WO2019140804A1 - 一种可疑交易监测方法、装置、设备及存储介质 - Google Patents

一种可疑交易监测方法、装置、设备及存储介质 Download PDF

Info

Publication number
WO2019140804A1
WO2019140804A1 PCT/CN2018/084554 CN2018084554W WO2019140804A1 WO 2019140804 A1 WO2019140804 A1 WO 2019140804A1 CN 2018084554 W CN2018084554 W CN 2018084554W WO 2019140804 A1 WO2019140804 A1 WO 2019140804A1
Authority
WO
WIPO (PCT)
Prior art keywords
transaction
suspicious
suspicious transaction
indicator
customer
Prior art date
Application number
PCT/CN2018/084554
Other languages
English (en)
French (fr)
Inventor
谢翠萍
冯跃东
刘晓兰
邱海燕
谭志荣
魏尧东
Original Assignee
平安科技（深圳）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 平安科技（深圳）有限公司 filed Critical 平安科技（深圳）有限公司
Publication of WO2019140804A1 publication Critical patent/WO2019140804A1/zh

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q40/00—Finance; Insurance; Tax strategies; Processing of corporate or income taxes
    • G06Q40/04—Trading; Exchange, e.g. stocks, commodities, derivatives or currency exchange

Definitions

  • the present application relates to the field of fund transaction monitoring, and in particular, to a suspicious transaction monitoring method, device, device and storage medium.
  • Money laundering refers to money laundering activities that cover and conceal drug crimes, organized crimes of the underworld nature, terrorist crimes, smuggling crimes, corruption and bribery crimes, crimes of financial management order, and other sources of crime and the sources and nature of their proceeds.
  • Common ways of money laundering are widely involved in various fields such as banking, insurance, securities, and real estate.
  • Anti-money laundering is a systematic project in which the government uses legislation and judicial power to mobilize relevant organizations and commercial organizations to identify possible money laundering activities, dispose of the relevant funds, and punish relevant institutions and individuals to achieve the purpose of preventing criminal activities. . Therefore, how to effectively prevent the fight against money laundering has become a hot issue in the current society.
  • the present application provides a suspicious transaction monitoring method, apparatus, device and storage medium, which can solve the technical problem of how to effectively utilize various suspicious transaction monitoring rules or indicators that have been determined to realize suspicious transaction monitoring.
  • the present application provides a suspicious transaction monitoring method, the method comprising the following steps:
  • the present application further provides a suspicious transaction monitoring device, the device comprising:
  • An information extraction module configured to acquire transaction information of a customer, and extract transaction data of a preset type from the transaction information
  • An indicator obtaining module configured to obtain a suspicious transaction indicator table corresponding to each suspicious transaction monitoring model
  • a data matching module configured to detect whether the transaction data falls within a data range of the suspicious transaction indicator table
  • the behavior determining module is configured to determine that the transaction behavior of the customer belongs to a suspicious transaction behavior when the transaction data falls within a data range of the suspicious transaction indicator table.
  • the present application further provides a suspicious transaction monitoring device, the device comprising: a memory, a processor, and a suspicious transaction monitoring program stored on the memory and operable on the processor,
  • the suspicious transaction monitoring program is configured to implement the steps of the suspicious transaction monitoring method as described above.
  • the present application further provides a storage medium on which a suspicious transaction monitoring program is stored, and when the suspicious transaction monitoring program is executed by the processor, the suspicious transaction as described above is implemented. The steps of the monitoring method.
  • the present application extracts the transaction data of the preset type from the transaction information by acquiring the transaction information of the customer; acquires a suspicious transaction indicator table corresponding to each suspicious transaction monitoring model; and detects whether the transaction data falls into the suspicious transaction index
  • the data range of the table when the transaction data falls within the data range of the suspicious transaction indicator table, determining that the transaction behavior of the customer belongs to a suspicious transaction behavior, because the customer transaction is based on the indicator table corresponding to each suspicious transaction monitoring model
  • the data is matched, so that the rules or indicators corresponding to the various suspicious transaction monitoring models that have been determined can be effectively utilized, and the suspicious transaction monitoring can be realized while maximally saving manpower and material resources.
  • FIG. 1 is a schematic structural diagram of a suspicious transaction monitoring device in a hardware operating environment according to an embodiment of the present application
  • FIG. 2 is a schematic flow chart of a first embodiment of a suspicious transaction monitoring method according to the present application
  • FIG. 3 is a schematic flow chart of a second embodiment of a suspicious transaction monitoring method according to the present application.
  • FIG. 4 is a schematic flow chart of a third embodiment of a suspicious transaction monitoring method according to the present application.
  • FIG. 5 is a structural block diagram of a first embodiment of a suspicious transaction monitoring apparatus according to the present application.
  • FIG. 1 is a schematic structural diagram of a suspicious transaction monitoring device in a hardware operating environment according to an embodiment of the present application.
  • the suspicious transaction monitoring device may include a processor 1001, such as a CPU, a communication bus 1002, a user interface 1003, a network interface 1004, a memory 1005, and a vehicle bus interface 1006.
  • the communication bus 1002 is used to implement connection communication between these components.
  • the user interface 1003 can include a display, an input unit such as a keyboard, and the optional user interface 1003 can also include a standard wired interface, a wireless interface.
  • the network interface 1004 can optionally include a standard wired interface, a wireless interface (such as a WI-FI interface).
  • the memory 1005 may be a high speed RAM memory or a stable memory (non-volatile) Memory), such as disk storage.
  • the memory 1005 can also optionally be a storage device independent of the aforementioned processor 1001.
  • Car bus interface 1006, can be the controller area network (Controller Area Network, CAN) bus interface.
  • FIG. 1 does not constitute a definition of a suspicious transaction monitoring device, may include more or fewer components than illustrated, or combine some components, or different component arrangements.
  • an operating system may be included in the memory 1005 as a computer storage medium.
  • the network interface 1004 is mainly used to connect to a server and perform data communication with the server; the user interface 1003 is mainly used to connect the user terminal and perform data interaction with the user terminal; the processor in the present application 1001.
  • the memory 1005 may be disposed in the suspicious transaction monitoring device.
  • the suspicious transaction monitoring device invokes the suspicious transaction monitoring program stored in the memory 1005 by the processor 1001, and performs an operation in the embodiment of the suspicious transaction monitoring method of the present application.
  • FIG. 2 is a schematic flowchart diagram of a first embodiment of a suspicious transaction monitoring method according to the present application.
  • the suspicious transaction monitoring method includes the following steps:
  • Step S10 acquiring transaction information of the customer, and extracting transaction data of a preset type from the transaction information;
  • the transaction information may be information that reflects the trend of the capital transaction of the customer within a certain period of time, such as: transaction time, transaction amount, transaction currency, transaction number and the like.
  • the preset type may be summarized or summarized according to a plurality of suspicious monitoring models, and the type of the pre-set transaction data extraction, such as: source of funds/use, amount of funds, public/private, currency, and means of transaction (Cash/transfer), etc., the type of the transaction information to be acquired and the type of the transaction data to be extracted may be determined according to actual conditions, and this embodiment does not limit this.
  • Step S20 Acquire a suspicious transaction indicator table corresponding to each suspicious transaction monitoring model
  • the suspicious transaction monitoring model may be based on the No. 2 Order of the People's Bank of China, “Administrative Measures for Large-Scale Transactions and Suspicious Transaction Reports of Financial Institutions”, for which four large transactions and 18 suspicious rules are Various suspicious transaction monitoring models pre-built or trained with a large number of historical suspicious transaction data, such as: centralized transfer to and from the monitoring model in the short term, and centralized transfer to and out of the monitoring model in the long term.
  • the suspicious transaction indicator table may be an indicator table established according to suspicious transaction indicators corresponding to different suspicious transaction monitoring models (for example, transaction amount, customer type, ratio of transfer-out times, etc.).
  • Step S30 detecting whether the transaction data falls within a data range of the suspicious transaction indicator table
  • the suspicious transaction indicator table includes indicator data for determining whether the transaction is a suspicious transaction; the indicator data may be information extracted from a customer's transaction flow, account information, and customer information, or may be The information calculated by the aforementioned directly extracted information.
  • the indicator data in the embodiment may be divided into multiple levels according to different acquisition methods, for example, information that can be extracted from the customer's transaction flow, account information, and customer information (transfer transfer amount, transfer transfer amount, etc.)
  • the calculation of the level indicators is also calculated based on the higher level indicators (first level indicators and/or second level indicators).
  • the transaction data may be matched according to the suspicious transaction indicator table, and whether all transaction data in the transaction data of the customer falls into the suspicious transaction indicator table is detected. data range.
  • the embodiment further includes the step of: determining that the transaction behavior of the customer does not belong to the suspicious transaction behavior when the transaction amount in the transaction data does not exceed a preset threshold.
  • the preset threshold is a preset value of the transaction amount, that is, when the total amount of the transaction amount in the customer transaction data does not exceed the preset threshold, it can be determined that the customer must have no suspicious transaction behavior.
  • the preset threshold may be set according to an actual situation, which is not limited in this embodiment.
  • Step S40 When the transaction data falls within the data range of the suspicious transaction indicator table, it is determined that the transaction behavior of the customer belongs to a suspicious transaction behavior.
