CN114818999B - Account identification method and system based on self-encoder and generation countermeasure network - Google Patents
Account identification method and system based on self-encoder and generation countermeasure network Download PDFInfo
- Publication number
- CN114818999B CN114818999B CN202210745030.XA CN202210745030A CN114818999B CN 114818999 B CN114818999 B CN 114818999B CN 202210745030 A CN202210745030 A CN 202210745030A CN 114818999 B CN114818999 B CN 114818999B
- Authority
- CN
- China
- Prior art keywords
- account
- transaction
- encoder
- discriminator
- behavior
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/24—Classification techniques
- G06F18/241—Classification techniques relating to the classification model, e.g. parametric or non-parametric approaches
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/25—Fusion techniques
- G06F18/253—Fusion techniques of extracted features
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/04—Architecture, e.g. interconnection topology
- G06N3/045—Combinations of networks
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/08—Learning methods
- G06N3/084—Backpropagation, e.g. using gradient descent
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q40/00—Finance; Insurance; Tax strategies; Processing of corporate or income taxes
- G06Q40/04—Trading; Exchange, e.g. stocks, commodities, derivatives or currency exchange
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- Data Mining & Analysis (AREA)
- General Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- Life Sciences & Earth Sciences (AREA)
- Artificial Intelligence (AREA)
- Evolutionary Computation (AREA)
- Business, Economics & Management (AREA)
- Computational Linguistics (AREA)
- Software Systems (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Health & Medical Sciences (AREA)
- Biomedical Technology (AREA)
- Biophysics (AREA)
- Bioinformatics & Computational Biology (AREA)
- General Health & Medical Sciences (AREA)
- Molecular Biology (AREA)
- Computing Systems (AREA)
- Mathematical Physics (AREA)
- Evolutionary Biology (AREA)
- Bioinformatics & Cheminformatics (AREA)
- Accounting & Taxation (AREA)
- Finance (AREA)
- Development Economics (AREA)
- Economics (AREA)
- Marketing (AREA)
- Strategic Management (AREA)
- Technology Law (AREA)
- General Business, Economics & Management (AREA)
- Image Analysis (AREA)
- Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)
Abstract
The invention discloses an account identification method and system based on a self-encoder and a generation countermeasure network, belonging to the technical field of financial information safety, and the method comprises the following steps: acquiring an account transaction report and an account attribute graph sequence of a bank account, and manually marking the account type; extracting fusion characteristics of the account through a self-encoder; based on the fusion characteristics, generating account characteristics with type labels by using a generation countermeasure network, and training a discriminator by using the account fusion characteristics and the generated account characteristics; and extracting the fusion characteristics of the account to be detected according to the account transaction report and the attribute graph sequence of the account to be detected, inputting the fusion characteristics into a discriminant which is trained, identifying the authenticity of the account to be detected and predicting the category of the account to be detected. According to the invention, the dynamic behavior mode and the dynamic structure mode of the money laundering account and the influence between the dynamic behavior mode and the dynamic structure mode are automatically captured in an end-to-end mode through the self-encoder structure, and the account identification performance is improved through the sample enhancement based on the generated countermeasure, so that the fine-grained identification of the money laundering account is realized.
Description
Technical Field
The invention belongs to the technical field of financial information security, and particularly relates to an account identification method and system based on an autoencoder and a generation countermeasure network.
Background
Money laundering refers to the process that organized criminals use financial institutions as tools to change illegal funds into seemingly legal funds and hide the source and destination of the funds through means such as transfer. The vast amount of property involved in money laundering activities not only severely disrupts economic order, but also encourages the development of criminal organizations. Therefore, the anti-money laundering technology has important significance on economic safety and social safety.
Money laundering typically involves the act of transferring funds between a large number of bank accounts, and detecting the bank accounts participating in money laundering from a transaction record is a key component in the anti-money laundering process. Existing money laundering account detection techniques have undergone development routes that are rule-based, statistical-based, and machine-learning-based. The early rule-based method detects the money laundering account number by formulating an identification rule through human experience or expert knowledge, and because the artificially formulated rule is easily influenced by human subjectivity, the method has high false alarm rate and is easy to avoid, and the money laundering account number in a novel money laundering mode cannot be identified; the general rule of the money laundering account is obtained through analysis and summary based on a statistical method, for example, the difference between the capital flow and the similar type of professional income is large, so that a detection strategy is formulated, but the effectiveness of the method is gradually reduced along with the continuous complication of a money laundering mode; in an automatic detection method based on a machine learning technology, a mode of a money laundering account is generally learned by using a traditional machine learning model such as a Support Vector Machine (SVM) and a Random Forest (RF) based on characteristics of manual design, however, the manual design of characteristics is time and labor consuming and is still easily avoided by criminals. In the prior art, a money laundering account detection technology based on deep learning is gradually raised, the technology does not need manual feature design, and can detect money laundering accounts in an end-to-end mode, but the technology usually needs a large amount of training data to fit model parameters.
Existing money laundering account technologies can be divided into three categories depending on the objects of analysis. One technology builds an identification model based on the transaction behavior characteristics of the money laundering account number, such as daily average transaction flow, daily average transaction counter-hand amount and the like; another type of technology builds an identification model based on structural characteristics of an account in a money laundering fund transaction network, such as degree of entrance, degree of exit, degree of centricity and the like; there is also a class of methods that combines the two types of features to construct recognition models, and the detection performance of these techniques is generally higher than that of the first two.
