JP7146218B1 - Information processing device, information processing method and program - Google Patents

Abstract

The present invention evaluates the risk of fraud involving multiple companies. A clustering processing unit 1 reads learning data including financial statements of each company, attribute information, information indicating whether or not fraud has been committed, and information indicating business relationships between companies, A network structure is obtained by clustering so that the number of nodes included in one cluster is equal to or less than a predetermined value. The cluster feature amount calculation unit 2 calculates the feature amount of each node belonging to each cluster included in the data after clustering, and calculates the feature amount of each cluster based on the calculated feature amount. The fraud flag assigning unit 3 assigns an fraud flag to each cluster based on information indicating whether or not a node belonging to each cluster is fraudulent. The model construction unit 4 acquires a trained model by performing supervised learning on the data to which the fraud flag is assigned, using the feature quantity as an explanatory variable and the fraud flag as an objective variable. [Selection drawing] Fig. 8

Description

The present invention relates to an information processing device, an information processing method, and a program.

Attempts to detect anomalies in accounting audits using AI technologies such as machine learning and deep learning are progressing. For example, a method has been proposed that focuses on account items of individual companies and detects anomalies in the account item values themselves. Assuming a VAR (Vector Auto-Regression) structure for fluctuations in multiple account items, sparse by LASSO (Least Absolute Shrinkage and Selection Operator) to detect journal entries that cause abnormal account items. A technique has been proposed (Patent Document 1). In the financial analysis device according to this technique, the first vector generation unit generates the first vector whose elements are the fluctuation values of the account items within the first period of the accounting data. An estimating unit estimates each fluctuation value of a plurality of account items within a first period based on a plurality of first vectors within a second period including a plurality of first periods. A residual detector detects a residual between the variation value and the actual variation value. An abnormality candidate identification unit extracts a variation value of a specific account item in a specific first period in which a value correlated with the residual exceeds a threshold. The journal limiting unit generates a second matrix in which second vectors are arranged in the row direction, the elements of which are the fluctuation values of the plurality of account items of each journal within a specific first period. A journal extractor extracts from the second matrix journals containing account items whose values correlated with the residuals exceed a threshold. An abnormal journal extraction unit extracts an abnormality detection unit that detects an abnormality contained in the extracted journal and a journal in which an abnormality is detected.

JP 2019-67086 A

V. A. Traag, L. Waltman, N. J. van Eck, "From Louvain to Leiden: guaranteeing well-connected communities", 26 March, 2019, Nature, Scientific Reports 9, Article Number 5233(2019), retrieved September 29, 2021, <URL: https://www.nature.com/articles/s41598-019-41695-z.pdf> Teppei Usuku, Satoshi Kondo, Kengo Shiraki, Daisuke Miyagawa, Yuki Yanagioka, "Predicting Fraudulent Accounting Using Machine Learning Techniques: A Study Using Unlisted Company Data," June 2021, Hitotsubashi Graduate School of Financial Strategy and Management Finance Program, Working Paper Series, FS-2021-J-001, retrieved on September 29, 2021, <URL: https://www.fs.hub.hit-u.ac.jp/inc/files/staff-research/workingpaper /FS-2021-J-001.pdf>

The technique of Patent Literature 1 can detect anomalies in individual account items. However, in principle, it is impossible to detect abnormal behavior involving multiple companies, such as fraudulent transactions involving multiple companies, such as circular transactions.

Therefore, in order to detect fraudulent transactions in which multiple companies are involved, it is necessary to establish a fraud detection method that also considers the business relationships between companies.

The present invention has been made in view of the above circumstances, and an object of the present invention is to evaluate the risk of fraudulent transactions involving multiple companies.

An information processing apparatus according to an embodiment includes a plurality of variables indicating the values of a plurality of account items included in financial statements of each company in which information of each company is represented by a multidimensional vector, attribute information of each company, and Read learning data containing information indicating whether a company has committed fraud and information indicating business relationships between companies, and adjust the number of nodes included in one cluster to a predetermined value or less. A clustering processing unit that performs clustering and acquires a network structure composed of nodes corresponding to each cluster and edges that indicate transaction relationships between the nodes, and characteristics of each node belonging to each cluster included in the data after the clustering. a feature quantity calculation unit that calculates the feature quantity of each cluster based on the calculated feature quantity; a fraud flag assigning unit that assigns a flag; and a model construction unit that obtains a trained model by performing supervised learning on the data to which the fraud flag is assigned, using the feature quantity as an explanatory variable and the fraud flag as an objective variable. ,

In the information processing method according to one embodiment, the clustering processing unit generates a plurality of variables indicating the values of a plurality of account items included in the financial statements of each company in which information of each company is represented by a multidimensional vector, each company attribute information, information indicating whether or not each company has committed fraud, and information indicating the business relationship between companies, and the number of nodes included in one cluster is a predetermined value. Clustering is performed as follows, a network structure composed of nodes corresponding to each cluster and edges indicating transaction relationships between nodes is obtained, and the feature amount calculation unit calculates each included in the data after the clustering Information indicating whether the feature amount of each node belonging to the cluster has been calculated, the feature amount of each cluster has been calculated based on the calculated feature amount, and the fraud flag assigning unit has performed the fraud of the node belonging to each cluster. Based on, a fraud flag is given to the cluster, and the model construction unit performs supervised learning on the data to which the fraud flag is assigned, with the feature amount as an explanatory variable and the fraud flag as an objective variable. It is the one that gets the model.

A program according to one embodiment includes a plurality of variables indicating the values of a plurality of account items included in the financial statements of each company in which information of each company is represented by a multidimensional vector, attribute information of each company, and Read learning data containing information indicating whether or not fraud has been committed and information indicating business relationships between companies, and perform clustering so that the number of nodes included in each cluster is equal to or less than a predetermined value. , a process of acquiring a network structure composed of nodes corresponding to each cluster and edges indicating a transaction relationship between the nodes, and a feature amount calculation unit performing each node belonging to each cluster included in the data after crystalling and calculating the feature amount of each cluster based on the calculated feature amount; , a process of assigning a fraudulent flag to the cluster, and a model construction unit performing supervised learning on the data to which the fraudulent flag is assigned, using the feature amount as an explanatory variable and the fraudulent flag as an objective variable to create a trained model and a process of obtaining the .

An information processing apparatus according to an embodiment includes a plurality of variables indicating the values of a plurality of account items included in financial statements of each company in which information of each company is represented by a multidimensional vector, attribute information of each company, and Read learning data containing information indicating whether a company has committed fraud and information indicating business relationships between companies, and adjust the number of nodes included in one cluster to a predetermined value or less. A clustering processing unit that performs clustering and acquires a network structure composed of nodes corresponding to each cluster and edges that indicate transaction relationships between the nodes, and characteristics of each node belonging to each cluster included in the data after the clustering. a feature quantity calculation unit that calculates the feature quantity of each cluster based on the calculated feature quantity; a fraud flag assigning unit that assigns a flag; and a model construction unit that obtains a trained model by performing supervised learning on the data to which the fraud flag is assigned, using the feature quantity as an explanatory variable and the fraud flag as an objective variable. a model storage unit that holds the model acquired by the model construction device; variables, attribute information of each company, and information indicating business relationships between companies, and inputs the input data into the learned model so that the company corresponding to the input data commits fraud. and an estimation processing unit for estimating whether or not it has been performed.