  • a suspicious transaction indicator table when it is detected that the customer's transaction data falls within the data range of a suspicious transaction indicator table, it can be determined that the customer's transaction behavior is a suspicious transaction behavior.
  • customer A's transaction data includes:
  • the transfer amount of the customer's local currency transfer was 200,000 yuan
  • the transfer amount of the local currency customer transfer is 5 million; (greater than the benchmark amount of the suspicious transaction indicator table of 4 million)
  • the local currency customer transfer transfer amount is 4.8 million
  • the number of transfers of local currency customers within 50 days is 50 times;
  • the number of transfers of local currency customers within 5 days is 5 times;
  • the transaction data of the customer A is detected according to the suspicious transaction indicator table corresponding to each system rule, and it is found that the transaction data of the customer A falls in the short-term Within the data range corresponding to the system rules of decentralized transfer and centralized transfer, it can be determined that the customer A triggers the system rule and there is suspicious transaction behavior.
  • the transaction information of the customer is obtained, and the transaction data of the preset type is extracted from the transaction information; the suspicious transaction indicator table corresponding to each suspicious transaction monitoring model is obtained; and the transaction data is detected to be suspicious.
  • a data range of the transaction indicator table when the transaction data falls within the data range of the suspicious transaction indicator table, determining that the transaction behavior of the customer belongs to a suspicious transaction behavior, because the indicator table corresponding to each suspicious transaction monitoring model is The customer transaction data is matched, so that the rules or indicators corresponding to the various suspicious transaction monitoring models that have been determined can be effectively utilized, and the suspicious transaction monitoring is realized while maximally saving manpower and material resources.
  • FIG. 3 a second embodiment of a suspicious transaction monitoring method of the present application is proposed based on the above first embodiment.
  • the method before the step S10, the method further includes the following steps:
  • Step S01 Acquire a suspicious transaction monitoring model set, where the suspicious transaction monitoring model set includes at least one suspicious transaction monitoring model;
  • the suspicious transaction monitoring model set may be a set comprising a plurality of suspicious transaction models constructed according to a large amount of historical suspicious transaction data.
  • the suspicious transaction monitoring model set includes at least one suspicious transaction monitoring model.
  • the set of suspicious transaction models does not constitute a limitation on a manifestation of a transaction including a plurality of suspicious transaction monitoring models.
  • the suspicious transaction monitoring model list may be established according to the name of each suspicious transaction monitoring model. The flow of this step.
  • Step S02 selecting a suspicious transaction monitoring model from the suspicious transaction monitoring model set
  • the manner of selecting the suspicious transaction monitoring model from the suspicious transaction monitoring model set in this step may be a random selection method, or may be according to other preset selection methods. For example: depending on the size of the model, the type or amount of transaction data involved in the model, and so on. This embodiment does not limit this.
  • Step S03 Acquire a suspicious transaction feature corresponding to the selected suspicious transaction monitoring model
  • the suspicious transaction feature may be a transaction rule or a characteristic result capable of characterizing or proving that the customer transaction is a suspicious transaction.
  • the obtaining of the suspicious transaction feature can be analyzed and summarized from a large number of historical suspicious transaction models by a computer or a manual, and the specific acquisition manner is not limited in this embodiment.
  • Step S04 splitting the suspicious transaction feature to obtain a suspicious transaction indicator table corresponding to the selected suspicious transaction monitoring model
  • the suspicious transaction characteristics need to be split.
  • the specific splitting method may be based on the public/private relationship, the receiving/paying, and the other party's public/ Different items such as private, cash/transfer, etc. are split into different system rules, and then the system rules are refined and split, the corresponding indicators are obtained, and corresponding indicator tables are established (ie, the suspicious transaction indicator table) ).
  • the suspicious transaction feature may be split according to a first preset rule, and a plurality of system rules corresponding to the suspicious transaction monitoring model are obtained, and a corresponding system rule table is established;
  • Each system rule in the system is split into a plurality of suspicious transaction indicators according to the second preset rule; determining an indicator level to which each suspicious transaction indicator belongs in the suspicious transaction indicator, and performing suspicious transaction indicators of different levels according to preset items
  • the classification schedule includes: an indicator code, an indicator name, and an indicator type; determining, according to the classified indicators at each level, the superior indicator corresponding to each indicator, obtaining the indicator code corresponding to the superior indicator, and the superior indicator
  • the corresponding indicator code is associated with the indicator code of the level, and a suspicious transaction indicator table is established according to the association result.
  • the first preset rule may be a splitting rule that can classify different transaction features according to a customer type, a currency, a monitored transaction type, a statistical period, and the like; the second preset rule may be Pre-set as the basis for splitting the rules of each system to obtain different levels of suspicious transaction indicators.
  • the highest level indicator includes: short-term foreign currency customer transfer transfer to transfer ratio, short-term The foreign currency customer transfer is transferred to the transfer ratio; then the secondary indicator corresponding to the third-level indicator is determined, including: the short-term foreign currency customer transfer transfer amount, the short-term foreign currency customer transfer transfer amount, and the short-term foreign currency customer transfer transfer time The number of transfers of foreign currency customers within a short period of time; finally, the first-level indicators corresponding to the second-level indicators, including: “short-term” specific time range, customer foreign currency transfer transfer amount, customer foreign currency transfer transfer amount, customer foreign currency transfer The number of transfers, the number of times the customer has transferred the foreign currency transfer, and the like, and the indicator code of the current level refers to the indicator code of the lower level indicator relative to the upper indicator code.
  • the corresponding suspicious transaction indicator table is established.
  • the indicators of each level are also classified, for example, each level of indicators is: index code, indicator name, indicator frequency
  • the index object, the indicator type, the belonging level, the superior level and other items are classified and arranged.
  • the upper level indicator corresponding to each indicator is determined according to the arrangement result, and then the indicator code corresponding to the superior indicator is obtained, and the upper indicator is obtained.
  • the corresponding indicator code is associated with the indicator code of the level, and a suspicious transaction indicator table is established according to the association result and the arrangement item corresponding to each indicator.
  • Step S05 Traverse the suspicious transaction monitoring model set, and obtain a suspicious transaction indicator table corresponding to each suspicious transaction monitoring model.
  • each suspicious transaction monitoring model in the suspicious transaction monitoring model set needs to be split into suspicious transaction features, and a suspicious transaction indicator table corresponding to each suspicious transaction monitoring model is obtained.
  • the method further includes: in response to the indicator modification instruction input by the staff, modifying the to-be-modified indicator in the suspicious transaction indicator table according to the indicator modification instruction, and modifying the suspicious transaction indicator table Save it.
  • the suspicious transaction monitoring model a centralized transfer to the outbound monitoring model in the short term, for example. Firstly, according to the monitoring model, determine the corresponding short-term centralized transfer and transfer of suspicious transaction characteristics, and then according to the customer type (for public and private), currency (local currency, foreign currency), the type of transaction being monitored (received and paid), The statistical cycle (short term), etc., can be divided into the following eight system rules: the suspicious transaction features corresponding to the transfer monitoring model in the short term are divided into the following eight system rules:
  • KY0101 Distribution of funds for public currency customers in a short period of time, centralized transfer
  • the three-level indicators corresponding to the system rules include: “Short-term local currency customer transfer transfer-to-transfer ratio (KH113004)” and “short-term local currency customer transfer transfer-to-out ratio (KH123003)”, where “KH113004” and “KH123003” is the indicator code; “the ratio of the local currency customer transfer to the transfer amount in the short term” and “the ratio of the local currency customer transfer to the transfer in the short term” is the indicator name; “20211104[L] (default is 90%) and 20211104[U] (default 110%)” is a defined parameter that can be obtained from a pre-established threshold table; “20311101[L] (parameters, default 6)" and "20211105[L] (default 4 million) are also Define parameters that can be obtained from a pre-established parameter list.
  • the secondary indicators associated with the three-level indicator in the system rules include “the number of local currency customer transfer transfers in the short term (KH112079) Use: KH110011", “Short-term local currency customer transfer transfer times (KH122080) Use: KH120009", “Short-term local currency customer transfer transfer amount (KH112077) Use: KH110012” and “Short-term local currency customer transfer transfer amount (KH122081) Use: KH120010".
  • the first-level indicators associated with the secondary indicators in the system include “customer local currency transfer transfer amount (KH110012)”, “customer local currency transfer transfer amount (KH120010)”, “customer local currency transfer transfer number (KH110011)” and “ The customer's local currency transfer times (KH120009) and the "short-term” specific time range (days).
  • mapping relationship between each indicator and the associated parameter may be established in advance, so as to obtain the corresponding parameter value through the mapping relationship;
  • the associated parameter may be stored in a pre-established parameter table or threshold table, where the parameter table may include: a parameter code, a parameter type, a parameter value type, a parameter value, a parameter description, etc., and the threshold table may include : Parameter code, parameter type, parameter object, currency type, upper and lower limit of problem value range, parameter description, etc.
