Transaction abnormity detection method and device, electronic equipment and storage medium

Abstract

The invention discloses a transaction abnormity detection method and device, electronic equipment and a storage medium, and relates to the technical field of artificial intelligence or other related fields, and the method comprises the steps: collecting cash withdrawal reservation information submitted by a target user through a telephone communication mode under the condition of obtaining the authorization of the target user; analyzing a call record in the cash withdrawal reservation information to obtain cash withdrawal service information; when it is verified that the cash withdrawal amount exceeds the preset amount threshold value, a pre-stored voiceprint library is obtained based on the affiliation website information, and the voiceprint information is compared with the pre-stored voiceprint library; and acquiring historical transaction behavior data based on the attribution network information, inputting the comparison result, the communication voice features and the historical transaction behavior data into an anomaly detection model, outputting an anomaly detection result, and generating reservation feedback information based on the anomaly detection result. Through the method and the device, the technical problem that an abnormal transaction supervision blind area exists due to low sensitivity of a risk monitoring system to a telephone reservation channel identification means in related technologies is solved.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence technology or other related fields, and in particular to a method for detecting transaction anomalies, a device thereof, an electronic device, and a storage medium. Background Art

[0002] The current technical solutions for preventing and controlling abnormal cash withdrawals mainly include: 1. Manual review, which relies on branch staff to judge customer behavior (such as expression, response logic, and business experience) through telephone communication or on-site observation, and judge the rationality of customer appointment behavior; 2. Electronic channel monitoring, centralized data storage and supervision of the business processing processes of online (such as mobile financial institutions) and offline (such as counters, self-service terminals) channels to achieve traceability of the entire business processing process, and identify and prevent suspicious transaction behaviors through preset rules; 3. Risk monitoring model: Based on multi-dimensional indicators such as transaction amount, frequency, customer risk rating, etc., risk warning is achieved through data analysis and mining, and the typical abnormal cash withdrawal characteristics such as low-amount transaction verification and high-frequency capital flow are equipped with intelligent monitoring and early warning capabilities.

[0003] The above scheme still has the following defects: 1. Manual review is inefficient and easily affected by personal experience, making it difficult to form a standardized risk identification system; 2. Electronic channel monitoring lacks effective monitoring means for businesses handled through non-standard channels such as telephone appointments. Such appointments generally have problems such as scattered information, incomplete content, irregular registration, and lack of a unified management platform, which further increases the difficulty of supervision; 3. The existing model has a good monitoring effect on suspicious transfer transactions, but there are obvious regulatory loopholes for new types of highly concealed funds transfers such as non-electronic channels or cash transactions. Once the risk is not intercepted before or during the event, and enters the post-tracing stage, the funds have been transferred in cash, making it difficult to track the flow of funds, posing a serious threat to property safety.

[0004] In summary, in the existing technology, the risk monitoring system has low sensitivity to the means of identifying telephone appointment channels, resulting in a technical problem of blind spots in the supervision of abnormal transactions.

[0005] To address the above-mentioned problems, no effective solutions have been proposed so far. Summary of the Invention

[0006] The main purpose of this application is to provide a method for detecting transaction anomalies and its device, electronic device, and storage medium, so as to at least solve the technical problem in the related technology that the risk monitoring system has low sensitivity to the means of identifying telephone appointment channels, resulting in blind spots in abnormal transaction supervision.

[0007] To achieve the above-mentioned objectives, according to one aspect of the present application, a method for detecting transaction anomalies is provided, the method comprising: with authorization from a target user, collecting cash withdrawal reservation information submitted by the target user to a target outlet via telephone communication, wherein the cash withdrawal reservation information includes at least a call recording and affiliated outlet information; analyzing the call recording in the cash withdrawal reservation information to obtain cash withdrawal service information, wherein the cash withdrawal service information includes at least the cash withdrawal amount reserved by the target user, voiceprint information, and communication voice characteristics, wherein the communication voice characteristics include at least one of the following: intonation fluctuation characteristics, speech speed characteristics, and emotional characteristics; When it is verified that the withdrawal amount exceeds the preset limit threshold, a pre-stored voiceprint library is obtained based on the affiliated outlet information, and the voiceprint information is compared with the pre-stored voiceprint library to obtain a comparison result, wherein the pre-stored voiceprint library pre-stores the trusted voiceprints of all registered users in the target outlet who are authenticated by a third-party trusted agency; based on the affiliated outlet information, the historical transaction behavior data of the target user is obtained, the comparison result, the communication voice feature and the historical transaction behavior data are input into the anomaly detection model, the anomaly detection result is output, and the reservation feedback information corresponding to the withdrawal reservation information is generated based on the anomaly detection result.

[0008] Furthermore, the step of analyzing the call recording in the cash withdrawal reservation information to obtain the cash withdrawal business information includes: calling a voice recognition engine, and converting the call recording into a call recording text through the voice recognition engine; identifying the target sentence in the call recording text for describing the amount value, and determining the cash withdrawal amount reserved by the target user based on the target sentence; calling a voice feature analysis engine, and analyzing the call recording through the voice feature analysis engine to obtain the voiceprint information and the communication voice feature; determining the cash withdrawal business information including the cash withdrawal amount, the voiceprint information and the communication voice feature.

