TW201926204A - Method and device for identifying corporations with abnormal transactions - Google Patents
Method and device for identifying corporations with abnormal transactions Download PDFInfo
- Publication number
- TW201926204A TW201926204A TW107141049A TW107141049A TW201926204A TW 201926204 A TW201926204 A TW 201926204A TW 107141049 A TW107141049 A TW 107141049A TW 107141049 A TW107141049 A TW 107141049A TW 201926204 A TW201926204 A TW 201926204A
- Authority
- TW
- Taiwan
- Prior art keywords
- transaction
- community
- node
- nodes
- edge
- Prior art date
Links
- 238000000034 method Methods 0.000 title claims abstract description 54
- 230000002159 abnormal effect Effects 0.000 title claims abstract description 39
- 238000004590 computer program Methods 0.000 claims abstract description 10
- 238000003860 storage Methods 0.000 claims abstract description 5
- 238000012546 transfer Methods 0.000 claims description 21
- 238000000638 solvent extraction Methods 0.000 claims description 18
- 230000008859 change Effects 0.000 claims description 9
- 230000001419 dependent effect Effects 0.000 claims 2
- 238000012545 processing Methods 0.000 abstract description 8
- 238000005259 measurement Methods 0.000 abstract 2
- 238000005516 engineering process Methods 0.000 abstract 1
- 238000004900 laundering Methods 0.000 description 11
- 238000004422 calculation algorithm Methods 0.000 description 10
- 238000012937 correction Methods 0.000 description 9
- 238000010586 diagram Methods 0.000 description 7
- 230000008569 process Effects 0.000 description 6
- 230000000694 effects Effects 0.000 description 5
- 238000009826 distribution Methods 0.000 description 2
- 239000011159 matrix material Substances 0.000 description 2
- 238000010606 normalization Methods 0.000 description 2
- 238000004364 calculation method Methods 0.000 description 1
- 238000001914 filtration Methods 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 238000012544 monitoring process Methods 0.000 description 1
- 238000005457 optimization Methods 0.000 description 1
- 238000005192 partition Methods 0.000 description 1
- 230000001105 regulatory effect Effects 0.000 description 1
- 238000011160 research Methods 0.000 description 1
- 230000000717 retained effect Effects 0.000 description 1
- 230000008685 targeting Effects 0.000 description 1
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/90—Details of database functions independent of the retrieved data types
- G06F16/901—Indexing; Data structures therefor; Storage structures
- G06F16/9024—Graphs; Linked lists
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q50/00—Information and communication technology [ICT] specially adapted for implementation of business processes of specific business sectors, e.g. utilities or tourism
- G06Q50/01—Social networking
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Databases & Information Systems (AREA)
- Business, Economics & Management (AREA)
- General Physics & Mathematics (AREA)
- Physics & Mathematics (AREA)
- Tourism & Hospitality (AREA)
- Economics (AREA)
- Primary Health Care (AREA)
- Strategic Management (AREA)
- Human Resources & Organizations (AREA)
- General Health & Medical Sciences (AREA)
- General Business, Economics & Management (AREA)
- Marketing (AREA)
- Health & Medical Sciences (AREA)
- Software Systems (AREA)
- Computing Systems (AREA)
- Data Mining & Analysis (AREA)
- General Engineering & Computer Science (AREA)
- Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
Abstract
Description
本發明涉及數據處理技術，特別涉及用於識別異常交易社團方法、實施該方法的裝置以及包含實施該方法的計算機程序的計算機可讀儲存媒體。The present invention relates to data processing techniques, and more particularly to a method for identifying an abnormal transaction community, an apparatus for implementing the method, and a computer readable storage medium including a computer program implementing the method.
諸如洗錢之類的非法資金轉移由於其對國家金融體系安全和經濟秩序穩定帶來的危害，一直是政府監管的重點。隨著電子支付的興起，更加便捷的支付方式在提高交易效率和降低交易成本的同時，也給非法資金轉移提供了可乘之機。
目前主流的反洗錢(AML)系統大多是基於規則的。這類系統的缺點是監管效率較低，並且由於規則很容易被學習掌握，導致監管被規避。此外，規則系統包含較多的主觀因素，難免出現錯誤或者疏漏。再者，由於洗錢之類的資金非法轉移活動往往涉及團夥犯罪，當前的監管系統缺乏全域性的監測能力，從而難以發現大範圍內的洗錢活動。
有鑑於此，迫切需要一種能夠準確、快速地識別異常交易社團的方法和裝置。The transfer of illegal funds, such as money laundering, has been the focus of government regulation because of its danger to the security of the national financial system and the stability of the economic order. With the rise of electronic payment, more convenient payment methods have provided opportunities for illegal fund transfer while improving transaction efficiency and reducing transaction costs.
Most of the current mainstream anti-money laundering (AML) systems are based on rules. The disadvantage of this type of system is that it is less efficient, and because the rules are easily learned, the supervision is circumvented. In addition, the rule system contains more subjective factors, and it is inevitable that errors or omissions will occur. Moreover, since illegal transfer of funds such as money laundering often involves gang crimes, the current regulatory system lacks global monitoring capabilities, making it difficult to detect large-scale money laundering activities.
In view of this, there is an urgent need for a method and apparatus for accurately and quickly identifying abnormal transaction communities.
本發明的一個目的是提供一種用於識別異常交易社團的方法，其具有處理效率高、識別準確度高等優點。
按照本發明一個方面的用於識別異常交易社團的方法包含下列步驟：
構建與多個帳戶相互間的交易事件相關的網路圖，其中，所述網路圖的每個節點代表所述多個帳戶的其中一個，並且以連接兩個節點的邊來指示在與這兩個節點相關聯的帳戶之間發生了交易，其中邊的方向代表交易的方向；
從所述網路圖確定為一個或多個社團；以及
根據社團的交易信息確定其相應的風險度量，該風險度量用於確定該社團是否屬於異常交易社團。
優選地，在上述方法中，確定社團的步驟包括：
從所述網路圖確定一個或多個連通子圖，其中，每個連通子圖內的任意兩個節點之間是連通的，並且兩個連通子圖之間無相連接的邊；以及
對連通子圖執行社團劃分操作。
優選地，在上述方法中，在執行社團劃分的步驟中，對於任一連通子圖，按照下列方式執行劃分操作：
基於節點權重和交易時序，對該連通子圖中的邊的權重進行修正；以及
以迭代方式對該連通子圖進行社團劃分直到劃分後該連通子圖的模組度不再變化為止，由此完成該連通子圖的社團劃分。
優選地，在上述方法中，節點權重依賴於邊兩端的每個節點的交易金額、交易次數和出入度總數。
優選地，在上述方法中，交易時序依賴於邊兩端的每個節點的資金平均轉入時間和資金平均轉出時間。
優選地，在上述方法中，對於兩個節點之間的邊，其對模組度的貢獻值與邊的方向相關。
優選地，在上述方法中，所述交易信息包括每個社團內的每筆交易的時間、該社團的總交易數量和總交易金額。
優選地，在上述方法中，每個社團的風險度量包括該社團的交易時間熵和整體風險因子。
本發明的還有一個目的是提供一種用於識別異常交易社團的裝置，其具有處理效率高、識別準確度高等優點。
按照本發明另一個方面的用於識別異常交易社團的裝置包含：
第一模組，用於構建與多個帳戶相互間的交易事件相關的網路圖，其中，所述網路圖的每個節點代表所述多個帳戶的其中一個，並且以連接兩個節點的邊來指示在與這兩個節點相關聯的帳戶之間發生了交易，其中邊的方向代表交易的方向；
第二模組，用於從所述網路圖確定為一個或多個社團；以及
第三模組，用於根據社團的交易信息確定其相應的風險度量，該風險度量用於確定該社團是否屬於異常交易社團。
按照本發明另一個方面的用於識別異常交易社團的裝置包含記憶體、處理器以及儲存在所述記憶體上並可在所述處理器上運行的計算機程序以執行如上所述的方法。
本發明的還有一個目的是提供一種計算機可讀儲存媒體，其上儲存計算機程序，該程序被處理器執行時實現如上所述的方法。An object of the present invention is to provide a method for identifying an abnormal transaction community, which has the advantages of high processing efficiency, high recognition accuracy, and the like.
