WO2019165670A1

WO2019165670A1 - Illegal pyramid scheme organization monitoring method and apparatus, computer device and storage medium

Info

Publication number: WO2019165670A1
Application number: PCT/CN2018/081514
Authority: WO
Inventors: 邱海燕; 谭志荣; 魏尧东
Original assignee: 平安科技（深圳）有限公司
Priority date: 2018-02-27
Filing date: 2018-04-02
Publication date: 2019-09-06
Also published as: CN108446979A

Abstract

The present application is applicable to the technical field of communications, and provides an illegal pyramid scheme organization monitoring method. Said monitoring method comprising: constructing a characteristic information base according to key information of an illegal pyramid scheme organization; acquiring transaction record information to be monitored, and matching the transaction record information with the characteristic information base, so as to acquire a suspicious entity and suspicious transaction record information corresponding thereto; generating a suspicious pyramid scheme case according to the suspicious entity and the corresponding suspicious transaction record information, and entering the suspicious pyramid scheme case into a suspicious case table; and monitoring the suspicious pyramid scheme case according to the suspicious case table. The present application enables real-time monitoring of illegal pyramid scheme organizations, being beneficial to preventing the reorganization of illegal pyramid scheme organizations, solving the problems in the prior art of insufficient monitoring of illegal pyramid scheme organizations and unsatisfactory monitoring implementation effect, and the monitoring being not performed in a timely manner.

Description

Monitoring method, device, computer equipment and storage medium of illegal pyramid scheme

This application is based on the Chinese invention patent application filed on February 27, 2018, with the application number 20110161840.4, entitled "Monitoring method, device, computer equipment and storage medium for illegal pyramid schemes", and requires priority.

Technical field

The present application belongs to the field of communication technologies, and in particular, to a method, a device, a computer device and a storage medium for monitoring an illegal pyramid scheme.

Background technique

With the rapid development of the Internet and e-commerce technology, the new MLM model relies on network means to attract a large number of netizens and students to become victims by pulling people and developing offline lines, causing tragedies and seriously disrupting the economic order. Further, due to the lack of effective monitoring methods at the current stage of the bank, it is impossible to generate suspicious case reports in real time to pay attention to and monitor suspicious objects, which led to the disappearance of these pyramid schemes when the Ministry of Public Security vigorously cracked down, and revived after the limelight. For example, the post-exposure full-return pyramid scheme, the Luomai Technology MLM organization, and the Futianxia MLM organization, their financial transactions in the public account have been in an active period. It can be seen that the existing technology has insufficient monitoring of illegal pyramid schemes, the monitoring effect is not timely, and the illegal pyramid schemes are prone to resurgence.

Summary of the invention

The embodiment of the present application provides a method, a device, a computer device, and a storage medium for monitoring an illegal pyramid scheme, so as to solve the problem that the prior art has insufficient monitoring power on the illegal pyramid scheme organization and the monitoring effect is not timely.

In a first aspect, an embodiment of the present application provides a method for monitoring an illegal pyramid scheme, where the monitoring method includes:

Construct a feature information base based on key information of the illegal pyramid scheme;

Obtaining transaction flow information to be monitored, matching the transaction flow information with the characteristic information database, and obtaining suspicious entities and corresponding suspicious transaction flow information;

Generating a suspicious pyramid scheme based on the suspicious entity and its corresponding suspicious transaction flow information, and recording the suspicious pyramid scheme into the suspicious case list;

The suspicious pyramid scheme is monitored according to the suspicious case list.

Further, the constructing the feature information base according to the key information of the illegal pyramid scheme organization includes:

Acquiring the body information of the illegal pyramid selling organization, and constructing a first feature information table based on the body information, where the first feature information table includes an illegal pyramid selling organization name and corresponding body information;

Acquiring the capital transaction characteristics of the illegal pyramid selling organization, constructing a second feature information table based on the characteristics of the fund transaction, wherein the second feature information table includes a pyramid selling keyword and a corresponding suspicious transaction rule.

Further, the obtaining the transaction flow information to be monitored, matching the transaction flow information with the characteristic information database, and obtaining the suspicious entity and the corresponding suspicious transaction flow information include:

Obtaining transaction flow information to be monitored;

Matching the transaction flow information with the first feature information table, acquiring subject information related to the illegal pyramid scheme in the transaction flow information, and transaction flow information of the subject information within a specified time period;

Matching the transaction flow information of the subject information in the specified time period and the second feature information table, acquiring the subject information that meets the suspicious transaction rule and the corresponding transaction flow information, as the suspicious subject and the corresponding suspicious transaction thereof Flowing water information.

Further, the generating a suspicious pyramid scheme according to the suspicious entity and its corresponding suspicious transaction flow information, and recording the suspicious pyramid scheme into the suspicious case list includes:

Obtaining attribute information, account information, and transaction information of the suspicious subject from the suspicious subject and the corresponding suspicious flow information, and configuring the suspicious subject corresponding to the suspicious case number of the specified time period to generate a suspicious pyramid scheme;

Attribute information, account information, transaction information, and the suspicious case number of the suspicious pyramid scheme are associated and stored in the suspicious case table.