[0009] Furthermore, the step of analyzing the call recording by the voice feature analysis engine to obtain the communication voice feature includes: performing spectral analysis on the call recording to obtain a fundamental frequency change curve, and calculating the intonation fluctuation feature based on the fundamental frequency change curve; and / or, counting the number of syllables in a preset unit time based on the call recording and the call recording text, and calculating the speaking speed feature based on the number of syllables; and / or, identifying emotional keywords and modal particles based on the call recording and the call recording text, and calculating the emotional feature based on the frequency of occurrence of the emotional keywords and modal particles; and determining the voice feature that includes at least any one of the intonation fluctuation feature, the speaking speed feature and the emotional feature.

[0010] Furthermore, the step of comparing the voiceprint information with a pre-stored voiceprint library to obtain a comparison result includes: retrieving a pre-stored voiceprint feature associated with the target user from the pre-stored voiceprint library; calculating a similarity score between the voiceprint information of the target user and the pre-stored voiceprint feature; and determining that the target user is a registered user in the target network when the similarity score is greater than or equal to a preset matching threshold; or, determining that the target user is a non-registered user when the similarity score is less than the preset matching threshold.

[0011] Furthermore, the anomaly detection model is constructed through the following steps: obtaining M sets of historical cash withdrawal appointment sample data within the target outlet, wherein each set of the historical cash withdrawal appointment sample data includes: historical comparison results, historical communication voice features and historical transaction behavior data, and M is a positive integer; for each set of the historical cash withdrawal appointment sample data, the historical comparison results are marked with credibility to generate a first type of training label, the historical communication voice features are marked with an abnormality degree to generate a second type of training label, and the historical transaction behavior data are marked with a risk level to generate a third type of training label; based on the first type of training labels, the second type of training labels and the third type of training labels, the initial model is jointly trained in multiple dimensions to obtain the anomaly detection model.

[0012] Furthermore, the comparison result, the communication voice feature and the historical transaction behavior data are input into the anomaly detection model, and the step of outputting the anomaly detection result includes: the anomaly detection model performs a credibility score on the target user based on the comparison result to obtain a first risk score; calculates a second risk score based on the intonation fluctuation feature, the speech speed feature and / or the emotional feature in the communication voice feature, wherein the second risk score is used to indicate the degree of voice abnormality; quantifies the risk indicators of the historical transaction behavior data, and performs weighted calculation based on the quantified risk indicators to obtain a third risk score; performs weighted calculation on the first risk score, the second risk score and the third risk score to obtain a comprehensive risk score, and grades the comprehensive risk score according to a preset risk level threshold to obtain a risk level; and outputs the anomaly detection result including the risk level.

[0013] Furthermore, the step of generating appointment feedback information corresponding to the cash withdrawal appointment information based on the abnormality detection result includes: determining the corresponding business processing strategy according to the risk level of the abnormality detection result, wherein the business processing strategy includes: intercepting the first type of risk business, reviewing the second type of risk business, and releasing the third type of risk business, the risk level of the first type of risk business is higher than that of the second type of risk business, and the risk level of the second type of risk business is higher than that of the third type of risk business; associating and packaging the business processing strategy with the cash withdrawal appointment information to obtain the appointment feedback information.

[0014] In order to achieve the above-mentioned purpose, according to another aspect of the present application, a transaction anomaly detection device is further provided, which includes: a collection unit, which is used to collect cash withdrawal reservation information submitted by the target user to the target outlet through telephone communication with the authorization of the target user, wherein the cash withdrawal reservation information at least includes: call recording and affiliated outlet information; an analysis unit, which is used to analyze the call recording in the cash withdrawal reservation information to obtain cash withdrawal service information, wherein the cash withdrawal service information at least includes: the cash withdrawal amount reserved by the target user, voiceprint information and communication voice characteristics, and the communication voice characteristics include at least one of the following: intonation fluctuation characteristics, speech speed characteristics and emotional characteristics ; A comparison unit is used to obtain a pre-stored voiceprint library based on the affiliated outlet information when verifying that the withdrawal amount exceeds a preset limit threshold, and compare the voiceprint information with the pre-stored voiceprint library to obtain a comparison result, wherein the pre-stored voiceprint library pre-stores the trusted voiceprints of all registered users in the target outlet who have been authenticated by a third-party trusted agency; A generation unit is used to obtain the historical transaction behavior data of the target user based on the affiliated outlet information, input the comparison result, the communication voice feature and the historical transaction behavior data into an anomaly detection model, output an anomaly detection result, and generate reservation feedback information corresponding to the withdrawal reservation information based on the anomaly detection result.

[0015] Furthermore, the analysis unit includes: a first calling module, used to call a voice recognition engine, and convert the call recording into a call recording text through the voice recognition engine; a recognition module, used to identify a target sentence in the call recording text for describing the amount value, and determine the withdrawal amount reserved by the target user based on the target sentence; a second calling module, used to call a voice feature analysis engine, and analyze the call recording through the voice feature analysis engine to obtain the voiceprint information and the communication voice feature; a first determination module, used to determine the withdrawal business information including the withdrawal amount, the voiceprint information and the communication voice feature.