According to the present invention, the risk of transaction fraud involving multiple companies can be evaluated.

1 is a diagram showing an example of a system configuration for realizing an accounting information processing apparatus according to Embodiment 1; FIG. 3 is a diagram schematically showing the basic configuration of company data according to the embodiment; FIG. It is a figure which shows the enterprise data concerning this Embodiment in tabular form. FIG. 3 is a diagram showing an example of a table showing edge information and nodes and edges based on the edge information; FIG. 10 is a diagram showing a first example of fraud history information; FIG. 10 is a diagram showing a second example of fraud history information; FIG. 13 is a diagram showing a third example of fraud history information; 1 is a diagram schematically showing the configuration of an information processing apparatus according to a first embodiment; FIG. FIG. 5 is a diagram schematically showing a modification of the information processing apparatus 100 according to the first embodiment; FIG. 4 is a flowchart of processing in the information processing apparatus according to the first embodiment; It is a figure which shows the example of the feature-value of each node in tabular form. FIG. 3 is a diagram showing an example of a network used for calculating feature amounts; FIG. FIG. 3 shows a network used to illustrate adjacency matrices; FIG. 2 is a diagram showing an example of a local network; FIG. It is a figure which shows the example of the feature-value of each cluster in tabular form. It is a figure which shows an example of a ROC curve and AUC. FIG. 10 is a diagram showing the adoption rate of each feature amount in evaluation case A; FIG. 10 is a diagram showing AUC when learning data is used and AUC when test data is used in evaluation case A; FIG. 10 is a diagram showing the adoption rate of each feature quantity in evaluation case B; FIG. 10 is a diagram showing AUC when learning data is used and AUC when test data is used in evaluation case B; FIG. 10 is a diagram showing the adoption rate of each feature quantity in evaluation case C; FIG. 11 is a diagram showing AUC when learning data is used and AUC when test data is used in evaluation case C; FIG. 4 is a diagram showing the relationship between the maximum value of nodes belonging to a cluster and AUC; FIG. 10 is a diagram schematically showing the configuration of an information processing apparatus according to a second embodiment; FIG. FIG. 10 is a diagram showing a modification of the information processing device according to the second embodiment; FIG. 10 is a diagram showing a modification of the information processing device according to the second embodiment;

BEST MODE FOR CARRYING OUT THE INVENTION Hereinafter, embodiments of the present invention will be described with reference to the drawings. In each drawing, the same elements are denoted by the same reference numerals, and redundant description will be omitted as necessary.

Embodiment 1
An information processing apparatus 100 according to the first embodiment will be described. The information processing apparatus 100 detects abnormal transactions (in other words, fraudulent transactions) between a plurality of companies using account items and transaction information included in the financial statements of individual companies. Configured.

FIG. 1 shows an example of a system configuration for realizing an information processing apparatus 100 according to the first embodiment. The information processing apparatus 100 can be realized by a computer 110 such as a dedicated computer or a personal computer (PC). However, the computer does not need to be physically single, and multiple computers may be used when performing distributed processing. As shown in FIG. 1, a computer 110 has a CPU (Central Processing Unit) 11, a ROM (Read Only Memory) 12 and a RAM (Random Access Memory) 13, which are interconnected via a bus 14. there is Although the explanation of OS software and the like for operating the computer is omitted, it is assumed that the computer that constructs this accounting information processing apparatus also has a computer.

An input/output interface 15 is connected to the bus 14 . An input unit 16 , an output unit 17 , a communication unit 18 and a storage unit 19 are connected to the input/output interface 15 .

The input unit 16 is composed of, for example, a keyboard, mouse, sensor, and the like. The output unit 17 is configured by, for example, a display device such as an LCD and an audio output device such as headphones and speakers. The communication unit 18 is configured by, for example, a router or a terminal adapter. The storage unit 19 is configured by a storage device such as a hard disk or flash memory.

The CPU 11 can perform various processes according to various programs stored in the ROM 12 or various programs loaded from the storage unit 19 to the RAM 13 . In this embodiment, the CPU 11 executes, for example, processing of each unit of the information processing apparatus 100, which will be described later. Separately from the CPU 11, a GPU (Graphics Processing Unit) is provided, and similar to the CPU 11, various processes are performed according to various programs stored in the ROM 12 or various programs loaded from the storage unit 19 to the RAM 13. In this embodiment, For example, the processing of each part of the information processing apparatus 100 described later may be performed.The GPU is suitable for performing routine processing in parallel, and can be applied to processing in a neural network described later. , it is also possible to improve the processing speed compared to the CPU 11. The RAM 13 also stores data necessary for the CPU 11 and GPU to execute various kinds of processing.

The communication unit 18 can perform two-way communication with the server 40 via the network 30 . The communication unit 18 can transmit data provided from the CPU 11 to the server 40 and output data received from the server 40 to the CPU 11, the RAM 13, the storage unit 19, and the like. The communication unit 18 may communicate with other devices using analog signals or digital signals. The storage unit 19 can exchange data with the CPU 11, and stores and erases information.

A drive 20 may be connected to the input/output interface 15 as necessary. A storage medium such as a magnetic disk 21, an optical disk 22, a flexible disk 23, or a semiconductor memory 24 can be appropriately loaded in the drive 20, for example. A computer program read from each storage medium may be installed in the storage unit 19 as necessary. In addition, data necessary for the CPU 11 to execute various types of processing, data obtained as a result of processing by the CPU 11, and the like may be stored in each storage medium as necessary.

Next, the format of learning data used in this embodiment will be described. The learning data DAT according to the present embodiment is in a table format in which various variables including at least company identification information (for example, an ID number) for identifying a company and data values of a plurality of account items are associated. data set. The data value here includes both numerical data and character data (text data). FIG. 2 schematically shows the basic configuration of the learning data DAT according to this embodiment. The learning data DAT is composed of corporate data CPR indicating corporate accounting information, edge information EDG indicating business relationships between companies, and fraud history information UDH indicating whether or not a company has committed fraud. be.

Enterprise data CPR will be described. The company data CPR is configured such that the ID of each company is linked with the information contained in the financial statements and the information indicating the attributes of each company (for example, the interview value of the industry and place of business). . FIG. 3 shows an example of the corporate data CPR according to this embodiment in tabular form. Data values of a plurality of account items, such as company identification information (company ID) and accounting identification information, are arranged in fields associated with one record of the company data CPR, that is, in the column direction of the table. Also, as a matter of course, a plurality of records are arranged in the row direction of the table. As shown in FIG. 3, multiple account identification information can be combined with one company identification information, so multiple records corresponding to one company can be included in the company data CPR.

