into a vector V ₂＝[y₁,y₂,...,y_d]∈R^d.

Step S3, splicing the vectors output in the step S1 and the step S2 to form a new vector;

The vector output in the step S3 is a feature matrix V _i of each node V _i, which is defined as follows:

V_i＝concat(V₁+V₂)＝[x₁,x₂,...x_b,y₁,y₂,…,y_d].

S4, taking the user as a node, taking the payment flow as an edge to form a graph, taking the vector output in the step S3 as the attribute characteristic of the graph convolution neural network node, and training and outputting a node classification result;

The specific operation of the step S4 is as follows:

Define graph g= (V, E), where V represents the set of all nodes V _i in the graph, where V represents the set of all users, i.e. V _i E V; e represents the set of all edges E _ij in the graph, here representing the set of all payment flows, i.e., E _ij＝(V_i,V_j) ε E, representing the transfer or payment of V _i to V _j; the adjacency matrix of the graph is denoted as a:

The set of neighbor nodes N (v _i)＝{u_i∈V|(v_i,u_i) ∈E) of node v _i, where u _i represents the node directly connected to node v _i, i.e., the neighbor node of node v _i; if there is an edge (v _i,u_i) E from node v _i to node u _i, node u _i is the neighbor node of node v _i; n (v _i) represents the set of neighbor nodes of node v _i, i.e. the set of all nodes directly connected to node v _i.

The graph convolution neural network aggregates information from adjacent nodes, captures information of at most k hops from the nodes by superposing convolution layers (k is the number of stacked GCN layers), and takes 2 as k, and the embedded vector h _i of the node v _i of the layer 2 is:

Wherein the method comprises the steps of Adjacency matrix representing undirected graph self-join that allows node characterization itself to be incorporated when updating node characterization,/>, andIs an identity matrix; /(I)Is a diagonal matrix, each/>I.e., the degree of node v _i; σ (·) is a ReLU activation function, specifically defined as ReLU (x) =max (0, x); /(I)Is a hierarchical linear transformation matrix optimized during training, where F and F' represent the node feature dimensions of layers 1 and 2, respectively;

For a node v _i, the node update formula is expressed as follows:

The convolution neural network outputs a feature vector h _i of each node V _i with a dimension of 32, and finally, the vector V _out expressed by the binary probability of the node is output through a linear layer and the Log_Softmax activation function:

V_out＝log_softmax(linear(h_i))。

the working principle of the invention is as follows:

According to the money back-flushing identification method based on BiLSTM and graph convolution neural network combination, only one layer of convolution structure design is adopted to reduce huge time expenditure caused by the application of the convolution network. The characteristics of each user transaction time sequence data are extracted through the bidirectional LSTM neural network, the characteristics are combined with the statistical math quantity extracted from the transaction flow data based on an empirical rule method, the combined vector is used as the node attribute characteristics of the graph convolution neural network, the characteristics are combined and extracted through BiLSTM and the statistical method, the dynamic characteristics of the transaction network can be well captured, the richer node characteristics are obtained, and finer granularity pattern recognition is supported.

The foregoing is merely a preferred embodiment of the present invention, and it should be noted that modifications and improvements can be made by those skilled in the art without departing from the spirit of the present invention, and these should also be considered as the scope of the present invention, which does not affect the effect of the implementation of the present invention and the utility of the patent.

Claims (5)

1. The money back washing identification method based on BiLSTM and graph convolution neural network is characterized by comprising the following steps of:

step S1, performing long-cut short-patch on user transaction time sequence data, wherein the time sequence length is the average value of all data lengths, and feeding the long-cut short-patch data into BiLSTM networks;

s2, respectively extracting statistical mathematical quantity of each user transaction data, and forming a vector by taking the statistical mathematical quantity as an element;

Step S3, splicing the vectors output in the step S1 and the step S2 to form a new vector;

and S4, taking the user as a node and the payment flow as an edge to form a graph, taking the vector output in the step S3 as the attribute characteristic of the graph convolution neural network node, and training and outputting the classification result of the node.

2. The method for identifying backwash money based on BiLSTM in combination with a graph roll-up neural network according to claim 1, wherein the specific operations of step S1 are as follows:

suppose that the transaction data for user v _i is A _i represents the transaction flow quantity of the user i, the quantity of the original transaction data of each user is subjected to long-cut short-patch, and the processed data is/>

Wherein the method comprises the steps ofF _p is a long-cut short-patch function indicating when the amount of user transaction data is greater than/>When the number of the user transaction data is less than/>, the excess data is cut offAt this point, the missing data is padded with 0 until the amount of transaction data is equal to/>When the amount of user transaction data is equal to/>When the transaction data is processed, the original transaction data is processed;

Data after cutting long and short Feeding BiLSTM a network f _R, taking the vector output by the hidden layer of the last layer as output, and generating a vector V ₁ with a dimension of b after the vector is subjected to a linear layer and an activation function:

Wherein V ₁＝{[x₁,x₂,…,x_b]}∈R^b,V₁ is obtained by long-cut short-patch processing of the original transaction data.

3. The method for identifying backwash money based on BiLSTM in combination with a graph roll-up neural network according to claim 2, wherein the specific operations in step S2 are as follows:

the original transaction data of each user is extracted with mathematical quantity statistical characteristics, and a vector V ₂＝[y₁,y₂,…,y_d]∈R^d is formed by the mathematical quantity based on statistics.

4. The method for identifying backwash money based on BiLSTM in combination with a graph convolution neural network according to claim 3, wherein the vector output in the step S3 is a feature matrix V _i of each node V _i, which is defined as follows:

V_i＝concat(V₁+V₂)＝[x₁,x₂,…x_b,y₁,y₂,…,y_d].

5. the method for identifying backwash money based on BiLSTM in combination with a graph roll-up neural network according to claim 4, wherein the specific operations of step S4 are as follows:

Define graph g= (V, E), where V represents the set of all nodes V _i in the graph, where V represents the set of all users, i.e. V _i E V; e represents the set of all edges E _ij in the graph, here representing the set of all payment flows, i.e., E _ij＝(V_i,V_j) ε E, representing the transfer or payment of V _i to V _j; the adjacency matrix of the graph is denoted as a:

The set of neighbor nodes N (v _i)＝{u_i∈V|(v_i,u_i) ∈E) of node v _i, where u _i represents the node directly connected to node v _i, i.e., the neighbor node of node v _i;

The graph convolution neural network aggregates information from adjacent nodes, a convolution layer is overlapped, and a layer 2 node v _i embedding vector h _i is:

Wherein the method comprises the steps of Adjacency matrix representing undirected graph self-join,/>Is an identity matrix; /(I)Is a diagonal matrix, each/>I.e., the degree of node v _i; σ (·) is a ReLU activation function, specifically defined as ReLU (x) =max (0, x); /(I)Is a hierarchical linear transformation matrix optimized during training, where F and F' represent the node feature dimensions of layers 1 and 2, respectively;

For a node v _i, the node update formula is expressed as follows:

The convolution neural network outputs a feature vector h _i of each node V _i with a dimension of 32, and finally, the vector V _out expressed by the binary probability of the node is output through a linear layer and the Log_Softmax activation function:

V_out＝log_softmax(linear(h_i))。