  • the specific content in the parameter table and the threshold table may be added, deleted, or set according to actual conditions, and no limitation is imposed thereon.
  • the suspicious transaction monitoring model set includes at least one suspicious transaction monitoring model; selecting a suspicious transaction monitoring model from the suspicious transaction monitoring model set; and obtaining the selected suspicious transaction monitoring model corresponding to The suspicious transaction feature; splitting the suspicious transaction feature to obtain a corresponding suspicious transaction indicator table; traversing the suspicious transaction monitoring model set, and obtaining a suspicious transaction indicator table corresponding to each suspicious transaction monitoring model, thereby being able to clearly
  • the suspicious transaction detection model is split into corresponding suspicious transaction indicator tables, which makes the suspicious transaction model regularized and reduces the workload of post-maintenance.
  • FIG. 4 a third embodiment of a suspicious transaction monitoring method of the present application is proposed based on the above embodiments.
  • the suspicious transaction monitoring method proposed in this embodiment further includes the following steps after the step S40:
  • Step S50 Acquire the identity, financial status and/or business operation information of the customer
  • the customer when it is determined that the customer has a suspicious transaction behavior, in order to further determine whether the customer has an illegal behavior (for example, money laundering behavior), it is necessary to check the customer's other information concerning the property and income; specifically, it may be Obtain information about the customer's identity (family situation, work status, etc.), financial status (income/expenditure, personal assets, etc.) and/or business operations (main business, business income/expenses, etc.).
  • an illegal behavior for example, money laundering behavior
  • Step S60 When the transaction data does not match the identity, financial status and/or business operation information of the customer, it is determined that the customer has an illegal behavior.
  • customer B is a private employee of a private enterprise, and his spouse is a self-employed person.
  • the average annual income per capita is 100,000 in the past five years, and the husband and wife have no other sources of income.
  • the transaction data of the latest three months is found in the transaction data of customer B.
  • the amount of money in and out is as high as 5 million, which is obviously inconsistent with the identity, financial status and/or business information of customer B. At this time, it can be determined that the customer has illegal behavior.
  • the customer by determining the identity, financial status, and/or business operation information of the customer having the suspicious transaction behavior, the customer is determined to be inconsistent with the identity, financial status, and/or business operation information of the customer.
  • the suspicious transaction indicator includes: a basic indicator and a rule indicator; correspondingly, the step S40 may specifically include: detecting whether the transaction data matches the basic indicator; When the transaction data matches the basic indicator, detecting whether the remaining transaction data in the transaction data falls within a data range of the rule indicator; the remaining transaction data in the transaction data falls into the rule When the data range of the indicator is determined, it is determined that the transaction behavior of the customer is a suspicious transaction behavior.
  • the rule indicator may be the highest level indicator of the suspicious transaction indicator corresponding to each system rule; the basic indicator is an indicator of all levels below the level corresponding to the rule indicator, for example, system rules.
  • C corresponds to the first, second and third level indicators, of which the third level indicator is the rule indicator, and the first level indicator and the second level indicator are the basic indicators.
  • the suspicious transaction index by dividing the suspicious transaction index into the basic indicator and the rule indicator, when the transaction data of the client is matched, detecting whether the transaction data matches the basic indicator; in the transaction data and the basic indicator When matching, detecting whether the remaining transaction data in the transaction data falls within the data range of the rule indicator; when the remaining transaction data in the transaction data falls within the data range of the rule indicator, determining the client
  • the trading behavior is suspicious trading behavior, so that it can detect whether the customer has suspicious trading behavior based on the basic indicators.
  • the customer's transaction data is found to be inconsistent with the basic indicators, the customer can quickly determine that the customer does not have suspicious trading behavior and raise the suspicious behavior. The efficiency of transaction monitoring.
  • FIG. 5 is a structural block diagram of a first embodiment of a suspicious transaction monitoring apparatus according to the present application.
  • the suspicious transaction monitoring apparatus 101 of the present embodiment includes: an information extraction module 1010, an index acquisition module 1011, a data matching module 1012, and a behavior determination module 1013;
  • the information extraction module 1010 is configured to acquire transaction information of a client, and extract transaction data of a preset type from the transaction information;
  • the indicator obtaining module 1011 is configured to obtain a suspicious transaction indicator table corresponding to each suspicious transaction monitoring model
  • the data matching module 1012 is configured to detect whether the transaction data falls within a data range of the suspicious transaction indicator table
  • the behavior determining module 1013 is configured to determine that the transaction behavior of the customer belongs to a suspicious transaction behavior when the transaction data falls within a data range of the suspicious transaction indicator table.
  • the transaction information of the customer is obtained, and the transaction data of the preset type is extracted from the transaction information; the suspicious transaction indicator table corresponding to each suspicious transaction monitoring model is obtained; and the transaction data is detected to be suspicious.
  • a data range of the transaction indicator table when the transaction data falls within the data range of the suspicious transaction indicator table, determining that the transaction behavior of the customer belongs to a suspicious transaction behavior, because the indicator table corresponding to each suspicious transaction monitoring model is The customer transaction data is matched, so that the rules or indicators corresponding to the various suspicious transaction monitoring models that have been determined can be effectively utilized, and the suspicious transaction monitoring is realized while maximally saving manpower and material resources.
  • the suspicious transaction monitoring apparatus 101 of the present embodiment further includes: a model processing module; the model processing module, configured to acquire a suspicious transaction monitoring model set, where the suspicious transaction monitoring model set includes at least one suspicious transaction monitoring model; Selecting a suspicious transaction monitoring model from the suspicious transaction monitoring model set; obtaining suspicious transaction characteristics corresponding to the selected suspicious transaction monitoring model; splitting the suspicious transaction characteristics to obtain a corresponding suspicious transaction indicator table; traversing the traversal
  • the suspicious transaction monitoring model set obtains a list of suspicious transaction indicators corresponding to each suspicious transaction monitoring model.
  • the suspicious transaction monitoring apparatus 101 of the present embodiment further includes: a behavior verification module, where the behavior verification module is configured to acquire identity information, financial status, and/or business operation information of the customer; When the customer's identity information, financial status, and/or business operation information does not match, it is determined that the customer has an illegal behavior.
  • a behavior verification module configured to acquire identity information, financial status, and/or business operation information of the customer; When the customer's identity information, financial status, and/or business operation information does not match, it is determined that the customer has an illegal behavior.
  • the determination is performed.
  • the customer has an illegal behavior, can truly and accurately determine whether the customer's trading behavior is legal, and achieve effective supervision of financial activities.
  • the behavior determining module 1013 is further configured to detect whether the transaction data matches the basic indicator; and when the transaction data matches the basic indicator, detect remaining in the transaction data. Whether the transaction data falls within the data range of the rule indicator; when the remaining transaction data in the transaction data falls within the data range of the rule indicator, it is determined that the transaction behavior of the customer belongs to a suspicious transaction behavior.
  • the rule indicator may be the highest level indicator of the suspicious transaction indicator corresponding to each system rule; the basic indicator is an indicator of all levels below the level corresponding to the rule indicator, for example, system rules.
  • C corresponds to the first, second and third level indicators, of which the third level indicator is the rule indicator, and the first level indicator and the second level indicator are the basic indicators.
  • the suspicious transaction index by dividing the suspicious transaction index into the basic indicator and the rule indicator, when the transaction data of the client is matched, detecting whether the transaction data matches the basic indicator; in the transaction data and the basic indicator When matching, detecting whether the remaining transaction data in the transaction data falls within the data range of the rule indicator; when the remaining transaction data in the transaction data falls within the data range of the rule indicator, determining the client
  • the trading behavior is suspicious trading behavior, so that it can detect whether the customer has suspicious trading behavior based on the basic indicators.
  • the customer's transaction data is found to be inconsistent with the basic indicators, the customer can quickly determine that the customer does not have suspicious trading behavior and raise the suspicious behavior. The efficiency of transaction monitoring.
  • the present application further provides a storage medium on which a suspicious transaction monitoring program is stored, and when the suspicious transaction monitoring program is executed by the processor, the operation in the above-described suspicious transaction monitoring method embodiment is implemented.
  • the embodiment method can be implemented by means of software plus a necessary general hardware platform, and of course hardware, but in many cases the former is a better implementation.
  • a storage medium such as ROM/RAM, disk, light.
  • the disk includes a number of instructions for causing a terminal device (which may be a cell phone, a computer, a server, an air conditioner, or a network device, etc.) to perform the methods described in various embodiments of the present application.