A method for identifying an abnormal transaction community in accordance with an aspect of the present invention includes the following steps:
Constructing a network map related to transaction events between the plurality of accounts, wherein each node of the network map represents one of the plurality of accounts, and is indicated by an edge connecting the two nodes A transaction occurs between accounts associated with two nodes, where the direction of the side represents the direction of the transaction;
Determining from the network map as one or more associations; and determining a corresponding risk metric according to the transaction information of the association, the risk metric being used to determine whether the association belongs to an abnormal transaction community.
Preferably, in the above method, the step of determining a community comprises:
Determining one or more connected subgraphs from the network map, wherein any two nodes in each connected subgraph are connected, and there are no connected edges between the two connected subgraphs; The subgraph performs a community partitioning operation.
Preferably, in the above method, in the step of performing community division, for any connected subgraph, the division operation is performed in the following manner:
Correcting the weight of the edge in the connected subgraph based on the node weight and the transaction timing; and performing the community division on the connected subgraph in an iterative manner until the modularity of the connected subgraph does not change after the partitioning, thereby Complete the community division of the connected subgraph.
Preferably, in the above method, the node weight depends on the transaction amount, the number of transactions, and the total number of penalties of each node at both ends of the edge.
Preferably, in the above method, the transaction timing depends on the average transfer time of funds and the average transfer time of funds for each node at both ends of the edge.
Preferably, in the above method, for the edge between two nodes, the contribution value to the module degree is related to the direction of the edge.
Preferably, in the above method, the transaction information includes the time of each transaction within each community, the total number of transactions of the community, and the total transaction amount.
Preferably, in the above method, the risk metric of each community includes the transaction time entropy of the association and the overall risk factor.
Still another object of the present invention is to provide an apparatus for identifying an abnormal transaction community, which has the advantages of high processing efficiency, high recognition accuracy, and the like.
An apparatus for identifying an abnormal transaction community according to another aspect of the present invention includes:
a first module, configured to construct a network map related to transaction events between the plurality of accounts, wherein each node of the network map represents one of the plurality of accounts, and connects two nodes The side indicates that a transaction has occurred between the accounts associated with the two nodes, where the direction of the side represents the direction of the transaction;
a second module, configured to determine, from the network map, one or more communities; and a third module, configured to determine, according to transaction information of the community, a corresponding risk metric, where the risk metric is used to determine whether the community is Belongs to the abnormal trading community.
An apparatus for identifying an abnormal transaction community in accordance with another aspect of the present invention includes a memory, a processor, and a computer program stored on the memory and operative on the processor to perform the method as described above.
It is still another object of the present invention to provide a computer readable storage medium having stored thereon a computer program that, when executed by a processor, implements the method as described above.
下面參照其中圖示了本發明示意性實施例的附圖更為全面地說明本發明。但本發明可以按不同形式來實現，而不應解讀為僅限於本文給出的各實施例。給出的上述各實施例旨在使本文的披露全面完整，以將本發明的保護範圍更為全面地傳達給本領域技術人員。
在本說明書中，諸如“包含”和“包括”之類的用語表示除了具有在說明書和申請專利範圍中有直接和明確表述的單元和步驟以外，本發明的技術方案也不排除具有未被直接或明確表述的其它單元和步驟的情形。
圖1為按照本發明一個實施例的用於識別異常交易社團的方法的流程圖。優選地但非必須地，圖1所示的方法可在雲端服務器或後臺交易處理系統處執行。
圖1所示的方法的流程開始於步驟110。在該步驟中，選取一個時間段Tm
內的多個帳戶之間的交易記錄，並構建刻畫多個帳戶相互間的交易事件的網路圖。該網路圖例如可以按照下列方式構建：網路圖的每個節點代表多個帳戶的其中一個，並且以連接兩個節點的邊來指示在與這兩個節點相關聯的帳戶之間發生了交易。在本實施例中，邊為有向邊，其方向表示交易的方向(例如在一筆交易中，該方向可以定義為從資金的轉出節點指向資金的轉入節點，但是將其定義為從資金的轉入節點指向資金的轉出節點是等價的)。此外，在本實施例中，邊具有權重。示例性地，可以將網路圖中的第i條邊的初始權重WBi