That is, methods based on rules, statistics and traditional machine learning technology all need to rely on rule summarization of money laundering modes by people, so that hysteresis exists when dealing with novel money laundering modes, and the novel money laundering modes cannot be effectively detected in time, for example, patent CN 202011479935.4 identifies risk accounts based on a time sequence transaction map and a preset account identification strategy, the scheme is time-consuming and labor-consuming through manual design of identification rules, and the identification rules are updated late, so that missed detection and false detection of risk accounts are easy; the existing deep learning-based method solves the problem to a certain extent, but the methods usually need a large amount of training data, but money laundering transaction data which can be used as training data are deficient in reality, so that model training is not easy to converge, and the generalization performance is poor, for example, in a security financing account identification method based on supervised machine learning of patent CN 201611134189.9, the scheme does not consider the problems of difficult convergence, poor generalization performance and the like of a classification model due to the small number of risk accounts in a real scene.
Second, the money laundering process is a dynamic process, so that it is more efficient to identify money laundering accounts by fully capturing their behavioral and structural dynamics. In the prior art, on one hand, a money laundering transaction network is regarded as a static network, development and evolution of a network structure are not concerned, on the other hand, complex interaction between behavior dynamics and structure dynamics is not fully considered, and only two types of simple characteristics are superposed for modeling, so that the complex money laundering pattern recognition performance is not ideal.
Finally, the existing money laundering account detection technology has a relatively large identification granularity, only can identify whether a target account participates in money laundering, namely two classifications, and cannot identify the functional roles borne by the money laundering account in the whole money laundering transaction process in a relatively fine granularity manner, such as loose money, fund collection, source confusion and the like.
According to the scheme, the account category is predicted without combining a transaction structure of a target account, and the category of a transaction opponent is helpful for predicting the category of the target account, for example, the transaction-to-hand probability of a benign account is also a benign account; (2) the complex interaction between the behavior dynamics and the structure dynamics of the accounts is not considered, for example, a benign account and a money washing account both accumulate and transfer large amounts of funds, from the view point of the behavior dynamics, the benign account transfers funds with different amounts for a long time, and the money washing account transfers large amounts of funds in a short time; from the viewpoint of structural dynamics, only considering the flow direction of the funds, the number of the transaction opponents of the benign account is large, and the number of the transaction opponents of the money laundering account is small and relatively fixed; however, from a static view angle, the benign account has similar characteristics with the money laundering account, so that the scheme has a high false alarm rate when predicting the money laundering account and the benign account with similar characteristics, and is not suitable for detecting a decentralized and concealed money laundering mode; (3) only whether the target account participates in money laundering or not, namely, two categories, can be identified, and technical support cannot be provided for related personnel to analyze the operation mechanism of the money laundering organization.
Disclosure of Invention
Aiming at the defects of the prior art, the invention provides an account identification method and an account identification system based on a self-encoder and a generation countermeasure network, which can automatically capture a behavior dynamic mode and a structure dynamic mode of a money laundering account in an end-to-end mode through a self-encoder structure without manual participation and fully capture the complex mutual influence between the behavior dynamic and the structure dynamic through a multi-task learning structure; a part of pseudo samples close to the real sample distribution are generated by generating a confrontation network, so that the enhancement of training data is realized, and the problems of difficult convergence, poor generalization and the like caused by the lack of training samples in the conventional deep learning method are solved; the method can perform fine-grained identification on roles born by the money laundering account in the whole money laundering process, and is beneficial to analyzing the operation mechanism of the money laundering organization, so that the money laundering organization can be attacked and disintegrated more effectively.
In order to achieve the above object, one or more embodiments of the present invention provide the following technical solutions:
the invention provides an account identification method based on an autoencoder and a generation countermeasure network.
An account identification method based on an autoencoder and a generation countermeasure network comprises the following steps:
acquiring a file and a transaction record of a bank account, manually marking the account type, and constructing an account transaction report and an account attribute graph sequence;
extracting account features based on the account transaction report and the sequence of account attribute maps; specifically, an account transaction report is input into a behavior feature encoder, account transaction behavior features are extracted, an account attribute graph sequence is input into a structure feature encoder, account transaction relationship features are extracted, and account transaction behavior features and account transaction relationship features are fused to obtain feature fusion vectors, namely account features;
the method comprises the steps that account characteristics with account category labels are used as real samples, account characteristics with type labels are generated by a generator for generating the countermeasure network based on the real samples, the generated account characteristics are used as pseudo samples, and the generator and the discriminator for generating the countermeasure network are trained by the real samples and the pseudo samples;
according to the file and the transaction record of the account to be detected, a transaction report of the account to be detected and an attribute graph sequence of the account to be detected are established, the fusion characteristic of the account to be detected is extracted, the fusion characteristic of the account is input into a discriminant which is trained, the authenticity of the account to be detected is recognized, and the category of the account to be detected is predicted.
According to a further technical scheme, the fusing the account transaction behavior characteristics and the account transaction relationship characteristics to obtain a characteristic fusion vector comprises the following steps:
transversely splicing the account transaction behavior characteristics and the account transaction relationship characteristics to obtain spliced characteristic vectors;
and inputting the spliced feature vectors into the full-connection layer to obtain the feature fusion vectors of the fusion behavior dynamic mode and the structure dynamic mode.
According to the further technical scheme, the specific process of generating the account characteristics with the type labels by using the generator for generating the countermeasure network based on the real samples comprises the following steps: and constructing prior distribution based on the mean and variance of the feature fusion vector, sampling random vectors from the prior distribution, inputting the random vectors and the account category labels into a generator consisting of full connection layers, and generating the account feature vector with type labels.
The further technical scheme is that a generator and a discriminator for generating the confrontation network by training real samples and pseudo samples refers to the following steps:
inputting the pseudo sample generated by the generator into a discriminator, calculating a loss value of the generator according to a class identification result output by the discriminator and the actual labeled class of the pseudo sample, and optimizing and updating the parameters of the generator based on the loss value to realize the training of the generator;
based on the real sample, generating a pseudo sample again by using the trained generator, mixing the pseudo sample and the real sample, inputting the mixed pseudo sample and the real sample into a discriminator, calculating a loss value of the discriminator according to a class recognition result output by the discriminator and an actual labeled class of the input sample, optimizing and updating parameters of the discriminator based on the loss value, and realizing the training of the discriminator;
and circularly iterating the training process until the loss values of the generator and the discriminator are minimum, and finishing the training.