Landscapes

  • Business, Economics & Management (AREA)
  • Accounting & Taxation (AREA)
  • Finance (AREA)
  • Engineering & Computer Science (AREA)
  • Development Economics (AREA)
  • Economics (AREA)
  • Marketing (AREA)
  • Strategic Management (AREA)
  • Technology Law (AREA)
  • Physics & Mathematics (AREA)
  • General Business, Economics & Management (AREA)
  • General Physics & Mathematics (AREA)
  • Theoretical Computer Science (AREA)
  • Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)

Abstract

本申请公开了一种可疑交易监测方法、装置、设备及存储介质，所述方法包括：获取客户的交易信息，从所述交易信息中提取预设类型的交易数据；获取各可疑交易监测模型分别对应的可疑交易指标表；检测所述交易数据是否落入所述可疑交易指标表的数据范围；在所述交易数据落入所述可疑交易指标表的数据范围时，判定所述客户的交易行为属于可疑交易行为。

Description

一种可疑交易监测方法、装置、设备及存储介质
技术领域
本申请涉及资金交易监测领域，尤其涉及一种可疑交易监测方法、装置、设备及存储介质。
背景技术
洗钱，是指通过各种方式掩饰、隐瞒毒品犯罪、黑社会性质的组织犯罪、恐怖活动犯罪、走私犯罪、贪污贿赂犯罪、破坏金融管理秩序犯罪等犯罪所得及其收益的来源和性质的洗钱活动，常见的洗钱途径广泛涉及银行、保险、证券、房地产等各种领域。
反洗钱是政府动用立法、司法力量，调动有关的组织和商业机构对可能的洗钱活动予以识别，对有关款项予以处置，对相关机构和人士予以惩罚，从而达到阻止犯罪活动目的的一项系统工程。因此，如何有效地防范打击洗钱活动，成为当前社会的一个热点问题。
在反洗钱工作中，会进行各种场景的可疑交易监测，以获得不同的可疑交易监测模型。在模型建立后，通常会根据已建立的模型确定若干规则、指标，然后再编写相应的程序，方便监测。一般情况下，每新建一个可疑交易监测模型后，就需要编写一套新的程序，程序的维护难度大，工作周期长。事实上，不同模型中往往会具有相同或相似的规则或者指标；现有的根据新模型编写新程序的方式就导致了这些相同或相似的规则或指标的利用率低，不能有效的利用已经确定的各种规则或指标，造成了人力、物力资源的浪费。
发明内容
本申请提供一种可疑交易监测方法、装置、设备及存储介质，其可解决如何有效的利用已经确定的各种可疑交易监测规则或指标，实现可疑交易监测的技术问题。
为实现上述目的，本申请提供了一种可疑交易监测方法，所述方法包括以下步骤:
获取客户的交易信息，从所述交易信息中提取预设类型的交易数据；
获取各可疑交易监测模型分别对应的可疑交易指标表；
检测所述交易数据是否落入所述可疑交易指标表的数据范围；
在所述交易数据落入所述可疑交易指标表的数据范围时，判定所述客户的交易行为属于可疑交易行为。
此外，为实现上述目的，本申请还提出一种可疑交易监测装置，所述装置包括：
信息提取模块，用于获取客户的交易信息，从所述交易信息中提取预设类型的交易数据；
指标获取模块，用于获取各可疑交易监测模型分别对应的可疑交易指标表；
数据匹配模块，用于检测所述交易数据是否落入所述可疑交易指标表的数据范围；
行为判定模块，用于在所述交易数据落入所述可疑交易指标表的数据范围时，判定所述客户的交易行为属于可疑交易行为。
此外，为实现上述目的，本申请还提出一种可疑交易监测设备，所述设备包括：存储器、处理器及存储在所述存储器上并可在所述处理器上运行的可疑交易监测程序，所述可疑交易监测程序配置为实现如上文所述的可疑交易监测方法的步骤。
此外，为实现上述目的，本申请还提出一种存储介质，所述计算机可读存储介质上存储有可疑交易监测程序，所述可疑交易监测程序被处理器执行时实现如上文所述的可疑交易监测方法的步骤。
本申请通过获取客户的交易信息，从所述交易信息中提取预设类型的交易数据；获取各可疑交易监测模型分别对应的可疑交易指标表；检测所述交易数据是否落入所述可疑交易指标表的数据范围；在所述交易数据落入所述可疑交易指标表的数据范围时，判定所述客户的交易行为属于可疑交易行为，由于是根据各可疑交易监测模型对应的指标表对客户交易数据进行匹配，从而能够有效的利用已经确定的各种可疑交易监测模型对应的规则或指标，在实现可疑交易监测的同时，最大化的节约人力、物力资源。
附图说明
图1为本申请实施例方案涉及的硬件运行环境的可疑交易监测设备的结构示意图；
图2为本申请一种可疑交易监测方法第一实施例的流程示意图；
图3为本申请一种可疑交易监测方法第二实施例的流程示意图；
图4为本申请一种可疑交易监测方法第三实施例的流程示意图；
图5为本申请一种可疑交易监测装置第一实施例的结构框图；
[根据细则91更正 16.07.2018]　
[根据细则91更正 16.07.2018]　
本申请目的的实现、功能特点及优点将结合实施例，参照附图做进一步说明。
具体实施方式
应当理解，此处所描述的具体实施例仅用以解释本申请，并不用于限定本申请。
参照图1，图1为本申请实施例方案涉及的硬件运行环境的可疑交易监测设备结构示意图。
如图1所示，该可疑交易监测设备可以包括：处理器1001，例如CPU，通信总线1002、用户接口1003，网络接口1004，存储器1005，车载总线接口1006。其中，通信总线1002用于实现这些组件之间的连接通信。用户接口1003可以包括显示屏（Display）、输入单元比如键盘（Keyboard），可选用户接口1003还可以包括标准的有线接口、无线接口。网络接口1004可选的可以包括标准的有线接口、无线接口（如WI-FI接口）。存储器1005可以是高速RAM存储器，也可以是稳定的存储器（non-volatile memory），例如磁盘存储器。存储器1005可选的还可以是独立于前述处理器1001的存储装置。车载总线接口1006，可以是控制器局域网络（Controller Area Network, CAN）总线接口。
本领域技术人员可以理解，图1中示出的结构并不构成对可疑交易监测设备的限定，可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件布置。
如图1所示，作为一种计算机存储介质的存储器1005中可以包括操作系统、网络通信模块、用户接口模块以及可疑交易监测程序。
在图1所示的可疑交易监测设备中，网络接口1004主要用于连接服务器，与服务器进行数据通信；用户接口1003主要用于连接用户终端，与用户终端进行数据交互；本申请中的处理器1001、存储器1005可以设置在所述可疑交易监测设备中，所述可疑交易监测设备通过处理器1001调用存储器1005中存储的可疑交易监测程序，并执行本申请可疑交易监测方法实施例中的操作。
参照图2，图2为本申请可疑交易监测方法第一实施例的流程示意图。
本实施例中，所述可疑交易监测方法包括以下步骤：
步骤S10：获取客户的交易信息，从所述交易信息中提取预设类型的交易数据；
需要说明的是，所述交易信息可以是能够反映客户一段时间内的资金交易动向的信息，例如：交易时间、交易金额、交易币种、交易次数等信息。所述预设类型可以是根据众多的可疑监测模型归纳或总结的，预先设定的交易数据提取的依据类型，例如：资金来源/用途、资金金额、对公/对私、币种、交易手段（现金/转账）等，具体的要获取的交易信息的种类以及交易数据的提取类型可根据实际情况而定，本实施例对此不加以限制。
步骤S20：获取各可疑交易监测模型分别对应的可疑交易指标表；
本实施例中，所述可疑交易监测模型可以是以人民银行2006年2号令《金融机构大额交易和可疑交易报告管理办法》为依据，针对其中的4条大额交易，18条可疑规则并结合大量历史可疑交易数据预先构建或训练出的各种可疑交易监测模型，例如：短期内集中转入转出监测模型、长期内集中转入转出监测模型等。相应地，所述可疑交易指标表可以是根据不同可疑交易监测模型对应的可疑交易指标（例如交易金额、客户类型、转入转出次数比等）建立的指标表。
步骤S30：检测所述交易数据是否落入所述可疑交易指标表的数据范围；
可理解的是，所述可疑交易指标表中包括有用于判定交易是否为可疑交易的指标数据；所述指标数据可以是从客户的交易流水、账户信息和客户信息中提取的信息，也可以是通过前述直接提取的信息计算得出的信息。本实施例中所述指标数据根据获取方式的不同可以分为多级，例如：可将从客户的交易流水、账户信息和客户信息中提取的信息（转账转入金额、转账转出金额等）作为一级指标，将根据提取的信息通过预设计算方式计算汇总获得的信息作为二级指标（例如：转账转入转出量比=转账转入金额÷转账转出金额）；相应地，三级指标的计算也依次根据上级指标（一级指标和/或二级指标）计算而来。
在具体实现中，在提取到客户的交易数据后，可根据可疑交易指标表对所述交易数据进行匹配，检测客户的交易数据中是否所有的交易数据均落入到所述可疑交易指标表的数据范围。
