> For the complete documentation index, see [llms.txt](https://beosinofficials-organization.gitbook.io/beosin-kyt-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://beosinofficials-organization.gitbook.io/beosin-kyt-user-guide/rule-settings/behavioral-risk.md).

# Behavioral Risk

#### Quick In and Quick Out

Quick in and quick out detection is used to identify addresses that have swift fund inflows and outflows within a short period of time. This type of behavior usually indicates obvious fund transit characteristics.

By comprehensively analyzing transaction time, transaction amount, and fund direction, the system automatically matches transactions that meet the relevant characteristics and identifies potential rapid fund transfer behavior.

#### Suspicious Large Transactions

Suspicious Large Transaction detection is used to identify transactions that are significantly higher than the address’s historical transaction level.

The system focuses on large transactions that occur after a long period of low activity, improving the ability to detect abnormal behavior.

#### Fund Aggregation

Fund Aggregation detection is used to identify scenarios where funds are transferred from multiple addresses into a single address or a concentrated group of addresses.

By analyzing the number of source and destination addresses, transaction time, transaction amount, and other characteristics, the system identifies potential fund aggregation behavior.

#### Fund Dispersion

Fund Dispersion detection is used to identify scenarios where an address transfers funds to multiple different addresses.

By analyzing fund inflow and outflow paths, as well as counterparty distribution, the system identifies fund dispersion behavior patterns.