The further technical scheme also comprises a self-encoder for iterative training by using the feature fusion vector loop, which specifically comprises the following steps: and calculating a loss function of the self-encoder, minimizing the loss function of the self-encoder by using a gradient descent method, and updating parameters of the self-encoder through back propagation to realize the training of the self-encoder.
According to a further technical scheme, the calculation process of the self-encoder loss function comprises the following steps:
respectively inputting the feature fusion vector into a behavior feature decoder and a structure feature decoder, and reconstructing account transaction behavior features and account transaction relation features;
and calculating the loss of the account transaction behavior characteristic and the transaction relationship characteristic by using a behavior characteristic loss function and a transaction relationship characteristic loss function respectively based on the reconstructed account transaction behavior characteristic and the account transaction relationship characteristic, and obtaining a loss function obtained from the encoder through weighted summation.
In a further technical scheme, the discriminator is a multi-head discriminator, and the true and false mixed account is used as input to output two groups of probability distributions, namely the true and false probability distribution of the account to be detected and the probability distribution of the category to which the account to be detected belongs.
In a second aspect, the invention provides an account identification system based on a self-encoder and a generation countermeasure network.
An account identification system based on a self-encoder and generation countermeasure network, comprising:
the data acquisition module is used for acquiring the file and the transaction record of the account and constructing an account transaction report and an account attribute graph sequence;
the characteristic extraction module is used for extracting account characteristics based on the account transaction report and the account attribute graph sequence; specifically, an account transaction report is input into a behavior feature encoder, account transaction behavior features are extracted, an account attribute graph sequence is input into a structural feature encoder, account transaction relationship features are extracted, account transaction behavior features and account transaction relationship features are fused, and feature fusion vectors, namely account features, are obtained;
and the prediction module is used for inputting the extracted account fusion characteristics into the trained discriminator, identifying the authenticity of the account and predicting the category of the account.
According to a further technical scheme, the fusing the account transaction behavior characteristics and the account transaction relationship characteristics to obtain a characteristic fusion vector comprises the following steps:
transversely splicing the account transaction behavior characteristics and the account transaction relationship characteristics to obtain spliced characteristic vectors;
and inputting the spliced feature vectors into the full-connection layer to obtain the feature fusion vectors of the fusion behavior dynamic mode and the structure dynamic mode.
In a further technical scheme, the discriminator is a multi-head discriminator, and the true and false mixed accounts are used as input to output two groups of probability distributions, namely the true and false probability distribution of the account to be detected and the probability distribution of the category of the account to be detected.
The above one or more technical solutions have the following beneficial effects:
(1) the invention provides an account identification method based on a self-encoder and a generation countermeasure network, which is used for detecting a money laundering account number in an end-to-end mode, relieving the problem that the prior art cannot effectively cope with a novel and complex money laundering mode under the condition of low labor cost by automatically capturing a behavior dynamic mode and a structure dynamic mode of the money laundering account number and complex mutual influence between the behavior dynamic mode and the structure dynamic mode and enhancing samples based on generation countermeasures, and further improving the performance of money laundering account number detection.
(2) The method provided by the invention can carry out fine-grained identification on the roles born by the money laundering account in the whole money laundering process, can better help investigators to analyze the operation mechanism of the money laundering organization, and can more effectively attack and disrupt the money laundering organization.
Drawings
The accompanying drawings, which are incorporated in and constitute a part of this specification, are included to provide a further understanding of the invention, and are incorporated in and constitute a part of this specification, illustrate exemplary embodiments of the invention and together with the description serve to explain the invention and not to limit the invention.
Fig. 1 is a schematic overall structure diagram of an identification method according to an embodiment of the present invention;
fig. 2 is a schematic diagram of a feature extraction process of a structure encoder in the identification method according to an embodiment of the present invention;
FIG. 3 is a schematic view illustrating a reconstruction process of a structure decoder in the identification method according to an embodiment of the present invention;
FIG. 4 is a schematic diagram illustrating a prediction flow of a discriminator in the identification method according to an embodiment of the invention;
fig. 5 is a schematic structural diagram of an identification system according to a second embodiment of the present invention.
Detailed Description
It is to be understood that the following detailed description is exemplary and is intended to provide further explanation of the invention as claimed. Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs.
It is noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of exemplary embodiments according to the invention. As used herein, the singular forms "a", "an" and "the" are intended to include the plural forms as well, and it should be understood that when the terms "comprises" and/or "comprising" are used in this specification, they specify the presence of stated features, steps, operations, devices, components, and/or combinations thereof, unless the context clearly indicates otherwise.
Example one
In order to solve the problem of poor recognition performance of the existing money laundering account number recognition technology, the embodiment provides an account recognition method based on a self-encoder and a generation countermeasure network, as shown in fig. 1, the method includes:
acquiring a file and a transaction record of a bank account, manually marking the account type, and constructing an account transaction report and an account attribute graph sequence;
extracting account features based on the account transaction report and the sequence of account attribute maps; specifically, an account transaction report is input into a behavior feature encoder, account transaction behavior features are extracted, an account attribute graph sequence is input into a structural feature encoder, account transaction relationship features are extracted, account transaction behavior features and account transaction relationship features are fused, and feature fusion vectors, namely account features, are obtained;
the method comprises the steps that account characteristics with account category labels are used as real samples, account characteristics with type labels are generated by a generator for generating the countermeasure network based on the real samples, the generated account characteristics are used as pseudo samples, and the generator and the discriminator for generating the countermeasure network are trained by the real samples and the pseudo samples;
and according to the file and the transaction record of the account to be detected, establishing a transaction report and an attribute graph sequence of the account to be detected, extracting the fusion characteristic of the account to be detected, inputting the fusion characteristic of the account into a trained discriminator, identifying the authenticity of the account to be detected and predicting the category of the account to be detected.
