KR102620870B1 - Method, system and non-transitory computer-readable recording medium for monitoring abnormal transactions - Google Patents

Abstract

According to one aspect of the present invention, as a method for monitoring abnormal transactions, information on the available-for-sale balance of the trader node is generated by referring to the asset transaction history of the trader node, and information on the available-for-sale balance is generated for the trader node by referring to the available-for-sale balance information. determining whether an abnormal transaction has occurred, allowing the trader node to verify the decision to generate primary verification information, and responding to the occurrence of a monitoring trigger for the primary verification information. A method is provided that includes the steps of transmitting the primary verification information to a monitoring node and having the monitoring node perform verification on the primary verification information to generate secondary verification information.

Description

Method, system and non-transitory computer-readable recording medium for monitoring abnormal transactions {METHOD, SYSTEM AND NON-TRANSITORY COMPUTER-READABLE RECORDING MEDIUM FOR MONITORING ABNORMAL TRANSACTIONS}

The present invention relates to a method, system, and non-transitory computer-readable recording medium for monitoring unusual transactions.

A representative example of abnormal transactions that can occur during asset trading is naked short selling. Unlevered short selling refers to selling assets without borrowing the target assets, and is prohibited in most countries, including Korea.

All abnormal transactions, including non-leveraged short selling, need to be monitored to determine whether they occur during the asset trading process, but the problem is that there are currently significant limitations in the supervisory agency's ability to detect abnormal transactions by constantly checking investors' balances. .

The purpose of the present invention is to solve all the problems of the prior art described above.

In addition, another purpose of the present invention is to quickly and accurately monitor abnormal transactions by identifying information on the sellable balance of a trader node by time or event.

Another purpose of the present invention is to support more efficient management of the overall audit process (audit life cycle).

A representative configuration of the present invention to achieve the above object is as follows.

According to one aspect of the present invention, as a method for monitoring abnormal transactions, information on the available-for-sale balance of the trader node is generated by referring to the asset transaction history of the trader node, and information on the available-for-sale balance is generated for the trader node by referring to the available-for-sale balance information. determining whether an abnormal transaction has occurred, allowing the trader node to verify the decision to generate primary verification information, and responding to the occurrence of a monitoring trigger for the primary verification information. A method is provided that includes the steps of transmitting the primary verification information to a monitoring node and having the monitoring node perform verification on the primary verification information to generate secondary verification information.

According to another aspect of the present invention, there is a system for monitoring abnormal transactions, which generates information on the available-for-sale balance of the trader node by referring to the asset transaction history of the trader node, and sends the information to the trader node by referring to the available-for-sale balance information. A trader node management unit that determines whether an abnormal transaction has occurred and causes the trader node to verify the decision to generate primary verification information, and a monitoring trigger for the primary verification information is generated. In response, a system is provided that includes a monitoring node manager that causes the primary verification information to be transmitted to the monitoring node and causes the monitoring node to perform verification of the primary verification information to generate secondary verification information. .

In addition, another method for implementing the present invention, another system, and a non-transitory computer-readable recording medium for recording a computer program for executing the method are further provided.

According to the present invention, it is possible to quickly and accurately monitor abnormal transactions by identifying the sellable balance information of the trader node by time or event.

Additionally, according to the present invention, the overall audit process (audit life cycle) can be managed more efficiently.

1 is a diagram showing a schematic configuration of an entire system for monitoring abnormal transactions according to an embodiment of the present invention.
Figure 2 is a diagram illustrating in detail the internal configuration of a monitoring system according to an embodiment of the present invention.

The detailed description of the present invention described below refers to the accompanying drawings, which show by way of example specific embodiments in which the present invention may be practiced. These embodiments are described in sufficient detail to enable those skilled in the art to practice the invention. It should be understood that the various embodiments of the present invention are different from one another but are not necessarily mutually exclusive. For example, specific shapes, structures and characteristics described herein may be implemented with changes from one embodiment to another without departing from the spirit and scope of the invention. Additionally, it should be understood that the location or arrangement of individual components within each embodiment may be changed without departing from the spirit and scope of the present invention. Accordingly, the detailed description described below is not to be taken in a limiting sense, and the scope of the present invention should be taken to encompass the scope claimed by the claims and all equivalents thereof. Like reference numbers in the drawings indicate identical or similar elements throughout various aspects.

Assets referred to in this specification are a concept that collectively refers to financial assets (e.g., securities), non-financial assets (e.g., real estate), and other assets (e.g., virtual currency, points, mileage, etc.), It should be understood in the broadest sense, encompassing all objects with economic value.

