Search

CN-122020591-A - Knowledge graph-based fund transaction association relation mining and abnormal behavior identification method

CN122020591ACN 122020591 ACN122020591 ACN 122020591ACN-122020591-A

Abstract

The invention provides a fund transaction association relation mining and abnormal behavior identification method based on a knowledge graph, which relates to the technical field of knowledge graphs and comprises the steps of collecting fund transaction flow data, cleaning and dividing a time window to obtain a standardized transaction data set; the method comprises the steps of constructing a time sequence dynamic knowledge graph, defining a rule type abnormal graph mode, extracting abnormal sub-graphs from historical abnormal case data, selecting a prototype mode, combining the prototype mode with the rule type abnormal graph mode to form an abnormal transaction graph mode library, executing graph mode matching to obtain an abnormal sub-graph instance set, calculating the abnormal score of each abnormal sub-graph instance in the abnormal sub-graph instance set, carrying out score propagation based on the account node overlapping relation among the abnormal sub-graph instances, and aggregating the abnormal scores of all the involved abnormal sub-graph instances of each account node to obtain account level abnormal scores. The invention can improve the identification accuracy of complex hidden abnormal transaction networks.

Inventors

  • QI YI

Assignees

  • 山东承云信息科技有限公司

Dates

Publication Date
20260512
Application Date
20260202

Claims (10)