Firstly, acquiring the file and transaction record of bank account, manually marking the account category based on the acquired account file and transaction record, namely manually marking whether each account is a money laundering account and the division of money laundering account, and meanwhile, according to the acquired file and transaction recordAnd (4) recording the account and the transaction records, and constructing an account transaction report and an account attribute graph sequence. Wherein the account profile includes an accountIDThe number of the owned bank cards, the card opening date and the like, and each piece of data in the transaction record is represented asr=[orig, dst, amount, time]WhereinorigTo be a money transfer account,dstin order to be the collection account, the user can select the collection account,amountto be the amount of the transaction,timeis the transaction time.
Constructing an account transaction report, comprising: at intervals of timetPartitioning transaction records for unitsr=[orig, dst, amount, time]Calculating a unit timetStatistics of estimated money laundering behavior, such as: the total amount of the collection, the total amount of the remittance, the account number remitted to the account and the like to obtain an account transaction reportR（
），NIndicating the number of accounts acquired and,krepresenting the number of statistics evaluating money laundering behavior,Trepresenting the total number of time periods.
Constructing an account attribute graph sequence, comprising: constructing an account attribute map sequence, noted asG= (G 1 ,G 2 ,…,G T )，t∈(1,2,…,T). Wherein the content of the first and second substances,G t =(V, E t )is at leasttProperty graphs constructed over time, i.e. over timetA status of the internal transaction network;V={v 1 ,v 2 ,…,v N represents a shared point set of the attribute map sequence;E t is shown intThe set of transactions that occur over time, for example,v 1 to the direction ofv 2 Remittance is made by connecting a directed edge starting atv 1 End point isv 2 (ii) a Subscriber profile X (
) As a shared node attribute feature of the attribute graph sequence,d a the dimensions in the user profile describing the user characteristics.
Second, account features are extracted based on the account transaction report and the sequence of account attribute maps.
To capture an accountu i Dynamic mode of action of, reporting from account transactionsRIn (C) acquisitionu i Account transaction reportR i （
) Will beR i As input to the behavior feature encoder, the behavior feature encoder automatically derives fromR i In the method, transaction behavior characteristics b are extracted i 。
Specifically, (1) first, convolutional neural network extraction is usedu i Short-term transaction characteristics of, i.e. using 32 sizesk* wConvolution kernel with step size of 1R i Convolution operation is carried out, a ReLU function is used for activation after the convolution operation, and the output of the convolution layer is
Wherein
Parameter ofk、wAre all constants; (2) then based on the convolutional layer output, using a recurrent neural network (e.g., long-short term memory network) to extract
The long-term transaction characteristics in time are taken as the output of the last time stepu i Characteristic of transaction behavior b i 。
To capture an accountu i Structural feature encoder with account attribute map sequenceGFor input, aggregating through a graph neural networku i To capture short-term patterns of account transaction relationships, using recurrent neural networksThe evolution process of the trading network is simulated by fusing a plurality of short-term modes to obtain the long-term characteristics of the trading relation, so that the evolution process of the trading network is extractedu i Characteristic of transaction relationship s i 。
Specifically, as shown in fig. 2, the structural feature encoder is composed of a graph neural network and a recurrent neural network, which are respectively used for extracting timetAnd a long-term mode between the plurality of windows. In this embodiment, a Graph Convolutional neural Network (GCN) and a Gated Recovery Unit (GRU) form a structural feature encoder, and a transaction relationship feature s i The extraction step comprises:
(1) graph sequence with node attribute matrix XGIn the graph convolution neural network GCN of the input structure feature encoder, foru i To (1) atIndividual figureG t GCN is atG t Upper pairu i Get the neighbor information aggregatedlStructural feature representation of order neighbor information:
wherein the content of the first and second substances,
，
and
representing nodesu i And nodev j The degree of (a) is greater than (b),
is composed ofu i The neighbor nodes of (a) are,
is a polymeric onelOrder neighbor node characteristic, W l Is as followslA parameter matrix of the layer. When in usel=When the pressure of the mixture is 1, the pressure is lower,u i is characterized by a nodeu i Vectors in the attribute matrix X, i.e.
。
(2) Structural feature representation at a time above a gated cell network GRU of a structural feature encoder
And timetStructural feature representation of
To enter, code accountu i Timing characteristics in transaction structure, taking GRU at last time stepTAs an output ofu i Characteristic s of transaction behavior i 。
As another embodiment, in the above solution of using Graph neural Network to construct the short-term feature of the account transaction structure, the Graph volume neural Network used may be replaced by other Graph neural networks with similar functions, such as Graph Attention Network (Graph Attention Network) and the like.
As another embodiment, in the above solution of using gated cyclic unit network to obtain Long-Term characteristics of account transaction structure, the model used may be replaced by other cyclic neural networks, such as Long Short-Term Memory network (Long Short-Term Memory).
After the account transaction behavior characteristics and the account transaction relationship characteristics are obtained, in order to realize more effective identification, the scheme of the embodiment fuses account numbersu i The dynamic patterns of the behavior and the dynamic patterns of the structure are fused by using a feature fusion layer consisting of full connectionu i Characteristic of transaction behavior b i And transaction relationship characteristics s i 。
Specifically, first, the methodB is to i And s i Performing transverse splicing to obtain spliced characteristic vector c i Then c is added i Inputting the feature fusion vector into the full-connection layer to finally obtain the feature fusion vector fusing the behavior dynamic mode and the structure dynamic mode
。
And then, taking the account characteristics with the account category labels as real samples, generating the account characteristics with the type labels by using a generator for generating the countermeasure network based on the real samples, taking the generated account characteristics as pseudo samples, and training the generator and the discriminator for generating the countermeasure network by using the real samples and the pseudo samples.