In addition, the asset trading platform referred to in this specification may mean a platform built to trade assets electronically, such as a lending and lending platform, a financial trading platform, an over-the-counter trading platform, and a virtual currency trading platform.

In addition, the sellable balance information referred to in this specification may mean the sellable quantity, where the sellable quantity includes net holding balance, loan balance, loan contract, and other (scheduled delivery, scheduled to be concluded, redemption, recall quantity and rights relations) ) It can mean a quantity that reflects the details.

Additionally, the abnormal transaction referred to in this specification may be a concept that encompasses all abnormal transactions that may occur during the asset trading process, including unleveraged short selling.

Hereinafter, several preferred embodiments of the present invention will be described in detail with reference to the attached drawings in order to enable those skilled in the art to easily practice the present invention.

Configuration of the entire system

1 is a diagram showing a schematic configuration of an entire system for monitoring abnormal transactions according to an embodiment of the present invention.

As shown in FIG. 1, the entire system according to an embodiment of the present invention may include a communication network 100, a monitoring system 200, and a device 300.

First, the communication network 100 according to an embodiment of the present invention can be configured regardless of communication mode, such as wired communication or wireless communication, and can be used as a local area network (LAN) or a metropolitan area network (MAN). ), and a wide area network (WAN). Preferably, the communication network 100 referred to in this specification may be the known Internet or World Wide Web (WWW). However, the communication network 100 is not necessarily limited thereto and may include at least a portion of a known wired or wireless data communication network, a known telephone network, or a known wired or wireless television communication network.

For example, the communication network 100 is a wireless data communication network, including WiFi communication, WiFi-Direct communication, Long Term Evolution (LTE) communication, 5G communication, and Bluetooth communication (Bluetooth Low Energy (BLE). It may implement, at least in part, conventional communication methods such as (including Bluetooth Low Energy) communication, infrared communication, ultrasonic communication, etc. For another example, the communication network 100 is an optical communication network and may implement at least a portion of a conventional communication method such as LiFi (Light Fidelity).

Next, the monitoring system 200 according to an embodiment of the present invention can communicate with the device 300, which will be described later, through the communication network 100, and sell the trader node by referring to the asset transaction history of the trader node. Generate available balance information, determine whether an abnormal transaction occurred by the trader node by referring to the available sell balance information, and have the trader node verify the above decision so that primary verification information is generated, A function that causes the primary verification information to be transmitted to the monitoring node in response to the occurrence of a monitoring trigger for the primary verification information, and has the monitoring node perform verification of the primary verification information to generate secondary verification information. can be performed. Meanwhile, this monitoring system 200 may be a digital device equipped with a memory means and equipped with a microprocessor and has computing capabilities. For example, it may be a server system operated on the communication network 100.

The configuration and function of the monitoring system 200 according to an embodiment of the present invention will be discussed in detail through the detailed description below.

Next, the device 300 according to an embodiment of the present invention is a digital device that includes a function that can communicate after connecting to the monitoring system 200, such as a smartphone, tablet, smart watch, smart band, or smart glasses. Any digital device equipped with a memory means and equipped with a microprocessor, such as a desktop computer, a laptop computer, a workstation, a PDA, a web pad, a mobile phone, etc., and has computing power can be adopted as the device 300 according to the present invention. there is.

Additionally, according to one embodiment of the present invention, the device 300 may further include an application program for performing functions according to the present invention. These applications may exist in the form of program modules within the device 300. The nature of this program module may be generally similar to the trader node management unit 210, monitoring node management unit 220, communication unit 230, and control unit 240 of the monitoring system 200, which will be described later. Here, at least part of the application may be replaced with a hardware device or firmware device that can perform substantially the same or equivalent functions as necessary.

Configuration of the monitoring system

Below, we will look at the internal configuration of the monitoring system 200 and the function of each component, which performs important functions for implementing the present invention.

FIG. 2 is a diagram illustrating in detail the internal configuration of the monitoring system 200 according to an embodiment of the present invention.

As shown in Figure 2, the monitoring system 200 according to an embodiment of the present invention may include a trader node management unit 210, a monitoring node management unit 220, a communication unit 230, and a control unit 240. . According to one embodiment of the present invention, at least some of the trader node management unit 210, monitoring node management unit 220, communication unit 230, and control unit 240 of the monitoring system 200 are connected to an external system (not shown). It may be a program module that communicates with These program modules may be included in the monitoring system 200 in the form of an operating system, application program module, or other program module, and may be physically stored in various known storage devices. Additionally, these program modules may be stored in a remote memory device capable of communicating with the monitoring system 200. Meanwhile, such program modules include, but are not limited to, routines, subroutines, programs, objects, components, data structures, etc. that perform specific tasks or execute specific abstract data types according to the present invention.