可理解的是，一般情况下，资金交易是否可疑主要看其当日或某一段时间内对应的交易总金额是否过大，如果对每个客户的交易数据都进行匹配、检测将会造成不必要的人力以及物力资源的浪费。因此，本实施例在所述步骤S30之后，还包括步骤：在所述交易数据中的交易金额不超过预设阈值时，判定所述客户的交易行为不属于可疑交易行为。其中，所述预设阈值为预先设定的交易金额数值，即当客户交易数据中的交易金额总数不超过所述预设阈值时，即可判定该客户一定不存在可疑交易行为。所述预设阈值可根据实际情况设定，本实施例对此不加以限制。
步骤S40：在所述交易数据落入所述可疑交易指标表的数据范围时，判定所述客户的交易行为属于可疑交易行为。
在具体实现中，当检测到客户的交易数据落入到某一可疑交易指标表的数据范围时，即可判定客户的交易行为属于可疑交易行为。此外需要说明的是，在对客户的交易数据进行匹配时，需要对所述交易数据中的各项数据进行匹配，若其中有一项数据匹配失败，则认定所述交易数据未落入到当前匹配的可疑交易指标表。
此处结合具体例子对本实施例进行说明。例如，客户A的交易数据包括：
客户类型为：“对公”，币种：“本币”，交易类型：收和付（转入/转出）
当天客户本币转账转入金额为20万；
当天客户本币转账转出金额为15万；
当天客户本币转账转入次数为12次；
当天客户本币转账转出次数为2次；
9天内本币客户转账转入金额为500万；（大于所述可疑交易指标表的基准额度400万）
9天内本币客户转账转出金额为480万；
9天内本币客户转账转入次数为50次；
9天内本币客户转账转出次数为5次；
9天内本币客户转账转入转出量比为（500/480）*100%=104%；（属于所述可疑交易指标表所默认的阈值范围[90%~110%]）
9天内本币客户转账转入转出次数比为（50/5）=10（大于所述可疑交易指标表所默认的次数6次）
在获取到客户A的上述交易数据后，根据各系统规则对应的所述可疑交易指标表对客户A的交易数据进行检测，发现该客户A的交易数据均落在【短期内对公本币客户资金分散转入、集中转出】的系统规则对应的数据范围内，此时就可以判定该客户A触发了该系统规则，存在可疑交易行为。
本实施例通过获取客户的交易信息，从所述交易信息中提取预设类型的交易数据；获取各可疑交易监测模型分别对应的可疑交易指标表；，检测所述交易数据是否落入所述可疑交易指标表的数据范围；在所述交易数据落入所述可疑交易指标表的数据范围时，判定所述客户的交易行为属于可疑交易行为，由于是根据各可疑交易监测模型对应的指标表对客户交易数据进行匹配，从而能够有效的利用已经确定的各种可疑交易监测模型对应的规则或指标，在实现可疑交易监测的同时，最大化的节约人力、物力资源。
进一步地，如图3所示，基于上述第一实施例提出本申请一种可疑交易监测方法第二实施例。
本实施例提出的可疑交易监测方法中在所述步骤S10之前，还包括如下步骤：
步骤S01：获取可疑交易监测模型集，所述可疑交易监测模型集包括至少一个可疑交易监测模型；
需要说明的是，所述可疑交易监测模型集可以是包含若干个根据大量历史可疑交易数据构建的可疑交易模型的集合，在本实施例中所述可疑交易监测模型集包括至少一个可疑交易监测模型。本实施例中，所述可疑交易模型集并不构成对包含多个可疑交易监测模型事物的表现形式的限定，例如：可以是根据各可疑交易监测模型的名称建立一个可疑交易监测模型列表来实现本步骤的流程。
步骤S02：从所述可疑交易监测模型集中选取一个可疑交易监测模型；
为了获取每一个可疑交易监测模型对应的可疑交易指标，本步骤中从所述可疑交易监测模型集中选取可疑交易监测模型的方式可以是随机选取的方式，也可以是按照其他预设的选取方式，例如：根据模型大小、模型涉及的交易数据的种类或数量的多少等。本实施例对此不加以限制。
步骤S03：获取被选取的可疑交易监测模型对应的可疑交易特征；
需要说明的是，所述可疑交易特征可以是能够表征或证明客户交易为可疑交易的交易规律或特性结果。所述可疑交易特征的获得可以通过计算机或人工从大量的历史可疑交易模型中分析归纳而来，其具体的获取方式本实施例对此不加以限制。
步骤S04：对所述可疑交易特征进行拆分，获取所述被选取的可疑交易监测模型对应的可疑交易指标表；
在获取可疑交易监测模型对应的可疑交易特征后，需要对可疑交易特征进行拆分，其具体的拆分方式可以是将这些可疑交易特征根据对公/对私,收/付，对方对公/对私,现金/转账等不同表项拆分成不同的系统规则，然后再将所述系统规则进行细化拆分，获得对应的指标，并建立对应的指标表（即所述可疑交易指标表）。
在具体实现中，可按第一预设规则对所述可疑交易特征进行拆分，获得所述可疑交易监测模型对应的若干个系统规则，并建立相应的系统规则表；将所述系统规则表中的各系统规则按照第二预设规则拆分为若干个可疑交易指标；确定所述可疑交易指标中各可疑交易指标所属的指标级别，并对不同级别的可疑交易指标按预设表项进行分类编排，所述预设表项包括：指标代码、指标名称以及指标类型；根据分类编排后的各级指标确定出各指标对应的上级指标，获取所述上级指标对应的指标代码，将上级指标对应的指标代码与本级指标代码进行关联，并根据关联结果建立可疑交易指标表。
需要说明的是：所述第一预设规则可以是根据客户类型、币种、被监测交易类型，统计周期等能够对不同交易特征进行分类的拆分规则；所述第二预设规则可以是预先设定的作为对各系统规则进行拆分以获取不同级别的可疑交易指标的依据。例如：先确定系统规则“短期内对公外币客户资金分散转入、集中转出”的最高级别指标（此处为三级指标）包括：短期内外币客户转帐转入转出量比、短期内外币客户转帐转入转出次数比；然后再确定三级指标对应的二级指标，包括：短期内外币客户转帐转入金额、短期内外币客户转帐转出金额、短期内外币客户转帐转入次数、短期内外币客户转帐转出次数；最后再确定二级指标对应的一级指标，包括：“短期”具体限定的时间范围、客户外币转帐转入金额、客户外币转帐转出金额、客户外币转帐转入次数、客户外币转帐转出次数等，所述本级指标代码是指相对于上级指标代码而言低一级指标的指标代码。
在获取到系统规则对应的各级指标后，建立相应的可疑交易指标表。需要说明的是，为了便于后期调用与查找，在建立所述可疑交易指标表前，还会对的各级指标进行分类编排，例如：将每级指标按：指标代码、指标名称、指标频度、指标对象、指标类型、所属层次、上级指标等表项进行分类编排，在编排完成后，根据编排结果确定出各指标对应的上级指标，然后获取所述上级指标对应的指标代码，将上级指标对应的指标代码与本级指标代码进行关联，并根据关联结果以及各指标对应的编排项建立可疑交易指标表。
步骤S05：遍历所述可疑交易监测模型集，获取各可疑交易监测模型对应的可疑交易指标表。
在本实施例中，需要对所述可疑交易监测模型集中的每个可疑交易监测模型进行可疑交易特征的拆分，获取各可疑交易监测模型对应的可疑交易指标表。
进一步地，实际情况中可能会需要对可疑交易指标表进行维护或修改，例如：将指标表中某些数值进行调整；因此，为了对已获取的各可疑交易指标表进行有效管理，在所述步骤S05之后，所述方法还包括：响应于工作人员输入的指标修改指令，根据所述指标修改指令对所述可疑交易指标表中的待修改指标进行修改，并对修改后的可疑交易指标表进行保存。
此处结合具体例子，对本实施例进行详细说明：
以可疑交易监测模型：短期内集中转入转出监测模型，为例。先根据该监测模型确定其对应的短期内集中转入转出可疑交易特征，然后根据客户类型（对公、对私），币种（本币、外币），被监测交易类型（收和付），统计周期（短期）等，可将短期内集中转入转出监测模型对应的可疑交易特征拆分为以下8个系统规则：
1、 短期内对公本币客户资金分散转入、集中转出；
2、 短期内对公外币客户资金分散转入、集中转出；
3、 短期内对私本币客户资金分散转入、集中转出；
4、 短期内对私外币客户资金分散转入、集中转出；
5、 短期内对公本币客户资金集中转入、分散转出；
6、 短期内对公外币客户资金集中转入、分散转出；
7、 短期内对私本币客户资金集中转入、分散转出；
8、 短期内对私外币客户资金集中转入、分散转出。
以系统规则：短期内对公本币客户资金分散转入、集中转出为例，其对应的源代码如下：
系统规则：KY0101【短期内对公本币客户资金分散转入、集中转出】
IF CONTAIN (客户本币转帐转入金额（KH110012）)
And 客户类型=’对公’
AND（20211104[L]（默认为90％）<=短期内本币客户转帐转入转出量比(KH113004) <= 20211104[U]（默认110％））
AND
短期内本币客户转帐转入转出次数比(KH123003)>= 20311101[L]（参数，默认6）
AND
短期内本币客户转帐转入金额(KH112077) >= 20211105[L]（默认400万）
THEN 预警
该系统规则对应的三级指标包括：“短期内本币客户转帐转入转出量比(KH113004)”和“短期内本币客户转帐转入转出次数比(KH123003)”，其中，“KH113004”和“KH123003”为指标代码；“短期内本币客户转帐转入转出量比”和“短期内本币客户转帐转入转出次数比”为指标名称；“20211104[L]（默认为90％）和20211104[U]（默认110％）”为定义参数，可以从预先建立的阈值表中获得；“20311101[L]（参数，默认6）”和“20211105[L]（默认400万）”也为定义参数，可以从预先建立的参数表中获得。
其中，短期内本币客户转帐转入转出量比(KH113004) =短期内本币客户转帐转入金额(KH112077)÷短期内本币客户转帐转出金额(KH122081)；
短期内本币客户转帐转入转出次数比(KH123003) =短期内本币客户转帐转入次数(KH112079)÷短期内本币客户转帐转出次数(KH122080)。