In the process of generating the pseudo samples by using the generating network, in order to reduce the randomness of the generated result of the generator, the pseudo samples are generated on the basis of the feature fusion vector
The mean and variance of (a) construct a prior distributionP pior From the prior distributionP pior Sampling a random vector z, and then combining the random vector z and an account class label y c Inputting a generator composed of all connected layers, and generating a class y c Is represented by the feature vector of (g) j 。
As another embodiment, the structure of the generator in the above-mentioned generation countermeasure Network is not limited to the fully-connected layer, and the model used here may be replaced by another Neural Network, such as a Convolutional Neural Network (Convolutional Neural Network).
And inputting the real sample and the pseudo sample into a discriminator for training. The discriminator predicts whether the input sample is a real sample on one hand and whether the sample is a money laundering account on the other hand, and directly outputs the role of the input sample in the money laundering process if the prediction result of the input sample is the money laundering account. In this embodiment, as shown in fig. 4, the discriminator adopts a multi-head discriminator, that is, the discriminator has a sigmoid function and a softmax function at the same time, and the multi-head discriminator can be used for distinguishing the true samples from the false samples and predicting the specific types of the samples to be predicted, respectively. The true or false sample distinguishing refers to distinguishing whether the input sample is a pseudo sample generated by the generator.
The method comprises the steps that a basic unit of a discriminator is composed of a full connection layer and an activation layer, true and false mixed samples are input, a linear regression layer is used for extracting features of a higher level, the features are input into a double-head discriminator after activation, the full connection layer in the double-head discriminator maps high-dimensional features to low dimensions, then an activation function is used for mapping a prediction result to a range between 0 and 1, namely the probability distribution of the samples on each category.
As another embodiment, the multi-head discriminator includes a fully-connected layer and an active layer, the fully-connected layer and the active layer are used for further predicting the authenticity and the category of the sample based on the fused representation obtained from the encoder, and the network structure used herein may be replaced by other classifiers, such as a Support Vector Machine (Support Vector Machine). The self-encoder refers to a behavior feature encoder and a structure feature encoder.
According to the scheme for generating the pseudo samples by using the generator for generating the countermeasure network, the generator enhances the data by generating the pseudo samples, so that the problem that the training process is difficult to converge is avoided.
In fact, in the account identification method according to this embodiment, an account identification model is formed by a self-encoder, a generator, and a discriminator, where the self-encoder is used to extract features of an account, the generator is used to generate a pseudo sample according to a prior distribution, and the discriminator is used to identify authenticity and category of the sample. In order to further improve the recognition effect of the account recognition model, parameters of a self-encoder, a generator and a discriminator in the model need to be further optimized.
And updating the parameters of the generator by using a loss function so as to enable the distribution of the pseudo samples generated by the generator to approximately fit the real samples, restricting the generation result of the generator and generating the characteristics with the category information.
Specifically, the feature vector of the generated pseudo sample is represented by g j Input into a discriminator to obtain g j The probability of belonging to a true sample and the probability distribution over each class. G predicted by model j The probability values belonging to true samples being mapped between 0 and 1, i.e. calculated
WhereinxIs the output vector of the second fully-connected layer in the discriminator. G predicted by model j Probability of belonging to true sample and true class y j Inputting a binary cross entropy loss function for calculation, and recording the calculated loss value asL gadv ：
Wherein the content of the first and second substances,p j representing a samplejA probability of predicting as a true sample; y is j Representing a samplejThe true sample is set to 1 and the dummy sample is set to 0, i.e., y j And = 0. Therefore, the temperature of the molten metal is controlled,L gadv can be simplified as follows:
g predicted by model j The probability distribution over each account class is calculated from the softmax function, i.e. the calculation
Whereinx j Is an accountjThe output vector of the second fully-connected layer (located before softmax) in the discriminator,Cis the account category number.
AccountjOf the probability distribution over each class with the true classone hotCalculating a multi-classification cross entropy loss function of the code input, and recording the loss value obtained by calculation asL gaux ：
Wherein the content of the first and second substances,
account category label y for input generator c ，
Is composed ofjBelong to the category y c The probability of (c).
The final loss function form of the generator is then:
wherein the content of the first and second substances,αto adjust the over-parameters of the proportion occupied by different losses. Generator parameters are updated by a gradient descent method and a back propagation algorithm.
Based on the calculated generator loss function, generator parameters are updated by the loss function, and the scheme of generating the pseudo sample effect by the generator is improved. Similarly, in this embodiment, parameters of the self-encoder and the discriminator are optimized and updated based on the loss function, so that the model learns the behavior characteristics and the structural characteristics of the training samples, a convergence state is achieved, and the recognition performance of the model is further improved.
Aiming at updating parameters of the discriminator, based on a real sample, utilizing a trained generator to generate a pseudo sample again, mixing the pseudo sample and the real sample and inputting the mixed pseudo sample and the real sample into the discriminator, calculating loss values of the discriminator according to a class recognition result output by the discriminator and an actual labeled class of the input sample, and at the moment, respectively calculating real sample classification by using a scheme similar to the calculation of a generator loss function formLoss ofL real And classification loss to generate pseudo samplesL fake The final loss function form of the discriminator is:
wherein the content of the first and second substances,βto adjust forL real AndL fake a hyperparameter of the occupied proportion. And updating parameters of the discriminator by a gradient descent method and a back propagation algorithm.