設定為：
這裡和分別代表邊(也即邊兩端節點之間)的總交易金額的標準化值和總交易次數的標準化值，和分別為總交易金額和總交易次數所對應的係數，這兩個係數之和為1。
隨後進入步驟120，從步驟110生成的網路圖確定為一個或多個社團。有關社團確定的具體方式將在下面作詳細的描述。
接著進入步驟130，對於每個社團，根據其交易信息確定相應的風險度量，該風險度量用於確定該社團是否發生異常交易社團。有關確定風險量度的具體方式將在下面作詳細的描述。
圖2為可應用於圖1所示實施例的確定社團方法的流程圖。優選地但非必須地，圖2所示的方法可在雲端服務器或後臺交易處理系統處執行。
如圖2所示，在步驟210，從步驟110生成的網路圖確定一個或多個連通子圖。示例性地，連通子圖的確定過程為，首先濾除網路圖中的孤立節點(也即與其它節點無交易的節點)，然後將整個網路圖劃分為一個或多個連通子圖(例如利用連通分量算法)，使得在劃分後的每個連通子圖內，任意兩個節點之間是連通的，並且兩個連通子圖之間無相連接的邊。
隨後進入步驟220，從步驟210所確定的連通子圖中選擇一個子集。例如可以按照下列方式挑選該子集中的元素：首先選擇總節點數在中等規模的連通子圖。隨後在這些中等規模的連通子圖內統計轉出金額和/或轉出交易次數(以下又稱為“出度”)或者轉入金額和/或轉入交易次數(以下又稱為“入度”)較大的節點的數量，這些節點統稱為可疑中心節點。最後將這些中等規模的連通子圖內可疑中心節點數量較多的連通子圖選入子集內。
在步驟220中，可以將出度(入度)大於閾值的節點視為可疑中心節點，該閾值的設定方式例如可以是：生成一個連通子圖內的所有節點的出度(入度)的統計分佈圖，並且將統計分佈圖中的曲線轉折點設定為出度(入度)的閾值。在步驟220中，還可以將可疑中心節點數量大於閾值的連通子圖納入子集。
隨後進入步驟230，對子集內尚未進行社團劃分操作的連通子圖執行社團劃分操作。有關社團劃分操作的詳細描述將在下面給出。
接著進入步驟240，確定是否對於子集內的每個連通子圖都實施了社團劃分操作，如果是，則可以進入圖1的步驟130，否則返回步驟230。
需要指出的是，在圖2所示的方法中，步驟210和220是優選的步驟。也就是說，在一個實施方式中，可以直接對網路圖執行如下所述的社團劃分操作，或者對步驟210所確定的連通子圖的每一個執行社團劃分操作。
每一個連通子圖都可以視為一個具有關聯性質的交易群體。然而在這些眾多的群體中，通常僅有一小部分涉及異常交易活動(例如洗錢)。而且一些非法交易活動的執行者還會刻意地將核心異常交易結構隱藏在大量的正常交易中，這進一步增加了異常交易的發現難度。本發明的發明人經過深入研究發現，如果對一個連通子圖直接進行分析或社團劃分操作，很可能出現的結果是雖然用於衡量該連通子圖的異常交易的風險度量較低，然而實際上卻隱藏著大量的異常交易。
針對上述情況，本發明的發明人創造性地引入下列方式來挖掘隱藏的異常交易：基於節點權重和交易時序對連通子圖中的邊的權重進行修正，然後利用為有向圖專門定義的模組度，以迭代方式對邊的權重修正後的連通子圖進行社團劃分，直到劃分後該連通子圖的模組度不再變化為止，由此完成該連通子圖的社團劃分。通過上述方式可以在連通子圖內發現異常交易風險極大的社團或者多個異常交易風險較高的社團，從而大幅度提高異常交易的辨識度，並且還能夠清楚地勾勒出核心的異常交易風險結構。
圖3為可應用於圖2所示實施例的社團劃分算法的流程圖，該算法基於上述方式。圖3所示算法的操作對象為一個連通子圖，但是這僅僅是示例性的，將整個網路圖作為操作對象也是成立的。
圖3所示的流程開始於步驟310。在該步驟中，利用節點權重對一個連通子圖的每條邊的權重進行修正或優化。優選地，可以利用一個節點的交易金額、交易次數、出入度總數等交易信息來計算用於修正邊的權重的節點權重。具體計算方式例如如下式(2)所示：
這裡，為節點j的節點權重分別表示該節點j的總交易金額的標準化值、交易次數的標準化值以及出入度總數的標準化值，為節點j的總交易金額、交易次數以及出入度總數的權重因子(例如每個權重因子可以都取值為1/3)。
對於第i條邊而言，假設它的起始節點或金額轉出節點為，目的節點或金額轉入節點為，則利用第i條邊的經節點權重修正後的權重WEi
變為：
這裡，wVi_in
為初始節點的節點權重，wVi_out
為目的節點的節點權重，WBi
為由式(1)確定的第i條邊的初始權重。
對於一個連通子圖內的每條邊，都可以利用上式(2)和(3)來修正其權重，從而得到邊的權重被利用節點權重修正過的連通子圖。
隨後進入步驟320。在該步驟中，對利用節點權重修正後的連通子圖的邊的權重進一步進行交易時序修正或優化。優選地，可以採用下列方式來作進一步的修正。
首先計算每個節點的平均轉入和轉出時間。例如對於連通子圖內的任一節點A，假設有條邊連入該節點，這條邊中的第j條邊連入該節點的時間為，這條邊中的第j條邊連出該節點的時間為，則節點A的平均連入時間為：
節點A的平均連出時間為：
隨後確定與交易時序相關的權重修正係數。對於“先分散轉入後集中轉出”的情況(也即首先是多個節點向一個節點轉帳，接著由後者將彙集的金額集中轉出的交易過程)，從交易時序上考察，集中轉出的那條邊應該在多次分散轉入的邊之後形成。對於“先集中轉入後分散轉出”的情況(也即首先是一個節點接收一筆款項，然後由該節點將該筆款項向多個節點轉帳，最後多個節點將各自接收的款項轉出的交易過程)，從交易時序上考察，集中轉入的那條邊應該在多次分散轉出的邊之前形成。
在本實施例中，對於第i條邊的兩端的節點，根據交易的方向(即節點為交易的轉出節點還是轉入節點)定義不同的權重修正係數以用於基於交易時序的修正。具體而言，對於第i條邊的初始節點src，其對應的權重修正係數q1
按照下式確定：
這裡，為初始節點src的入度，為初始節點src的出度，為初始節點src的平均連入時間，其可由式(4)確定，Tsrc
為初始節點src連出第j條邊的時間，TR
為規範化因子。
由上式(6)-(9)可見，對於滿足條件且的邊，其修正係數，其他情況下。
類似地，對於第i條邊的目的節點dst，其對應的權重修正係數q2
按照下式確定：
這裡，為目的節點dst的出度，為目的節點dst的入度，為目的節點dst的平均連入時間，其可由式(5)確定，Tdst
為目的節點dst連入第j條邊的時間，TR
為規範化因子。
由上式(10)-(13)可見，對於滿足條件且的邊，其修正係數，其他情況下。
由此，對於第i條邊，其權重可以按照下式進行基於交易時序的修正：
這裡，WEi
為步驟310中確定的第i條邊的利用節點權重進行修正後的權重。
接著進入步驟330，在該步驟中，對經過步驟310和320的權重修正處理後的連通子圖進行社團劃分，從而將每個節點都劃歸到相應的社團內。
如上所述，在本實施例的網路圖中，每條邊為有向邊。對於任意一條有向邊iàj，令，，其中表示指向節點i的所有邊的權重和，表示由節點i連出的所有邊的權重和，表示節點j的所有邊的權重和，表示節點j的所有邊的權重和。
優選地，在本實施例中可以將模組度QD
定義為：
這裡，如果節點i和節點j屬於同一個社團，則=1，否則=0，為有向網路的鄰接權重矩陣中相應的值，如果存在邊jài，則等於邊的權重，否則為0，表示社團C內的邊的權重之和(包括社團內的點和社團外的點相連的邊)，m表示所有邊的權重之和，代表對全部社團的求和，表示僅對社團C內部矩陣的所有元素進行求和，具體表示如下：
在本步驟中，優選地，可以採用與Louvain算法類似的迭代算法，利用上面定義的模組度來完成社團劃分。
圖4為可應用於圖3所示實施例的迭代算法的流程圖。
參見圖4，在步驟410中，首先執行初始化處理，將一個連通子圖中的每個節點劃歸到不同的社團中。
接著進入步驟420。在該步驟中，採用上式(15)定義的模組度，對於連通子圖中的每個節點執行迭代操作。以該連通子圖中的第i個節點為例，首先將節點i分配給它的每個鄰居節點所屬的社團，然後計算分配前與分配後的模組度變化值，從而得到與節點i相關聯的一個或多個模組度變化值。在本實施例中，模組度變化值可以按照下式確定：
其中表示節點i與社團c內部節點的連邊的權重之和。
在依照上式(18)和(19)得到到與節點i相關聯的一個或多個模組度變化值之後，如果判斷這些模組度變化值中的最大值max＞0，則將節點i分配給與max對應的那個鄰居節點所屬的社團，否則使節點i保持在原社團不變。
接著進入步驟430。在該步驟中，確定所有節點歸屬社團的狀態在本次執行步驟420前後是否發生變化，如果發生變化，則返回步驟420，否則進入步驟440。
在步驟440，按照下列方式對連通子圖進行壓縮：將屬於同一社團的節點壓縮為一個新節點，社團內節點之間的邊的權重轉化為新節點的環的權重，社團間的邊權重轉化為新節點間的邊權重。
隨後進入步驟450。在該步驟中，依照上式(15)-(17)確定步驟440中生成的壓縮的連通子圖的模組度，並且隨後進入步驟460。
在步驟460，判斷步驟450中確定的模組度與本次執行步驟440之前的連通子圖的模組度之差是否小於預設的閾值，如果是，則進入步驟470，輸出當前處理的連通子圖的社團劃分結果，否則返回步驟420。
圖5為可應用於圖1所示實施例的確定社團的風險量度的方法的流程圖。為闡述方便起見，這裡的描述以確定一個社團k的風險量度的過程為例。
圖5所示的流程開始於步驟510。在該步驟中，確定時間段Tm
期間待確定風險量度的社團的平均交易時間。優選地，對於該社團在該段時間內的每筆交易，可以以最起始的一筆交易作為時間基準點來確定交易時間。
隨後進入步驟520。對於該社團在該段時間內的每筆交易，確定其交易時間與平均交易時間之差的絕對值，這裡h為交易的索引號。
接著進入步驟530，根據的取值將每筆交易歸類到多個區間的相應區間中，並統計每個區間內的交易次數與該社團在時間段Tm
期間的總交易次數的比率。
隨後進入步驟540，依照下式確定用於反映交易時間與異常交易之間相關性的交易時間熵HC
：
這裡n為區間的總數，Pi
表示第i個區間內的交易筆數與該社團在時間段Tm
期間的總交易筆數的比率。
由式(20)可見，在一個時間段內，如果一個社團內的交易時間熵越小，則表示交易活動的時間越集中，因此交易異常的可能性越大。
接著進入步驟550，確定該社團的整體風險因子。優選地，整體風險因子可以利用下式確定：
這裡為社團k內節點的數量的標準化值，為社團k在時間段Tm
期間的總交易次數的的標準化值，為社團k在時間段Tm