The company identification information may be text data such as a company name, or numeric data such as an identification number (company ID). In addition, in FIGS. 2 and 3, a company ID is used as company identification information. The company identification information may also include other variables, such as a variable indicating the type of business of the company, as required.

Variables include balance sheet, income statement and cash flow statement items. The variables may also include information other than the balance sheet, income statement, and cash flow statement items.

In other words, each company's record is described as a multi-dimensional vector having various data values as components, and the company data is configured to include a plurality of nodes representing each company described by this multi-dimensional vector. be.

Next, edge information EDG will be described. Of the companies included in the company data CPR according to the present embodiment, two companies having a business relationship are connected by an edge. Therefore, learning data DAT in the learning process described below includes edge information EDG indicating an edge.

An example of edge information EDG will be described. FIG. 4 shows an example of a table showing edge information and nodes and edges based on the edge information. In this example, there are edges from node N1 to nodes N2 to N4, edges from node N2 to nodes N1 and N3, and edges from node N3 to node N4. Based on this table, a network can be configured as a directed graph that reflects the direction of edges or an undirected graph that does not consider the direction of edges.

Further, in the present embodiment, the learning data DAT includes fraud history information UDH indicating that fraud has occurred for each company. The fraud history information UDH may, for example, be aggregated into a specific column, and the aggregated information may be represented as text information such as the name of the fraud type and sentences explaining the fraud. In the fraud history information UDH, information indicating fraud may be summarized in a specific column. The aggregated information may be represented as text information such as the name of the type of fraud and sentences explaining the fraud, and may also be expressed as numerical data such as "1" or "0" and various types of variables such as Boolean variables. may be expressed in the form

For example, in the fraud history information UDH, the presence or absence of fraud may be displayed for each account item. FIG. 5 shows a first example of fraud history information UDH. In the first example, the fraud history information UDH is configured by assigning a value of "1" if there is fraud and "0" if there is no fraud for each account item. .

Further, for example, fraud may be displayed as text data in the fraud history information UDH. FIG. 6 shows a second example of fraud history information UDH. In the second example, the fraud history information UDH is configured by storing text data indicating the fraud type in the "fraud type" column. Note that in this example, if there is no fraud, the "fraud type" column is blank or has no data.

Further, for example, a column may be provided for each fraud type name, and the presence or absence of fraud may be expressed in some identifiable format such as "1" or "0". FIG. 7 shows a second example of fraud history information UDH. In the third example, a column is provided for each type of fraud, and a value of "1" is given when there is fraud corresponding to each column, and a value of "0" is given when there is no fraud. It constitutes the information UDH.

The learning data DAT, and the company data CPR, edge information EDG, and fraud history information UDH that are the basis of the learning data DAT may be stored, for example, in the storage unit 19 shown in FIG. These data may be provided from the server 40 via the network 30 and the communication unit 18, or may be provided from various storage media via the drive 20. FIG.

Next, the configuration and processing of the information processing apparatus 100 will be described. In the present embodiment, information processing apparatus 100 uses the learning data DAT described above to estimate the presence or absence of fraudulent transactions involving two or more companies in a group (cluster) including a plurality of groups. Configured.

FIG. 8 schematically shows the configuration of the information processing apparatus 100 according to the first embodiment. In the information processing apparatus 100, each process is actually realized by cooperation of software and hardware resources such as the CPU 11 on hardware. The information processing apparatus 100 includes at least a clustering processing unit 1, a cluster feature value calculation unit 2, a fraud flag assignment unit 3, and a model construction unit 4 in order to realize processing for creating a trained model for estimating fraudulent transactions. have.

The model building process described below can be executed by the information processing apparatus 100 having the clustering processing unit 1, the cluster feature amount calculation unit 2, the fraud flag adding unit 3, and the model building unit 4. You may add the structure for evaluating. FIG. 9 schematically shows the configuration of an information processing device 101, which is a modification of the information processing device 100. As shown in FIG. The information processing device 101 has a configuration obtained by adding a test processing unit 5 to the information processing device 100 .

Model construction processing and test processing will be described below. FIG. 10 shows a flowchart of processing in the information processing apparatus 100 according to the first embodiment. The information processing apparatus 100 creates and evaluates a learned model for detecting fraudulent transactions by executing the processes of steps S1 to S5 shown in FIG.

Step S1: Clustering Processing The clustering processing section 1 takes in corporate data and performs clustering by unsupervised learning. Step S1 includes steps S11 to S13 below.

Step S11: Read data DAT for learning The clustering processing unit 1 reads data DAT for learning. The learning data DAT may be provided by an operator of the information processing apparatus 100 via input means or communication means, or may be stored in advance in a storage device (for example, the storage section 19 in FIG. 1).

Step S12: Read the Maximum Number of Nodes in Each Cluster In the present embodiment, the clustering processing unit 1 performs clustering using a clustering method capable of limiting the maximum number of nodes included in a cluster. Therefore, the clustering processing unit 1 reads the maximum number of nodes included in the cluster. The maximum number of nodes included in the cluster may be given by the operator of the information processing apparatus 100 as needed, or may be stored in advance in the storage device (for example, the storage unit 19 in FIG. 1).

Step S13: Clustering The clustering processing unit 1 performs clustering by referring to the maximum number of nodes included in the cluster. As a clustering method capable of limiting the maximum number of nodes included in a cluster, for example, the Leiden Algorithm (Non-Patent Document 1) can be used. However, it goes without saying that any method other than the Leiden Algorithm can be appropriately used as long as it is possible to limit the maximum number of nodes included in the cluster. In this method, it is possible to appropriately cluster a network structure composed of nodes and edges.

Step S2: Cluster Feature Amount Calculation The cluster feature amount calculator 2 calculates a feature amount for each node after the clustering process. Step S2 includes steps S21 and S22 below.

Step S21: Feature Amount Calculation of Each Company (Node) The cluster feature amount calculator 2 first calculates a feature amount based on the data of each company included in the learning data DAT. In the present embodiment, nine feature amounts described below are used. FIG. 11 shows an example of the feature amount of each node in tabular form. Specifically, as features, fraud risk score RS, degree centrality DC, eigenvector centrality EC, product DC*RS of degree centrality and fraud risk score, product EC of eigenvector centrality and fraud risk score RS *RS, cluster coefficient CC, local eigenvector centrality EEC, sum of adjacent node degrees CT and group degree centrality GDC shall be used.

To facilitate understanding of the feature amount, FIG. 12 shows an example of a network used for calculating the feature amount. The network of FIG. 12 includes 14 nodes Na1 to Na14, with nodes Na1 to Na5 belonging to cluster C1, nodes Na6 to Na8 belonging to cluster C2, and nodes Na9 to Na14 belonging to cluster C3.

First feature amount: fraud risk score RS
The fraud risk score of each node, that is, the fraud risk score of each individual company, is calculated from company data such as individual financial statements to calculate a fraud risk score RS indicating the risk of various fraudulent transactions. Examples of fraudulent transactions include fraudulent transactions between two companies (for example, forced sales with repurchase conditions), fraudulent transactions involving collusion between several companies (for example, fictitious circular transactions), and fraudulent transactions involving multiple companies. There are large-scale fraudulent transactions involving For the fraud risk score RS, various methods including the method described in Non-Patent Document 2, for example, can be used to calculate the fraud risk score RS.