[0016] Furthermore, the second calling module includes: a first calculation submodule, which is used to perform spectral analysis on the call recording to obtain a fundamental frequency change curve, and calculate the intonation fluctuation feature based on the fundamental frequency change curve; a second calculation submodule, which is used to count the number of syllables in a preset unit time based on the call recording and the call recording text, and calculate the speaking speed feature based on the number of syllables; a third calculation submodule, which is used to identify emotional keywords and modal particles based on the call recording and the call recording text, and calculate the emotional feature based on the frequency of occurrence of the emotional keywords and modal particles; a determination submodule, which is used to determine the speech feature that includes at least any one of the intonation fluctuation feature, the speaking speed feature and the emotional feature.

[0017] Furthermore, the comparison unit includes: a retrieval module, used to retrieve the pre-stored voiceprint features associated with the target user from the pre-stored voiceprint library; a first calculation module, used to calculate the similarity score between the voiceprint information of the target user and the pre-stored voiceprint features; a first judgment module, used to determine that the target user is a registered user in the target outlet when the similarity score is greater than or equal to a preset matching threshold; and a second judgment module, used to determine that the target user is a non-registered user when the similarity score is less than the preset matching threshold.

[0018] Furthermore, the transaction anomaly detection device also includes: a model construction unit, used to construct the anomaly detection model, and the model construction unit includes: an acquisition module, used to obtain M historical cash withdrawal appointment sample data in the target outlet, wherein each historical cash withdrawal appointment sample data includes: historical comparison results, historical communication voice features and historical transaction behavior data, and M is a positive integer; a marking module, used to mark the credibility of the historical comparison results for each historical cash withdrawal appointment sample data to generate a first type of training label, mark the abnormality degree of the historical communication voice features to generate a second type of training label, and mark the risk level of the historical transaction behavior data to generate a third type of training label; a training module, used to perform multi-dimensional joint training on the initial model based on the first type of training labels, the second type of training labels and the third type of training labels to obtain the anomaly detection model.

[0019] Furthermore, the generation unit includes: a scoring module, which is used to use the anomaly detection model to perform a credibility score on the target user based on the comparison result to obtain a first risk score; a second calculation module, which is used to calculate a second risk score based on the intonation fluctuation feature, the speaking speed feature and / or the emotional feature in the communication voice feature, wherein the second risk score is used to indicate the degree of voice abnormality; a third calculation module, which is used to quantify the risk indicators of the historical transaction behavior data, and perform weighted calculation based on the quantified risk indicators to obtain a third risk score; a fourth calculation module, which is used to perform weighted calculation on the first risk score, the second risk score and the third risk score to obtain a comprehensive risk score, and grade the comprehensive risk score according to a preset risk level threshold to obtain a risk level; and an output module, which is used to output the anomaly detection result including the risk level.

[0020] Furthermore, the generation unit also includes: a second determination module, used to determine the corresponding business processing strategy according to the risk level of the abnormality detection result, wherein the business processing strategy includes: intercepting the first type of risk business, reviewing the second type of risk business and releasing the third type of risk business, the risk level of the first type of risk business is higher than that of the second type of risk business, and the risk level of the second type of risk business is higher than that of the third type of risk business; an encapsulation module, used to associate and encapsulate the business processing strategy with the cash withdrawal appointment information to obtain the appointment feedback information.

[0021] In order to achieve the above-mentioned purpose, according to another aspect of the present application, a computer-readable storage medium is also provided, wherein the computer-readable storage medium includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute any one of the above-mentioned transaction anomaly detection methods.

[0022] In order to achieve the above-mentioned purpose, according to another aspect of the present application, an electronic device is also provided, comprising one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement any one of the above-mentioned transaction anomaly detection methods.

[0023] In order to achieve the above-mentioned purpose, according to another aspect of the present application, a computer program product is further provided, comprising computer instructions, wherein when the computer instructions are executed by a processor, the steps of any one of the above-mentioned methods for detecting transaction anomalies are implemented.

[0024] The present invention proposes a method for detecting transaction anomalies. First, after obtaining authorization from a target user, cash withdrawal reservation information submitted by the target user to a target branch via telephone communication is collected, wherein the cash withdrawal reservation information includes at least call recordings and affiliated branch information. The call recordings in the cash withdrawal reservation information are then analyzed to obtain cash withdrawal service information, wherein the cash withdrawal service information includes at least the target user's reserved cash withdrawal amount, voiceprint information, and communication voice features, wherein the communication voice features include at least one of the following: intonation fluctuation features, speech speed features, and emotional features. Then, when it is verified that the cash withdrawal amount exceeds a preset limit threshold, a pre-stored voiceprint library is obtained based on the affiliated branch information, and the voiceprint information is compared with the pre-stored voiceprint library to obtain a comparison result, wherein the pre-stored voiceprint library pre-stores the trusted voiceprints of all registered users of the target branch who have been authenticated by a third-party trusted institution. Finally, historical transaction behavior data of the target user is obtained based on the affiliated branch information, the comparison result, communication voice features, and historical transaction behavior data are input into an anomaly detection model, an anomaly detection result is output, and appointment feedback information corresponding to the cash withdrawal reservation information is generated based on the anomaly detection result.