期間的總交易金額的的標準化值，為社團k內節點的平均度數的的標準化值，為社團k在時間段Tm
期間的交易時間熵的標準化值，為權重值，可根據實際應用設定。
由式(21)計算得到的越大，則表明交易異常的風險度較大。
可選地但並非必須的，對於一個網路圖或一個連通子圖內的多個社團，可以按照圖5所示方法確定的整體風險因子對它們進行從高到低的排序，其中前5%的社團被評級為I級可疑社團，介於5%~10%的社團被評級為II級可疑社團等。
在上面借助圖1-5所述的實施例中，描述了用於識別一個時間段Tm
內的異常交易社團的方法。上述實施例也可以推廣到多個時間段內異常交易社團的識別中。當需要對較長跨度的時間段內的交易活動進行監測時，考慮到社團可能的變化而將長跨度時間段分割為多個時間段來監測是有利的。
例如可以將一個較長跨度的時間段(例如一個星期、一個月或者半年等)分為n個時間段，然後在每個時間段內，分別採用上面借助圖1-5所述的實施例來識別異常交易社團。考慮到數據量較大，優選地，可以採用下述增量式方法進行社團的劃分。具體而言，在第一個時間段Ti
內完成社團劃分後保留每個節點所對應的社團標簽；隨後，在對下一時間段Ti+1
進行社團劃分時，取該時間段內的所有節點與上一時間段內的所有節點的交集，並且將交集部分的節點所對應的社團標簽作為當前時間段的相關節點的初始標簽，而將那些無社團標簽的節點初始化為自身所屬的社團，然後在此基礎上執行社團劃分操作。這種方式可以大大加快社團劃分操作的收斂速度。
圖6為按照本發明另一個實施例的用於識別異常交易社團的裝置的框圖。
圖6所示的裝置60包含記憶體610、處理器620以及儲存在記憶體610上並可在處理器620上運行的計算機程序630，其中，計算機程序630通過在處理器620上運行以可執行如上借助圖1-3所述實施例的方法。
圖7為按照本發明另一個實施例的用於識別異常交易社團的裝置的框圖。
圖7所示的裝置70包含第一模組710、第二模組720和第三模組730，其中，第一模組710用於構建與多個帳戶相互間的交易事件相關的網路圖，其中，所述網路圖的每個節點代表所述多個帳戶的其中一個，並且以連接兩個節點的邊來指示在與這兩個節點相關聯的帳戶之間發生了交易，其中邊的方向代表交易的方向；第二模組720用於從所述網路圖確定為一個或多個社團；以及第三模組730用於根據社團的交易信息確定其相應的風險度量，該風險度量用於確定該社團是否屬於異常交易社團。
按照本發明的一個方面，提供一種計算機可讀儲存媒體，其上儲存計算機程序，該程序被處理器執行時實現借助圖1-3所述實施例的方法。
與現有技術相比，本發明的上述實施例具有下列優點：
1、不依賴已有案件信息，僅從海量交易中即能主動發現高風險的非法交易團夥。
2、通過創造性地將社團發現算法與動態洗錢模式相結合，形成了對於反洗錢具有特別針對性的時序有向社團發現算法，使得能夠準確地進行洗錢意義上的社團劃分。
3、能夠對社團進行準確的異常交易風險量化評分，依照評分等級劃分形成社團洗錢風險評級，業務人員能夠根據該評級進行更加有目的性的反洗錢工作的開展。
4、通過動態分析多個時間跨度內的交易社團結構隨時間的演化，能夠確定高風險洗錢社團並分析其內在演化規律。
提供本文中提出的實施例和示例，以便最好地說明按照本技術及其特定應用的實施例，並且由此使本領域的技術人員能夠實施和使用本發明。但是，本領域的技術人員將會知道，僅為了便於說明和舉例而提供以上描述和示例。所提出的描述不是意在涵蓋本發明的各個方面或者將本發明局限於所公開的精確形式。
鑒於以上所述，本公開的範圍通過以下申請專利範圍來確定。The invention will now be described more fully hereinafter with reference to the accompanying drawings However, the invention may be embodied in different forms and should not be construed as limited to the various embodiments presented herein. The above-described embodiments are intended to be complete and complete to convey the scope of the present invention to those skilled in the art.
In the present specification, the terms "including" and "including" are used to mean that the present invention does not exclude the direct Or the case of other units and steps that are expressly stated.
1 is a flow chart of a method for identifying an abnormal transaction community in accordance with one embodiment of the present invention. Preferably, but not necessarily, the method illustrated in Figure 1 can be performed at a cloud server or a background transaction processing system.
The flow of the method illustrated in FIG. 1 begins at step 110. In this step, selecting a time period between a plurality of transaction accounts within the T m, characterize and construct a plurality of transaction accounts FIG web between each event. The network map can be constructed, for example, in such a way that each node of the network map represents one of a plurality of accounts, and the side connecting the two nodes indicates that an account has occurred between the accounts associated with the two nodes. transaction. In this embodiment, the edge is a directed edge whose direction indicates the direction of the transaction (for example, in a transaction, the direction can be defined as a transfer node from the transfer node of the fund to the fund, but it is defined as the fund. The transfer node points to the transfer node of the funds is equivalent). Further, in the present embodiment, the sides have weights. Illustratively, the initial weight W Bi of the i-th edge in the network map can be set to:
Here with The normalized value of the total transaction amount and the normalized value of the total number of transactions, respectively, representing the edge (that is, between the nodes at both ends). with The coefficient corresponding to the total transaction amount and the total number of transactions, respectively, the sum of these two coefficients is 1.
Then proceeding to step 120, the network map generated from step 110 is determined to be one or more communities. The specific ways in which the association is determined will be described in detail below.
Next, proceeding to step 130, for each community, a corresponding risk metric is determined according to the transaction information, and the risk metric is used to determine whether the community has an abnormal transaction community. Specific ways to determine risk metrics are described in more detail below.
2 is a flow chart of a method of determining a community applicable to the embodiment of FIG. 1. Preferably, but not necessarily, the method illustrated in Figure 2 can be performed at a cloud server or a background transaction processing system.