The fraud risk score RS is associated with each company, and is an index indicating the risk of individual companies committing fraud. However, in order to detect the risk of fraudulent transactions with high accuracy, it may be necessary to consider the relationship between each company and the trading company. Therefore, in the present embodiment, the feature amount described below is introduced.

First, the following second and third features are introduced in order to evaluate how much the focused company plays a central role in the transaction network.

式［１］からわかるように、注目するノードに接続するエッジの数が多いほど、次数中心性ＤＣは大きな値となる。つまり、次数中心性ＤＣは、ネットワーク全体に含まれる企業に対して、着目した企業が直接取引をしている企業の割合を示す指標である。図１２のクラスタＣ２に属するノードＮａ６に注目すると、次数中心性は、４／（１４－１）＝０．３０７６．．．となる。 Second feature quantity: degree centrality DC
The degree centrality DC of each node is calculated based on the number of neighboring nodes of each node, ie, the number of nodes connected to each node by edges. Needless to say, degree centrality DC is a measure for bilateral trading. Assuming that the number of edges connected to the node of interest is ED and the total number of nodes belonging to the network is N, the degree centrality DC of the node of interest is expressed by the following equation.

As can be seen from Equation [1], the greater the number of edges connected to the node of interest, the greater the value of the degree centrality DC. In other words, the degree centrality DC is an index that indicates the proportion of companies with which the focused company has direct transactions with respect to companies included in the entire network. Focusing on node Na6 belonging to cluster C2 in FIG. 12, the degree centrality is 4/(14−1)=0.3076. . . becomes.

成分Ａ_ｉｊの値は、隣接する２つのノードがエッジで直接的に接続されている場合に「１」、隣接する２つのノードがエッジで接続されていない場合に「０」となる。 Third feature quantity: eigenvector centrality EC
The eigenvector centrality EC of each node is calculated by obtaining the maximum eigenvalue and the eigenvector corresponding to the maximum eigenvalue for the adjacency matrix A described below. Needless to say, the eigenvector centrality EC is an index that indicates to what extent a focused company has transactions with companies that have a large number of transactions among companies included in the entire network. The _adjacency matrix A is a square matrix having the same number of rows and columns as the total number of nodes. Needless to say, row number i and column number j are integers of 1 or more and N or less.

The value of the component A _ij is "1" when two adjacent nodes are directly connected by an edge, and "0" when two adjacent nodes are not connected by an edge.

A specific example of an adjacency matrix is shown. FIG. 13 shows the network used to illustrate the adjacency matrix. In this network, there are five nodes, node Nb2 is edge-connected with nodes Nb1, Nb3 and Nb4, and node Nb4 is edge-connected with node Nb5. The adjacency matrix at this time is represented by the following formula.

算出した固有値λから、最大の値を有する固有値λ_ＭＡＸを選択し、最大の固有値λ_ＭＡＸに対応する固有ベクトル（中心性ベクトルとも称する）ｕ_ＭＡＸの各成分ｕ_ｉを、ノードＮＤｉの特徴量である固有ベクトル中心性ＥＣｉとして算出する。例えば、式［３］の隣接行列Ａの最大の固有値λ_ＭＡＸは１．８４７７．．．となり、これに対応する固有ベクトルは、以下の式で表される。

Next, an eigenvector u and an eigenvalue λ that satisfy the following equations are calculated.

From the calculated eigenvalues λ, the eigenvalue λ _MAX having the maximum value is selected, and each component u _i of the eigenvector (also referred to as the centrality vector) u _MAX corresponding to the maximum eigenvalue λ _MAX is used as the feature quantity of the node NDi. It is calculated as the eigenvector centrality ECi. For example, the maximum eigenvalue λ _MAX of the adjacency matrix A in equation [3] is 1.8477. . . , and the corresponding eigenvector is expressed by the following equation.

Next, the following fourth and fifth feature amounts are introduced as indexes considering the fraud risk score and business relationship of the company of interest.

Fourth feature amount: product of degree centrality DC and fraud risk score RS (DC*RS)
For each node, the product DC*RS of the degree centrality DC and the fraud risk score RS is calculated and used as the feature quantity of each node. The product DC*RS of the degree centrality DC and the fraud risk score RS indicates that there are many companies that have direct transactions with the focused company, and if the focused company itself has a high fraud risk, the risk of transaction fraud is also high. indicator.

Fifth feature quantity: product of eigenvector centrality EC and fraud risk score RS (EC*RS)
For each node, the product EC*RS of the eigenvector centrality EC and the fraud risk score RS is calculated and used as the feature quantity of each node. The product EC*RS of the eigenvector centrality EC and the fraud risk score RS is the risk of transaction fraud if the company in question has transactions with companies with a large number of transactions and the company itself has a high fraud risk. It is an index that indicates that it is high.

Next, in order to evaluate how comprehensive a transaction network the focused company and the companies that have business relationships with the focused company constitute, a cluster coefficient, which is the following sixth feature quantity, is introduced.

式［１２］において、分母は、各ノードとエッジで接続される２つの隣接ノード同士をエッジで接続する場合のエッジの最大数（各ノードとエッジで接続される隣接ノードで構成される組み合わせの数）である。したがって、クラスタ係数ＣＣは、２つの隣接ノード同士をエッジで接続する場合のエッジの最大数に対して、実際に２つの隣接ノード同士を接続しているエッジの数の比率と示している。換言すれば、クラスタ係数ＣＣは、各ノードに対応する企業と、これと取引関係を有する企業とが、どれほど密なネットワークを形成しているかを見積る指標として利用することができる。図１２のクラスタＣ２に属するノードＮａ６に注目すると、クラスタ係数は、１／（４＊３／２）＝０．１６６６．．．となる。 Sixth Feature Amount: Clustering Coefficient CC
A cluster coefficient CC is calculated for each node. Let T be the number of triangles containing the node of interest (that is, the number of edges connecting each node and two adjacent nodes connected by an edge), and ED be the degree of the node of interest (the number of connected edges). Then, the cluster coefficient of the node of interest is represented by the following equation.

In Equation [12], the denominator is the maximum number of edges when each node and two adjacent nodes connected by an edge are connected by an edge (the number of combinations composed of each node and adjacent nodes connected by an edge). number). Therefore, the cluster coefficient CC indicates the ratio of the number of edges actually connecting two adjacent nodes to the maximum number of edges connecting two adjacent nodes. In other words, the cluster coefficient CC can be used as an index for estimating how dense a network is formed between the company corresponding to each node and the companies having business relationships with it. Focusing on node Na6 belonging to cluster C2 in FIG. 12, the cluster coefficient is 1/(4*3/2)=0.1666. . . becomes.

Next, we introduce an indicator for detecting fraudulent transactions conducted by collusion of several companies. Fraudulent transactions involving the collusion of several companies, such as fictitious cyclical transactions, are known as frauds related to business relationships between two companies ahead of each other. Local eigenvector centrality, which is a seventh feature quantity, is introduced as an index for detecting such fraudulent transaction relationships between two companies.