[0025] The present invention adopts an automated data collection and intelligent analysis approach, integrating advanced methods such as voiceprint recognition and communication voice feature analysis to achieve the goal of accurately identifying the authenticity of large-scale cash withdrawal transactions scheduled by phone, thereby achieving the technical effect of enhancing pre-emptive risk warning capabilities and reducing false alarm rates. Specifically, the cash withdrawal reservation information submitted by the target user through the telephone communication channel, including call recordings and branch information, is collected under the premise of obtaining the target user's authorization. Subsequently, the call recordings are deeply analyzed to extract the target user's scheduled cash withdrawal amount, voiceprint features, and communication voice features, such as tone fluctuations, speaking speed, and emotional fluctuations, which together constitute a multi-dimensional understanding of the user's communication behavior. Then, after confirming that the reserved amount exceeds a preset threshold, a pre-stored voiceprint library containing trusted voiceprints of all registered users certified by a third-party authority is used for accurate comparison, which not only verifies the authenticity of the user's identity but also provides a comparison benchmark for the abnormality of the communication voice features. Finally, based on the user's historical transaction behavior data, the above comparison results, communication voice features, and historical data are used as input to drive the anomaly detection model for comprehensive evaluation, output anomaly detection results, and generate appointment feedback information accordingly.

[0026] This series of steps not only significantly improved the ability to identify abnormal transactions through telephone appointment channels, but also built a comprehensive and efficient abnormal transaction early warning system for financial institutions. By introducing voiceprint recognition and communication voice feature analysis technology, it effectively filled the technical gap in the risk monitoring system in the scenario of large-scale cash withdrawals through telephone appointments, and thus solved the technical problem in related technologies that the risk monitoring system has low sensitivity to telephone appointment channel identification methods, resulting in blind spots in abnormal transaction supervision. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] The accompanying drawings, which constitute part of this application, are intended to provide a further understanding of this application. The exemplary embodiments and descriptions of this application are intended to explain this application and do not constitute an improper limitation on this application. In the accompanying drawings:

[0028] Figure 1 A hardware structure block diagram of a computer terminal (or mobile device) for implementing a method for detecting transaction anomalies is shown;

[0029] Figure 2 is a flow chart of an optional transaction anomaly detection method according to an embodiment of the present invention;

[0030] Figure 3 This is a flowchart of an optional method for early warning of large-amount scheduled cash withdrawals over the phone based on voiceprint recognition according to an embodiment of the present invention;

[0031] Figure 4 is a schematic diagram of an optional transaction anomaly detection device according to an embodiment of the present invention;

[0032] Figure 5 The present invention is a block diagram of an electronic device for executing a method for detecting transaction anomalies according to an embodiment of the present invention. DETAILED DESCRIPTION

[0033] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of the present invention.

[0034] It should be noted that the terms "first", "second", etc. in the description and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0035] It should be noted that the transaction anomaly detection method and device thereof in the present application can be used in the field of artificial intelligence technology when conducting real-time risk assessment and early warning of large-scale cash withdrawals scheduled by phone, and can also be used in any field other than the field of artificial intelligence technology when conducting real-time risk assessment and early warning of large-scale cash withdrawals scheduled by phone. The application does not limit the application field of the transaction anomaly detection method and device thereof in the present application.

[0036] It should be noted that the relevant information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, storage, processing, transmission, provision, disclosure, use and processing of the relevant data comply with the laws, regulations and standards of the relevant regions, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse. For example, an interface is set up between this system and the relevant users or institutions. Before obtaining relevant information, it is necessary to send an acquisition request to the aforementioned user or institution through the interface, and obtain relevant information after receiving the consent information fed back by the aforementioned user or institution.

[0037] The information collection (for example, user voice, video, and text collection) and analysis operations involved in this application have provided users with corresponding operation entrances when they are executed, allowing users to choose to agree or reject the automated decision-making results; if the user chooses to reject, the expert decision-making process will be entered.

[0038] The following embodiments of the present invention can be applied to various systems, applications, and devices requiring customer identity verification and transaction risk assessment, enabling intelligent transaction warnings based on voiceprint recognition and communication speech characteristics. This invention uses voiceprint recognition technology to confirm user identity based on telephone appointment information. Then, by analyzing communication speech characteristics (such as intonation, speech rate, and emotional changes) combined with historical transaction behavior data, it can better identify potential transaction anomalies and risky behaviors, while ensuring the smooth conduct of normal transactions, thereby improving the security of financial services and user experience.

[0039] The present invention also accurately constructs an anomaly detection model by integrating multi-dimensional data, dynamically monitors and intelligently analyzes scheduled cash withdrawal behaviors. The early warning process is comprehensive and responsive, effectively preventing the risks that may be brought about by opaque transactions, and providing financial institutions with a powerful and flexible risk management tool.

[0040] The present invention will be described in detail below with reference to various embodiments.

[0041] Example 1

[0042] According to an embodiment of the present invention, an embodiment of a method for detecting transaction anomalies is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0043] The transaction anomaly detection method embodiment provided in the first embodiment of the present invention can be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 1 The hardware structure block diagram of a computer terminal (or mobile device) for implementing a method for detecting transaction anomalies is shown. Figure 1 As shown, the computer terminal 10 (or mobile device) may include one or more (illustrated as 102a, 102b, ..., 102n in the figure) processors 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the BUS bus), a network interface, a power supply and / or a camera. It will be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 1 More or fewer components than shown, or with Figure 1 Different configurations shown.

[0044] It should be noted that the one or more processors 102 and / or other data processing circuits described above may generally be referred to herein as "data processing circuitry". The data processing circuitry may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuitry may be a single independent processing module, or may be incorporated in whole or in part into any of the other components of the computer terminal 10 (or mobile device). As described in the embodiments of the present application, the data processing circuitry serves as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0045] Memory 104 can be used to store software programs and modules for application software, such as the program instructions / data storage device corresponding to the transaction anomaly detection method in the embodiments of the present application. Processor 102 executes the software programs and modules stored in memory 104 to perform various functional applications and data processing, thereby implementing the aforementioned transaction anomaly detection method. Memory 104 may include high-speed random access memory (RAM) and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, memory 104 may further include memory remotely located relative to processor 102, and such remote memory may be connected to computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0046] The transmission device 106 is configured to receive or transmit data via a network. A specific example of the aforementioned network may include a wireless network provided by the communications provider of the computer terminal 10. In one embodiment, the transmission device 106 includes a network interface controller (NIC), which can be connected to other network devices via a base station to enable communication with the Internet. In another embodiment, the transmission device 106 may be a radio frequency (RF) module, which is configured to communicate with the Internet wirelessly.

[0047] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the computer terminal 10 (or mobile device).

[0048] Under the above operating environment, the present invention provides Figure 2 The method for detecting transaction anomalies shown is implemented by an intelligent prevention and control system, which combines voiceprint recognition and natural language processing technology and is used in scenarios where large cash withdrawals are made by telephone appointment. In particular, it is used to identify abnormal transactions through non-standardized channels. By automatically collecting and analyzing telephone recordings, extracting and verifying appointment information, and comprehensively evaluating user risk levels, the method includes recording collection, feature extraction, identity authentication, risk assessment, and early warning feedback steps, so as to achieve accurate early warning and interception of potential abnormal transactions, thereby improving the security of financial transactions.

[0049] The embodiment of the present invention is described in detail below with reference to various specific steps.

[0050] Figure 2 is a flow chart of an optional method for detecting transaction anomalies according to an embodiment of the present invention, such as Figure 2 As shown, the method includes the following steps:

[0051] Step S201: With authorization from the target user, collect cash withdrawal reservation information submitted by the target user to the target outlet via telephone communication, wherein the cash withdrawal reservation information at least includes: call recording and affiliated outlet information.

[0052] It should be noted that cash withdrawal appointment information refers to the relevant data collected through telephone communication channels on the target user's request to make an appointment to withdraw cash at a specific financial institution branch, with the user's explicit consent.

[0053] Specifically, call recordings included in cash withdrawal appointments are the most direct source of information about the telephone appointment process, encompassing conversations between users and financial institution customer service or branch staff. In-depth analysis of these recordings can extract communication characteristics such as the user's specific reservation requirements, intonation, speech speed, and emotional changes, providing important clues for identifying potential anomalous behavior. Branch information refers to the branch of the financial institution selected by the target user for the withdrawal appointment, including but not limited to the branch's geographic coordinates and administrative district code.

[0054] In some optional embodiments, the withdrawal reservation information may also include: the scheduled withdrawal amount, user identity information, and scheduled withdrawal details. The scheduled withdrawal amount refers to the total amount of cash the user plans to withdraw. Reservations exceeding a preset limit will be marked as large-amount withdrawals. User identity information includes the user's name, ID number, and contact number, which are used to verify the authenticity and consistency of the reservation holder's identity through verification with the financial institution's internal database and the database of an external authority. The scheduled withdrawal details include the date and time of the reservation, as well as whether special services are required (e.g., large-amount withdrawals do not require prior notification of the source of funds), which are used to build a complete profile of user behavior and determine the rationality and potential risks of the reservation behavior.

[0055] The collection process for withdrawal reservation information adheres to strict data protection principles, ensuring that the storage and processing of recordings complies with data security regulations, retaining only necessary features for risk analysis, and fully respecting user privacy. Through this information collection mechanism, embodiments of the present invention can provide sufficient data support for subsequent transaction anomaly detection and risk warning within a legal and compliant framework.

[0056] Step S202: Analyze the call recording in the withdrawal reservation information to obtain withdrawal service information, wherein the withdrawal service information at least includes: the withdrawal amount reserved by the target user, voiceprint information, and communication voice features, and the communication voice features include at least one of the following: intonation fluctuation features, speech speed features, and emotional features.

[0057] Specifically, cash withdrawal business information refers to key data extracted from telephone reservation calls. The reserved cash withdrawal amount is the core value of the transaction, which is used to determine whether the standard for large-scale cash withdrawal is met, that is, it exceeds the preset amount threshold.

[0058] Voiceprint information refers to the unique biometric data of the user's voice in the call recording. It is extracted from the recording through voiceprint recognition technology and covers the key attributes of the voice signal. For example, the fundamental frequency feature, that is, the basic frequency of the sound. Since the fundamental frequency of different individuals varies, the fundamental frequency feature can be used as one of the bases for identity recognition; for example, the resonance peak feature, because it reflects the changes in the sound quality of the sound, is also an important component of voiceprint recognition; for example, the speaking speed and intonation features, although not as directly related to identity recognition as the fundamental frequency and resonance peak, can also help identify potential psychological states and behavioral tendencies in abnormal behavior detection.

[0059] The voiceprint extraction and matching process involves establishing a voiceprint feature library, which stores voiceprint samples pre-registered by financial institution users. The voiceprint feature vectors extracted from call recordings are compared with the samples in the feature library to verify the identity of the caller.

[0060] Another thing that needs to be explained is that communication voice features involve non-verbal information in call recordings, that is, inferring the user's mental state or intention through the user's voice expression, including but not limited to: intonation fluctuation characteristics, speaking speed characteristics and emotional characteristics.

[0061] The voice intonation feature is used to monitor changes in voice tone to identify potential nervousness, impatience, or evasiveness displayed by the caller during the call. Abnormal voice intonation fluctuations can indicate pressure or concealment. The speech rate feature analyzes the speed at which the caller speaks. An abnormal speaking rate may indicate that the caller is eager to complete the transaction or is trying to quickly steer the conversation to avoid exposing any unusual issues. The emotion feature uses sentiment analysis technology to identify the caller's basic emotions, such as anxiety, excitement, and calmness. Abnormal emotional fluctuations, such as excessive nervousness or unusual calmness, can indicate an unnatural motivation behind the caller's behavior.

[0062] The analysis of communication speech features is achieved through automatic speech recognition (ASR) and natural language processing (NLP) technologies, which can convert recordings into text and further analyze the speech features behind the text.

[0063] Optionally, in the transaction anomaly detection method provided in an embodiment of the present invention, the step of analyzing the call recording in the cash withdrawal reservation information to obtain the cash withdrawal business information includes: calling a speech recognition engine, and converting the call recording into a call recording text through the speech recognition engine; identifying a target sentence in the call recording text for describing the amount value, and determining the cash withdrawal amount reserved by the target user based on the target sentence; calling a speech feature analysis engine, and analyzing the call recording through the speech feature analysis engine to obtain voiceprint information and communication voice features; and determining the cash withdrawal business information including the cash withdrawal amount, voiceprint information, and communication voice features.

[0064] It should be noted that speech recognition uses signal processing and machine learning techniques to convert audio signals from call recordings into text. The key lies in accurately recognizing speech, maintaining a high transcription accuracy even in the presence of background noise or significant accent variations. Further identifying and extracting the phrase describing the withdrawal amount from the generated call recording text involves keyword searches or entity recognition techniques to accurately identify the specific withdrawal amount reserved by the user.

[0065] The voice feature analysis engine then performs an in-depth analysis of the call recording, extracting voiceprint information and identifying and quantifying various features of the conversational speech, such as intonation, speech rate, and emotional fluctuations. Digitizing these features facilitates an objective assessment of the user's communication status, assisting in determining the legitimacy and reasonableness of the transaction. The extracted voiceprint information is compared with a pre-stored voiceprint database to verify the authenticity of the caller. Voice communication features, including but not limited to intonation fluctuations, speech rate, and emotion, are used to identify any abnormal psychological states, such as nervousness, haste, or deliberate avoidance, among others.

[0066] Finally, the withdrawal amount, voiceprint information and communication voice features are integrated to form complete withdrawal business information.

[0067] The embodiment of the present invention effectively confirms the identity of the subscriber through the comparison of voiceprint information, reduces the limitations of relying on traditional credentials for identity authentication, and improves the accuracy and speed of identity authentication; through the analysis of communication voice characteristics, it can capture abnormal behaviors that the subscriber may exhibit during the call, such as emotional characteristics such as nervousness and urgency; it can also automatically extract and identify the cash withdrawal amount, and quickly trigger further review procedures when the amount exceeds the preset threshold, ensuring the security and compliance of large cash withdrawals.

[0068] Optionally, in the transaction anomaly detection method provided in an embodiment of the present invention, the call recording is analyzed by a voice feature analysis engine to obtain the communication voice features, including: performing spectral analysis on the call recording to obtain a fundamental frequency change curve, and calculating the tone fluctuation feature based on the fundamental frequency change curve; and / or, counting the number of syllables in a preset unit time based on the call recording and the call recording text, and calculating the speaking speed feature based on the number of syllables; and / or, identifying emotional keywords and modal particles based on the call recording and the call recording text, and calculating the emotional feature based on the frequency of occurrence of the emotional keywords and modal particles; and determining a voice feature that includes at least any one of the tone fluctuation feature, the speaking speed feature and the emotional feature.

[0069] Optionally, in the step of performing spectral analysis on the call recording to obtain the fundamental frequency change curve of the sound, the fundamental frequency refers to the lowest frequency in the sound. It should be noted that it is usually related to the gender and age of the speaker, but is also affected by emotions and tone. Calculating the fluctuation amplitude and frequency of the fundamental frequency change curve can capture subtle changes in tone. For example, a sudden rise in tone may indicate excitement or nervousness, while a falling tone may imply calmness or hidden information. Extracting the characteristics of tone fluctuations helps to identify possible signs of psychological pressure or deliberate concealment of emotions during the call. It can more accurately capture subtle changes in user emotions, which plays an important role in identifying potential abnormal psychological states (such as nervousness, impatience, and concealment), thereby improving the sensitivity of risk warnings.

[0070] Furthermore, obtaining speech rate features involves a comprehensive analysis of call recordings and converted call texts. First, the user's speaking speed is quantified by counting the number of syllables spoken within a preset unit of time (such as seconds or minutes). Fast speaking speed indicates anxiety or an attempt to end the conversation quickly, while too slow speaking speed suggests hesitation or insufficient information preparation. Even if the speech rate feature is used to assess whether the user's information transmission rate in the call is within the normal range or whether there is a possibility of deliberate misleading.