Further, the monitoring the suspicious pyramid scheme according to the suspicious case list includes:

For each suspicious pyramid scheme in the suspicious case list, if the suspicious pyramid scheme is a confirmed illegal pyramid scheme, the transaction frequency and transaction amount of the suspicious pyramid scheme for the public account or the private account are counted;

If the transaction frequency is greater than or equal to the first threshold and the transaction amount is greater than or equal to the second threshold, the reporting operation is performed.

In a second aspect, the embodiment of the present application provides a monitoring device for an illegal pyramid scheme, and the monitoring device includes:

a building module for constructing a feature information base based on key information of an illegal pyramid scheme organization;

a matching module, configured to acquire transaction flow information to be monitored, and match the transaction flow information with the feature information database to obtain suspicious entities and corresponding suspicious transaction flow information;

a generating module, configured to generate a suspicious pyramid scheme according to the suspicious entity and its corresponding suspicious transaction flow information, and record the suspicious pyramid scheme into the suspicious case list;

And a monitoring module, configured to monitor the suspicious pyramid scheme according to the suspicious case list.

Further, the building module includes:

a first building unit, configured to acquire body information of the illegal pyramid selling organization, and construct a first feature information table based on the body information, where the first feature information table includes an illegal pyramid selling organization name and corresponding body information thereof;

a second building unit, configured to acquire a fund transaction characteristic of the illegal pyramid selling organization, and construct a second feature information table based on the fund transaction characteristic, where the second feature information table includes a pyramid selling keyword and a corresponding suspicious transaction rule thereof .

Further, the matching module includes:

An obtaining unit, configured to obtain transaction flow information to be monitored;

a first matching unit, configured to match the transaction flow information with the first feature information table, obtain body information related to an illegal pyramid scheme in the transaction flow information, and transaction flow of the body information within a specified time period information;

a second matching unit, configured to match the transaction flow information of the subject information in the specified time period and the second feature information table, and obtain the subject information that meets the suspicious transaction rule and the corresponding transaction flow information as suspicious The subject and its corresponding suspicious transaction flow information.

In a third aspect, an embodiment of the present application provides a computer device, including a memory, a processor, and computer readable instructions stored in the memory and executable on the processor, the processor executing the computer The following steps are implemented when the instructions are readable:

In a fourth aspect, the embodiment of the present application provides one or more non-volatile readable storage media storing computer readable instructions, when the computer readable instructions are executed by one or more processors, such that the one Or multiple processors perform the following steps:

Details of one or more embodiments of the present application are set forth in the accompanying drawings and description below. Other features and advantages of the present invention will be apparent from the description, drawings and claims.

DRAWINGS

In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings used in the description of the embodiments of the present application will be briefly described below. It is obvious that the drawings in the following description are only some embodiments of the present application. Other drawings may also be obtained from those of ordinary skill in the art based on these drawings without the inventive labor.

1 is a first implementation flowchart of a method for monitoring an illegal pyramid scheme provided by an embodiment of the present application;

2 is a second implementation flowchart of a method for monitoring an illegal pyramid scheme provided by an embodiment of the present application;

3 is a third implementation flowchart of a method for monitoring an illegal pyramid scheme provided by an embodiment of the present application;

4 is a fourth implementation flowchart of a method for monitoring an illegal pyramid scheme according to an embodiment of the present application;

5 is a structural diagram of a monitoring device of an illegal pyramid scheme provided by an embodiment of the present application;

FIG. 6 is a schematic diagram of a computer device according to an embodiment of the present application.

Detailed ways

The technical solutions in the embodiments of the present application are clearly and completely described in the following with reference to the drawings in the embodiments of the present application. It is obvious that the described embodiments are a part of the embodiments of the present application, and not all of the embodiments. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present application without departing from the inventive scope are the scope of the present application.

FIG. 1 shows a first implementation flow of a method for monitoring an illegal pyramid scheme provided by an embodiment of the present application. The monitoring method of the illegal pyramid selling organization provided by the embodiment of the present application is applied to a computer device. Referring to FIG. 1, the monitoring method of the illegal pyramid selling organization includes:

In step S101, a feature information base is constructed based on key information of the illegal pyramid scheme.

In the embodiment of the present application, the illegal pyramid scheme organization is an organization that uses the means of network marketing to defraud the victim to develop the offline line, pull the head, pay the membership fee, the entry fee, and the qualification fee to achieve the purpose of illegal financing. The network marketing means include, but is not limited to, means such as low investment, high return, consumption rebate, merchant settlement, shopping pension, electronic currency trading, and original stock investment through platforms, shopping websites, and the like.

The embodiment of the present application extracts key information of an illegal pyramid scheme from an illegal pyramid scheme that has been exposed by the Ministry of Public Security, and then constructs a feature information base based on the key information. The identified information database records the confirmed illegal pyramid selling organization and its corresponding iconic features, and is used for mining the suspicious subject and the suspicious transaction flow information in the transaction flow information to be monitored, that is, determining the transaction flow information to be monitored. Whether or not the iconic features are included to identify whether it is a suspicious pyramid scheme or not, and to monitor illegal pyramid schemes. Optionally, the key information of the illegal pyramid scheme organization includes, but is not limited to, the main characteristics of the organization and the characteristics of the fund transaction.

In step S102, the transaction flow information to be monitored is acquired, and the transaction flow information is matched with the characteristic information database to obtain the suspicious entity and the corresponding suspicious transaction flow information.