As shown in FIG. 2, at step 210, one or more connected sub-pictures are determined from the network map generated at step 110. Illustratively, the determining sub-graph is determined by first filtering out isolated nodes in the network graph (ie, nodes that have no transactions with other nodes), and then dividing the entire network graph into one or more connected sub-graphs ( For example, using the connected component algorithm), in each connected subgraph after the partition, any two nodes are connected, and there is no connected edge between the two connected subgraphs.
Then, proceeding to step 220, a subset is selected from the connected sub-pictures determined in step 210. For example, the elements in the subset can be selected in the following manner: First, select the total number of nodes in the medium-sized connected subgraph. Then, in these medium-sized connected subgraphs, the amount of transfer and/or the number of transactions (hereinafter referred to as “outside”) or the amount of transfer and/or the number of transactions transferred (hereinafter referred to as “input degree” are counted. ") The number of larger nodes, collectively referred to as suspicious central nodes. Finally, the connected subgraphs with a large number of suspicious central nodes in these medium-sized connected subgraphs are selected into the subset.
In step 220, a node whose degree of ingress (indegree) is greater than a threshold may be regarded as a suspicious central node, and the threshold may be set in a manner, for example, to generate statistics of the degree of ingress (indegree) of all nodes in a connected subgraph. The distribution map is set and the curve turning point in the statistical distribution map is set as the threshold of the out degree (into the degree). In step 220, a connected subgraph having a number of suspected central nodes greater than a threshold may also be included in the subset.
Then, proceeding to step 230, a community partitioning operation is performed on the connected sub-graphs in the subset that have not been subjected to the community partitioning operation. A detailed description of the community division operation will be given below.
Next, proceeding to step 240, it is determined whether a community partitioning operation is performed for each of the connected sub-graphs in the subset, and if so, step 130 of FIG. 1 may be entered, otherwise returning to step 230.
It should be noted that in the method shown in Figure 2, steps 210 and 220 are preferred steps. That is, in one embodiment, the community partitioning operation as described below may be performed directly on the network map, or the community partitioning operation may be performed on each of the connected sub-graphs determined in step 210.
Each connected subgraph can be considered as a trading group with an associated nature. However, of these large groups, usually only a small part of the unusual trading activities (such as money laundering). Moreover, some executors of illegal trading activities will deliberately hide the core abnormal trading structure in a large number of normal transactions, which further increases the difficulty of finding abnormal trading. The inventors of the present invention have found through in-depth research that if a connected subgraph is directly analyzed or collated, it is likely that the result is that although the risk measure for the abnormal transaction for measuring the connected subgraph is low, actually There are a lot of unusual transactions hidden.
In view of the above situation, the inventors of the present invention creatively introduce the following ways to mine hidden abnormal transactions: the weights of the edges in the connected subgraph are corrected based on the node weight and the transaction timing, and then the module specifically defined for the directed graph is utilized. Degree, iteratively divides the connected subgraphs of the edge weights into groups, until the modularity of the connected subgraphs does not change after the partitioning, thereby completing the community partitioning of the connected subgraphs. Through the above-mentioned methods, it is possible to find a community with an abnormal transaction risk or a group with a high risk of abnormal transactions in the connected subgraph, thereby greatly improving the identification of abnormal transactions, and clearly clarifying the core abnormal transaction risk structure. .
3 is a flow chart of a community partitioning algorithm applicable to the embodiment of FIG. 2, which is based on the above manner. The operation object of the algorithm shown in Fig. 3 is a connected subgraph, but this is merely exemplary, and it is also true that the entire network map is regarded as an operation object.
The flow shown in FIG. 3 begins at step 310. In this step, the weight of each edge of a connected subgraph is corrected or optimized using the node weight. Preferably, the node weights for correcting the weight of the edge may be calculated by using transaction information such as the transaction amount, the number of transactions, and the total number of degrees of entry of one node. The specific calculation method is as shown in the following formula (2):
Here, Node weight for node j Representing the normalized value of the total transaction amount of the node j, the normalized value of the transaction number, and the normalized value of the total number of the entry degrees, respectively. The total transaction amount, the number of transactions, and the weighting factor of the total number of penalties for node j (for example, each weighting factor may take a value of 1/3).
For the ith side, assume that its starting node or amount is transferred out of the node. , the destination node or the amount transferred to the node is Then, the weight W Ei corrected by the node weight of the i-th edge becomes:
Here, w Vi_in initial node to the right node weights, w Vi_out destination node for the node weight weight of the i th initial weight W Bi sides determined by the formula (1) weight.
For each edge in a connected subgraph, the weights of the edges (2) and (3) can be used to correct the weights, so that the weights of the edges are corrected by the node weights.
Then proceed to step 320. In this step, the transaction timing correction or optimization is further performed on the weight of the edge of the connected subgraph corrected by the node weight. Preferably, further modifications can be made in the following manner.
First calculate the average turn-in and roll-out time for each node. For example, for any node A in the connected subgraph, suppose there is The edge of the strip is connected to the node, this The time when the jth edge in the edge of the strip is connected to the node is ,This The time of the jth edge in the edge of the strip is connected to the node. , the average connection time of node A is:
The average connection time of node A is:
The weight correction factor associated with the transaction timing is then determined. For the case of “first decentralized transfer and then transferred out” (that is, the first is the transfer process in which multiple nodes transfer funds to one node, and then the latter transfers the aggregated amount out), from the transaction timing, the centralized transfer The side of the strip should be formed after the edges that have been dispersed many times. For the case of “distributing and transferring out after centralized transfer” (that is, first, a node receives a payment, and then the node transfers the money to multiple nodes, and finally, the plurality of nodes transfer the money received by each node. The transaction process), from the transaction timing, the side that is transferred intensively should be formed before the edges that are scattered out many times.
In the present embodiment, for the nodes at both ends of the ith side, different weight correction coefficients are defined for the correction based on the transaction timing according to the direction of the transaction (ie, whether the node is a transit node or a transit node of the transaction). Specifically, for the initial node src of the i-th edge, the corresponding weight correction coefficient q 1 is determined according to the following formula:
Here, For the ingress of the initial node src, For the out node src out, It is the average connection time of the initial node src, which can be determined by the formula (4), T src is the time when the initial node src is connected to the j-th edge, and T R is the normalization factor.
Visible from the above equations (6)-(9), for satisfying the conditions And Edge, its correction factor In other cases .
Similarly, for the destination node dst of the i-th edge, the corresponding weight correction coefficient q 2 is determined according to the following formula:
Here, For the outbound degree of the destination node dst, For the ingress of the destination node dst, For the average connection time of the destination node dst, which can be determined by the equation (5), T dst is the time when the destination node dst is connected to the j-th edge, and T R is the normalization factor.
Visible from the above equations (10)-(13), for satisfying the conditions And Edge, its correction factor In other cases .
Thus, for the ith side, its weight can be modified based on the transaction timing according to the following formula:
Here, W Ei is the weight of the used node weight determined by the i-th edge determined in step 310.
Next, proceeding to step 330, in which the connected sub-pictures subjected to the weight correction processing of steps 310 and 320 are subjected to community division, thereby classifying each node into the corresponding community.
As described above, in the network diagram of this embodiment, each side is a directed edge. For any one of the directed edges iàj, , ,among them Represents the weight sum of all edges pointing to node i, Represents the weight sum of all edges connected by node i, Represents the weight sum of all edges of node j, Represents the sum of the weights of all edges of node j.