[0071] In the embodiment of the present invention, the addition of speech speed features can compare the difference between the user's normal communication speed and the current call speed, identify possible avoidance behavior or manipulation intentions, and based on the analysis of speech speed, adjust the interaction strategy with the user in real time, such as slowing down or speeding up the communication rhythm, guiding the user to provide more details, and improving the immediacy and effectiveness of the warning.

[0072] Furthermore, extracting emotional features involves deep text analysis, including identifying emotional keywords and modal particles in call text, such as "worried," "urgent," and "assured." The user's emotional state is measured by calculating the frequency of these keywords and modal particles during a call. For example, a high frequency of emotional keywords indicates a high level of tension or anxiety, while the use of modal particles can reveal a user's communication style and intentions, such as being overly polite or deliberately assertive.

[0073] In the embodiment of the present invention, the analysis of emotional characteristics is not only about literal emotional reactions, but also can provide insight into the user's possible hidden psychological state, providing a more comprehensive emotional portrait for risk assessment. By identifying emotional characteristics, abnormal communication patterns that occur during calls, such as being too calm or overly excited, can be detected.

[0074] Step S203, when it is verified that the withdrawal amount exceeds the preset limit threshold, the pre-stored voiceprint database is obtained based on the affiliated network information, and the voiceprint information is compared with the pre-stored voiceprint database to obtain a comparison result, wherein the pre-stored voiceprint database pre-stores the trusted voiceprints of all registered users in the target network who are authenticated by a third-party trusted organization.

[0075] Specifically, the pre-stored voiceprint database pre-stores the trusted voiceprint information of all users who have registered at the target outlets and have been authenticated by a third-party trusted agency. The third-party trusted agency here can be understood as an authoritative organization specifically responsible for identity authentication and biometric recognition, which authenticates and stores users' voiceprints in accordance with high-standard security protocols and processes.

[0076] The establishment and maintenance of the pre-stored voiceprint database follows the following principles:

[0077] 1. Authentication and Storage Process: When users activate the phone-based scheduled cash withdrawal function, they must undergo voiceprint authentication by a trusted third-party organization. The authentication process involves the user recording a standard voice clip in a secure environment. The third-party organization then uses specialized equipment and algorithms to extract the user's voiceprint features, converting them into digital feature vectors, which are ultimately stored in a voiceprint database.

[0078] 2. Security and privacy protection: Every voiceprint sample in the pre-stored voiceprint database is encrypted to ensure that even in the event of a data leak, the user's original voice cannot be restored. At the same time, access to the voiceprint database is strictly restricted, and the comparison process is only initiated when necessary during the verification process;

[0079] 3. Dynamic update and maintenance: Considering that the user's physiological and environmental factors may change over time, the pre-stored voiceprint database needs to be updated regularly to ensure the timeliness and accuracy of the voiceprint samples. At the same time, for users who no longer use the telephone cash withdrawal function, the voiceprint information should be removed from the database in a timely manner, following the principle of minimum data retention.

[0080] After analyzing the acquired voiceprint information in step S202, step S203 turns attention to comparing the voiceprint information with the verification of the user's identity, specifically involving: extraction and comparison, threshold matching, and multiple verification mechanisms.

[0081] In a specific implementation scenario, the corresponding pre-stored voiceprint library is first located based on the home network information, and the voiceprint information extracted from the most recent call recording is accurately compared with the voiceprint samples of each registered user in the library. The voiceprint recognition algorithm will set a matching threshold. It should be noted that this matching threshold is set based on the statistical results of a large number of voiceprint matching experiments in a historical time period. If the matching degree of the extracted voiceprint information with any sample in the library exceeds the set threshold, it is considered to be the same user and the target user's identity verification is passed.

[0082] In addition to voiceprint comparison, other identity authentication methods can also be combined, such as online verification and information consistency check. These multiple verification mechanisms work together to ensure the accuracy and security of identity recognition.

[0083] Through the above steps, the embodiment of the present invention can use the pre-stored voiceprint library to perform efficient and accurate identity authentication in large-scale cash withdrawal reservation scenarios, thereby enhancing the security of financial transactions and minimizing the risk of illegal financial activities.

[0084] Optionally, in the transaction anomaly detection method provided in an embodiment of the present invention, the step of comparing the voiceprint information with the pre-stored voiceprint library to obtain a comparison result includes: retrieving the pre-stored voiceprint features associated with the target user from the pre-stored voiceprint library; calculating the similarity score between the target user's voiceprint information and the pre-stored voiceprint features; when the similarity score is greater than or equal to a preset matching threshold, determining that the target user is a registered user in the target outlet; or, when the similarity score is less than the preset matching threshold, determining that the target user is an unregistered user.

[0085] It should be noted that the step of retrieving pre-stored voiceprint features involves retrieving the voiceprint features associated with the target user from a pre-stored voiceprint database. This pre-stored voiceprint database contains voiceprint samples submitted by registered users of financial institutions when opening accounts or conducting sensitive transactions. These samples are standardized and stored in encrypted form to protect user privacy and data security. To ensure accurate voiceprint matching, each voiceprint feature in the database must be closely linked to the user's identity information and authenticated by a trusted third-party organization to prevent forgery and tampering.

[0086] Another important point to note is that the process of extracting and storing voiceprint features involves digitizing the voice signal, creating feature vectors, and managing a database. The digitization process converts the analog voice signal into a digital signal, while the feature vectors are composed of various acoustic features such as the voiceprint's fundamental frequency, formants, and speaking rate. Database management ensures real-time updates and efficient retrieval of voiceprint samples, facilitating rapid identification of the target user's voice template during voiceprint recognition.