In the monitoring of the illegal pyramid scheme organization, the transaction flow information to be monitored is obtained from the bank, and then the transaction flow information is matched with the iconic features in the pre-built feature information database to determine whether the transaction flow information is all Or partially covering the key information of the confirmed illegal pyramid scheme organization, for example, the counterparty in the transaction flow information to be monitored is the confirmed illegal pyramid scheme organization, the customer itself is the leader or backbone of the existing pyramid scheme organization, and the transaction funds are concentrated. Import and so on. If the transaction flow information completely or partially covers the key information in the feature information base, the transaction flow information is used as the suspicious entity and its corresponding suspicious transaction flow information.

It should be understood that the suspicious subject refers to a set of members of a suspicious illegal pyramid scheme, and is a general concept.

In step S103, a suspicious pyramid scheme is generated according to the suspicious entity and its corresponding suspicious transaction flow information, and the suspicious pyramid scheme is recorded in the suspicious case list.

Here, the suspicious case table is used to record the suspicious pyramid schemes and their detailed information hit by the matching feature information base. For the suspicious entity obtained in step S102 and the corresponding suspicious transaction flow information, the embodiment of the present application further sets a suspicious case number for the suspicious subject and its corresponding suspicious transaction flow information, and then stores the suspect case number in order to facilitate the Suspicious pyramid schemes are queried and managed.

In step S104, the suspicious pyramid scheme is monitored according to the suspicious case list.

For the suspicious pyramid scheme in the suspicious case list, the embodiment of the present application continuously pays attention to and analyzes in the follow-up, and performs the reporting operation when the suspicious degree reaches the preset level, including reporting to the People's Bank or reporting to the public security system, which is beneficial to each supervision. The department promptly and effectively cracked down on illegal pyramid schemes and maintained market economic order.

In summary, the embodiment of the present application mines suspicious pyramid schemes by matching the feature information database and records them in real time, realizing real-time supervision of illegal pyramid schemes, facilitating rapid identification of suspicious pyramid schemes and launching prevention and control measures, and preventing illegal pyramid schemes. The phenomenon of resurgence of organizations has solved the problem of insufficient monitoring of illegal pyramid schemes in the prior art and poor timeliness of monitoring effects.

Further, based on the first implementation process of the monitoring method of the illegal pyramid selling organization provided in FIG. 1 , the second implementation process of the monitoring method of the illegal pyramid selling organization provided by the embodiment of the present application is proposed.

FIG. 2 is a schematic diagram of a second implementation process of a method for monitoring an illegal pyramid scheme provided by an embodiment of the present application. The constructing the feature information base according to the key information of the illegal pyramid scheme according to step S101 includes:

In step 1011, the subject information of the illegal pyramid scheme is obtained, and the first feature information table is constructed based on the subject information, where the first feature information table includes an illegal pyramid scheme organization name and corresponding body information.

As mentioned above, the key information of the illegal pyramid scheme organization includes but is not limited to the main characteristics of the organization and the characteristics of the fund transaction. In view of this, for the main features of the organization, the embodiment of the present application constructs a first feature information table for recording the existing MLM organization and the subject information corresponding thereto. The subject information includes, but is not limited to, public customer information, private customer information, legal representative information, partner information, agent information, and counterparty customer information of the illegal pyramid scheme.

Illustratively, in order to attract attention and defraud trust, illegal pyramid schemes often pretend to be companies, organizations, or institutions, and the accounts used to collect money are mostly the public accounts of these companies, organizations, or institutions. The legal representative's accounts are mostly opened in different places, or accounts that have not been activated for a long time, there are sudden and frequent transactions, 3 to 6 months of account cancellation, large funds transfer, daily balance clearing, cross-border transfer or The characteristics of cross-border cash withdrawal. The embodiment of the present application records the public customer information, the legal representative's customer information, and the associated partner and agent information of the company, organization, and organization involved in the MLM organization that has been exposed by the Ministry of Public Security into the first feature information table.

In step S1012, the capital transaction characteristics of the illegal pyramid scheme organization are acquired, and a second feature information table is constructed based on the fund transaction characteristics, and the second feature information table includes a pyramid selling keyword and a corresponding suspicious transaction rule.

For the characteristics of the fund transaction, the embodiment of the present application constructs a second feature information table for recording the marketing keyword and the suspicious transaction rule corresponding thereto. The pyramid selling keywords refer to the category attributes of illegal pyramid schemes, such as national policy categories, shopping wealth management, original stock investment, and pension. The suspicious transaction rule refers to a representative transaction law extracted from the bank transactions of existing illegal pyramid schemes, such as bank remittance, transfer, deposit, withdrawal, and the like.

Illustratively, in the flow of funds in an illegal pyramid scheme organization, the source of funds flowing into the public account is dispersed, and the counterparty is mostly a private client. And the same counterparty has a small change in the amount of the previous transaction and a large amount of subsequent transactions. Most of this trend occurs within one to three months; after a large transaction, the counterparty does not follow the rare or less Trading, but from the public account, irregularly receive small profits from interest, income, rewards, dividends, etc. The suspicious transaction rules from which illegal pyramid schemes can be obtained include, but are not limited to, a large number of foreigners in the same place in a certain period open a private account in the bank; in a certain period, there is considerable funds to be remitted from the local bank to the same account in the field by a foreigner; Foreigners have large foreign funds remitted in local bank private accounts. The embodiment of the present application takes such a representative transaction rule as a suspicious transaction rule, and divides the affiliated marketing keyword according to the attribute information of the illegal pyramid scheme, associates the pyramid selling keyword with the corresponding suspicious transaction rule, and enters the first Two feature information tables.