  1. 1. The method for mining the association relation of the funds transaction and identifying the abnormal behavior based on the knowledge graph is characterized by comprising the following steps: s1, collecting funds transaction flow data, cleaning and dividing a time window to obtain a standardized transaction data set; s2, constructing a time sequence dynamic knowledge graph based on a standardized transaction data set, converting account identification into graph nodes, and converting transaction records into directed edges containing transaction time stamps, transaction amounts and transaction type attributes; S3, defining a rule-type abnormal pattern according to the field business knowledge, extracting an abnormal subgraph from the historical abnormal case data, clustering based on pattern similarity to select a prototype pattern, and combining the prototype pattern and the rule-type abnormal pattern to form an abnormal transaction pattern library; S4, performing graph pattern matching in the time sequence dynamic knowledge graph based on the abnormal transaction graph pattern library to obtain an abnormal sub-graph instance set; S5, calculating the abnormal scores of each abnormal sub-graph instance in the abnormal sub-graph instance set, carrying out score propagation based on the account node overlapping relation among the abnormal sub-graph instances, and aggregating the abnormal scores of all the abnormal sub-graph instances participated by each account node to obtain account-level abnormal scores.
  2. 2. The knowledge-graph-based funds transaction association relation mining and abnormal behavior recognition method according to claim 1, wherein for two abnormal subgraphs And , And The calculation formulas of the pattern similarity of the abnormal subgraphs corresponding to the p-th and the q-th historical abnormal samples are as follows: ; In the formula, In order for the structural similarity to be of a similar nature, In order for the time series similarity to be the same, The calculation formula of the self-adaptive coupling factor is as follows: ; In the formula, For the edge density of the subgraph, For the transaction urgency of the sub-graph, As a parameter of the dimensions of the device, To prevent a small constant from dividing by zero, where edge density is the ratio of the number of sub-graph edges to the maximum possible number of edges, transaction urgency is the ratio of the number of sub-graph edges to the sub-graph time span.
  3. 3. The knowledge-graph-based fund transaction association relation mining and abnormal behavior recognition method according to claim 1, wherein the pattern type difference degree used in calculating the trust propagation strength in step S5 is defined in a segmented manner according to whether the pattern types of the two abnormal sub-graph instances are identical, the pattern type difference degree is 0 when the pattern types of the two abnormal sub-graph instances are identical, the pattern type difference degree is a medium value when the pattern types of the two abnormal sub-graph instances are different but have common business characteristics, and the pattern type difference degree is a maximum value when the pattern types of the two abnormal sub-graph instances are completely uncorrelated.
  4. 4. The knowledge-graph-based fund transaction association relation mining and abnormal behavior recognition method according to claim 1, wherein the rule-type abnormal graph mode defined in the step S3 comprises a fast circulation mode, a star-shaped aggregation mode, a hierarchy diffusion mode and a synchronous transaction mode, wherein the fast circulation mode is that funds form a closed loop path between a plurality of accounts and the time intervals of adjacent transactions are smaller than a set threshold value, the star-shaped aggregation mode is that a single central account and different accounts exceeding the threshold value are transacted within the set time window to form a star-shaped structure, the hierarchy diffusion mode is that funds finally reach a large number of terminal accounts from a single source account through multi-layer shunt to form a tree structure, and the synchronous transaction mode is that a plurality of accounts are transacted with similar amounts within the similar time window.
  5. 5. The knowledge-graph-based funds transaction association relation mining and abnormal behavior recognition method according to claim 1, wherein the performing pattern matching in the time-series dynamic knowledge graph based on the abnormal transaction pattern library in step S4 comprises: Carrying out hard matching on the regular abnormal graph mode by adopting a graph traversal algorithm with constraint to obtain a sub-graph instance meeting constraint conditions; performing soft matching on the prototype mode by calculating the similarity between the candidate subgraph and the graph mode of the prototype mode, wherein the candidate subgraph with the similarity larger than a matching threshold value is used as a matching example; each abnormal sub-graph instance records a corresponding account node set, transaction edge set, pattern type of match, and match score.
  6. 6. The knowledge-graph-based funds transaction association relation mining and abnormal behavior recognition method according to claim 1, wherein scoring propagation based on account node overlapping relation between abnormal sub-graph instances in step S5 comprises: constructing an abnormal subgraph association network; If the two abnormal sub-graph examples have the common account node, establishing a correlation edge between the two abnormal sub-graph examples, and calculating the trust propagation strength between the abnormal sub-graph examples; Updating the anomaly score of each anomaly sub-graph instance based on the trust propagation strength by adopting an iterative propagation algorithm; the trust propagation strength is dynamically determined according to three factors, namely account overlapping degree, pattern type difference and scoring height.
  7. 7. The knowledge-graph-based funds transaction association relation mining and abnormal behavior recognition method according to claim 6, wherein for abnormal sub-graph examples To abnormal subgraph instance Is a function of the strength of the belief propagation, And For the index of the abnormal subgraph example, the calculation formula is: ; In the formula, For the degree of account overlap, For the degree of pattern type difference, Is the first Abnormal subgraph instance in round iteration Is used for the abnormal scoring of (a), Is the first The average anomaly score for all anomaly subgraph instances at round of iteration, In order to control the parameters of the device, A small constant to prevent zero removal; The account overlapping degree is the ratio of the number of common account nodes to the number of smaller sub-nodes of two abnormal sub-graph examples.
  8. 8. The knowledge-graph-based funds transaction association relation mining and abnormal behavior recognition method as claimed in claim 2, wherein for two abnormal subgraphs And The calculation of the structural similarity comprises the steps of obtaining a node alignment set by adopting a node alignment strategy, and aiming at an abnormal subgraph Edges of (2) And anomaly subgraph Corresponding edge of (a) The edge matching score calculation formula is: ; In the formula, And The transaction amounts on the two sides respectively, A small constant to prevent zero removal; computing a slave anomaly subgraph based on edge matching scores To an anomaly subgraph Matching precision and slave outlier of (2) To an anomaly subgraph The structural similarity adopts the harmonic average calculation of the matching precision and the matching recall, and the formula is as follows: ; In the formula, In order to match the accuracy of the matching, To match recall.
  9. 9. The knowledge-graph-based funds transaction association relation mining and abnormal behavior recognition method according to claim 2, wherein for abnormal subgraphs The edges in the edge set are arranged in ascending order according to the time stamp Wherein For the number of sides, the number of sides is the number of sides, The sequence number of the ordering of the representing edges, the trade cadence sequence is defined as: ; In the formula, For the time intervals of the kth and k+1 transactions, k is the serial number of the transaction edge, A timestamp of the kth edge; calculating distance between transaction rhythm sequences of two abnormal subgraphs by adopting dynamic time warping algorithm The time sequence similarity calculation formula is: ; In the formula, Is an abnormal subgraph Is a mean value of the sequence of trade cadences, As a parameter of the dimensions of the device, To prevent a small constant of zero removal.
  10. 10. The knowledge-graph-based funds transaction association mining and abnormal behavior recognition method according to claim 1, wherein calculating the abnormal score of each abnormal sub-graph instance in step S5 includes calculating an initial abnormal score and a final abnormal score after propagation, for the abnormal sub-graph instance The initial anomaly score calculation formula is as follows: ; In the formula, For the purpose of the degree of matching scoring, In order to be of a structural complexity, For the size of the funds, In order to achieve a degree of time urgency, And Is a weight coefficient; for an account node v in the knowledge graph, an account level abnormal score calculation formula is as follows: ; In the formula, As the total number of instances of the outlier sub-graph, For abnormal subgraph instance Is a set of account nodes of (a), Is the final anomaly score after score propagation.