Preferably, in this embodiment, the module degree Q D can be defined as:
Here, if node i and node j belong to the same community, then =1, otherwise =0, Is the corresponding value in the neighboring weight matrix of the directed network, if there is an edge jài, then Equal to the weight of the edge, otherwise 0, Represents the sum of the weights of the edges in the community C (including the points in the community and the points outside the community), and m represents the sum of the weights of all the edges. Representing the summation of all associations, Represents only the internal matrix of the community C All elements of the sum are summed, The specific expression is as follows:
In this step, preferably, an iterative algorithm similar to the Louvain algorithm can be used to complete the community partitioning using the module degrees defined above.
4 is a flow chart of an iterative algorithm applicable to the embodiment of FIG.
Referring to FIG. 4, in step 410, an initialization process is first performed to classify each node in a connected subgraph into a different community.
Then proceed to step 420. In this step, the module degree defined by the above formula (15) is used to perform an iterative operation for each node in the connected subgraph. Taking the i-th node in the connected sub-picture as an example, the node i is first assigned to the community to which each of its neighbor nodes belongs, and then the module change value before and after the allocation is calculated, thereby obtaining the relationship with the node i. One or more module degree change values. In this embodiment, the module degree change value can be determined according to the following formula:
among them Indicates the sum of the weights of the connected edges of node i and the internal nodes of community c.
After obtaining one or more module degree change values associated with the node i according to the above equations (18) and (19), if the maximum value max of the module degree change values is judged >0, assign node i to max The corresponding community to which the neighbor node belongs, otherwise the node i remains unchanged in the original community.
Then proceed to step 430. In this step, it is determined whether the state of the belonging community of all nodes changes before and after the current execution step 420. If the change occurs, the process returns to step 420, otherwise, the process proceeds to step 440.
In step 440, the connected subgraph is compressed in the following manner: the nodes belonging to the same community are compressed into a new node, the weights of the edges between the nodes in the community are converted into the weights of the rings of the new node, and the edge weights between the communities are transformed. The edge weight between the new nodes.
Then proceed to step 450. In this step, the module degree of the compressed connected sub-picture generated in step 440 is determined in accordance with the above equations (15)-(17), and then proceeds to step 460.
In step 460, it is determined whether the difference between the module degree determined in step 450 and the module degree of the connected sub-picture before the step 440 is less than a preset threshold. If yes, the process proceeds to step 470 to output the current processing connection. The result of the community division of the subgraph, otherwise returns to step 420.
5 is a flow diagram of a method of determining a risk metric for a community that may be applied to the embodiment of FIG. 1. For the sake of convenience, the description herein determines an example of a risk metric for a community k.
The flow shown in FIG. 5 begins at step 510. In this step, determining the average trading time of the society for which the risk measure is to be determined during the time period T m . Preferably, for each transaction of the association during the period of time, the transaction time can be determined by using the first transaction as the time reference point.
Then proceed to step 520. For each transaction of the association during that period of time, determine the absolute value of the difference between its trading time and the average trading time. , where h is the index number of the transaction.
Then proceed to step 530, according to The value of each transaction are classified into a plurality of sections in the respective sections, and counting the number of transactions in each section with the ratio of the total number of transactions in association T m during the time period.
Then, proceeding to step 540, a transaction time entropy H C for reflecting the correlation between the transaction time and the abnormal transaction is determined according to the following formula:
Here n is the total number of intervals, and P i represents the ratio of the number of transactions in the i-th interval to the total number of transactions of the society during the time period T m .
It can be seen from equation (20) that in a time period, if the transaction time entropy within a society is smaller, the more concentrated the transaction activity time is, the more likely the transaction is abnormal.
Next, proceeding to step 550, an overall risk factor for the community is determined. Preferably, the overall risk factor It can be determined by the following formula:
Here a standardized value for the number of nodes within the community k, The normalized value of the total number of transactions for the community k during the time period T m , The normalized value of the total transaction amount for the community k during the time period T m , The normalized value of the average degree of the nodes in the community k, a normalized value of the transaction time entropy for the community k during the time period T m , It is a weight value and can be set according to the actual application.
Calculated by equation (21) The larger the value, the greater the risk of abnormal trading.
Optionally, but not necessarily, for a plurality of communities within a network map or a connected subgraph, they can be ranked from highest to lowest according to the overall risk factor determined by the method shown in FIG. 5, wherein the top 5% The associations are rated as level I suspicious societies, and between 5% and 10% of clubs are rated as level II suspicious societies.
In the above embodiment of the means of FIG. 1-5, it describes a method for identifying a time period in association unusual transactions in T m. The above embodiments can also be extended to the identification of abnormal transaction communities within a plurality of time periods. When it is desired to monitor trading activity over a longer span of time periods, it is advantageous to divide the long span time period into multiple time periods in view of possible changes in the community.
For example, a longer span of time periods (eg, one week, one month, or half a year, etc.) can be divided into n time periods, and then in each time period, the embodiments described above with reference to FIGS. 1-5 are employed, respectively. Identify unusual trading communities. In view of the large amount of data, it is preferable to divide the community by the following incremental method. Specifically, after the community division is completed in the first time period T i , the community label corresponding to each node is retained; and then, when the community is divided into the next time period T i+1 , the time period is taken. The intersection of all nodes with all the nodes in the previous time period, and the community label corresponding to the node of the intersection part is used as the initial label of the relevant node of the current time period, and the nodes without the social label are initialized as the association to which they belong. Then, the community division operation is performed on this basis. This method can greatly speed up the convergence speed of community division operations.
6 is a block diagram of an apparatus for identifying an abnormal transaction community in accordance with another embodiment of the present invention.
The apparatus 60 shown in FIG. 6 includes a memory 610, a processor 620, and a computer program 630 stored on the memory 610 and executable on the processor 620, wherein the computer program 630 is executable by running on the processor 620. The method of the embodiment described with reference to Figures 1-3 is as above.
7 is a block diagram of an apparatus for identifying an abnormal transaction community in accordance with another embodiment of the present invention.
The device 70 shown in FIG. 7 includes a first module 710, a second module 720, and a third module 730. The first module 710 is configured to construct a network map related to transaction events between multiple accounts. , wherein each node of the network map represents one of the plurality of accounts, and an edge connecting the two nodes indicates that a transaction has occurred between accounts associated with the two nodes, wherein The direction of the transaction represents the direction of the transaction; the second module 720 is configured to determine from the network map as one or more communities; and the third module 730 is configured to determine its corresponding risk metric according to the transaction information of the community, the risk The metric is used to determine if the association belongs to an abnormal trading community.
According to one aspect of the invention, a computer readable storage medium is provided having stored thereon a computer program that, when executed by a processor, implements the method of the embodiment described with reference to Figures 1-3.
The above embodiment of the present invention has the following advantages over the prior art:
1. Do not rely on the information of existing cases, and can actively discover high-risk illegal trading gangs only from massive transactions.
2. By creatively combining the community discovery algorithm with the dynamic money laundering mode, a time-series directed community discovery algorithm with special targeting for anti-money laundering is formed, which enables accurate community division in the sense of money laundering.
3. It can accurately quantify the abnormal abnormal trading risk of the association, and form a corporate money laundering risk rating according to the rating level. The business personnel can carry out more targeted anti-money laundering work according to the rating.
4. By dynamically analyzing the evolution of trading community structure over time in multiple time spans, it is possible to identify high-risk money laundering communities and analyze their inherent evolutionary laws.