因此，该系统规则中三级指标关联的二级指标就包括“短期内本币客户转帐转入次数(KH112079) 使用：KH110011”、“短期内本币客户转帐转出次数(KH122080) 使用：KH120009”、“短期内本币客户转帐转入金额(KH112077) 使用：KH110012”和“短期内本币客户转帐转出金额(KH122081) 使用：KH120010”。
该系统中二级指标关联的一级指标就包括“客户本币转帐转入金额（KH110012）”，“客户本币转帐转出金额（KH120010）”，“客户本币转帐转入次数（KH110011）”和“客户本币转帐转出次数（KH120009）”以及“短期内”具体限定的时间范围（天数）。
需要说明的是，在各级指标的计算过程中，需要利用到各种定义参数，例如：对公的短期时间是多少天、对私的短期时间是多少天、账户类型（例如：外债专户）等，因此在指标计算过程中，可预先建立各指标与相关联参数之间的映射关系，以实现通过该映射关系获取对应的参数值；
所述相关联参数可存储在预先建立的参数表或阈值表中，所述参数表中可包括：参数代码、参数类型、参数值类型，参数值、参数描述等，所述阈值表中可包括：参数代码、参数类型、参数对象、货币类型、问题值域上下限、参数描述等。当然，所述参数表和阈值表中的具体内容可根据实际情况增删或设定，对此不做限制。
本实施例通过获取可疑交易监测模型集，所述可疑交易监测模型集包括至少一个可疑交易监测模型；从所述可疑交易监测模型集中选取一个可疑交易监测模型；获取被选取的可疑交易监测模型对应的可疑交易特征；对所述可疑交易特征进行拆分，获取对应的可疑交易指标表；遍历所述可疑交易监测模型集，获取各可疑交易监测模型对应的可疑交易指标表，从而能够较为清晰地将各个可疑交易检测模型拆分为对应的可疑交易指标表，使得可疑交易模型规则化，减小了后期维护的工作量。
进一步地，如图4所示，基于上述各实施例提出本申请一种可疑交易监测方法第三实施例。
本实施例提出的可疑交易监测方法在所述步骤S40之后，还包括如下步骤：
步骤S50：获取所述客户的身份、财务状况和/或经营业务信息；
可理解的是，当判定客户存在可疑交易行为后，为了进一步确定该客户是否存在非法行为（例如：洗钱行为），就需要对该客户涉及财产及收入的其他信息进行核查；具体的，可以是获取该客户的身份（家庭情况、工作情况等）、财务状况（收入/支出、个人资产等）和/或经营业务（主营业务、业务收入/支出等）信息。
步骤S60：在所述交易数据与所述客户的身份、财务状况和/或经营业务信息不符时，判定所述客户存在非法行为。
当核查出客户的交易数据与客户的身份、财务状况和/或经营业务信息显明不符时，即可确定该客户存在非法行为。例如：客户B为某私企普通职员，其配偶为个体户，近五年人均年收入为10万，且夫妻双方无其他收入来源；但从客户B交易数据中发现其最近三月的资金交易（转入转出）金额高达500万，明显与客户B的身份、财务状况和/或经营业务信息不符，此时即可判定该客户存在非法行为。
本实施例通过获取存在可疑交易行为的客户的身份、财务状况和/或经营业务信息，在所述交易数据与所述客户的身份、财务状况和/或经营业务信息不符时，判定所述客户存在非法行为，能够真实准确地判断出客户的交易行为是否合法，实现了对金融活动的有效监管。
进一步地，基于上述各实施例提出本申请一种可疑交易监测方法第四实施例。
在本实施例提出的可疑交易监测方法中，所述可疑交易指标包括：基础指标和规则指标；相应地，所述步骤S40可具体包括：检测所述交易数据是否与所述基础指标相匹配；在所述交易数据与所述基础指标相匹配时，检测所述交易数据中剩余的交易数据是否落入所述规则指标的数据范围；在所述交易数据中剩余的交易数据落入所述规则指标的数据范围时，判定所述客户的交易行为属于可疑交易行为。
需要说明的是，所述规则指标可以是各系统规则对应的可疑交易指标中最高级别的指标；所述基础指标为指标级别低于所述规则指标对应级别的所有级别的指标，例如：系统规则C对应有一级、二级和三级指标，其中三级指标为所述规则指标，一级指标和二级指标则为所述基础指标。
本实施例通过将可疑交易指标划分为基础指标和规则指标，在对客户的交易数据进行匹配时，检测所述交易数据是否与所述基础指标相匹配；在所述交易数据与所述基础指标相匹配时，检测所述交易数据中剩余的交易数据是否落入所述规则指标的数据范围；在所述交易数据中剩余的交易数据落入所述规则指标的数据范围时，判定所述客户的交易行为属于可疑交易行为，从而能够先根据基础指标检测客户是否存在可疑交易行为，在发现客户的交易数据与基础指标不相符时，即可快速判断出客户不存在可疑交易行为，提高了可疑交易监测的效率。
参照图5，图5为本申请可疑交易监测装置第一实施例的结构框图。
如图5所示，本实施例提出的可疑交易监测装置101包括：信息提取模块1010、指标获取模块1011、数据匹配模块1012和行为判定模块1013；
所述信息提取模块1010，用于获取客户的交易信息，从所述交易信息中提取预设类型的交易数据；
所述指标获取模块1011，用于获取各可疑交易监测模型分别对应的可疑交易指标表；
所述数据匹配模块1012，用于检测所述交易数据是否落入所述可疑交易指标表的数据范围；
所述行为判定模块1013，用于在所述交易数据落入所述可疑交易指标表的数据范围时，判定所述客户的交易行为属于可疑交易行为。
本实施例的具体例子可参照上述可疑交易监测方法第一实施例中的举例，此处不再赘述。
本实施例通过获取客户的交易信息，从所述交易信息中提取预设类型的交易数据；获取各可疑交易监测模型分别对应的可疑交易指标表；，检测所述交易数据是否落入所述可疑交易指标表的数据范围；在所述交易数据落入所述可疑交易指标表的数据范围时，判定所述客户的交易行为属于可疑交易行为，由于是根据各可疑交易监测模型对应的指标表对客户交易数据进行匹配，从而能够有效的利用已经确定的各种可疑交易监测模型对应的规则或指标，在实现可疑交易监测的同时，最大化的节约人力、物力资源。
进一步地，本实施例提出的可疑交易监测装置101还包括：模型处理模块；所述模型处理模块，用于获取可疑交易监测模型集，所述可疑交易监测模型集包括至少一个可疑交易监测模型；从所述可疑交易监测模型集中选取一个可疑交易监测模型；获取被选取的可疑交易监测模型对应的可疑交易特征；对所述可疑交易特征进行拆分，获取对应的可疑交易指标表；遍历所述可疑交易监测模型集，获取各可疑交易监测模型对应的可疑交易指标表。
进一步地，本实施例提出的可疑交易监测装置101还包括：行为核实模块，所述行为核实模块，用于获取所述客户的身份信息、财务状况和/或经营业务信息；在所述交易数据与所述客户的身份信息、财务状况和/或经营业务信息不符时，判定所述客户存在非法行为。
本实施例通过获取存在可疑交易行为的客户的身份信息、财务状况和/或经营业务信息，在所述交易数据与所述客户的身份信息、财务状况和/或经营业务信息不符时，判定所述客户存在非法行为，能够真实准确地判断出客户的交易行为是否合法，实现了对金融活动的有效监管。
基于上述各实施例，提出本申请可疑交易监测装置第四实施例。
本实施例中，所述行为判定模块1013，还用于检测所述交易数据是否与所述基础指标相匹配；在所述交易数据与所述基础指标相匹配时，检测所述交易数据中剩余的交易数据是否落入所述规则指标的数据范围；在所述交易数据中剩余的交易数据落入所述规则指标的数据范围时，判定所述客户的交易行为属于可疑交易行为。
需要说明的是，所述规则指标可以是各系统规则对应的可疑交易指标中最高级别的指标；所述基础指标为指标级别低于所述规则指标对应级别的所有级别的指标，例如：系统规则C对应有一级、二级和三级指标，其中三级指标为所述规则指标，一级指标和二级指标则为所述基础指标。
本实施例通过将可疑交易指标划分为基础指标和规则指标，在对客户的交易数据进行匹配时，检测所述交易数据是否与所述基础指标相匹配；在所述交易数据与所述基础指标相匹配时，检测所述交易数据中剩余的交易数据是否落入所述规则指标的数据范围；在所述交易数据中剩余的交易数据落入所述规则指标的数据范围时，判定所述客户的交易行为属于可疑交易行为，从而能够先根据基础指标检测客户是否存在可疑交易行为，在发现客户的交易数据与基础指标不相符时，即可快速判断出客户不存在可疑交易行为，提高了可疑交易监测的效率。
此外，本申请还提供一种存储介质，所述存储介质上存储有可疑交易监测程序，所述可疑交易监测程序被处理器执行时实现上述可疑交易监测方法实施例中的操作。
需要说明的是，在本文中，术语“包括”、“包含”或者其任何其它变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、物品或者系统不仅包括那些要素，而且还包括没有明确列出的其它要素，或者是还包括为这种过程、方法、物品或者系统所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括该要素的过程、方法、物品或者系统中还存在另外的相同要素。
上述本申请实施例序号仅仅为了描述，不代表实施例的优劣。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到上述 实施例方法可借助软件加必需的通用硬件平台的方式来实现，当然也可以通 过硬件，但很多情况下前者是更佳的实施方式。基于这样的理解，本申请的 技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体 现出来，该计算机软件产品存储在一个存储介质(如ROM/RAM、磁碟、光 盘)中，包括若干指令用以使得一台终端设备(可以是手机，计算机，服务器，空调器，或者网络设备等)执行本申请各个实施例所述的方法。
以上仅为本申请的优选实施例，并非因此限制本申请的专利范围，凡是利用本申请说明书及附图内容所作的等效结构或等效流程变换，或直接或间接运用在其它相关的技术领域，均同理包括在本申请的专利保护范围内。