The embodiment of the present application constructs a feature information table, and uses the feature information table to record the confirmed illegal pyramid selling organization and its corresponding iconic features, and is used for mining the suspicious subject and the suspicious transaction flow information in the transaction flow information to be monitored. It facilitates the management and update of mining rules, which is conducive to improving the efficiency and accuracy of suspicious pyramid schemes.

Further, based on the implementation process of the monitoring method of the illegal pyramid selling organization provided in FIG. 2, the third implementation process of the monitoring method of the illegal pyramid selling organization provided by the embodiment of the present application is proposed.

As shown in FIG. 3, it is a schematic diagram of a third implementation process of the monitoring method of the illegal pyramid scheme organized by the embodiment of the present application. Obtaining the transaction flow information to be monitored, and matching the transaction flow information with the characteristic information database to obtain the suspicious entity and the corresponding suspicious transaction flow information including:

In step S1021, transaction flow information to be monitored is acquired.

Optionally, the transaction flow information to be monitored includes, but is not limited to, account information of the two parties to the transaction, a remittance transaction record, a transfer transaction record, and a transaction transaction record of the transaction party. Each transaction record includes, but is not limited to, transaction time, trading floor, transaction amount, cross-city or cross-border transactions, duration.

In step S1022, the transaction flow information is matched with the first feature information table, and the body information related to the illegal pyramid scheme in the transaction flow information and the transaction flow information of the body information in the specified time period are acquired.

As described above, the feature information database includes a first feature information table and a second feature information table. The first feature information table includes an illegal pyramid scheme organization name and corresponding body information. When matching the feature information database, the embodiment of the present application first matches the transaction flow information to be monitored with the first feature information table, and captures the transaction flow information from the existing illegal pyramid organization. Subject information, such as transaction subject information, counterparty information. Then, based on the transaction flow information, the transaction flow trajectory of the subject within a specified time period is counted, for example, the transfer amount, the transfer amount, and the number of transferred opponents in a specified short period, such as 3 days, 5 days, and 10 days, The number of transferred areas, the number of overseas withdrawals, the number of transferred to the opponents, the number of transferred areas, the non-counter transfer, the transfer amount, the local currency transfer, the transfer amount, and the account balance.

In step S1023, the transaction flow information of the subject information in the specified time period and the second feature information table are matched, and the subject information that meets the suspicious transaction rule and the corresponding transaction flow information are obtained as the suspicious subject and Its corresponding suspicious transaction flow information.

After obtaining the transaction flow track of the subject related to the existing MLM organization in the specified short-term by step S1022, the transaction flow track is further matched with the second feature information table in the feature information database to determine the transaction flow. Whether the trajectory violates the suspicious transaction rule, and the suspicious transaction flow information is captured from the transaction flow trajectory.

By setting the first feature information table, the embodiment of the present application can effectively filter out non-suspect transaction flow information, and specifically select the transaction behavior of the illegal pyramid marketing organization head; and set the second feature information table to filter the presence The illegal trading of the heads of illegal pyramid schemes is conducive to monitoring the resurgence of illegal pyramid schemes and monitoring illegal pyramid schemes that appear in new ways.

Optionally, the method may further include: acquiring, according to the suspicious transaction trajectory that is violated, a corresponding marketing keyword from the second feature information table, to further capture a new type of MLM that is not exposed by the public security department.

Further, the step S103 generates a suspicious pyramid scheme based on the suspicious entity and its corresponding suspicious transaction flow information, and records the suspicious pyramid scheme into the suspicious case list, including:

In step S1031, the attribute information, the account information, and the transaction information of the suspicious subject are obtained from the suspicious subject and the corresponding suspicious flow information, and the suspicious subject corresponding to the suspicious case number of the specified time period is configured to generate Suspicious pyramid schemes.

Here, the attribute information of the suspicious subject includes, but is not limited to, the name, nationality, document type, ID number, occupation, education, address information, and contact information of the public/private customer, the legal representative, the agent, and the like. It is used to judge whether the customer has had a pyramid scheme. The account information of the suspicious entity includes but is not limited to the public/private account opening institution, the account balance, the account type, the account opening time, the account closing time, and the last trading time. The transaction information of the suspicious subject includes but is not limited to the transaction date, the transaction account, the agent information, the place where the transaction occurs, the transaction method, the fund collection and payment mark, the currency symbol, the transaction amount, the use, and the counterparty information.

Optionally, in other embodiments, the capital inflow and outflow characteristics of the entity may be further determined to generate a suspicious feature. For example: capital inflows from MLM organizations, capital inflows from major stakeholders, and so on.

After obtaining the attribute information, the account information, and the flow information of the suspicious subject, the suspicious case number of the suspicious subject within the specified time period is configured to generate a suspicious pyramid scheme to facilitate the production operation. Here, the specified time period should be understood as a certain time range in which the transaction occurs, that is, the specified time period described in step S1022, which defines the coverage of the suspicious pyramid scheme; the suspicious subject exceeding the specified time period and Suspicious flow information belongs to another suspicious pyramid scheme, corresponding to another suspicious case number.