The embodiments and examples set forth herein are provided to best illustrate the embodiments of the present invention and the specific application thereof, and thereby enabling those skilled in the art to make and use the invention. However, those skilled in the art will appreciate that the above description and examples are provided for ease of illustration and illustration. The descriptions are not intended to cover the various aspects of the invention or to limit the invention to the precise forms disclosed.
In view of the above, the scope of the present disclosure is determined by the scope of the following claims.
110‧‧‧步驟110‧‧‧Steps
120‧‧‧步驟 120‧‧‧Steps
130‧‧‧步驟 130‧‧‧Steps
210‧‧‧步驟 210‧‧‧Steps
220‧‧‧步驟 220‧‧‧Steps
230‧‧‧步驟 230‧‧‧Steps
310‧‧‧步驟 310‧‧‧Steps
320‧‧‧步驟 320‧‧‧Steps
330‧‧‧步驟 330‧‧‧Steps
410‧‧‧步驟 410‧‧‧Steps
420‧‧‧步驟 420‧‧ steps
430‧‧‧步驟 430‧‧ steps
440‧‧‧步驟 440‧‧‧Steps
450‧‧‧步驟 450‧‧‧Steps
460‧‧‧步驟 460‧‧ steps
470‧‧‧步驟 470‧‧‧ steps
510‧‧‧步驟 510‧‧ steps
520‧‧‧步驟 520‧‧‧Steps
530‧‧‧步驟 530‧‧‧Steps
540‧‧‧步驟 540‧‧‧Steps
550‧‧‧步驟 550‧‧ steps
610‧‧‧記憶體 610‧‧‧ memory
620‧‧‧處理器 620‧‧‧ processor
630‧‧‧計算機程序 630‧‧ computer program
710‧‧‧第一模組 710‧‧‧ first module
720‧‧‧第二模組 720‧‧‧ second module
730‧‧‧第三模組 730‧‧‧ third module
本發明的上述和/或其它方面和優點將通過以下結合附圖的各個方面的描述變得更加清晰和更容易理解，附圖中相同或相似的單元採用相同的標號表示。附圖包括：The above and/or other aspects and advantages of the present invention will be more clearly understood and understood from The drawings include:
圖1為按照本發明一個實施例的用於識別異常交易社團的方法的流程圖。 1 is a flow chart of a method for identifying an abnormal transaction community in accordance with one embodiment of the present invention.
圖2為可應用於圖1所示實施例的確定社團方法的流程圖。 2 is a flow chart of a method of determining a community applicable to the embodiment of FIG. 1.
圖3為可應用於圖2所示實施例的社團劃分算法的流程圖。 3 is a flow chart of a community partitioning algorithm applicable to the embodiment of FIG. 2.
圖4為可應用於圖3所示實施例的迭代算法的流程圖。 4 is a flow chart of an iterative algorithm applicable to the embodiment of FIG.
圖5為可應用於圖1所示實施例的確定社團的風險量度的方法的流程圖。 5 is a flow diagram of a method of determining a risk metric for a community that may be applied to the embodiment of FIG. 1.
圖6為按照本發明另一個實施例的用於識別異常交易社團的裝置的框圖。 6 is a block diagram of an apparatus for identifying an abnormal transaction community in accordance with another embodiment of the present invention.
圖7為按照本發明另一個實施例的用於識別異常交易社團的裝置的框圖。 7 is a block diagram of an apparatus for identifying an abnormal transaction community in accordance with another embodiment of the present invention.
Claims (11)
Applications Claiming Priority (3)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| ??201711182339.8 | 2017-11-23 | ||
| CN201711182339.8 | 2017-11-23 | ||
| CN201711182339.8A CN108228706A (en) | 2017-11-23 | 2017-11-23 | For identifying the method and apparatus of abnormal transaction corporations |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| TW201926204A true TW201926204A (en) | 2019-07-01 |
| TWI759562B TWI759562B (en) | 2022-04-01 |
Family
ID=62652777
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| TW107141049A TWI759562B (en) | 2017-11-23 | 2018-11-19 | Method and apparatus for identifying abnormal trading communities |
Country Status (3)
| Country | Link |
|---|---|
| CN (1) | CN108228706A (en) |
| TW (1) | TWI759562B (en) |
| WO (1) | WO2019100967A1 (en) |
Families Citing this family (44)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN108228706A (en) * | 2017-11-23 | 2018-06-29 | 中国银联股份有限公司 | For identifying the method and apparatus of abnormal transaction corporations |
| CN109102151B (en) * | 2018-07-03 | 2021-08-31 | 创新先进技术有限公司 | Suspicious group identification method and device |
| CN109118053B (en) * | 2018-07-17 | 2022-04-05 | 创新先进技术有限公司 | Method and device for identifying card stealing risk transaction |
| CN109345252A (en) * | 2018-08-24 | 2019-02-15 | 阿里巴巴集团控股有限公司 | A kind of online trading control method, device and computer equipment |
| CN109146669A (en) * | 2018-08-24 | 2019-01-04 | 阿里巴巴集团控股有限公司 | Detection method, device and the server of abnormal funds transfer plan |
| CN109947865B (en) * | 2018-09-05 | 2023-06-30 | 中国银联股份有限公司 | Merchant classifying method and merchant classifying system |
| CN109272323B (en) * | 2018-09-14 | 2022-03-04 | 创新先进技术有限公司 | Risk transaction identification method, device, equipment and medium |
| CN111046237B (en) * | 2018-10-10 | 2024-04-05 | 京东科技控股股份有限公司 | User behavior data processing method and device, electronic equipment and readable medium |
| CN109460664B (en) * | 2018-10-23 | 2022-05-03 | 北京三快在线科技有限公司 | Risk analysis method and device, electronic equipment and computer readable medium |
| CN109598511B (en) * | 2018-11-05 | 2023-06-20 | 创新先进技术有限公司 | Account risk identification method, device and equipment |
| CN109615521A (en) * | 2018-12-26 | 2019-04-12 | 天翼电子商务有限公司 | Anti- arbitrage recognition methods, system and server based on anti-arbitrage model of marketing |
| CN109872232A (en) * | 2019-01-04 | 2019-06-11 | 平安科技（深圳）有限公司 | It is related to illicit gain to legalize account-classification method, device, computer equipment and the storage medium of behavior |
| CN111754342B (en) * | 2019-03-26 | 2024-05-24 | 众安信息技术服务有限公司 | Method, system and device for obtaining circulation speed of block chain encrypted currency |
| CN111951021A (en) * | 2019-05-15 | 2020-11-17 | 财付通支付科技有限公司 | Method and device for discovering suspicious communities, storage medium and computer equipment |
| CN110222297B (en) * | 2019-06-19 | 2021-07-23 | 武汉斗鱼网络科技有限公司 | Identification method of tag user and related equipment |
| CN110490730B (en) * | 2019-08-21 | 2022-07-26 | 北京顶象技术有限公司 | Abnormal fund aggregation behavior detection method, device, equipment and storage medium |
| CN110544104B (en) * | 2019-09-04 | 2024-01-23 | 北京趣拿软件科技有限公司 | Account determination method and device, storage medium and electronic device |
| CN110705995B (en) * | 2019-10-10 | 2022-08-30 | 支付宝(杭州)信息技术有限公司 | Data tagging method and device |
| CN110717758B (en) * | 2019-10-10 | 2021-04-13 | 支付宝(杭州)信息技术有限公司 | Abnormal transaction identification method and device |
| CN111177477B (en) * | 2019-12-06 | 2023-06-20 | 东软集团股份有限公司 | Method, device and equipment for determining suspicious group |
| CN111161063A (en) * | 2019-12-12 | 2020-05-15 | 厦门市美亚柏科信息股份有限公司 | Capital account identification method based on graph calculation and computer readable storage medium |
| CN112990919A (en) * | 2019-12-17 | 2021-06-18 | 中国银联股份有限公司 | Information processing method and device |
| CN111242763A (en) * | 2020-01-07 | 2020-06-05 | 北京明略软件系统有限公司 | Method and device for determining target user group |