Meanwhile, although the monitoring system 200 has been described as above, this description is illustrative, and at least some of the components or functions of the monitoring system 200 are stored in the device 300 or the server (not shown) as needed. It is obvious to those skilled in the art that it may be realized in or included in an external system (not shown).

First, the trader node management unit 210 according to an embodiment of the present invention may generate sellable balance information of the trader node by referring to the asset transaction history of the trader node.

For example, the trader node management unit 210 according to an embodiment of the present invention records the details of asset transactions concluded by the trader node with other trader nodes from the asset trading platform (the details are based on a standardized frame (or format)). By combining the details of these asset transactions, information on the sellable balance of the trader node can be generated.

Here, the trader node management unit 210 according to an embodiment of the present invention may generate sellable balance information based on at least one of a time unit and an event occurrence unit. For example, the trader node management unit 210 according to an embodiment of the present invention may generate sellable balance information on a time basis, that is, on a second basis, and the event occurrence unit, that is, the trader node may trade assets with other trader nodes. It can also be created each time a contract is concluded. However, it should be noted that the time unit or event occurrence unit for generating available-for-sale balance information is not necessarily limited to the above example, and may be changed in various ways within the scope of achieving the purpose of the present invention.

Continuing, the trader node management unit 210 according to an embodiment of the present invention determines whether an abnormal transaction occurred by the trader node (or whether an abnormal transaction occurred by the trader node) by referring to the sellable balance information generated as above. can be extracted. For example, the trader node management unit 210 according to an embodiment of the present invention compares the sellable balance information and the short sell order quantity information (the information may include short sell order submission time information) to determine the non-borrowed price by the trader node. It is possible to determine whether short selling has occurred.

In addition, the trader node management unit 210 according to an embodiment of the present invention verifies the above decision on the trader node side when it is determined that an abnormal transaction has occurred or has not occurred, that is, whether an abnormal transaction has occurred. Verification (or pre-audit) can be performed to generate primary verification information. Specifically, the trader node management unit 210 according to an embodiment of the present invention may allow the trader node, which is a party to the asset transaction, to verify whether an abnormal transaction has occurred on a predetermined time basis, for example, on a daily basis, and the trader The node can generate primary verification information by verifying whether an abnormal transaction has occurred. Meanwhile, the trader node management unit 210 according to an embodiment of the present invention may designate a manager node and have the manager node verify whether an abnormal transaction has occurred, where the manager node is different from the trader node. It may correspond to a separate node, or if a trader node is a concept that includes multiple nodes, it may correspond to a specific node included in the trader node. According to one embodiment of the present invention, these manager nodes may be stakeholders in asset transactions concluded by trader nodes, and may be designated differently each time verification is required.

According to one embodiment of the present invention, the trader node (or manager node) that generated the first verification information can group the first verification information and the available-for-sale balance information that is the basis for generating the first verification information, as described later. The above grouped information can be kept (or stored) in the database until a monitoring trigger occurs. According to one embodiment of the present invention, primary verification information (or grouped information) may be generated based on a standardized frame (or format), and accordingly, primary verification information (or grouped information) is as described later. It can be stored in a state ready for immediate transmission in response to the occurrence of a monitoring trigger.

Next, the monitoring node management unit 220 according to an embodiment of the present invention may cause the primary verification information to be transmitted to the monitoring node in response to the occurrence of a monitoring trigger for the primary verification information.

For example, a monitoring node can generate a monitoring trigger for primary verification information (here, the monitoring node can select (or designate) a specific trader node to generate a monitoring trigger), and in this way, the monitoring node can generate a monitoring trigger for primary verification information. As a monitoring trigger occurs, the monitoring node management unit 220 may cause the trader node (or manager node) to transmit primary verification information (specifically, the grouped information described above) to the monitoring node.

As another example, a monitoring node may fire a monitoring trigger on primary verification information (where the monitoring node may select (or designate) a specific trader node to fire a monitoring trigger), and thus the monitoring node As the monitoring trigger occurs, the monitoring node management unit 220 can ensure that the primary verification information (specifically, the grouped information described above) stored in the database is immediately transmitted to the monitoring node.