Description

Knowledge graph-based fund transaction association relation mining and abnormal behavior identification method Technical Field The invention relates to the technical field of knowledge graphs, in particular to a method for mining fund transaction association relation and identifying abnormal behaviors based on the knowledge graphs. Background With the continuous expansion of financial transaction scale and the increasing complexity of transaction modes, the fund transaction data has the characteristics of massive, multi-source and heterogeneous. The traditional abnormal transaction identification method is mainly based on the transaction characteristics of a single account for analysis, such as statistical indexes of transaction frequency, transaction amount, transaction time period and the like, and identifies abnormal behaviors by setting a threshold rule or training a classification model. However, such methods have difficulty in finding abnormal patterns hidden in complex associations between accounts, such as abnormal actions of fast transfer of funds through multiple layers of accounts, scattered transfer of funds by cooperation of multiple accounts, closed loop reflux of funds in an account network, and the like. These abnormal patterns are not characterized by transaction data of a single account, but rather by transaction association structures among multiple accounts, resulting in higher miss rates of traditional methods. Chinese patent CN111400560a discloses a method for predicting based on heterogeneous graph neural network model, which comprises constructing heterogeneous graph data and grouping neighboring nodes based on path types, aggregating different groups of node features by using the graph neural network, determining node weights and path weights by combining attention mechanisms, and finally obtaining a representation vector of a node to be predicted for risk prediction. The patent utilizes node association information in the graph structure, and can mine complex relations among entities to a certain extent. However, the method does not consider the time sequence evolution characteristics of the abnormal transaction mode when the similarity of the graph modes is measured, and does not fully utilize the association information between the abnormal subgraphs to carry out grading propagation when the abnormal scores are carried out, so that the hidden networked abnormal behavior identification capability is required to be improved. Disclosure of Invention In view of the above, the invention provides a fund transaction association relation mining and abnormal behavior identification method based on a knowledge graph, which is characterized in that a graph mode similarity measurement method of self-adaptive coupling is designed to fuse structural features and time sequence features by constructing a time sequence dynamic knowledge graph to express transaction association relation among accounts, abnormal sub-graph examples are mined in the knowledge graph by adopting a strategy of combining soft and hard matching, and a trust propagation mechanism is established for scoring propagation based on account overlapping relation among the abnormal sub-graphs, so that the identification accuracy of a complex hidden abnormal transaction network is improved. The technical scheme of the invention is realized as follows: the invention provides a knowledge-graph-based fund transaction association relation mining and abnormal behavior identification method, which comprises the following steps: s1, collecting funds transaction flow data, cleaning and dividing a time window to obtain a standardized transaction data set; s2, constructing a time sequence dynamic knowledge graph based on a standardized transaction data set, converting account identification into graph nodes, and converting transaction records into directed edges containing transaction time stamps, transaction amounts and transaction type attributes; S3, defining a rule-type abnormal pattern according to the field business knowledge, extracting an abnormal subgraph from the historical abnormal case data, clustering based on pattern similarity to select a prototype pattern, and combining the prototype pattern and the rule-type abnormal pattern to form an abnormal transaction pattern library; S4, performing graph pattern matching in the time sequence dynamic knowledge graph based on the abnormal transaction graph pattern library to obtain an abnormal sub-graph instance set; S5, calculating the abnormal scores of each abnormal sub-graph instance in the abnormal sub-graph instance set, carrying out score propagation based on the account node overlapping relation among the abnormal sub-graph instances, and aggregating the abnormal scores of all the abnormal sub-graph instances participated by each account node to obtain account-level abnormal scores. Preferably, for two outlier subgraphsAnd,AndThe calculation formulas of the pattern similarity of