In step S1032, the attribute information, the account information, the transaction information, and the suspicious case number of the suspicious pyramid scheme are associated and stored in the suspicious case table.

The attribute information, the account information and the transaction information of the suspicious subject are associated with the suspicious case number, and are stored in the suspicious case list, and are stored in the case, so as to facilitate the inquiry and management of the suspicious pyramid scheme.

In summary, the embodiment of the present application mines suspicious pyramid schemes by matching the feature information table and records them in real time, realizing real-time supervision of illegal pyramid schemes, facilitating rapid identification of suspicious pyramid schemes and launching prevention and control measures, and preventing illegal pyramid schemes. The phenomenon of resurgence of organizations has solved the problem of insufficient monitoring of illegal pyramid schemes in the prior art and poor timeliness of monitoring effects.

Further, based on the implementation process of the monitoring method of the illegal pyramid selling organization provided in FIG. 1 , FIG. 2 or FIG. 3 , the fourth implementation process of the monitoring method of the illegal pyramid selling organization provided by the embodiment of the present application is proposed.

As shown in FIG. 4, it is a schematic diagram of a fourth implementation process of the monitoring method of the illegal pyramid scheme organized by the embodiment of the present application. In the embodiment of the present application, the monitoring of the suspicious pyramid scheme according to the suspicious case table described in step S104 includes:

In step S1041, for each suspicious pyramid scheme in the suspicious case list, if the suspicious pyramid scheme is an confirmed illegal pyramid scheme, the transaction frequency of the suspicious pyramid scheme for the public account or the private account is counted. And the transaction amount.

The embodiment of the present application preferably monitors a public account or a private account of a suspicious pyramid scheme that has been confirmed as an illegal pyramid scheme, and calculates a transaction frequency and a total transaction amount in the specified time period, and the transaction frequency passes the number of transactions. Said.

In step S1042, if the transaction frequency is greater than or equal to the first threshold and the transaction amount is greater than or equal to the second threshold, the reporting operation is performed.

The first threshold and the second threshold are preset in the embodiment of the present application. The first threshold is used to measure the frequency of transactions of the public account and/or the private account of the suspicious pyramid scheme, and if the transaction frequency of the public account and/or the private account is greater than or equal to the first threshold, Indicates the limit of reaching frequent transactions. The second threshold is used to measure the degree of the transaction amount of the suspicious pyramid scheme for the public account and/or the private account, and if the transaction amount for the public account and/or the private account is greater than or equal to the second threshold, it indicates that the huge amount is reached. The limits of the transaction. The embodiment of the present application combines the transaction frequency and the transaction amount to determine whether the suspicious pyramid scheme has a resurgence sign. After obtaining the transaction frequency and the transaction amount of the public account and/or the private account through step S1041, the transaction frequency and the first threshold are compared, the transaction amount and the second threshold are compared. If, and only if the transaction frequency is greater than or equal to the first threshold and the transaction amount is greater than or equal to the second threshold, determining that the suspicious pyramid scheme has a resurgence sign and performing a reporting operation. The reporting operation includes reporting to the People's Bank or reporting to the public security system, thereby facilitating the timely and effective suppression of illegal pyramid schemes by various regulatory authorities, maintaining the market economic order, and thus improving the monitoring, monitoring effect and timeliness of suspicious pyramid schemes.

It should be understood that, in the foregoing embodiments, the size of the serial number of each step does not mean the order of execution order, and the order of execution of each step should be determined by its function and internal logic, and should not constitute any implementation process of the embodiment of the present application. limited.

Example 2

FIG. 5 is a structural diagram showing the structure of the monitoring apparatus of the illegal pyramid scheme provided by the embodiment of the present application. For the convenience of description, only the parts related to the embodiment of the present application are shown.

In the embodiment of the present application, the monitoring device of the illegal pyramid scheme is used to implement the monitoring method of the illegal pyramid scheme described in the foregoing embodiment of FIG. 1, FIG. 2, FIG. 3, or FIG. 4, which may be built in a computer device. Software unit, hardware unit or unit combining software and hardware.

Referring to FIG. 5, the monitoring device of the illegal pyramid scheme includes:

The building module 51 is configured to construct a feature information base according to key information of the illegal pyramid scheme organization;

The matching module 52 is configured to acquire transaction flow information to be monitored, match the transaction flow information with the feature information database, and obtain suspicious entities and corresponding suspicious transaction flow information;

The generating module 53 is configured to generate a suspicious pyramid scheme according to the suspicious entity and its corresponding suspicious transaction flow information, and record the suspicious pyramid scheme into the suspicious case list;

The monitoring module 54 is configured to monitor the suspicious pyramid scheme according to the suspicious case list.

Optionally, the building module 51 includes:

a first constructing unit 511, configured to acquire body information of the illegal pyramid selling organization, and construct a first feature information table according to the body information, where the first feature information table includes an illegal pyramid selling organization name and corresponding body information thereof;

a second constructing unit 512, configured to acquire a fund transaction characteristic of the illegal pyramid selling organization, and construct a second feature information table according to the fund transaction feature, where the second feature information table includes a pyramid selling keyword and a corresponding suspicious transaction thereof rule.