Meanwhile, according to one embodiment of the present invention, the primary verification information (specifically, the grouped information described above) may be accumulated to a certain level before the monitoring trigger occurs, and the monitoring node management unit 220 In response to what occurs, the accumulated information can be transmitted to the monitoring node. For example, if a 3rd monitoring trigger occurs after the 1st monitoring trigger and the 2nd monitoring trigger occur, the monitoring node management unit 220 generates and accumulates between the 2nd monitoring trigger and the 3rd monitoring trigger. Information can be transmitted to the monitoring node.

Continuing, the monitoring node management unit 220 according to an embodiment of the present invention may cause the monitoring node to perform verification of the primary verification information and generate secondary verification information. Specifically, the monitoring node management unit 220 according to an embodiment of the present invention may enable the monitoring node to perform re-verification (or audit) of whether an abnormal transaction has occurred, and the monitoring node may perform grouping of the received data. Secondary verification information can be generated by performing verification on the information provided, that is, primary verification information and available-for-sale balance information. According to one embodiment of the present invention, the monitoring node can determine whether an abnormal transaction has occurred by the trader node based on the secondary verification information generated as above.

Meanwhile, the monitoring node management unit 220 according to an embodiment of the present invention can support the monitoring node to receive supplementary information necessary to generate secondary verification information. Here, according to an embodiment of the present invention, supplementary information may mean missing information when at least one piece of information included in grouped information is missing. Specifically, according to one embodiment of the present invention, the monitoring node can determine whether supplementary information is needed in the process of generating secondary verification information, and if it is determined that supplementary information is necessary, the monitoring node management unit 220 The node (or manager node) can transmit the corresponding supplementary information to the monitoring node.

Additionally, the monitoring node management unit 220 according to an embodiment of the present invention can support the monitoring node to receive reference information necessary for generating secondary verification information. Here, according to an embodiment of the present invention, reference information may mean reference (or auxiliary) information to verify whether an abnormal transaction has occurred. Specifically, according to one embodiment of the present invention, the monitoring node can determine whether reference information is needed in the process of generating secondary verification information, and if it is determined that reference information is necessary, the relevant organization (e.g. For example, you can select (or designate) an exchange, a depository, a brokerage, a trust, a broker, etc.). The monitoring node management unit 220 according to an embodiment of the present invention requests reference information from a related organization (specifically, a server or device provided in the related organization) selected from the monitoring node as described above, and sends the reference information to the monitoring node. can be transmitted to.

In addition, the monitoring node management unit 220 according to an embodiment of the present invention provides information based on the monitoring node and an external institution (e.g., financial authorities) (specifically, an external institution) to determine whether an abnormal transaction has occurred. It can be shared between servers or devices provided in . Here, according to an embodiment of the present invention, the information shared as above may include secondary verification information generated by the monitoring node, but is not limited thereto, and includes primary verification information (or grouped information), supplementation At least one of information and reference information may further be included. For example, the monitoring node management unit 220 according to an embodiment of the present invention may allow basic information to be transmitted from the monitoring node to an external organization to determine whether an abnormal transaction has occurred. For another example, the monitoring node management unit 220 according to an embodiment of the present invention may synchronize the basic information with a database provided by an external organization to determine whether an abnormal transaction has occurred.

In the above, the functions and embodiments according to the present invention have been described in detail. However, at least some of the functions performed by the trader node or monitoring node may be performed by the trader node management unit 210 or the monitoring node management unit 220, and conversely, the trader node management unit 210 or the monitoring node management unit 220 It should be noted that at least some of the functions performed by may be performed by trader nodes or monitoring nodes.

Next, the communication unit 230 according to an embodiment of the present invention may perform a function that enables data transmission and reception to/from the trader node management unit 210 and the monitoring node management unit 220.

Lastly, the control unit 240 according to an embodiment of the present invention may perform the function of controlling the flow of data between the trader node management unit 210, the monitoring node management unit 220, and the communication unit 230. That is, the control unit 240 according to an embodiment of the present invention controls the data flow to/from the outside of the monitoring system 200 or the data flow between each component of the monitoring system 200, thereby controlling the trader node management unit 210. ), the monitoring node management unit 220 and the communication unit 230 can each be controlled to perform their own functions.

The embodiments according to the present invention described above can be implemented in the form of program instructions that can be executed through various computer components and recorded on a computer-readable recording medium. The computer-readable recording medium may include program instructions, data files, data structures, etc., singly or in combination. Program instructions recorded on the computer-readable recording medium may be specially designed and configured for the present invention, or may be known and usable by those skilled in the computer software field. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tapes, optical recording media such as CD-ROMs and DVDs, and magneto-optical media such as floptical disks. medium), and hardware devices specifically configured to store and execute program instructions, such as ROM, RAM, flash memory, etc. Examples of program instructions include not only machine language code such as that created by a compiler, but also high-level language code that can be executed by a computer using an interpreter or the like. A hardware device can be converted into one or more software modules to perform processing according to the invention and vice versa.