Aiming at updating the parameters of the self-encoder, firstly, in order to further capture the complex interaction between the behavior dynamics and the structure dynamics of the money laundering account number, the obtained fusion vector is obtained
For behaviour and structure reconfiguration tasks, i.e. to be
Respectively input into a structure decoder and a behavior characteristic decoder, and comprises the following steps: fusing vectors using a structure decoder
Is reconstructed intoGGraph sequence with same number of subgraphs and nodes
(ii) a Fusing vectors using a behavioral feature decoder consisting of a recurrent neural network and deconvolution
Is reconstructed as b i Representation of similar distribution
。
Specifically, as shown in fig. 3, the structure decoder is composed of a recurrent neural network and an inner product decoder. Circulation typeThe recurrent neural network reconstructs the high-order representation of the node for each time step, and the inner product decoder willtThe high-order representation of the nodes at the moment is further reconstructed into an adjacent matrix of the subgraph, and the specific steps comprise:
(1) for accountu i The characteristics of transaction behavior and transaction structure information are fused
Inputting the sum of outputs of the gated unit network GRU based on the previous time
Reconstruction ofTStructure vector representation of individual subgraphstGRU output at time is
；
(2) In thattTime of day, inner product decoder pass pair
And (3) solving an inner product to obtain a reconstructed adjacency matrix:
the inner product is obtained by solving the output of each time step of the GRUTA reconstructed adjacency matrix
。
After the behavior reconstruction task and the structure reconstruction task are completed, the parameters of the self-encoder, namely the loss of the self-encoder, are optimized by adopting a multi-task learning structureL AE Reconfiguring tasks from behaviorsL behav And structure reconfiguration tasksL struc And (4) weighted summation. Specifically, the difference between the behavior characteristic reconstructed by the model and the real behavior characteristic is measured by using a mean square error loss function, and the form of the difference isThe formula is as follows:
wherein, the first and the second end of the pipe are connected with each other,
for the characteristic values of the model reconstruction,
is composed ofiThe true eigenvalues of.
Using homographic producer penalty valuesL gadv The same form of the loss function calculates the difference between the model reconstructed adjacency matrix and the true adjacency matrix, namely:
wherein the content of the first and second substances,E train representing the total number of training set edges,
is as followstIn a person graphe i An edge at a position, if an edge exists at the position, the value at the position is 1, otherwise the value is 0;
predicted for the modeltIn a person graphe i The probability of the presence of an edge at a location,
is sigmoid function.
Thus, the loss function from the encoder is of the form:
wherein the content of the first and second substances,γto adjust the over-parameters of the proportion of each loss.
On the basis of calculating the loss functions of the self-encoder and the discriminator, the self-encoder and the discriminator are respectively based onL dis AndL AE and circularly iterating the training process, updating the model parameters by using a gradient descent method and back propagation until the recognition model converges, namely the loss value is basically unchanged or the loss value floats in a small interval, and fitting the characteristics of the training data by the model, thereby completing the training of the recognition model and improving the robustness of the model.
Finally, the account to be tested is checkedu x Is preprocessed, i.e. according to the account to be testedu x The record and the transaction record of the account to be tested are established, a transaction report of the account to be tested and an attribute graph sequence of the account to be tested are established and input into a self-encoder which is trained to obtain the account to be testedu x Is characterized bye x The discriminant of the completion of the training is based one x Predicting to obtain account to be testedu x The category (2).
In the scheme of this embodiment, the feature extraction process includes two stages, namely an encoding stage and a decoding stage of behavior dynamic features and structure dynamic features, and the process uses a multitask learning structure to capture complex interaction between behavior dynamics and structure dynamics; the data enhancement process constructs a pseudo sample close to the distribution of real samples from the sampling noise vector and the class label in the prior distribution. By automatically capturing the behavior dynamic mode and the structure dynamic mode of the money laundering account number and the complex mutual influence between the two modes, and by enhancing the samples based on the generated countermeasures, the problem that the prior art cannot effectively deal with the novel and complex money laundering mode is solved under the condition of low labor cost, and the performance of money laundering account number detection can be further improved.
In the scheme of the embodiment, the multi-head discriminator takes the true and false mixed sample as input, and outputs two groups of probability distributions, namely the true and false probability distribution of the sample to be detected and the probability distribution of the category or role of the sample to be detected, so that the role born by the money laundering account number in the whole money laundering process is identified in a fine granularity manner, an investigator can be better helped to analyze the operation mechanism of the money laundering organization, and the money laundering organization can be more effectively attacked and disintegrated.
Example two
The embodiment provides an account identification system based on a self-encoder and a generation countermeasure network, as shown in fig. 5, the system includes:
the data acquisition module is used for acquiring the file and the transaction record of the account and constructing an account transaction report and an account attribute graph sequence;
the characteristic extraction module is used for extracting account characteristics based on the account transaction report and the account attribute graph sequence; specifically, an account transaction report is input into a behavior feature encoder, account transaction behavior features are extracted, an account attribute graph sequence is input into a structural feature encoder, account transaction relationship features are extracted, account transaction behavior features and account transaction relationship features are fused, and feature fusion vectors, namely account features, are obtained;
and the prediction module is used for inputting the extracted account fusion characteristics into the trained discriminator, identifying the authenticity of the account and predicting the category of the account.
The steps related to the second embodiment correspond to the first embodiment of the method, and the detailed description thereof can be found in the relevant description of the first embodiment.
Those skilled in the art will appreciate that the modules or steps of the present invention described above can be implemented using general purpose computer means, or alternatively, they can be implemented using program code that is executable by computing means, such that they are stored in memory means for execution by the computing means, or they are separately fabricated into individual integrated circuit modules, or multiple modules or steps of them are fabricated into a single integrated circuit module. The present invention is not limited to any specific combination of hardware and software.
The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention, and various modifications and changes may be made by those skilled in the art. Any modification, equivalent replacement, or improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.
Although the embodiments of the present invention have been described with reference to the accompanying drawings, it is not intended to limit the scope of the invention, and it should be understood by those skilled in the art that various modifications and variations can be made without inventive changes in the technical solutions of the present invention.
Although the embodiments of the present invention have been described with reference to the accompanying drawings, it is not intended to limit the scope of the present invention, and it should be understood by those skilled in the art that various modifications and variations can be made without inventive efforts by those skilled in the art based on the technical solution of the present invention.