Claims (20)

  1. 一种可疑交易监测方法，其中，所述方法包括：
    获取客户的交易信息，从所述交易信息中提取预设类型的交易数据；
    获取各可疑交易监测模型分别对应的可疑交易指标表；
    检测所述交易数据是否落入所述可疑交易指标表的数据范围；
    在所述交易数据落入所述可疑交易指标表的数据范围时，判定所述客户的交易行为属于可疑交易行为。
  2. 如权利要求1所述的方法，其中，所述获取客户的交易信息，从所述交易信息中提取预设类型的交易数据之前，所述方法还包括：
    获取可疑交易监测模型集，所述可疑交易监测模型集包括至少一个可疑交易监测模型；
    从所述可疑交易监测模型集中选取一个可疑交易监测模型；
    获取被选取的可疑交易监测模型对应的可疑交易特征；
    对所述可疑交易特征进行拆分，获取对应的可疑交易指标表；
    遍历所述可疑交易监测模型集，获取各可疑交易监测模型对应的可疑交易指标表。
  3. 如权利要求2所述的方法，其中，所述检测所述交易数据是否落入所述可疑交易指标表的数据范围之后，所述方法还包括：
    在所述交易数据中的交易金额不超过预设阈值时，判定所述客户的交易行为不属于可疑交易行为。
  4. 如权利要求3所述的方法，其中，所述在所述交易数据落入所述可疑交易指标表的数据范围时，判定所述客户的交易行为属于可疑交易行为之后，所述方法还包括：
    获取所述客户的身份信息、财务状况和/或经营业务信息；
    在所述交易数据与所述客户的身份信息、财务状况和/或经营业务信息不符时，判定所述客户存在非法行为。
  5. 如权利要求4所述的方法，其中，所述对所述可疑交易特征进行拆分，获取对应的可疑交易指标表，包括：
    按第一预设规则对所述可疑交易特征进行拆分，获得所述可疑交易监测模型对应的若干个系统规则，并建立相应的系统规则表；
    将所述系统规则表中的各系统规则按照第二预设规则拆分为若干个可疑交易指标；
    确定所述可疑交易指标中各可疑交易指标所属的指标级别，并对不同级别的可疑交易指标按预设表项进行分类编排，所述预设表项包括：指标代码、指标名称以及指标类型；
    根据分类编排后的各级指标确定出各指标对应的上级指标，获取所述上级指标对应的指标代码，将上级指标对应的指标代码与本级指标代码进行关联，并根据关联结果建立可疑交易指标表。
  6. 如权利要求5所述的方法，其中，所述遍历所述可疑交易监测模型集，获取各可疑交易监测模型对应的可疑交易指标表之后，所述方法还包括：
    响应于工作人员输入的指标修改指令，根据所述指标修改指令对所述可疑交易指标表中的待修改指标进行修改，并对修改后的可疑交易指标表进行保存。
  7. 如权利要求6所述的方法，其中，所述可疑交易指标包括基础指标和规则指标；
    相应地，所述在所述交易数据落入所述可疑交易指标表的数据范围时，判定所述客户的交易行为属于可疑交易行为，具体包括：
    检测所述交易数据是否与所述基础指标相匹配；
    在所述交易数据与所述基础指标相匹配时，检测所述交易数据中剩余的交易数据是否落入所述规则指标的数据范围；
    在所述交易数据中剩余的交易数据落入所述规则指标的数据范围时，判定所述客户的交易行为属于可疑交易行为。
  8. 一种可疑交易监测装置，其中，所述装置包括：
    信息提取模块，用于获取客户的交易信息，从所述交易信息中提取预设类型的交易数据；
    指标获取模块，用于获取各可疑交易监测模型分别对应的可疑交易指标表；
    数据匹配模块，用于检测所述交易数据是否落入所述可疑交易指标表的数据范围；
    行为判定模块，用于在所述交易数据落入所述可疑交易指标表的数据范围时，判定所述客户的交易行为属于可疑交易行为。
  9. 一种可疑交易监测设备，其中，所述设备包括：存储器、处理器及存储在所述存储器上并可在所述处理器上运行的可疑交易监测程序，所述可疑交易监测程序配置为实现如下步骤：
    获取客户的交易信息，从所述交易信息中提取预设类型的交易数据；
    获取各可疑交易监测模型分别对应的可疑交易指标表；
    检测所述交易数据是否落入所述可疑交易指标表的数据范围；
    在所述交易数据落入所述可疑交易指标表的数据范围时，判定所述客户的交易行为属于可疑交易行为。
  10. 如权利要求9所述的可疑交易监测设备，其中，所述可疑交易监测程序配置为实现如下步骤：
    获取可疑交易监测模型集，所述可疑交易监测模型集包括至少一个可疑交易监测模型；
    从所述可疑交易监测模型集中选取一个可疑交易监测模型；
    获取被选取的可疑交易监测模型对应的可疑交易特征；
    对所述可疑交易特征进行拆分，获取对应的可疑交易指标表；
    遍历所述可疑交易监测模型集，获取各可疑交易监测模型对应的可疑交易指标表。
  11. 如权利要求10所述的可疑交易监测设备，其中，所述可疑交易监测程序配置为实现如下步骤：
    在所述交易数据中的交易金额不超过预设阈值时，判定所述客户的交易行为不属于可疑交易行为。
  12. 如权利要求11所述的可疑交易监测设备，其中，所述可疑交易监测程序配置为实现如下步骤：
    获取所述客户的身份信息、财务状况和/或经营业务信息；
    在所述交易数据与所述客户的身份信息、财务状况和/或经营业务信息不符时，判定所述客户存在非法行为。
  13. 如权利要求12所述的可疑交易监测设备，其中，所述可疑交易监测程序配置为实现如下步骤：
    按第一预设规则对所述可疑交易特征进行拆分，获得所述可疑交易监测模型对应的若干个系统规则，并建立相应的系统规则表；
    将所述系统规则表中的各系统规则按照第二预设规则拆分为若干个可疑交易指标；
    确定所述可疑交易指标中各可疑交易指标所属的指标级别，并对不同级别的可疑交易指标按预设表项进行分类编排，所述预设表项包括：指标代码、指标名称以及指标类型；
    根据分类编排后的各级指标确定出各指标对应的上级指标，获取所述上级指标对应的指标代码，将上级指标对应的指标代码与本级指标代码进行关联，并根据关联结果建立可疑交易指标表。
  14. 如权利要求13所述的可疑交易监测设备，其中，所述可疑交易监测程序配置为实现如下步骤：
    响应于工作人员输入的指标修改指令，根据所述指标修改指令对所述可疑交易指标表中的待修改指标进行修改，并对修改后的可疑交易指标表进行保存。
  15. 如权利要求14所述的可疑交易监测设备，其中，所述可疑交易监测程序配置为实现如下步骤：
    检测所述交易数据是否与所述基础指标相匹配；
    在所述交易数据与所述基础指标相匹配时，检测所述交易数据中剩余的交易数据是否落入所述规则指标的数据范围；
    在所述交易数据中剩余的交易数据落入所述规则指标的数据范围时，判定所述客户的交易行为属于可疑交易行为。
  16. 一种计算机可读存储介质，其中，所述计算机可读存储介质上存储有可疑交易监测程序，所述可疑交易监测程序被处理器执行时实现如下步骤：
    获取客户的交易信息，从所述交易信息中提取预设类型的交易数据；
    获取各可疑交易监测模型分别对应的可疑交易指标表；
    检测所述交易数据是否落入所述可疑交易指标表的数据范围；
    在所述交易数据落入所述可疑交易指标表的数据范围时，判定所述客户的交易行为属于可疑交易行为。
  17. 如权利要求16所述的计算机可读存储介质，其中，所述可疑交易监测程序被处理器执行时实现如下步骤：
    获取客户的交易信息，从所述交易信息中提取预设类型的交易数据；
    获取各可疑交易监测模型分别对应的可疑交易指标表；
    检测所述交易数据是否落入所述可疑交易指标表的数据范围；
    在所述交易数据落入所述可疑交易指标表的数据范围时，判定所述客户的交易行为属于可疑交易行为。
  18. 如权利要求17所述的计算机可读存储介质，其中，所述可疑交易监测程序被处理器执行时实现如下步骤：
    获取可疑交易监测模型集，所述可疑交易监测模型集包括至少一个可疑交易监测模型；
    从所述可疑交易监测模型集中选取一个可疑交易监测模型；
    获取被选取的可疑交易监测模型对应的可疑交易特征；
    对所述可疑交易特征进行拆分，获取对应的可疑交易指标表；
    遍历所述可疑交易监测模型集，获取各可疑交易监测模型对应的可疑交易指标表。
  19. 如权利要求18所述的计算机可读存储介质，其中，所述可疑交易监测程序被处理器执行时实现如下步骤：
    在所述交易数据中的交易金额不超过预设阈值时，判定所述客户的交易行为不属于可疑交易行为。
  20. 如权利要求19所述的计算机可读存储介质，其中，所述可疑交易监测程序被处理器执行时实现如下步骤：
    获取所述客户的身份信息、财务状况和/或经营业务信息；
    在所述交易数据与所述客户的身份信息、财务状况和/或经营业务信息不符时，判定所述客户存在非法行为。
PCT/CN2018/084554 2018-01-16 2018-04-26 一种可疑交易监测方法、装置、设备及存储介质 WO2019140804A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810042378.6A CN108230151A (zh) 2018-01-16 2018-01-16 一种可疑交易监测方法、装置、设备及存储介质
CN201810042378.6 2018-01-16