| CN111340622A (en) * | 2020-02-21 | 2020-06-26 | 中国银联股份有限公司 | Abnormal transaction cluster detection method and device |
| CN113313505B (en) * | 2020-02-25 | 2023-07-25 | 中国移动通信集团浙江有限公司 | Abnormality positioning method and device and computing equipment |
| CN111401959B (en) * | 2020-03-18 | 2023-09-29 | 多点(深圳)数字科技有限公司 | Risk group prediction method, apparatus, computer device and storage medium |
| CN111476662A (en) * | 2020-04-13 | 2020-07-31 | 中国工商银行股份有限公司 | Anti-money laundering identification method and device |
| CN111612041B (en) * | 2020-04-24 | 2023-10-13 | 平安直通咨询有限公司上海分公司 | Abnormal user identification method and device, storage medium and electronic equipment |
| CN111612039B (en) * | 2020-04-24 | 2023-09-29 | 平安直通咨询有限公司上海分公司 | Abnormal user identification method and device, storage medium and electronic equipment |
| CN111770047B (en) * | 2020-05-07 | 2022-09-23 | 拉扎斯网络科技（上海）有限公司 | Abnormal group detection method, device and equipment |
| CN111339376B (en) * | 2020-05-15 | 2020-10-27 | 支付宝(杭州)信息技术有限公司 | Method and device for clustering network nodes |
| CN111740977B (en) * | 2020-06-16 | 2022-06-21 | 北京奇艺世纪科技有限公司 | Voting detection method and device, electronic equipment and computer readable storage medium |
| CN111652718B (en) * | 2020-07-09 | 2023-07-28 | 平安银行股份有限公司 | Value flow direction monitoring method, device, equipment and medium based on relational network graph |
| CN111831923A (en) * | 2020-07-14 | 2020-10-27 | 北京芯盾时代科技有限公司 | Method, device and storage medium for identifying associated specific account |
| CN112052404B (en) * | 2020-09-23 | 2023-08-15 | 西安交通大学 | Group discovery method, system, equipment and medium of multi-source heterogeneous relation network |
| CN112381544B (en) * | 2020-11-16 | 2022-09-02 | 支付宝(杭州)信息技术有限公司 | Subgraph determination method and device and electronic equipment |
| CN112491900B (en) * | 2020-11-30 | 2023-04-18 | 中国银联股份有限公司 | Abnormal node identification method, device, equipment and medium |
| CN112989272B (en) * | 2020-12-31 | 2024-02-27 | 中科院计算技术研究所大数据研究院 | Community discovery algorithm based on local path |
| CN113487427A (en) * | 2021-04-20 | 2021-10-08 | 微梦创科网络科技（中国）有限公司 | Transaction risk identification method, device and system |
| CN113393250A (en) * | 2021-06-09 | 2021-09-14 | 北京沃东天骏信息技术有限公司 | Information processing method and device and storage medium |
| CN113554308B (en) * | 2021-07-23 | 2024-05-28 | 中信银行股份有限公司 | User community division and risk user identification method and device and electronic equipment |
| CN113837874B (en) * | 2021-11-22 | 2022-04-12 | 北京芯盾时代科技有限公司 | Data identification method and device, storage medium and electronic equipment |
| CN115048436A (en) * | 2022-06-01 | 2022-09-13 | 优米互动(北京)科技有限公司 | High-dimensional financial time sequence stage division method based on visual principle |
| CN116340090A (en) * | 2023-02-09 | 2023-06-27 | 中科南京软件技术研究院 | Method, device, equipment and storage medium for identifying software based on interaction sequence |
Family Cites Families (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| TW201123055A (en) * | 2009-12-31 | 2011-07-01 | Yao-Lang Guo | Method of monitoring and evaluating securities trade safety. |
| CN104751566B (en) * | 2013-12-30 | 2018-11-27 | 中国银联股份有限公司 | It monitors the method for pseudo- card risk and realizes the transaction processing system of this method |
| CN105335855A (en) * | 2014-08-06 | 2016-02-17 | 阿里巴巴集团控股有限公司 | Transaction risk identification method and apparatus |
| CN105988998B (en) * | 2015-01-27 | 2021-02-26 | 创新先进技术有限公司 | Relational network construction method and device |
| CN105931046A (en) * | 2015-12-16 | 2016-09-07 | 中国银联股份有限公司 | Suspected transaction node set detection method and device |
| CN107103171B (en) * | 2016-02-19 | 2020-09-25 | 阿里巴巴集团控股有限公司 | Modeling method and device of machine learning model |
| CN108228706A (en) * | 2017-11-23 | 2018-06-29 | 中国银联股份有限公司 | For identifying the method and apparatus of abnormal transaction corporations |
-
2017
- 2017-11-23 CN CN201711182339.8A patent/CN108228706A/en active Pending
-
2018
- 2018-11-13 WO PCT/CN2018/115141 patent/WO2019100967A1/en active Application Filing
- 2018-11-19 TW TW107141049A patent/TWI759562B/en active
Also Published As
| Publication number | Publication date |
|---|---|
| WO2019100967A1 (en) | 2019-05-31 |
| CN108228706A (en) | 2018-06-29 |
| TWI759562B (en) | 2022-04-01 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| WO2019100967A1 (en) | Method and device for identifying social group having abnormal transaction activity | |
| de Blas et al. | Combined social networks and data envelopment analysis for ranking | |
| CN110490730B (en) | Abnormal fund aggregation behavior detection method, device, equipment and storage medium | |
| CN102801629B (en) | Traffic matrix estimation method | |
| Ma et al. | Decomposition-based multiobjective evolutionary algorithm for community detection in dynamic social networks | |
| WO2019200739A1 (en) | Data fraud identification method, apparatus, computer device, and storage medium | |
| JP6553816B2 (en) | User data sharing method and apparatus | |
| CN111368147A (en) | Graph feature processing method and device | |
| CN112819353A (en) | Risk analysis method based on enterprise graph and computer equipment | |
| CN111178957A (en) | Method for early warning sudden increase of electric quantity of electricity consumption customer | |
| CN109977131A (en) | A kind of house type matching system | |
| CN113112186A (en) | Enterprise evaluation method, device and equipment | |
| Rahman et al. | To predict customer churn by using different algorithms | |
| Fei et al. | Efficient solution selection for two-stage stochastic programs | |
| Yan et al. | The impact of capital market opening on stock market stability: Based on D-MST method complex network perspective | |
| Hao et al. | Research on accurate identification of poor students in colleges based on big data analysis | |
| Yu et al. | Violations detection of listed companies based on decision tree and K-nearest neighbor | |
| TWM596940U (en) | Real estate appraisal system | |
| JP2017509047A (en) | Report on technology sector size using patent assets | |
| TWM568442U (en) | Cash flow grouping system | |
| Guo et al. | FedCSL: A Scalable and Accurate Approach to Federated Causal Structure Learning | |
| Feng et al. | Systemic risk models for disjoint and overlapping groups with equilibrium strategies | |
| TWI759702B (en) | Real estate appraisal system | |
| TWI657393B (en) | Marketing customer group prediction system and method | |
| TWI678671B (en) | Gold flow grouping method and system |