Claims (9)
1. An account identification method based on a self-encoder and a confrontation network generation is characterized by comprising the following steps:
acquiring a file and a transaction record of a bank account, manually marking the account type, and constructing an account transaction report and an account attribute graph sequence; the manual labeling account category specifically includes: whether each account is a money laundering account or not and the division of labor of the money laundering account is marked manually;
extracting account features based on the account transaction report and the sequence of account attribute maps; specifically, an account transaction report is input into a behavior feature encoder, account transaction behavior features are extracted, an account attribute graph sequence is input into a structural feature encoder, account transaction relationship features are extracted, account transaction behavior features and account transaction relationship features are fused, and feature fusion vectors, namely account features, are obtained; the method comprises the following steps of extracting account transaction behavior characteristics, specifically: extracting short-term transaction characteristics of the account through a convolutional neural network, and on the basis, extracting long-term transaction characteristics of the account by using the convolutional neural network to obtain account transaction behavior characteristics; extracting the characteristics of the transaction relationship of the account, which specifically comprises the following steps: capturing a short-term mode of the account transaction relationship through a graph neural network, and on the basis, fusing a plurality of short-term modes by using a recurrent neural network to obtain long-term transaction characteristics and account transaction relationship characteristics;
the method comprises the steps that account characteristics with account category labels are used as real samples, account characteristics with type labels are generated by a generator for generating the countermeasure network based on the real samples, the generated account characteristics are used as pseudo samples, and the generator and the discriminator for generating the countermeasure network are trained by the real samples and the pseudo samples; the method comprises the following specific steps of generating account characteristics with type labels by using a generator for generating the confrontation network based on the real samples, wherein the specific steps comprise: constructing prior distribution based on the mean and variance of the feature fusion vector, sampling a random vector from the prior distribution, inputting the random vector and the account category label into a generator consisting of a full connection layer, and generating an account feature vector with type labels;
and according to the file and the transaction record of the account to be detected, establishing a transaction report and an attribute graph sequence of the account to be detected, extracting the fusion characteristic of the account to be detected, inputting the fusion characteristic of the account into a trained discriminator, identifying the authenticity of the account to be detected and predicting the category of the account to be detected.
2. The account identification method based on the self-encoder and the generation countermeasure network as claimed in claim 1, wherein the fusing the account transaction behavior feature and the account transaction relationship feature to obtain a feature fusion vector comprises:
transversely splicing the account transaction behavior characteristics and the account transaction relationship characteristics to obtain spliced characteristic vectors;
and inputting the spliced feature vectors into the full-connection layer to obtain the feature fusion vectors of the fusion behavior dynamic mode and the structure dynamic mode.
3. The account identification method based on the self-encoder and the generation of the confrontation network as claimed in claim 1, wherein the generator and the discriminator for generating the confrontation network by training the real samples and the pseudo samples are as follows:
inputting the pseudo sample generated by the generator into a discriminator, calculating a loss value of the generator according to a class identification result output by the discriminator and the actual labeled class of the pseudo sample, and optimizing and updating the parameters of the generator based on the loss value to realize the training of the generator;
based on the real sample, generating a pseudo sample again by using the trained generator, mixing the pseudo sample and the real sample, inputting the mixed pseudo sample and the real sample into a discriminator, calculating a loss value of the discriminator according to a class recognition result output by the discriminator and an actual labeled class of the input sample, optimizing and updating parameters of the discriminator based on the loss value, and realizing the training of the discriminator;
and circularly iterating the training process until the loss values of the generator and the discriminator are minimum, and finishing the training.
4. The account identification method based on the self-encoder and the generation countermeasure network as claimed in claim 1, further comprising iteratively training the self-encoder by using a feature fusion vector loop, specifically: and calculating a loss function of the self-encoder, minimizing the loss function of the self-encoder by using a gradient descent method, and updating parameters of the self-encoder through back propagation to realize the training of the self-encoder.
5. The method of claim 4, wherein the calculation of the autoencoder loss function comprises:
respectively inputting the feature fusion vector into a behavior feature decoder and a structure feature decoder, and reconstructing account transaction behavior features and account transaction relation features;
and calculating the loss of the account transaction behavior characteristic and the transaction relationship characteristic by using a behavior characteristic loss function and a transaction relationship characteristic loss function respectively based on the reconstructed account transaction behavior characteristic and the account transaction relationship characteristic, and obtaining a loss function obtained from the encoder through weighted summation.
6. The method as claimed in claim 1, wherein the discriminator is a multi-head discriminator, and outputs two sets of probability distributions, namely, the authenticity probability distribution of the account to be tested and the probability distribution of the category to which the account to be tested belongs, using the mixed authenticity account as an input.
7. An account identification system based on a self-encoder and a generation countermeasure network, characterized by comprising:
the data acquisition module is used for acquiring the file and the transaction record of the account and constructing an account transaction report and an account attribute graph sequence;
the characteristic extraction module is used for extracting account characteristics based on the account transaction report and the account attribute graph sequence; specifically, an account transaction report is input into a behavior feature encoder, account transaction behavior features are extracted, an account attribute graph sequence is input into a structural feature encoder, account transaction relationship features are extracted, account transaction behavior features and account transaction relationship features are fused, and feature fusion vectors, namely account features, are obtained; the method comprises the following steps of extracting account transaction behavior characteristics, specifically: extracting short-term transaction characteristics of the account through a convolutional neural network, and on the basis, extracting long-term transaction characteristics of the account by using the convolutional neural network to obtain account transaction behavior characteristics; extracting the characteristics of the transaction relationship of the account, which specifically comprises the following steps: capturing a short-term mode of the account transaction relationship through a graph neural network, and on the basis, fusing a plurality of short-term modes by using a recurrent neural network to obtain long-term transaction characteristics and account transaction relationship characteristics;
and the prediction module is used for inputting the extracted account fusion characteristics into the trained discriminator, identifying the authenticity of the account and predicting the category of the account.
