Search

CN-121980432-A - Abnormal transaction monitoring method, device, equipment, medium and program product

CN121980432ACN 121980432 ACN121980432 ACN 121980432ACN-121980432-A

Abstract

The application provides a monitoring method for abnormal transactions, which can be applied to the technical field of artificial intelligence, the information security field and the financial science and technology field. The abnormal transaction monitoring method comprises the steps of constructing a first multi-layer network based on multi-source transaction data acquired in real time, coupling the first multi-layer network to extract a first aggregation topology adjacency matrix, wherein the first aggregation topology adjacency matrix comprises aggregation transaction characteristics of each layer of network in the first multi-layer network, and monitoring abnormal transactions in the multi-source transaction data through a pre-trained graph network model based on the first aggregation topology adjacency matrix. The application also provides a monitoring device, equipment, a storage medium and a program product for abnormal transaction.

Inventors

  • Mi Anran

Assignees

  • 中国工商银行股份有限公司

Dates

Publication Date
20260505
Application Date
20250626

Claims (12)

  1. 1. A method of monitoring for abnormal transactions, the method comprising: constructing a first multi-layer network based on multi-source transaction data acquired in real time; Coupling the first multi-tier network to extract a first aggregate topology adjacency matrix, wherein the first aggregate topology adjacency matrix includes aggregate transaction characteristics for each of the first multi-tier network, and Abnormal transactions in the multi-source transaction data are monitored by a pre-trained graph network model based on the first aggregated topological adjacency matrix.
  2. 2. The method of claim 1, wherein the first multi-tier network comprises a directed, boundless, weight single tier network constructed based on personal relationships between accounts, a directed, edge weight single tier network constructed based on cash flow relationships between accounts, and a directed, edge weight single tier network constructed based on business relationships between accounts.
  3. 3. The method of claim 2, wherein constructing a first multi-tier network based on the multi-source transaction data acquired in real-time comprises: integrating the multisource transaction data acquired in real time; Based on the integrated multi-source transaction data, taking accounts as nodes, personal relations among the accounts as undirected edges, and edge weights among the accounts as equivalent weights, and constructing the undirected and undirected weight single-layer network constructed based on the personal relations among the accounts; based on the integrated multi-source transaction data, constructing the directed edge weight single-layer network constructed based on the inter-account funds flow relationship by taking the accounts as nodes, the funds transaction relationship between the accounts as directed edges and the edge weight between the accounts as funds flow data, and Based on the integrated multi-source transaction data, the account is taken as a node, the enterprise relationship among the accounts is taken as a directional edge, the edge weight among the accounts is taken as enterprise relationship data, and the directional edge weight single-layer network constructed based on the enterprise relationship among the accounts is constructed.
  4. 4. The method of claim 2, wherein said coupling the first multi-layer network to extract a first aggregate topology adjacency matrix comprises: constructing an adjacency matrix for a single-layer network of the first multi-layer network based on network directionality of the single-layer network, and And obtaining the first aggregation topology adjacency matrix according to the adjacency matrix of the single-layer network.
  5. 5. The method of claim 4, wherein the constructing the adjacency matrix for the single-layer network based on network directionality for a single-layer network in the first multi-layer network comprises: if the single-layer network is a directed network, determining the characteristic value of a node adjacent matrix element according to the edge weight between two nodes under the condition that a forward edge exists between the two nodes; If the single-layer network is an undirected network, determining the characteristic value of the node adjacent matrix element according to the equivalent weight of the two nodes under the condition that undirected edges exist between the two nodes, and And constructing an adjacency matrix of the single-layer network based on the characteristic values of the node adjacency matrix elements.
  6. 6. The method of claim 4, wherein the obtaining the first aggregate topology adjacency matrix from the adjacency matrix of the single-layer network comprises: Summing the adjacency matrix of the single-layer network to obtain the first aggregation topology adjacency matrix.
  7. 7. The method of claim 1, wherein the training process of the graph network model comprises: constructing a second multi-layer network based on the multi-source abnormal transaction data; coupling the second multi-layer network to extract a second polymeric topology adjacency matrix, and And training the graph network model by taking the second aggregation topology adjacency matrix as a training set and adopting reinforcement learning, wherein the graph network model is a multi-layer network model constructed based on multi-source historical transaction data.
  8. 8. The method of claim 7, wherein the rewarding mechanism in reinforcement learning comprises: forward rewarding the graph network model in the event that the graph network model detects a closed loop transaction path or associated high risk entity, and And under the condition that the map network model misreports normal transaction or the search step number exceeds a preset threshold value, the map network model is rewarded negatively.
  9. 9. A monitoring device for abnormal transactions, the device comprising: the network construction module is used for constructing a first multi-layer network based on the multi-source transaction data acquired in real time; A coupling module for coupling the first multi-layer network to extract a first aggregate topology adjacency matrix, wherein the first aggregate topology adjacency matrix includes aggregate transaction characteristics for each of the first multi-layer network, and And the monitoring module is used for monitoring abnormal transactions in the multi-source transaction data through a pre-trained graph network model based on the first aggregation topology adjacency matrix.
  10. 10. An electronic device, comprising: One or more processors; a memory for storing one or more computer programs, Characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1-8.
  11. 11. A computer-readable storage medium, on which a computer program or instructions is stored, which, when executed by a processor, carries out the steps of the method according to any one of claims 1-8.
  12. 12. A computer program product comprising a computer program or instructions which, when executed by a processor, implement the steps of the method according to any one of claims 1 to 8.