Optionally, the matching module 52 includes:

The obtaining unit 521 is configured to obtain transaction flow information to be monitored;

The first matching unit 522 is configured to match the transaction flow information with the first feature information table, obtain the subject information related to the illegal pyramid scheme in the transaction flow information, and the transaction of the subject information within a specified time period. Flowing water information;

The second matching unit 523 is configured to match the transaction flow information of the subject information in the specified time period and the second feature information table, and obtain the subject information that meets the suspicious transaction rule and the corresponding transaction flow information, as Suspicious subject and its corresponding suspicious transaction flow information.

Optionally, the generating module 53 includes:

a generating unit 531, configured to acquire attribute information, account information, and transaction information of the suspicious subject from the suspicious subject and the corresponding suspicious water information, and configure the suspicious subject to correspond to the suspicious case number of the specified time period, Generate suspicious pyramid schemes;

The associating unit 532 is configured to associate and store attribute information, account information, transaction information, and the suspicious case number of the suspicious pyramid scheme in the suspicious case table.

Optionally, the monitoring module 54 includes:

The statistical unit 541 is configured to: for each suspicious pyramid scheme in the suspicious case list, if the suspicious pyramid scheme is a confirmed illegal pyramid scheme, the transaction of the suspicious pyramid scheme is recorded on a public account or a private account. Frequency and transaction amount;

The reporting unit 542 is configured to perform a reporting operation if the transaction frequency is greater than or equal to the first threshold and the transaction amount is greater than or equal to the second threshold.

It should be noted that each module/unit in the embodiment of the present application may be used to implement all the technical solutions in the foregoing method embodiments, and the specific working process may refer to the corresponding process in the foregoing method embodiments, and details are not described herein again. .

In the above embodiments, the descriptions of the various embodiments are different, and the parts that are not detailed or described in a certain embodiment can be referred to the related descriptions of other embodiments.

Example 3

The present embodiment provides one or more non-volatile readable storage media having computer readable instructions stored thereon, the one or more non-readable readable storage media storing computer readable instructions, the computer readable instructions being When one or more processors are executed, one or more processors are caused to perform the monitoring method of the illegal pyramid scheme in the embodiment 1. To avoid repetition, details are not described herein again. Alternatively, when the computer readable instructions are executed by the processor, the functions of the modules/units in the monitoring device of the illegal pyramid scheme in Embodiment 2 are implemented. To avoid repetition, details are not described herein again.

It will be understood that the one or more non-volatile readable storage media storing computer readable instructions may comprise any entity or device capable of carrying the computer readable instruction code, a recording medium, a USB flash drive, a mobile Hard disk, disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, and telecommunication signals.

Example 4

FIG. 6 is a schematic diagram of a computer device according to an embodiment of the present application. As shown in FIG. 6, the computer device 6 of this embodiment includes a processor 60, a memory 61, and computer readable instructions 62 stored in the memory 61 and executable on the processor 60. The processor 60 executes the computer readable instructions 62 to implement the steps of the method for monitoring the illegal pyramid scheme in the first embodiment, such as steps S101 to S104 shown in FIG. 1, and step S1011 described in the embodiment of FIG. Step S1012, steps S1021 to S1023, steps S1031 to S1032, and step S1041 to step S1042 described in the embodiment of FIG. 4 are performed in the embodiment of FIG. 3, or the processor 60 executes the computer readable At the time of instruction 62, the functions of the modules/units in the monitoring device of the illegal pyramid scheme described in the above embodiment 2 are realized, for example, the functions of the modules 51 to 54 shown in FIG.

It will be apparent to those skilled in the art that, for convenience and brevity of description, only the division of each functional unit and module described above is exemplified. In practical applications, the above functions may be assigned to different functional units as needed. The module is completed by dividing the internal structure of the device into different functional units or modules to perform all or part of the functions described above.

The above-mentioned embodiments are only used to explain the technical solutions of the present application, and are not limited thereto; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that they can still implement the foregoing embodiments. The technical solutions described in the examples are modified or equivalently replaced with some of the technical features; and the modifications or substitutions do not deviate from the spirit and scope of the technical solutions of the embodiments of the present application, and should be included in Within the scope of protection of this application.

Claims

A method for monitoring an illegal pyramid scheme, characterized in that the monitoring method comprises:

Construct a feature information base based on key information of the illegal pyramid scheme;

Obtaining transaction flow information to be monitored, matching the transaction flow information with the characteristic information database, and obtaining suspicious entities and corresponding suspicious transaction flow information;

Generating a suspicious pyramid scheme based on the suspicious entity and its corresponding suspicious transaction flow information, and recording the suspicious pyramid scheme into the suspicious case list;

The suspicious pyramid scheme is monitored according to the suspicious case list.
The method for monitoring an illegal pyramid scheme according to claim 1, wherein the constructing the feature information base according to the key information of the illegal pyramid scheme comprises:

Acquiring the body information of the illegal pyramid selling organization, and constructing a first feature information table based on the body information, where the first feature information table includes an illegal pyramid selling organization name and corresponding body information;