8. The account identification system based on the self-encoder and the generation countermeasure network as claimed in claim 7, wherein the fusing the account transaction behavior feature and the account transaction relationship feature to obtain the feature fusion vector comprises:
transversely splicing the account transaction behavior characteristics and the account transaction relationship characteristics to obtain spliced characteristic vectors;
and inputting the spliced feature vectors into the full-connection layer to obtain the feature fusion vectors of the fusion behavior dynamic mode and the structure dynamic mode.
9. The system as claimed in claim 7, wherein the discriminator is a multi-head discriminator, and outputs two sets of probability distributions, namely, the authenticity probability distribution of the account to be tested and the probability distribution of the class to which the account to be tested belongs, using the mixed authenticity account as an input.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210745030.XA CN114818999B (en) | 2022-06-29 | 2022-06-29 | Account identification method and system based on self-encoder and generation countermeasure network |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210745030.XA CN114818999B (en) | 2022-06-29 | 2022-06-29 | Account identification method and system based on self-encoder and generation countermeasure network |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN114818999A CN114818999A (en) | 2022-07-29 |
| CN114818999B true CN114818999B (en) | 2022-09-16 |
Family
ID=82522447
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202210745030.XA Active CN114818999B (en) | 2022-06-29 | 2022-06-29 | Account identification method and system based on self-encoder and generation countermeasure network |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN114818999B (en) |
Families Citing this family (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN116720123B (en) * | 2023-08-10 | 2023-11-28 | 中南大学 | Account identification method, account identification device, terminal equipment and medium |
| CN117573865A (en) * | 2023-10-19 | 2024-02-20 | 南昌大学 | Rumor fuzzy detection method based on interpretable adaptive learning |
| CN118133214A (en) * | 2024-05-09 | 2024-06-04 | 北京芯盾时代科技有限公司 | Account classification method, device, equipment and program product |
Citations (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20210241118A1 (en) * | 2020-01-30 | 2021-08-05 | Visa International Service Association | System, Method, and Computer Program Product for Implementing a Generative Adversarial Network to Determine Activations |
Family Cites Families (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US10621586B2 (en) * | 2017-01-31 | 2020-04-14 | Paypal, Inc. | Fraud prediction based on partial usage data |
| US20200167787A1 (en) * | 2018-11-26 | 2020-05-28 | Bank Of America Corporation | System for anomaly detection and remediation based on dynamic directed graph network flow analysis |
| CN111539811B (en) * | 2020-05-27 | 2022-06-14 | 支付宝(杭州)信息技术有限公司 | Risk account identification method and device |
| CN111882446B (en) * | 2020-07-28 | 2023-05-16 | 哈尔滨工业大学（威海） | Abnormal account detection method based on graph convolution network |
-
2022
- 2022-06-29 CN CN202210745030.XA patent/CN114818999B/en active Active
Patent Citations (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20210241118A1 (en) * | 2020-01-30 | 2021-08-05 | Visa International Service Association | System, Method, and Computer Program Product for Implementing a Generative Adversarial Network to Determine Activations |
Non-Patent Citations (2)
| Title |
|---|
| Credit Card Fraud Detection Using Sparse Autoencoder and Generative Adversarial Network;Jian Chen etc.;《IEEE》;20181230;全文 * |
| 基于自编码器和对抗生成网络的***欺诈检测;陈健;《中国优秀硕士学位论文全文数据库信息科技辑》;20200615;全文 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN114818999A (en) | 2022-07-29 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN114818999B (en) | Account identification method and system based on self-encoder and generation countermeasure network | |
| Gómez et al. | End-to-end neural network architecture for fraud scoring in card payments | |
| Roseline et al. | Autonomous credit card fraud detection using machine learning approach☆ | |
| Wang et al. | Multi-classification assessment of bank personal credit risk based on multi-source information fusion | |
| Suryanarayana et al. | Machine learning approaches for credit card fraud detection | |
| Fang et al. | Deep learning anti-fraud model for internet loan: Where we are going | |
| CN110084609B (en) | Transaction fraud behavior deep detection method based on characterization learning | |
| CN113283909B (en) | Ether house phishing account detection method based on deep learning | |
| CN114187112A (en) | Training method of account risk model and determination method of risk user group | |
| Cheong et al. | Interpretable stock anomaly detection based on spatio-temporal relation networks with genetic algorithm | |
| CN116485406A (en) | Account detection method and device, storage medium and electronic equipment | |
| CN114240659A (en) | Block chain abnormal node identification method based on dynamic graph convolutional neural network | |
| CN115375480A (en) | Abnormal virtual coin wallet address detection method based on graph neural network | |
| Kataria et al. | Internet banking fraud detection using deep learning based on decision tree and multilayer perceptron | |
| Iscan et al. | Wallet-based transaction fraud prevention through LightGBM with the focus on minimizing false alarms | |
| Pandey et al. | A review of credit card fraud detection techniques | |
| Wu et al. | Customer churn prediction for commercial banks using customer-value-weighted machine learning models | |
| Yang et al. | Anti-money laundering supervision by intelligent algorithm | |
| Xiao et al. | Explainable fraud detection for few labeled time series data | |
| El Orche et al. | Approach to combine an ontology-based on payment system with neural network for transaction fraud detection | |
| Sengupta et al. | A review of payment card fraud detection methods using artificial intelligence | |
| Huang et al. | Imbalanced credit card fraud detection data: A solution based on hybrid neural network and clustering-based undersampling technique | |
| Rahman | Supervised machine learning algorithms for credit card fraudulent transaction detection: A comparative survey | |
| Jena et al. | A comparative analysis of financial fraud detection in credit card by decision tree and random forest techniques | |
| Singh | Application of Classification and Regression Techniques in Bank Fraud Detection |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |