Screening method and screening device for financial business operation log

Abstract

The present invention discloses a method for screening financial business operation logs, including the following steps: operation record acquisition step, rule definition step, rule parsing and matching step, rule verification step, rule review step and data screening step. The present invention also proposes a screening device for financial business operation logs, including: operation record acquisition module, rule definition module, rule parsing and matching module, rule verification module, rule review module and data screening module. The screening method and screening device for financial business operation logs proposed by the present invention are highly practical, simple to operate, and can greatly reduce the internal control rule verification and inspection time of business personnel.

Description

Technical Field

[0001] The present invention relates to the field of financial technology, and more specifically, to compliance inspection technology for internal operating procedures of financial institutions. Background Art

[0002] Risk control is the most important issue for financial institutions, and internal control compliance is an important part of financial institutions' risk control. Internal control compliance mainly targets the internal operations of financial institutions, requiring each position to strictly follow the operating specifications and perform them in sequence. If the operating specifications are not followed during the operation, the data records will be confused or wrong. Although it does not affect the final result from a practical point of view, incorrect operations will cause errors in the data recorded in the database, which will bring hidden dangers to other subsequent businesses. Therefore, internal control compliance has long been the guarantee and support for the development of the financial industry. For the internal control of banks, due to the extremely large amount of data, there are problems such as large manual input, low efficiency, and slow experience iteration. Whether it is possible to efficiently identify risk points in employee operations and promptly discover high-risk behaviors in employee operations is the key focus area of ​​internal control compliance risk control technology.

[0003] In order to reduce manual workload, software is introduced to assist in risk control. This software is called a risk control engine. Usually, risk control engines require business personnel from the internal control and compliance department to manually simulate business models or business processes, or design rules based on some of the cases that have been discovered, and then hand them over to the technical department for verification. After confirming that the rules are reasonable, the rules are hard-coded into the compliance management system and handed over to the compliance department for use in daily compliance supervision and inspection. The problems with this approach are:

[0004] 1) Risk control rules need to be verified and implemented by professional programmers. The internal control department is responsible for proposing business models or rules. The business models or rules are divorced from actual operation data and need to rely on the actual experience and familiarity of the internal control department operators. This places extremely high demands on the internal control department operators. In addition, because the design process is divorced from actual operation data, the business models and rules are out of touch with the actual business, resulting in low efficiency and waste.

[0005] 2) When the rules need to be updated, business personnel need to provide feedback to programmers for coding, repackaging and release. Updates can only be made through the scheduled release window, and effectiveness cannot be guaranteed.

[0006] 3) Existing risk control engines usually operate in stand-alone mode. Due to the large amount of employee operation log data, the historical operation data accumulated by a bank reaches hundreds of TB. The traditional rule verification method based on a stand-alone database can no longer meet the risk control compliance verification needs of massive businesses. Summary of the invention

[0007] According to an embodiment of the present invention, a method for screening financial business operation logs is provided, comprising the following steps:

[0008] An operation record acquisition step, acquiring operation records from operation logs from multiple data sources, and obtaining an operation sequence file after processing and converting the operation records;

[0009] A rule definition step is to define business rules in the form of expressions, each business rule corresponds to a financial business, and the business rule defines the sequence of various operations in the financial business;

[0010] The rule parsing and matching step parses the expressions of the business rules and the operation sequence file, matches the business rules with the corresponding operation records in the operation sequence file, and outputs the matching results;

[0011] In the rule verification step, the business rules are evaluated based on the matching results. The business rules that pass the evaluation are entered into the rule base and published. The business rules that fail the evaluation are redefined.

[0012] The rule review step calls business rules from the rule library, applies business rules to the newly added data, and issues a synchronous alarm for the review results;

[0013] The data screening step calls business rules from the rule library, applies business rules to screen the specified stock data, and issues asynchronous alarms for the screening results.

[0014] In one embodiment, in the operation record acquisition step, the operation logs from multiple data sources are aligned according to timestamps, and the aligned operation logs are arranged in chronological order according to the timestamps.

[0015] In one embodiment, in the operation record acquisition step, the operation record acquired from the operation log includes: a personnel identification number, a device identification number, a timestamp, a type identification number, a serial number and a success flag, a set of personnel identification number, device identification number, timestamp, type identification number, serial number and success flag corresponds to one operation, and multiple sets of personnel identification numbers, device identification numbers, timestamp, type identification number, serial number and success flag corresponding to multiple operations are arranged in chronological order according to the timestamp to form an operation sequence file.

[0016] In one embodiment, in the rule parsing and matching step, matching the business rules with the corresponding operation records in the operation sequence file includes:

[0017] The business rules are fully matched with the operation records in the operation sequence file; or

[0018] The business rules are matched with the operation records in the operation sequence file according to the specified range; or

[0019] The business rules are sampled and matched with the operation records in the operation sequence file.

[0020] In one embodiment, matching the business rules with the operation records in the operation sequence file according to the specified range includes determining the specified range of the operation records according to one or more of the personnel identification number, the device identification number, the timestamp, and the type identification number. Sampling matching the business rules with the operation records in the operation sequence file includes sampling according to the timestamp, sampling according to the sampling ratio in each time period, or sampling according to the sampling ratio for all operation records.

[0021] In one embodiment, in the rule parsing and matching steps, the output matching results include: the total number of scanned records, the total number of matching records, the matching ratio, and the matching details list.

[0022] In one embodiment, in the rule verification step, the business rules are evaluated based on the total number of scanned records, the total number of matched records, and the matching ratio in the matching results. For business rules that fail the evaluation, the rules are redefined with reference to the matching detail list.

[0023] In one embodiment, in the rule review step, after the daily business termination time, the operation sequence file obtained on that day is used as new data, and the business rules are applied to perform rule review, and a synchronous alarm is issued for the review results that violate the business rules.

[0024] In one embodiment, in the rule review step, a date range is specified for the stock data, business rules are applied to screen the data, and asynchronous alarms are issued for screening results that violate the business rules.

[0025] According to one embodiment of the present invention, a screening device for financial business operation logs is proposed, comprising: an operation record acquisition module, a rule definition module, a rule parsing and matching module, a rule verification module, a rule review module and a data screening module. The operation record acquisition module acquires operation records from operation logs from multiple data sources, processes and converts the operation records to obtain an operation sequence file. The rule definition module defines business rules in the form of expressions, each business rule corresponds to a financial business, and the business rules define the order of each operation in the financial business. The rule parsing and matching module parses the expressions of the business rules and the operation sequence file, matches the business rules with the corresponding operation records in the operation sequence file, and outputs the matching results. The rule verification module evaluates the business rules based on the matching results, inputs the business rules that pass the evaluation into the rule library and publishes them, and redefines the business rules that fail the evaluation. The rule review module calls the business rules from the rule library, applies the business rules to perform rule review on the newly added data, and issues a synchronous alarm for the review results. The data screening module calls the business rules from the rule library, applies the business rules to perform data screening on the specified stock data, and issues an asynchronous alarm for the screening results.

[0026] The screening method and screening device for financial business operation logs proposed in the present invention are highly practical, simple to operate, and can greatly reduce the time for business personnel to verify and check internal control rules. Business personnel can customize rules to reduce and solve the strong dependence on scientific and technological personnel, and improve the response ability of internal control personnel to new businesses, emergencies, etc. The rules that have been verified to be effective can be released by business personnel after review to solve the timeliness problem. The performance can be expanded linearly, and the performance is improved by about two orders of magnitude compared to the original database-based method, meeting the performance requirements such as rule calculation and full data screening. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 A flow chart of a method for screening financial business operation logs according to an embodiment of the present invention is disclosed.

[0028] Figure 2 A structural block diagram of a device for screening financial business operation logs according to an embodiment of the present invention is disclosed. DETAILED DESCRIPTION

[0029] Figure 1 A flowchart of a method for screening financial business operation logs according to an embodiment of the present invention is disclosed. Figure 1 As shown, the screening method of the financial business operation log includes the following steps:

[0030] S1, operation record acquisition step. Operation records are acquired from operation logs from multiple data sources, and operation sequence files are obtained after processing and converting the operation records. Since the bank has many branches and business outlets, each branch and business outlet has a local operation log that records local related operation data. In the operation record acquisition step, the respective operation records are acquired from the servers of each branch and business outlet. In the internal compliance review, the order of operations is an important verification link, and the order of operations is mainly judged by the time when the operation is recorded. In order to avoid the local time difference that may exist between different branches or business outlets, a globally unified timestamp is used to record the time of each operation. The use of a globally unified timestamp can ensure that the time of each recorded operation is judged within a unified time coordinate. Therefore, in one embodiment, in the operation record acquisition step S1, for the operation logs from multiple data sources, the operation logs are aligned according to the timestamps, and the aligned operation logs are arranged in chronological order according to the timestamps. After the timestamps are aligned, the operation logs from different branches and business outlets are reordered, and all are arranged in chronological order according to the instructions of the timestamps.

[0031] In one embodiment, in the operation record acquisition step S1, the operation record acquired from the operation log includes: a personnel identification number (such as a teller number), a device identification number (such as a terminal number), a timestamp, a type identification number (such as a transaction code), a serial number, and a success flag (whether the operation is successful). A set of personnel identification numbers, device identification numbers, timestamps, type identification numbers, serial numbers, and success flags corresponds to one operation, that is, it records who handled what business at what time using which terminal, and whether it was successful. Multiple sets of personnel identification numbers, device identification numbers, timestamps, type identification numbers, serial numbers, and success flags corresponding to multiple operations are arranged in chronological order according to the timestamps to form an operation sequence file.

[0032] For example, for the cash box replacement operation of an ATM, when the ATM cash box is full, the cash box needs to be replaced. The prescribed process of this operation is as follows: first the registration operation, then the account entry operation. In the banking system, a transaction code is assigned to each operation, and the transaction code represents the business type. For example, the transaction code for the registration operation is

[1071] , and the transaction code for the account entry operation is

[4381] . Together with the operator's teller number, the terminal number of the ATM, the time of operation execution, and the success mark of whether the operation is successful, the operation record for the ATM cash box replacement operation is formed. The records of various operations of each branch and business outlet are sorted by time to form an operation sequence file.

[0033] S2. Rule definition step. Define business rules in the form of expressions. Each business rule corresponds to a financial business, and the business rule defines the order of each operation in the financial business. For each financial business, there will be a series of operations. From the perspective of overall norms and risk control, the operation order of each financial business will be specified:

[0034] Let's take the ATM cash box replacement operation as an example. The prescribed process of this operation is as follows: first the registration operation, then the account entry operation. The registration operation needs to be performed before the account entry operation. Therefore, from the perspective of business rules, the registration operation

[1071] is the predecessor of the account entry operation

[4381] , and the account entry operation

[4381] is the successor of the registration operation

[1071] .

[0035] For another example, when a customer sells foreign exchange, the prescribed process of the operation is as follows: first, deposit foreign exchange in the customer's foreign currency deposit account, then settle the exchange, and finally deposit RMB in the customer's RMB account. According to the business process, the foreign exchange selling business should include three operations, which are: foreign exchange deposit, settlement of exchange, and RMB deposit in the order of execution. However, in actual operation, if the foreign exchange deposit operation is not performed, the settlement of exchange and RMB deposit are performed directly, the same demand can also be met. Directly using the two-step operation of "settlement of exchange, RMB deposit" to sell foreign exchange does not make any difference to the customer or to the bank's account, but from the perspective of internal control, this is an illegal operation because the business process is not strictly implemented and the foreign exchange deposit operation is missing. This type of illegal operation is the operation that the present invention needs to review and screen.

[0036] Back to the rule definition step, in the rule definition step S2, the business rules are first defined in the form of expressions. The business rules defined here are mainly from the perspective of specifications, and the operating specifications are used to agree on how many operations should be included in each financial business and how the order of operations should be arranged. This step can be defined by business personnel according to needs. Traditionally, business rules need to be set by technical personnel. Since technical personnel are not familiar with business processes and business personnel do not understand technology, the setting of business rules is inefficient. The rule definition step of the present invention can be directly defined by business personnel in the form of simple expressions according to actual needs, stipulating how many operations should be included in each financial business and how the order of operations should be arranged.

[0037] S3, rule parsing and matching step, the expression of the business rule is parsed, the operation sequence file is also parsed, the business rule is matched with the corresponding operation record in the operation sequence file, and the matching result is output. In one embodiment, the rule parsing and matching step S3 is performed by a GPU cluster or a distributed computing system, and the GPU cluster or the distributed computing system uses sufficient computing power to check and match the actual operation conditions represented by the business rules defined in step S2 and the operation sequence file. To improve the situation in which the business rule formulation is out of touch with the actual operation in the traditional scheme. After the business rules expressed in the expression are parsed, the combination of "operation + sequence" corresponding to a financial business can be extracted. In the operation sequence file, the combination of "operation + sequence" of the corresponding financial business can also be obtained by using the timestamp, type identification number (transaction code), serial number and success mark. The operation sequence file reflects the combination of "operation + sequence" of the financial business in the actual operation. Use a GPU cluster or a distributed computing system to verify how well the formulated business rules match the actual operation. Since there are many types of emerging businesses in the financial system, and the original businesses also need to be constantly adjusted according to the actual situation, there are indeed discrepancies between business rules (early formulation) and actual operations (real-time updates). The rule parsing and matching step S3 can discover and correct this situation.

[0038] In one embodiment, in the rule parsing and matching step S3, matching the business rules with the corresponding operation records in the operation sequence file includes:

[0039] The first matching method is to fully match the business rules with the operation records in the operation sequence file. The so-called full matching is to match all the operation records in all the collected operation sequence files with the business rules. Since full matching covers all data, it is more beneficial to the accuracy of data and rules, but the calculation amount of full matching is very large and requires a lot of hardware resources. It is usually only used when there is a special need.

[0040] The second matching method is to match the business rules with the operation records in the operation sequence file according to a specified range. In one embodiment, the business rules and the operation records in the operation sequence file are matched according to the specified range, including determining the specified range of the operation record based on one or more of the personnel identification number, the equipment identification number, the timestamp, and the type identification number. For example, for a newly launched business, the operation sequence file within the last 1 year or 6 months can be selected for matching according to the timestamp. For example, for the business of a certain position, the operation sequence file related to the position can be selected for matching according to the personnel identification number or the equipment identification number. Or for a specific business, the operation sequence file of the similar business can be matched according to the type identification number (transaction code). Matching the operation records in the operation sequence file according to the specified range is more targeted, and the amount of data involved is relatively small, which is a more commonly used matching mode.

[0041] The third matching method is to perform sampling matching between the business rules and the operation records in the operation sequence file. In one embodiment, the sampling matching between the business rules and the operation records in the operation sequence file includes sampling according to the timestamp, sampling according to the sampling ratio in each time period, or sampling according to the sampling ratio for the full amount of operation records. Sampling matching is more often used in testing or inspection situations.

[0042] In the rule parsing and matching step S3, the matching results output by the GPU cluster or distributed computing system include: the total number of scanned records, the total number of matched records, the matching ratio, and the matching detailed list. The total number of scanned records, the total number of matched records, the matching ratio, and the matching detailed list reflect the matching degree between the formulated business rules and the actual operation.

[0043] S4, rule verification step, evaluate the business rules based on the matching results, enter the business rules that pass the evaluation into the rule library and publish them, and redefine the rules for the business rules that fail the evaluation. In one embodiment, in the rule verification step S4, the business rules are evaluated based on the total number of scanned records, the total number of matching records, and the matching ratio in the matching results. For business rules whose matching ratio is higher than the set value, it is considered that they have passed the evaluation, and these business rules are entered into the rule library and published. For business rules whose matching ratio does not reach the set value, they are considered to be business rules that have failed the evaluation, and these business rules deviate from the actual operation. This is so that business personnel can obtain the matching list, redefine the rules with reference to the matching details list, and the modified business rules are matched and verified again.

[0044] S5, rule review step, calling business rules from the rule library, applying business rules to the newly added data, and synchronously alarming the review results. In one embodiment, in the rule review step S5, after the daily business end time, the operation sequence file obtained on the day is used as the newly added data, and the business rules are applied to perform rule review, and synchronously alarming the review results that violate the business rules. Step S5 can be applied to the review of newly generated operations every day, and synchronously alarming in time after discovering illegal operations.

[0045] Let’s take the aforementioned ATM cash box replacement and foreign exchange selling business as an example to explain the meaning of illegal operations:

[0046] If the business rule published after verification is: ATM cash box replacement includes two steps: first registration operation, then account entry operation. If in the rule review step, it is found that the actual operation corresponding to the ATM cash box replacement is missing a step, or the order of registration and account entry is reversed, it is considered an illegal operation.

[0047] If the business rules published after verification are: the foreign exchange selling business includes three operations, and the execution order is: foreign exchange deposit, foreign exchange settlement, and RMB deposit. During the rule review step, it is found that the actual operation corresponding to the foreign exchange selling business is missing a step, such as directly using the two-step operation of "foreign exchange settlement and RMB deposit" to sell foreign exchange, it is considered an illegal operation.

[0048] S6, data screening step, calling business rules from the rule library, applying business rules to the specified stock data, and asynchronously alarming the screening results. In one embodiment, in the rule review step S6, the stock data specifies a date range, applies business rules to the data screening, and asynchronously alarms the screening results that violate the business rules. The common application scenario of data screening of stock data is post-event accountability, so it is necessary to trace back historical data to find the specific executors of the illegal operations.

[0049] Figure 2 The structural block diagram of a device for screening financial business operation logs according to an embodiment of the present invention is disclosed. Figure 2 As shown, the screening device for the financial business operation log includes: an operation record acquisition module 101, a rule definition module 102, a rule parsing and matching module 103, a rule verification module 104, a rule review module 105 and a data screening module 106.

[0050] The operation record acquisition module 101 acquires operation records from operation logs from multiple data sources, and obtains an operation sequence file after processing and converting the operation records. The operation record acquisition module 101 executes the aforementioned operation record acquisition step S1.

[0051] The rule definition module 102 defines business rules in the form of expressions, each business rule corresponds to a financial business, and the business rule defines the sequence of various operations in the financial business. The rule definition module 102 executes the aforementioned rule definition step S2.

[0052] The rule parsing and matching module 103 parses the expression of the business rule and the operation sequence file, matches the business rule with the corresponding operation record in the operation sequence file, and outputs the matching result. The rule parsing and matching module 103 is composed of a GPU cluster or a distributed computing system, and performs the above-mentioned rule parsing and matching step S3.

[0053] The rule verification module 104 evaluates the business rules according to the matching results, inputs the business rules that pass the evaluation into the rule library and publishes them, and redefines the business rules that fail the evaluation. The rule verification module 104 executes the aforementioned rule verification step S4.

[0054] The rule review module 105 calls the business rules from the rule base, applies the business rules to conduct rule review on the newly added data, and issues a synchronous alarm for the review result. The rule review module 105 executes the aforementioned rule review step S5.

[0055] The data screening module 106 calls the business rules from the rule base, applies the business rules to perform data screening on the specified stock data, and issues an asynchronous alarm for the screening results. The data screening module 106 executes the aforementioned data screening step S6.

[0056] The screening method and screening device for financial business operation logs proposed in the present invention are highly practical, simple to operate, and can greatly reduce the time for business personnel to verify and check internal control rules. Business personnel can customize rules to reduce and solve the strong dependence on scientific and technological personnel, and improve the response ability of internal control personnel to new businesses, emergencies, etc. The rules that have been verified to be effective can be released by business personnel after review to solve the timeliness problem. The performance can be expanded linearly, and the performance is improved by about two orders of magnitude compared to the original database-based method, meeting the performance requirements such as rule calculation and full data screening.

[0057] It should also be noted that the embodiments listed above are only specific embodiments of the present invention. Obviously, the present invention is not limited to the above embodiments, and similar changes or deformations made therewith can be directly derived or easily associated with the contents disclosed by those skilled in the art from the present invention, and should all belong to the protection scope of the present invention. The above embodiments are provided to those familiar with the art to implement or use the present invention, and those familiar with the art can make various modifications or changes to the above embodiments without departing from the inventive concept of the present invention. Therefore, the protection scope of the present invention is not limited by the above embodiments, but should be the maximum scope of the innovative features mentioned in the claims.

Claims

1. A method for screening financial business operation logs, characterized in that: include: An operation record acquisition step, acquiring operation records from operation logs from multiple data sources, and obtaining an operation sequence file after processing and converting the operation records; wherein, for operation logs from multiple data sources, the operation logs are aligned according to a globally unified timestamp, and the aligned operation logs are arranged in chronological order according to the timestamp; A rule definition step is to define business rules in the form of expressions, each business rule corresponds to a financial business, and the business rule defines the sequence of various operations in the financial business; The rule parsing and matching step parses the expressions of the business rules and the operation sequence file, matches the business rules with the corresponding operation records in the operation sequence file, and outputs the matching results; In the rule verification step, the business rules are evaluated based on the matching results. The business rules that pass the evaluation are entered into the rule base and published. The business rules that fail the evaluation are redefined. The rule review step calls business rules from the rule library, applies business rules to the newly added data, and issues a synchronous alarm for the review results; The data screening step calls business rules from the rule library, applies business rules to screen the specified stock data, and issues asynchronous alarms for the screening results.

2. The method for screening financial business operation logs according to claim 1, characterized in that: In the operation record acquisition step, the operation records acquired from the operation log include: personnel identification number, device identification number, timestamp, type identification number, serial number and success flag. A set of personnel identification number, device identification number, timestamp, type identification number, serial number and success flag corresponds to one operation, and multiple sets of personnel identification numbers, device identification numbers, timestamp, type identification number, serial number and success flag corresponding to multiple operations are arranged in chronological order according to the timestamp to form an operation sequence file.

3. The method for screening financial business operation logs according to claim 2, characterized in that: In the rule parsing and matching step, the business rules are matched with the corresponding operation records in the operation sequence file, including: The business rules are fully matched with the operation records in the operation sequence file; or The business rules are matched with the operation records in the operation sequence file according to the specified range; or The business rules are sampled and matched with the operation records in the operation sequence file.

4. The method for screening financial business operation logs according to claim 3, characterized in that: The business rule is matched with the operation record in the operation sequence file according to the specified range, including determining the specified range of the operation record according to one or more of the personnel identification number, the equipment identification number, the timestamp, and the type identification number; Sampling and matching the business rules with the operation records in the operation sequence file includes sampling according to the timestamp, sampling according to the sampling ratio in each time period, or sampling according to the sampling ratio for all operation records.

5. The method for screening financial business operation logs according to claim 4, characterized in that: In the rule parsing and matching steps, the output matching results include: total number of scanned records, total number of matching records, matching ratio, and matching detail list.

6. The method for screening financial business operation logs according to claim 5, characterized in that: In the rule verification step, the business rules are evaluated based on the total number of scanned records, the total number of matched records, and the matching ratio in the matching results; For business rules that fail the evaluation, redefine the rules by referring to the matching details list.

7. The method for screening financial business operation logs according to claim 1, characterized in that: In the rule review step, after the daily business termination time, the operation sequence file obtained on that day is used as new data, and the business rules are applied to conduct rule review, and synchronous alarms are issued for review results that violate the business rules.

8. The method for screening financial business operation logs according to claim 1, characterized in that: In the rule review step, a date range is specified for the existing data, business rules are applied to screen the data, and asynchronous alarms are issued for screening results that violate business rules.

9. A device for screening financial business operation logs, characterized in that: include: An operation record acquisition module acquires operation records from operation logs from multiple data sources, processes and converts the operation records to obtain an operation sequence file; wherein, for operation logs from multiple data sources, the operation logs are aligned according to a globally unified timestamp, and the aligned operation logs are arranged in chronological order according to the timestamp; A rule definition module defines business rules in the form of expressions. Each business rule corresponds to a financial business, and the business rule defines the order of each operation in the financial business. The rule parsing and matching module parses the expressions of business rules and the operation sequence files, matches the business rules with the corresponding operation records in the operation sequence files, and outputs the matching results; The rule verification module evaluates the business rules based on the matching results. The business rules that pass the evaluation are entered into the rule library and published. The business rules that fail the evaluation are redefined. The rule review module calls business rules from the rule library, applies business rules to conduct rule review on new data, and issues synchronous alarms for review results; The data screening module calls business rules from the rule library, applies business rules to screen the specified stock data, and issues asynchronous alarms for the screening results.

Images