Acquiring the capital transaction characteristics of the illegal pyramid selling organization, constructing a second feature information table based on the characteristics of the fund transaction, wherein the second feature information table includes a pyramid selling keyword and a corresponding suspicious transaction rule.
The method for monitoring an illegal pyramid scheme according to claim 2, wherein the obtaining the transaction flow information to be monitored, matching the transaction flow information with the feature information database, and obtaining the suspicious subject and its corresponding Suspicious transaction flow information includes:

Obtaining transaction flow information to be monitored;

Matching the transaction flow information with the first feature information table, acquiring subject information related to the illegal pyramid scheme in the transaction flow information, and transaction flow information of the subject information within a specified time period;

Matching the transaction flow information of the subject information in the specified time period and the second feature information table, acquiring the subject information that meets the suspicious transaction rule and the corresponding transaction flow information, as the suspicious subject and the corresponding suspicious transaction thereof Flowing water information.
The method for monitoring an illegal pyramid scheme according to any one of claims 1 to 3, wherein the suspicious pyramid scheme is generated according to the suspicious subject and its corresponding suspicious transaction flow information, and the suspicious pyramid scheme is The list of suspicious cases included:

Obtaining attribute information, account information, and transaction information of the suspicious subject from the suspicious subject and the corresponding suspicious flow information, and configuring the suspicious subject corresponding to the suspicious case number of the specified time period to generate a suspicious pyramid scheme;

Attribute information, account information, transaction information, and the suspicious case number of the suspicious pyramid scheme are associated and stored in the suspicious case table.
The method for monitoring an illegal pyramid scheme according to any one of claims 1 to 3, wherein the monitoring of the suspicious pyramid scheme according to the suspicious case list comprises:

For each suspicious pyramid scheme in the suspicious case list, if the suspicious pyramid scheme is a confirmed illegal pyramid scheme, the transaction frequency and transaction amount of the suspicious pyramid scheme for the public account or the private account are counted;

If the transaction frequency is greater than or equal to the first threshold and the transaction amount is greater than or equal to the second threshold, the reporting operation is performed.
A monitoring device for an illegal pyramid scheme, characterized in that the monitoring device comprises:

a building module for constructing a feature information base based on key information of an illegal pyramid scheme organization;

a matching module, configured to acquire transaction flow information to be monitored, and match the transaction flow information with the feature information database to obtain suspicious entities and corresponding suspicious transaction flow information;

a generating module, configured to generate a suspicious pyramid scheme according to the suspicious entity and its corresponding suspicious transaction flow information, and record the suspicious pyramid scheme into the suspicious case list;

And a monitoring module, configured to monitor the suspicious pyramid scheme according to the suspicious case list.
The monitoring device of the illegal pyramid scheme according to claim 6, wherein the building module comprises:

a first building unit, configured to acquire body information of the illegal pyramid selling organization, and construct a first feature information table based on the body information, where the first feature information table includes an illegal pyramid selling organization name and corresponding body information thereof;

a second building unit, configured to acquire a fund transaction characteristic of the illegal pyramid selling organization, and construct a second feature information table based on the fund transaction characteristic, where the second feature information table includes a pyramid selling keyword and a corresponding suspicious transaction rule thereof .
The monitoring device of the illegal pyramid scheme according to claim 7, wherein the matching module comprises:

An obtaining unit, configured to obtain transaction flow information to be monitored;

a first matching unit, configured to match the transaction flow information with the first feature information table, obtain body information related to an illegal pyramid scheme in the transaction flow information, and transaction flow of the body information within a specified time period information;

a second matching unit, configured to match the transaction flow information of the subject information in the specified time period and the second feature information table, and obtain the subject information that meets the suspicious transaction rule and the corresponding transaction flow information as suspicious The subject and its corresponding suspicious transaction flow information.
The monitoring device of the illegal pyramid scheme according to any one of claims 6 to 8, wherein the generating module comprises:

a generating unit, configured to obtain attribute information, account information, and transaction information of the suspicious subject from the suspicious subject and the corresponding suspicious water information, and configure the suspicious subject corresponding to the suspicious case number of the specified time period to generate a suspicious pyramid scheme Case

And an association unit, configured to associate and store the attribute information, the account information, the transaction information, and the suspicious case number of the suspicious pyramid scheme in the suspicious case table.
The monitoring device of the illegal pyramid scheme according to any one of claims 6 to 8, wherein the monitoring module comprises:

a statistical unit, configured to: for each suspicious pyramid scheme in the suspicious case list, if the suspicious pyramid scheme is an confirmed illegal pyramid scheme, the transaction frequency of the suspicious pyramid scheme for the public account or the private account is counted And the transaction amount;

The reporting unit is configured to perform a reporting operation if the transaction frequency is greater than or equal to the first threshold and the transaction amount is greater than or equal to the second threshold.
A computer device comprising a memory, a processor, and computer readable instructions stored in the memory and operative on the processor, wherein the processor executes the computer readable instructions as follows step:

Construct a feature information base based on key information of the illegal pyramid scheme;

Obtaining transaction flow information to be monitored, matching the transaction flow information with the characteristic information database, and obtaining suspicious entities and corresponding suspicious transaction flow information;

Generating a suspicious pyramid scheme based on the suspicious entity and its corresponding suspicious transaction flow information, and recording the suspicious pyramid scheme into the suspicious case list;