Seventh Feature Amount: Local Eigenvector Centrality EEC
The eigenvector centrality EC described above is calculated for the network up to the next node. On the other hand, here, for a local network (Egocentric Network: Egonet), which is a network composed of the node of interest and the one- and two-neighboring nodes, the local eigenvector centrality EEC (Egonet Eigenvector Centrality ) is calculated.

FIG. 14 shows, as an example of a local network, a local network focused on node Na6 in the example of FIG. In this example, a node Na6, nodes Na5, Na7, Na8 and Na9 which are adjacent nodes by one, and nodes Na4, Na10 and Na13 which are adjacent nodes by two constitute a local network. For this local network, an adjacency matrix B composed of elements that are "1" if the node is adjacent and "0" if the node is not adjacent is obtained as follows. For the sake of simplification, the node numbers displayed in rows and columns are only numerals excluding "Na".

算出した固有値λから最大の値を有する固有値λ_ＭＡＸを選択し、最大の固有値λ_ＭＡＸを局所固有ベクトル中心性ＥＥＣとして算出する。この例では、式［７］の隣接行列Ｂの最大の固有値λ_ＭＡＸである２．４６１４．．．が局所固有ベクトル中心性ＥＥＣとして算出される。 Next, an eigenvalue λ that satisfies the following equation is calculated.

The eigenvalue λ _MAX having the maximum value is selected from the calculated eigenvalues λ, and the maximum eigenvalue λ _MAX is calculated as the local eigenvector centrality EEC. In this example, the maximum eigenvalue λ _MAX of the adjacency matrix B in equation [7], 2.4614. . . is computed as the local eigenvector centrality EEC.

Eighth feature quantity: total CT of degrees of adjacent nodes
Calculate the sum CT of degrees of adjacent nodes, that is, the sum of transaction relations (Co Transaction) of adjacent nodes. The sum CT of degrees of adjacent nodes is an index indicating how many companies that directly trade with the focused company do business with other companies. Focusing on the node Na6 belonging to the cluster C2 in FIG. 12, since the degree of the neighboring node Na5 is 2, the degree of the node Na7 is 2, the degree of the node Na8 is 2, and the degree of the node Na9 is 3, the sum of the degrees of the neighboring nodes is CT becomes 2+2+2+3=9.

Step S22: Calculation of Feature Amount of Cluster For each cluster, the average value of each feature amount of the node to which it belongs is calculated, and the calculated average value is used as each feature amount of the cluster of interest. FIG. 15 shows an example of the feature amount of each cluster in tabular form. Here, the mean value is used as the statistic used as the feature quantity, but other statistic such as maximum value, minimum value and median value may be used as necessary.

Further, as the cluster feature amount, the group degree centrality GDC, which is the ninth feature amount, is calculated.

図１２のクラスタＣ１に注目すると、クラスタＣ１のグループ次数中心性ＧＤＣは１／９＝０．１１１１．．．となる。 Ninth feature quantity: group degree centrality GDC
A group degree centrality GDC (Group Degree Centrality) is calculated for each cluster generated by the clustering process, and is used as a feature quantity of a node included in the cluster of interest. Let ED _EXT be the total number of edges connecting nodes included in the cluster of interest and nodes included in clusters other than the cluster of interest, and let _NEXT be the total number of nodes included in clusters other than the cluster of interest. The group degree centrality GDC is calculated using the following formula.

Focusing on cluster C1 in FIG. 12, the group degree centrality GDC of cluster C1 is 1/9=0.1111. . . becomes.

step S3
The fraud flag assigning unit 3 assigns flags to clusters including nodes that have been fraudulent in the past. Specifically, as shown in FIG. 15, the fraud flag assigning unit 3 sets the fraud flag of clusters containing nodes that have been fraudulent in the past to "1", and the fraud flags of clusters that do not contain nodes that have been fraudulent. to '0'. For the fraud flag, a column indicating fraud history information included in the learning data DAT is referred to. If there is fraud, "1" is given as the fraud flag, and if there is no fraud, "0" is given as the fraud flag. It may be represented by numerical data, such as giving If there are multiple columns corresponding to the fraud history information, the fraud flag "1" may be given if all of the referenced columns indicate that fraud has occurred. A fraud flag "1" may be given if it indicates that there is fraud. Note that the data format of the illegality flag is not limited to numerical data, and may be expressed in various formats such as a Boolean variable, for example.

Step S4: Model Construction The model construction unit 4 constructs a learned model using the feature amount of each cluster as an explanatory variable and the fraud flag as an objective variable. Here, in order to construct the process f indicating the trained model, the trained model is constructed using logistic regression, for example. Note that not only logistic regression but also various supervised learning methods such as random forest and support vector regression can be appropriately used for building a trained model. Step S4 includes steps S40 to S45 below.

Step S40: Initial value setting for the number of times of processing "1" is set as the initial value of the number of times of processing NUM.

Step S41: Node Extraction A certain percentage of clusters are extracted from clusters with fraud flags of “1” and a certain percentage of clusters are extracted from clusters with fraud flags of “0”, and the extracted clusters are used for learning. Used as data. The remaining clusters are used as test data. In this embodiment, as an example, the fixed ratio is 70%. However, the fixed ratio value is not limited to 70%, and may be any ratio.

Step S42: Standardization of Feature Quantity of Learning Data For the learning data, the feature quantity of each cluster is standardized. Here, the number of feature amounts included in each cluster is M (M=9 in the above example), each feature amount included in the cluster is x _k (k is an integer from 1 to M), and the extracted cluster Let x _{k_AVE} be the average value of the feature quantity x _k of , and let σ _xk be the standard deviation of the extracted feature quantity x _k . At this time, the standardized feature quantity x _ks is represented by the following formula.

Step S43: Exclusion of Feature Amounts from Learning Data A correlation CRR is calculated for all combinations of two feature amounts selected from the standardized feature amounts _{x1s to} x9s. Then, when the correlation CRR is greater than the predetermined value TH, one of the two selected feature amounts is excluded from the learning data. In this embodiment, for example, the predetermined value TH is set to 0.9. In this case, if the correlation between the standardized feature quantity x _5s and the standardized feature quantity x _9s is 0.95, the standardized feature quantity x _9s is excluded from the learning data.

Step S44: Weight Calculation In the next step S45, weights to be given to data are calculated in order to perform learning processing by weighted logistic regression. Here, when n is the total number of extracted clusters, n ₁ is the number of clusters with the fraud flag of “1”, and n ₀ is the number of clusters with the fraud flag of “0”, the number of clusters with the fraud flag of “1” is n/2n ₁ is calculated as the weight for the standardized feature amount, and n/2n ₀ is calculated as the weight for the standardized feature amount of the cluster whose fraud flag is "0".