Publications (1)

Publication Number Publication Date
WO2019140804A1 true WO2019140804A1 (zh) 2019-07-25

Family

ID=62641670

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/084554 WO2019140804A1 (zh) 2018-01-16 2018-04-26 一种可疑交易监测方法、装置、设备及存储介质

Country Status (2)

Country Link
CN (1) CN108230151A (zh)
WO (1) WO2019140804A1 (zh)

Families Citing this family (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109118371B (zh) * 2018-08-31 2021-03-23 中国建设银行股份有限公司 一种监督方法及装置
CN109377339B (zh) * 2018-10-22 2021-01-05 中信网络科技股份有限公司 一种可疑交易案例的辅助甄别方法及系统
CN109784662A (zh) * 2018-12-19 2019-05-21 深圳平安综合金融服务有限公司 交易数据处理方法、装置、计算机设备和存储介质
CN109767322B (zh) * 2018-12-20 2024-02-27 平安科技（深圳）有限公司 基于大数据的可疑交易分析方法、装置和计算机设备
CN109919454A (zh) * 2019-02-20 2019-06-21 中国银行股份有限公司 反洗钱监控方法及系统
CN110400220A (zh) * 2019-07-23 2019-11-01 上海氪信信息技术有限公司 一种基于半监督图神经网络的智能可疑交易监测方法
CN110807706B (zh) * 2019-12-02 2022-07-26 南京工业职业技术学院 一种基于互联网的反洗钱监控系统
CN111798243A (zh) * 2020-06-30 2020-10-20 中国工商银行股份有限公司 一种可疑交易在线识别方法及装置
CN111951102B (zh) * 2020-08-17 2023-08-22 中国银行股份有限公司 实物对账方法及装置
CN111915316B (zh) * 2020-08-18 2024-08-13 南方电网数字电网研究院有限公司 一种可疑交易的监控方法、装置、计算机设备和存储介质
CN113450218B (zh) * 2021-06-30 2022-07-01 福建华通银行股份有限公司 一种基于时间轴变化的客户资金状态跟踪设计方法
CN114581093A (zh) * 2022-03-01 2022-06-03 中国建设银行股份有限公司 虚拟货币交易的监控方法、装置、存储介质和设备

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101976419A (zh) * 2010-10-19 2011-02-16 中国工商银行股份有限公司 交易数据的风险监控处理方法和系统
CN102117459A (zh) * 2010-01-06 2011-07-06 阿里巴巴集团控股有限公司 风险控制系统及方法
CN104978618A (zh) * 2014-04-08 2015-10-14 汕头市海西信息科技有限公司 一种电子商务风险监控方法
CN105678544A (zh) * 2015-12-31 2016-06-15 深圳前海微众银行股份有限公司 远程开户的风险监控方法及服务器
CN105761000A (zh) * 2016-02-17 2016-07-13 中国工商银行股份有限公司 交易数据处理及风险预警系统和方法
US20160239771A1 (en) * 2015-02-12 2016-08-18 Ca, Inc. Monitoring ecommerce transactions using transaction metrics statistics for different combinations of transaction attributes and values

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102117459A (zh) * 2010-01-06 2011-07-06 阿里巴巴集团控股有限公司 风险控制系统及方法
CN101976419A (zh) * 2010-10-19 2011-02-16 中国工商银行股份有限公司 交易数据的风险监控处理方法和系统
CN104978618A (zh) * 2014-04-08 2015-10-14 汕头市海西信息科技有限公司 一种电子商务风险监控方法
US20160239771A1 (en) * 2015-02-12 2016-08-18 Ca, Inc. Monitoring ecommerce transactions using transaction metrics statistics for different combinations of transaction attributes and values
CN105678544A (zh) * 2015-12-31 2016-06-15 深圳前海微众银行股份有限公司 远程开户的风险监控方法及服务器
CN105761000A (zh) * 2016-02-17 2016-07-13 中国工商银行股份有限公司 交易数据处理及风险预警系统和方法

Also Published As

Publication number Publication date
CN108230151A (zh) 2018-06-29

Similar Documents

Publication Publication Date Title
WO2019140804A1 (zh) 一种可疑交易监测方法、装置、设备及存储介质
WO2019061613A1 (zh) 贷款资质筛选方法、装置及计算机可读存储介质
WO2019090986A1 (zh) 一种保险理赔案件的理算方法和装置
WO2018107610A1 (zh) 业务数据处理方法、系统、设备及计算机可读存储介质
WO2019037396A1 (zh) 账户清结算方法、装置、设备及存储介质
WO2018233351A1 (zh) 自助理赔方法、装置、服务器和计算机可读存储介质
WO2019061614A1 (zh) 贷款产品匹配方法、装置及计算机可读存储介质
WO2019001087A1 (zh) 案件理赔方法、装置、服务器及计算机可读存储介质
WO2018149299A1 (zh) 社保欺诈行为的识别方法、装置、设备及计算机存储介质
WO2019104876A1 (zh) 保险产品的推送方法、系统、终端、客户终端及存储介质
WO2019109521A1 (zh) 视频面签身份审核方法、装置、设备及可读存储介质
WO2018228050A1 (zh) 防止敏感信息泄露的方法、装置及存储介质
WO2018205544A1 (zh) 软件项目管理方法、装置、终端及计算机存储介质
WO2018166314A1 (zh) 额度审批方法、装置、设备以及计算机可读存储介质
WO2019119618A1 (zh) 健康险产品投保方法、装置、设备及可读存储介质
WO2017036007A1 (zh) 线上线下健康服务产品多级推广处理系统及方法
WO2017143692A1 (zh) 智能电视及其语音控制方法
WO2019100604A1 (zh) 账户查询方法、装置、设备及计算机可读存储介质
WO2015131803A1 (en) Application recommending method and system
WO2019104877A1 (zh) 通过网站对接购买保险的方法、装置、设备及介质
WO2015120808A1 (en) Method and system for security protection of account information
WO2015144089A1 (en) Application recommending method and apparatus
WO2018149300A1 (zh) 疾病概率的检测方法、装置、设备及计算机可读存储介质
WO2019037454A1 (zh) 保费缴纳方法、装置、设备及可读存储介质
WO2019033904A1 (zh) 登录验证方法、系统及计算机可读存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18900975

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205 DATED 20/10/2020)

122 Ep: pct application non-entry in european phase

Ref document number: 18900975

Country of ref document: EP

Kind code of ref document: A1