In the above, the present invention has been described in terms of specific details, such as specific components, and limited embodiments and drawings, but this is only provided to facilitate a more general understanding of the present invention, and the present invention is not limited to the above embodiments. Anyone with ordinary knowledge in the technical field to which the invention pertains can make various modifications and changes from this description.

Therefore, the spirit of the present invention should not be limited to the above-described embodiments, and the scope of the patent claims described below as well as all scopes equivalent to or equivalently changed from the scope of the claims are within the scope of the spirit of the present invention. It will be said to belong to

100: communication network
200: monitoring system
210: Trader Node Management Department
220: Monitoring node management unit
230: Department of Communications
240: control unit
300: device

Claims (15)

As a method for monitoring abnormal transactions,
(a) generating available-for-sale balance information of the trader node by referring to the asset transaction history of the trader node, and determining whether an abnormal transaction has occurred by the trader node by referring to the available-for-sale balance information;
(b) performing verification of the decision on the trader node side to generate primary verification information, and
(c) In response to the occurrence of a monitoring trigger for the first verification information, the first verification information is transmitted to the monitoring node, and the monitoring node performs verification of the first verification information, thereby creating a second verification information. Including steps for causing verification information to be generated,
In step (b), the trader node, which is a party to the asset transaction, performs verification of whether the abnormal transaction has occurred so that the first verification information is generated, and the first verification is performed until the monitoring trigger occurs. Ensure that the information and salable information that is the basis for generating the primary verification information are stored in a grouped state,
The primary verification information is pre-audited by the trader node, which is the party to the asset transaction, so that the responsibility for verifying whether the abnormal transaction has occurred can be imposed on the trader node, which is the party to the asset transaction. generated according to
method. According to paragraph 1,
The above abnormal transactions include unleveraged short selling.
method. According to paragraph 1,
The available-for-sale balance information is generated based on at least one of a time unit and an event occurrence unit.
method. According to paragraph 1,
The first verification information is generated based on a standardized frame.
method. According to paragraph 1,
In step (c), the primary verification information accumulated to a predetermined level is transmitted to the monitoring node in response to the occurrence of the monitoring trigger.
method. According to paragraph 1,
In step (c), supporting the monitoring node to receive supplementary information or reference information necessary to generate the secondary verification information.
method. According to paragraph 1,
In step (c), the underlying information is shared between the monitoring node and an external organization to determine whether the abnormal transaction has occurred.
method. A non-transitory computer-readable recording medium recording a computer program for executing the method according to claim 1. A system for monitoring abnormal transactions,
Generate information on the available-for-sale balance of the trader node by referring to the asset transaction history of the trader node, determine whether an abnormal transaction has occurred by the trader node by referring to the available-for-sale balance information, and make the decision on the side of the trader node. A trader node management unit that performs verification and generates primary verification information, and
In response to the occurrence of a monitoring trigger for the primary verification information, the primary verification information is transmitted to the monitoring node, and the monitoring node performs verification of the primary verification information, so that the secondary verification information is Includes a monitoring node management unit that creates
The trader node management unit causes the trader node, which is a party to the asset transaction, to verify whether the abnormal transaction has occurred to generate the primary verification information, and generates the primary verification information until the monitoring trigger occurs. and ensuring that the salable information that is the basis for generating the primary verification information is stored in a grouped state,
The primary verification information is pre-audited by the trader node, which is the party to the asset transaction, so that the responsibility for verifying whether the abnormal transaction has occurred can be imposed on the trader node, which is the party to the asset transaction. generated according to
system. According to clause 9,
The above abnormal transactions include unleveraged short selling.
system. According to clause 9,
The available-for-sale balance information is generated based on at least one of a time unit and an event occurrence unit.
system. According to clause 9,
The first verification information is generated based on a standardized frame.
system. According to clause 9,
The monitoring node management unit causes the primary verification information accumulated to a predetermined level to be transmitted to the monitoring node in response to the occurrence of the monitoring trigger.
system. According to clause 9,
The monitoring node management unit supports the monitoring node to receive supplementary information or reference information necessary to generate the secondary verification information.
system. According to clause 9,
The monitoring node management unit ensures that the basic information is shared between the monitoring node and an external organization to determine whether the abnormal transaction has occurred.
system.

Images