ここでは、式［１１］から、式［１２］に示す対数尤度ｌｏｇＬを用いる。

ここで、式［１２］の左辺にステップＳ４４で算出した式［１３］に示す重みｗ_ｉを乗じて、式［１２］を式［１４］に変換する。

Step S45: Learning Process As described above, a trained model is constructed using the learning data, for example, by logistic regression. Here, the fraud flag of each cluster included in n clusters is y _i (i is an integer from 1 to n), and the probability that the fraud flag is “1” in each cluster is p _i (0<pi< 1). Assuming that events to which fraud flags are assigned in each cluster are independent, the likelihood L, which is the probability of obtaining a permutation consisting of n fraud flags respectively assigned to n clusters in step S3, is expressed by the following equation: is represented by

Here, the logarithmic likelihood logL shown in Equation [12] is used from Equation [11].

Here, the left side of the equation [12] is multiplied by the weight _wi shown in the equation [13] calculated in step S44 to transform the equation [12] into the equation [14].

式［１５］において、特徴量ｘ_ｉ＿ｋは、ｉ番目のクラスタのｋ番目の特徴量を示している。 As described above, since logistic regression is performed in this embodiment, the probability p _i that the fraud flag is "1" is expressed by the following equation.

In Equation [15], the feature quantity x _{i_k} indicates the k-th feature quantity of the i-th cluster.

A trained model can be constructed by performing regression analysis under the above conditions and finding β ₀ to β _n that maximize the logarithmic likelihood logL.

Step S5: Test The test processing unit 5 tests the trained model according to the following procedure. Here, it is assumed that the test is repeated 100 times in the following procedure.

Step S51: Exclusion of feature amount from test data The feature amount excluded in step S43 is similarly excluded from the test data.

Step S52: Standardization of Feature Quantity of Test Data For the test data, the feature quantity of each cluster is standardized as in the case of the learning data. Here, the number of feature amounts included in each cluster after exclusion processing is m (m is an integer of M or less), and each feature amount included in each cluster is y _k (k is an integer of 1 or more and m or less) and At this time, the standardized feature amount y _ks is represented by the following formula.

Step S53: Result output A cluster having the standardized feature amount of the test data is input to the trained model, and the result is obtained.

Step S54: AUC calculation Output results are compared with the actual fraud flag attached to the input node to obtain an ROC (Receiver Operating Characteristic) curve, and AUC (Area Under Curve) is calculated using the ROC curve. do.

Briefly describe the ROC curve and AUC. FIG. 16 shows an example of the ROC curve and AUC. A ROC curve is a curve corresponding to the locus of points defined as the true positive rate and the false positive rate. The vertical axis of the ROC curve is the true positive rate (True Positive Rate), and corresponds to the area surrounded by the solid line P and the horizontal axis indicating positive in the range above the threshold set on the horizontal axis of the detection result. . The horizontal axis of the ROC curve is the false positive rate (False Positive Rate), and corresponds to the area of the portion surrounded by the dashed line N indicating negative in the range above the threshold set on the horizontal axis of the prediction result and the horizontal axis. .

As an example, a threshold TH is set on the horizontal axis of the ROC curve, and a point P on the ROC curve corresponding to the threshold TH is shown. The true positive rate (True Positive Rate) TPR1 at the point P is the portion surrounded by the solid line P and the horizontal axis indicating positive in the range above the threshold TH set on the horizontal axis of the detection result (thin hatched part). The false positive rate (False Positive Rate) FPR1 at the point P is the portion surrounded by the dashed line N indicating negative in the range above the threshold TH set on the horizontal axis of the detection result and the horizontal axis (thick hatched part).

AUC is the area of the portion (hatched portion) below the ROC curve. In general, the value of AUC is 0.5 when the occurrence of events is random, and approaches 1 as the accuracy of predicting the occurrence and non-occurrence of events increases.

Step S55: Update number of tests Increase the number of tests NUM by one.

Step S56: Termination Judgment If the test count NUM is less than 100, the process returns to step S41. If the test count NUM is 100, the process ends.

By repeating the above steps S41 to S45 and S51 to S56, the clusters included in the learning data and the clusters in the test data can be re-extracted for each test, and the test can be repeated. As a result, variations due to cluster extraction are averaged, and the model can be evaluated with higher accuracy.

Note that the number of tests is only an example, and the number of tests may be less than 100 or more than 100.

Next, an example of performance evaluation will be described. In this embodiment, the maximum value of the nodes belonging to the cluster in the clustering in step S1 was changed to three levels of 1000, 500 and 100, and the performance evaluation results were compared. In the following description, when a cluster with one node is generated as a result of clustering, that cluster is excluded.

Evaluation case A
In evaluation case A, the maximum number of nodes belonging to a cluster in the clustering in step S1 was set to 1,000. Under this condition, the number of clusters with the fraud flag "1" is 2522, and the number of clusters with the fraud flag "0" is 47. This data was tested 100 times and the AUC was calculated. As a comparative example of test results using test data, AUC was also calculated when learning data was input to the constructed model.

FIG. 17 shows the acceptance rate of each feature amount in the evaluation case A. In FIG. In this example, among the nine feature quantities, the group degree centrality GDC was never adopted, and the eigenvector centrality EC was rarely adopted (with a probability of several percent). The other seven features were adopted 100%.

FIG. 18 shows AUC when learning data is used and AUC when test data is used in evaluation case A. In FIG. In this example, the average AUC value for the learning data was 0.798, and the average AUC value for the test using the test data was 0.772. The AUC of the test data generally fluctuates between 0.7 and 0.8, confirming that fraudulent transactions within a cluster can be detected with high accuracy.

Evaluation case B
In evaluation case B, the maximum number of nodes belonging to a cluster was set to 500 in clustering in step S1. Under this condition, the number of clusters with the fraud flag "1" is 4695, and the number of clusters with the fraud flag "0" is 49. Similar to evaluation case A, this data was tested 100 times using learning data and test data, and AUC was calculated.

FIG. 19 shows the acceptance rate of each feature amount in the evaluation case B. In FIG. In this example, among the nine features, the group degree centrality GDC was never adopted, and the other eight features were adopted 100%.

FIG. 20 shows AUC when learning data is used and AUC when test data is used in evaluation case B. In FIG. In this example, the average AUC value when using the learning data was 0.778, and the average AUC value in the test using the test data was 0.730. The AUC of the test data generally fluctuated between 0.7 and 0.8, and it was confirmed that even in the evaluation case B, fraudulent transactions within the cluster could be detected with high accuracy.

Evaluation case C
In evaluation case C, the maximum number of nodes belonging to a cluster in the clustering in step S1 was set to 100. Under this condition, the number of clusters with the fraud flag "1" is 20296, and the number of clusters with the fraud flag "0" is 55. Similar to evaluation cases A and B, this data was tested 100 times using learning data and test data, and AUC was calculated.

FIG. 21 shows the acceptance rate of each feature amount in evaluation case C. In FIG. In this example, among the nine features, the group degree centrality GDC was never adopted, and the other eight features were adopted 100%.