Description

Abnormal transaction monitoring method, device, equipment, medium and program product Technical Field The present application relates to the fields of artificial intelligence, information security and financial technology, and more particularly to a method, apparatus, device, medium and program product for monitoring abnormal transactions. Background In financial transactions, monitoring abnormal transaction activities such as illegal funds transfer, malicious transfer, funds cleaning and the like is of great importance, monitoring abnormal transactions can maintain stability of a financial system, prevent systematic risks, protect public property safety, avoid malicious encroachment of funds, can assist in supervision compliance, promote public trust of financial institutions, and has great significance in construction of safe finance ecology. At present, the traditional monitoring technology mainly relies on direct monitoring of transactions, relies on static rules (such as an amount threshold) to identify abnormal transactions, has suddenly reduced effectiveness in front of novel abnormal transaction behaviors with high concealment and strong cross-domain performance, and cannot accurately locate abnormal transactions in a large amount of real-time multi-source transaction data. Disclosure of Invention In view of the foregoing, the present application provides an abnormal transaction monitoring method, apparatus, device, medium and program product that improve the accuracy of identifying abnormal transactions. According to a first aspect of the application, a monitoring method of abnormal transactions is provided, which comprises the steps of constructing a first multi-layer network based on multi-source transaction data acquired in real time, coupling the first multi-layer network to extract a first aggregation topology adjacency matrix, wherein the first aggregation topology adjacency matrix comprises aggregation transaction characteristics of each layer of network in the first multi-layer network, and monitoring abnormal transactions in the multi-source transaction data through a pre-trained graph network model based on the first aggregation topology adjacency matrix. According to an embodiment of the application, the first multi-layer network comprises an undirected borderless weight single layer network constructed based on personal relationships among accounts, a directed borderless weight single layer network constructed based on fund flow relationships among accounts, and a directed borderless weight single layer network constructed based on enterprise relationships among accounts. According to the embodiment of the application, a first multi-layer network is constructed based on multi-source transaction data acquired in real time, the multi-source transaction data acquired in real time is integrated, the non-directional non-edge weighted single-layer network constructed based on personal relations among accounts is constructed based on the integrated multi-source transaction data by taking the accounts as nodes and the personal relations among the accounts as non-directional edges and the edge weights among the accounts as equivalent weights, the directional edge weighted single-layer network constructed based on the inter-account enterprise relations is constructed based on the integrated multi-source transaction data by taking the accounts as nodes, the fund relation among the accounts as directional edges and the edge weights among the accounts as fund flow data, and the directional edge weighted single-layer network constructed based on the inter-account enterprise relations is constructed based on the integrated multi-source transaction data by taking the accounts as nodes, the enterprise relations among the accounts as directional edges and the edge weights among the accounts as enterprise relation data. According to an embodiment of the application, the coupling the first multi-layer network to extract a first aggregation topology adjacency matrix comprises constructing an adjacency matrix of a single-layer network in the first multi-layer network based on network directionality of the single-layer network, and obtaining the first aggregation topology adjacency matrix according to the adjacency matrix of the single-layer network. According to the embodiment of the application, the construction of the adjacency matrix of the single-layer network based on the network directionality of the single-layer network in the first multi-layer network comprises the steps of determining the characteristic value of a node adjacency matrix element according to the edge weight between two nodes when a forward edge exists between the two nodes if the single-layer network is a directional network, determining the characteristic value of the node adjacency matrix element according to the equivalent weight of the two nodes when an undirected edge exists between the two nodes if the single-layer network is an