The suspicious pyramid scheme is monitored according to the suspicious case list.
The computer device according to claim 11, wherein the constructing the feature information database according to the key information of the illegal pyramid scheme comprises:

Acquiring the body information of the illegal pyramid selling organization, and constructing a first feature information table based on the body information, where the first feature information table includes an illegal pyramid selling organization name and corresponding body information;

Acquiring the capital transaction characteristics of the illegal pyramid selling organization, constructing a second feature information table based on the characteristics of the fund transaction, wherein the second feature information table includes a pyramid selling keyword and a corresponding suspicious transaction rule.
The computer device according to claim 12, wherein the acquiring the transaction flow information to be monitored, matching the transaction flow information with the feature information database, and obtaining the suspicious entity and the corresponding suspicious transaction flow information include:

Obtaining transaction flow information to be monitored;

Matching the transaction flow information with the first feature information table, acquiring subject information related to the illegal pyramid scheme in the transaction flow information, and transaction flow information of the subject information within a specified time period;

Matching the transaction flow information of the subject information in the specified time period and the second feature information table, acquiring the subject information that meets the suspicious transaction rule and the corresponding transaction flow information, as the suspicious subject and the corresponding suspicious transaction thereof Flowing water information.
The computer device according to any one of claims 11 to 13, wherein the suspicious pyramid scheme is generated according to the suspicious entity and its corresponding suspicious transaction flow information, and the suspicious pyramid scheme is entered into the suspicious case list. Includes:

Obtaining attribute information, account information, and transaction information of the suspicious subject from the suspicious subject and the corresponding suspicious flow information, and configuring the suspicious subject corresponding to the suspicious case number of the specified time period to generate a suspicious pyramid scheme;

Attribute information, account information, transaction information, and the suspicious case number of the suspicious pyramid scheme are associated and stored in the suspicious case table.
The computer device according to any one of claims 11 to 13, wherein the monitoring of the suspicious pyramid scheme according to the suspicious case list comprises:

For each suspicious pyramid scheme in the suspicious case list, if the suspicious pyramid scheme is a confirmed illegal pyramid scheme, the transaction frequency and transaction amount of the suspicious pyramid scheme for the public account or the private account are counted;

If the transaction frequency is greater than or equal to the first threshold and the transaction amount is greater than or equal to the second threshold, the reporting operation is performed.
One or more non-transitory readable storage mediums storing computer readable instructions, wherein when the computer readable instructions are executed by one or more processors, cause the one or more processors to execute The following steps:

Construct a feature information base based on key information of the illegal pyramid scheme;

Obtaining transaction flow information to be monitored, matching the transaction flow information with the characteristic information database, and obtaining suspicious entities and corresponding suspicious transaction flow information;

Generating a suspicious pyramid scheme based on the suspicious entity and its corresponding suspicious transaction flow information, and recording the suspicious pyramid scheme into the suspicious case list;

The suspicious pyramid scheme is monitored according to the suspicious case list.
The non-volatile readable storage medium according to claim 16, wherein the constructing the feature information base according to the key information of the illegal pyramid scheme comprises:

Acquiring the body information of the illegal pyramid selling organization, and constructing a first feature information table based on the body information, where the first feature information table includes an illegal pyramid selling organization name and corresponding body information;

Acquiring the capital transaction characteristics of the illegal pyramid selling organization, constructing a second feature information table based on the characteristics of the fund transaction, wherein the second feature information table includes a pyramid selling keyword and a corresponding suspicious transaction rule.
The non-volatile readable storage medium according to claim 17, wherein the obtaining transaction flow information to be monitored, matching the transaction flow information with the feature information library, and obtaining a suspicious entity and The corresponding suspicious transaction flow information includes:

Obtaining transaction flow information to be monitored;

Matching the transaction flow information with the first feature information table, acquiring subject information related to the illegal pyramid scheme in the transaction flow information, and transaction flow information of the subject information within a specified time period;

Matching the transaction flow information of the subject information in the specified time period and the second feature information table, acquiring the subject information that meets the suspicious transaction rule and the corresponding transaction flow information, as the suspicious subject and the corresponding suspicious transaction thereof Flowing water information.
The non-volatile readable storage medium according to any one of claims 16 to 18, wherein said generating a suspicious pyramid scheme based on said suspicious subject and its corresponding suspicious transaction flow information, and said suspicious The MLM case entry into the suspicious case list includes:

Obtaining attribute information, account information, and transaction information of the suspicious subject from the suspicious subject and the corresponding suspicious flow information, and configuring the suspicious subject corresponding to the suspicious case number of the specified time period to generate a suspicious pyramid scheme;

Attribute information, account information, transaction information, and the suspicious case number of the suspicious pyramid scheme are associated and stored in the suspicious case table.
The non-volatile readable storage medium according to any one of claims 16 to 18, wherein the monitoring of the suspicious pyramid scheme according to the suspicious case list comprises:

For each suspicious pyramid scheme in the suspicious case list, if the suspicious pyramid scheme is a confirmed illegal pyramid scheme, the transaction frequency and transaction amount of the suspicious pyramid scheme for the public account or the private account are counted;

If the transaction frequency is greater than or equal to the first threshold and the transaction amount is greater than or equal to the second threshold, the reporting operation is performed.