FIG. 22 shows AUC when learning data is used and AUC when test data is used in evaluation case C. In FIG. In this example, the average AUC value in the case of using the learning data was 0.714, and the average AUC value in the test using the test data was 0.761. The AUC of the test data generally fluctuates between 0.6 and 0.7, confirming that the accuracy of fraudulent transactions has declined compared to evaluation cases A and B.

Comparing the evaluation cases A to C, it can be understood that if the maximum value of the nodes belonging to the cluster is made too small, the fraudulent transaction detection accuracy is lowered. From the above test results, it can be inferred that by setting the maximum number of nodes belonging to a cluster to at least about several hundred, preferably 500 or more, it is possible to achieve good fraudulent transaction detection accuracy.

Therefore, in order to realize the detection accuracy of fraudulent transactions, in order to study what value is suitable for the maximum value of the nodes belonging to the cluster, the fluctuation of AUC when the maximum value of the nodes belonging to the cluster is changed is calculated as follows. Observed. FIG. 23 shows the relationship between the maximum value of nodes belonging to a cluster and AUC. Here, the maximum number of nodes belonging to a cluster was varied within a range of 100 to 25000. Specifically, the maximum number of nodes belonging to a cluster was changed to 100, 500, and 1000, and in the range of 1000 to 25000, it was changed in increments of 1000.

As a result, in the range of 5000 to 20000 maximum nodes belonging to a cluster, the AUC value tended to stabilize at a high value of about 0.87 to 0.90.

As described above, according to this configuration, it is possible to estimate the risk of fraudulent transactions involving a plurality of nodes (companies) in a cluster, which is difficult only by estimating the fraud risk of individual companies. This makes it possible to suitably estimate the risk of fraudulent transactions involving multiple companies, such as circular transactions.

Embodiment 2
An information processing apparatus according to the second embodiment will be described. In the first embodiment, construction of a trained model for detecting fraudulent transactions using account items and transaction information included in financial statements of individual companies has been described. In the present embodiment, the built trained model is used to input input data indicating the information of the company to be analyzed into the trained model, thereby estimating the risk of fraud by the company to be analyzed. explain.

FIG. 24 schematically shows the configuration of an information processing apparatus 200 according to the second embodiment. The information processing device 200 has a configuration in which the test processing unit 5 of the information processing device 100 according to the first embodiment is replaced with an estimation processing unit 6 .

As described in the first embodiment, the model construction unit constructs the learned model MD. After that, the trained model MD is passed to the estimation processing section 6 . The trained model MD may be stored, for example, in a storage unit provided in the estimation processing unit 6, or may be stored in a storage unit provided separately from the estimation processing unit 6, and the estimation processing unit 6 is not necessary. The learned model MD may be read accordingly. As these storage units, appropriately available storage means such as the storage unit 19 shown in FIG. 1 can be used.

The estimation processing unit 6 receives input data IN indicating information about a company whose fraud risk is to be analyzed. The data format of the input data IN includes, for example, the above-described company data and edge information. By inputting the input data IN to the trained model MD, the estimation processing unit 6 outputs the output data OUT which is information indicating the risk of the target company committing fraud, for example, the probability of the target company committing fraud. A user of the information processing apparatus 200 can recognize the risk of fraudulent conduct by the target company by referring to the output data OUT.

Note that the information processing apparatus according to this embodiment may have the test processing unit 5 of the information processing apparatus 101 . FIG. 25 schematically shows the configuration of an information processing device 201 that is a modification of the information processing device 200. As shown in FIG. By providing the test processing unit 5, as described in the first embodiment, it is possible to perform an estimation process using a verified learned model.

Note that the estimation process described above can also be performed using a trained model MD constructed by an information processing apparatus different from the information processing apparatus that performs the estimation process. FIG. 26 schematically shows the configuration of an information processing device 210 which is a modification of the information processing device according to the second embodiment. The information processing device 210 has a model storage unit 7 and an estimation processing unit 6 .

The model storage unit 7 stores a learned model MD constructed by, for example, the information processing apparatus 100, which is different from the information processing apparatus 210. FIG. The learned model MD is provided to the information processing device 210 from a different external information processing device via a communication line, a storage medium, or the like, and stored in the model storage unit 7 . As the model storage unit 7, it is possible to use appropriately available storage means such as the storage unit 19 shown in FIG.

As with the information processing apparatus 200 , the estimation processing unit 6 receives input data IN indicating information about a company whose risk of fraud is to be analyzed. By inputting the input data IN to the trained model MD, the estimation processing unit 6 similarly outputs the output data OUT, which is information indicating the risk of the target company committing fraud, for example, the probability of the target company committing fraud. can be done.

According to the information processing device 210, the estimation process can be performed by appropriately using a trained model constructed by another information processing device that is a model construction device. Accordingly, when there are a plurality of other information processing apparatuses, it is possible to receive provision of a trained model suitable for estimation processing from an appropriate information processing apparatus. In addition, the estimation process can be performed at a desired location without depending on the installation position of the information processing device that constructs the model.

Other Embodiments The present invention is not limited to the above-described embodiments, and can be modified as appropriate without departing from the scope of the invention. For example, the contents and items (account items) of financial statements included in the training data, and the items of attribute information (for example, industry and business location) may be all of the obtained items. It goes without saying that some items may be included that are selected according to.

The processing executed by the information processing apparatus according to the above embodiments may be implemented using a semiconductor processing apparatus including an ASIC (Application Specific Integrated Circuit). Also, these processes may be realized by causing a computer system including at least one processor (eg microprocessor, CPU, GPU, MPU, DSP (Digital Signal Processor)) to execute a program. Specifically, one or a plurality of programs containing a group of instructions for causing a computer system to execute algorithms relating to these transmission signal processing or reception signal processing may be created, and the programs may be supplied to the computer.

These programs can be stored and delivered to computers using various types of non-transitory computer readable media. Non-transitory computer-readable media include various types of tangible storage media. Examples of non-transitory computer-readable media include magnetic recording media (eg, flexible discs, magnetic tapes, hard disk drives), magneto-optical recording media (eg, magneto-optical discs), CD-ROMs (Read Only Memory), CD-Rs, CD-R/W, semiconductor memory (eg, mask ROM, PROM (Programmable ROM), EPROM (Erasable PROM), flash ROM, RAM (random access memory)). The program may also be delivered to the computer on various types of transitory computer readable medium. Examples of transitory computer-readable media include electrical signals, optical signals, and electromagnetic waves. Transitory computer-readable media can deliver the program to the computer via wired channels, such as wires and optical fibers, or wireless channels.

REFERENCE SIGNS LIST 1 clustering processing unit 2 cluster feature quantity calculation unit 3 fraud flag assignment unit 4 model construction unit 5 test processing unit 6 estimation processing unit 7 model storage unit 11 CPU
12 ROMs
13 RAM
14 bus 15 input/output interface 16 input unit 17 output unit 18 communication unit 19 storage unit 20 drive 21 magnetic disk 22 optical disk 23 flexible disk 24 semiconductor memory 30 network 40 server 100, 101, 200, 201, 210 information processing device 110 computer CPR Corporate data EDG Edge information DAT Learning data IN Input data MD Trained model UDH Fraud history information

Claims (13)

Multiple variables that indicate the values of multiple account items included in each company's financial statements, in which each company's information is represented by a multidimensional vector, each company's attribute information, and information that indicates whether each company has committed fraud and information indicating business relationships between companies, and perform clustering so that the number of nodes included in one cluster is equal to or less than a predetermined value, and the nodes corresponding to each cluster. A clustering processing unit that performs a clustering process for acquiring a network structure composed of edges that indicate a business relationship between
a feature amount calculation unit that calculates the feature amount of each node belonging to each cluster included in the data after the crystalling process , and calculates the feature amount of each cluster based on the calculated feature amount;
a fraud flag assigning unit that assigns a fraud flag to a cluster based on information indicating whether or not a node belonging to each cluster has performed fraud;
a model building unit that acquires a trained model by performing supervised learning on the data to which the fraud flag is assigned, with the feature quantity as an explanatory variable and the fraud flag as an objective variable;
Information processing equipment. The feature amount of each cluster is calculated based on the statistics of the feature amount of the cluster,
The information processing device according to claim 1 . the statistic is a mean, maximum, minimum or median;
The information processing apparatus according to claim 2. The feature of each node is
the risk score of each company corresponding to each node;
degree centrality of each node and
Eigenvector centrality of each node and
a product of the risk score and the degree centrality of each node;
a product of the eigenvector centrality and the degree centrality of each node;
the cluster coefficient of each node, and
local eigenvector centrality, which is the eigenvector centrality calculated in the network from each node to two adjacent nodes connected to each node by edges;
sum of degrees of adjacent nodes to each node, and
The information processing apparatus according to any one of claims 1 to 3. The features of each cluster are the risk score of each node, the degree centrality, the eigenvector centrality, the product of the risk score and the degree centrality, the product of the eigenvector centrality and the degree centrality, the a value calculated based on each statistic of the cluster coefficient, the local eigenvector centrality, and the sum of the degrees;
Group degree center, which is a value obtained by dividing the total number of edges connecting nodes included in a cluster of interest and nodes included in clusters other than the cluster of interest by the total number of nodes included in clusters other than the cluster of interest including sex and
The information processing apparatus according to claim 4. The model construction unit extracts clusters to which fraud flags are attached at a predetermined ratio from the clusters included in the data to which the fraud flags are assigned, and randomly extracts clusters to which fraud flags are not attached at the predetermined ratio. learn what is extracted in
further comprising a test processing unit for inputting test data consisting of clusters not extracted from the clusters included in the data to which the fraud flag is attached to the trained model, and calculating an evaluation index of transaction fraud detection accuracy. ,
The information processing apparatus according to any one of claims 1 to 5. By performing the processing by the clustering processing unit, the feature amount calculation unit, the fraud flag assignment unit, the model construction unit, and the test processing unit a plurality of times while changing the predetermined value, a plurality of Calculate the first evaluation index of
wherein the test processing unit determines the predetermined value based on the plurality of first evaluation indices;
The information processing device according to claim 6 . calculating a plurality of second evaluation indices by repeating the processing by the model construction unit and the test processing unit a plurality of times for one of the predetermined values;
wherein the test processing unit calculates statistics of the plurality of second evaluation indices as the second evaluation index corresponding to the one predetermined value;
The information processing device according to claim 6 . The statistic of the plurality of second evaluation indicators is an average value, maximum value, minimum value or median value,
The information processing apparatus according to claim 8 . It includes multiple variables that indicate the values of multiple account items included in each company's financial statements, in which information about each company is represented by a multidimensional vector, information that indicates the attribute information of each company, and information that indicates the business relationships between companies. further comprising an estimation processing unit that reads the input data that is received, inputs the input data to the trained model, and estimates whether the company corresponding to the input data has committed fraud;
The information processing apparatus according to any one of claims 1 to 9. A clustering processing unit obtains multiple variables representing the values of multiple account items included in the financial statements of each company in which the information of each company is represented by a multidimensional vector, attribute information of each company, and whether each company has committed fraud. Read learning data containing information indicating whether or not, and information indicating the business relationship between companies, and perform clustering so that the number of nodes included in one cluster is a predetermined value or less. Perform clustering processing to acquire a network structure composed of corresponding nodes and edges indicating transaction relationships between nodes,
A feature amount calculation unit calculates the feature amount of each node belonging to each cluster included in the data after the crystalling process , calculates the feature amount of each cluster based on the calculated feature amount,
a fraudulent flag assigning unit assigning an fraudulent flag to each cluster based on information indicating whether or not a node belonging to each cluster has committed fraud;
A model construction unit acquires a trained model by performing supervised learning using the data to which the fraud flag is assigned as learning data, the feature amount as an explanatory variable, and the fraud flag as an objective variable,
Information processing methods. Each company's information is represented by a multidimensional vector whose components are multiple variables that indicate the values of multiple account items included in each company's financial statements, and information that indicates whether each company has committed fraud. , input data including enterprise data including the plurality of multidimensional vectors corresponding to the plurality of enterprises, and information indicating the business relationships of the plurality of enterprises, and a predetermined number of nodes included in one cluster. a clustering process for clustering so as to be equal to or less than the value, and obtaining a network structure composed of nodes corresponding to each cluster and edges indicating transaction relationships between the nodes;
A process in which the feature amount calculation unit calculates the feature amount of each node belonging to each cluster included in the data after the crystalling process , and calculates the feature amount of each cluster based on the calculated feature amount;
a process in which the fraud flag assigning unit assigns an fraud flag to the cluster based on the information indicating whether or not the node belonging to each cluster has committed fraud;
a process in which the model construction unit acquires a trained model by performing supervised learning using the data to which the fraud flag is assigned as learning data, the feature quantity as an explanatory variable, and the fraud flag as an objective variable; to run
program. Multiple variables that indicate the values of multiple account items included in each company's financial statements, in which each company's information is represented by a multidimensional vector, each company's attribute information, and information that indicates whether each company has committed fraud and information indicating business relationships between companies, and perform clustering so that the number of nodes included in one cluster is equal to or less than a predetermined value, and the nodes corresponding to each cluster. A clustering processing unit that performs clustering processing to obtain a network structure composed of edges that indicate business relationships between clustering processing units; a feature amount calculation unit that calculates the feature amount of each cluster based on the feature amount obtained; and a fraud flag that assigns a fraud flag to the cluster based on information indicating whether or not the node belonging to each cluster has committed the fraud. and a model construction unit that acquires a trained model by performing supervised learning on the data to which the fraud flag is assigned, using the feature quantity as an explanatory variable and the fraud flag as an objective variable. a model repository that holds the model acquired by the device;
It includes multiple variables that indicate the values of multiple account items included in each company's financial statements, in which information about each company is represented by a multidimensional vector, information that indicates the attribute information of each company, and information that indicates the business relationships between companies. an estimation processing unit that reads the input data received, inputs the input data to the trained model, and estimates whether the company corresponding to the input data has committed fraud;
Information processing equipment.

Images