[0087] In the step of calculating the similarity score, a voiceprint recognition algorithm is used to calculate the similarity score between the voiceprint information extracted from the call recording of the target user and the pre-stored voiceprint features. Based on the comparison of feature vectors, a distance metric (such as Euclidean distance, Mahalanobis distance) or a probability model (such as Gaussian mixture model) can be used to quantify the similarity of the voiceprints.

[0088] It should be noted that voiceprint recognition algorithms need to be able to handle recognition issues under various speech conditions, including noisy environments, accent differences, and changes in speaking speed. To improve recognition rates, deep learning models can be used to learn more robust voiceprint feature representations through training on a large number of voiceprint samples.

[0089] Based on the similarity score, the target user will be determined to be a registered user:

[0090] 1. Matching success: If the similarity score is greater than or equal to the preset matching threshold, the target user is determined to be a registered user in the target branch and the identity verification is passed;

[0091] 2. Match failure: If the similarity score is lower than the matching threshold, the target user is determined to be an unregistered user or the voiceprint sample does not match, triggering further identity verification process or marking the appointment as high risk.

[0092] In the embodiments of the present invention, the preset matching threshold is set to balance the false positive rate and the false negative rate. A threshold that is too high will cause legitimate users' voiceprints to fail to match, resulting in a high false negative rate, while a threshold that is too low will allow illegitimate users' voiceprints to pass verification, resulting in a high false positive rate. The ideal threshold is determined through extensive experimentation and testing, ensuring an optimal balance between high security and user experience.

[0093] In the embodiments of the present invention, voiceprint recognition technology enables rapid and accurate verification of user identities, significantly reducing authentication time and improving the responsiveness of financial institutions' systems. Compared to traditional password or ID verification, voiceprint recognition provides an alternative, difficult-to-forge authentication method, significantly enhancing transaction security and reducing the risk of identity theft. Users making phone appointments do not require additional verification steps; simply proceed with the call, and the financial system automatically extracts and compares voiceprint information, enhancing the naturalness of the verification process and user experience.

[0094] Step S204: Obtain the historical transaction behavior data of the target user based on the affiliated branch information, input the comparison results, communication voice features and historical transaction behavior data into the anomaly detection model, output the anomaly detection results, and generate reservation feedback information corresponding to the cash withdrawal reservation information based on the anomaly detection results.

[0095] Specifically, historical transaction behavior data uses attribution branch information to retrieve the target user's transaction records within the financial institution's system over a period of time, identifying whether the user's behavior patterns remain consistent or whether there are any abnormal activities. Historical transaction behavior data includes, but is not limited to, account balances and changes, transaction frequency and type, customer risk rating, and geographic location associations.

[0096] Among them, account balance and changes are used to monitor the recent balance level and its changes in user accounts, especially the inflow and outflow of large amounts of funds to identify whether there is a "quick in and quick out" feature; transaction frequency and type are used to analyze the user's daily transaction frequency and preferred transaction type (such as transfers, cash withdrawals, deposits), and evaluate whether the transaction behavior is consistent with their historical habits; customer risk rating refers to risk rating based on the customer's credit status, transaction history and account characteristics in the financial institution to determine the rationality of the appointment cash withdrawal request and the degree of risk that may be involved; geographic location association refers to comparing the user's usual transaction location with the location of the branch for this appointment cash withdrawal through positioning technology to detect whether there are any abnormal cross-regional appointments.

[0097] It's also important to note that anomaly detection results are derived from an analysis of the anomaly detection model, combining voiceprint comparison results, communication voice characteristics, and historical transaction behavior data. The model assesses whether a transaction request deviates from typical user behavior, including considerations such as voiceprint comparison results, communication voice characteristics analysis, historical transactions, and risk rating.

[0098] Among them, the voiceprint comparison results are used to determine the matching degree between the voiceprint information extracted from the call and the voiceprint of the corresponding user in the pre-stored voiceprint library. Mismatch or low matching degree means identity fraud; communication voice feature analysis refers to the combination of voice fluctuations, speech speed changes and emotional characteristics to evaluate whether the user in the call shows abnormal communication patterns such as tension and avoidance; historical transactions and risk rating considerations refer to the model combining the user's historical transaction behavior and risk rating to identify whether the cash withdrawal appointment is consistent with the user's previous behavior pattern and whether the user belongs to a high-risk group.

[0099] Furthermore, reservation feedback information is generated based on the anomaly detection results to guide branch staff and users on how to handle the next steps for the scheduled withdrawal request. This information may include, but is not limited to, normal reservation confirmation, high-risk warnings, recommended action steps, and risk reports.

[0100] Specifically, if the test results show that the transaction is normal, a confirmation message will be automatically generated, allowing the appointment to continue according to the normal process; for abnormal or high-risk appointments detected, a warning will be issued, instructing the branch to suspend processing the appointment, requiring the user to provide additional verification information or further verify the user's identity and transaction purpose through telephone follow-up.

[0101] Furthermore, different processing steps can be recommended based on different risk levels. For example, low-risk appointments can be confirmed directly, while high-risk appointments need to be reported to senior management or risk control department for review.

[0102] The anomaly detection model also generates detailed reports that describe the detected anomaly characteristics and corresponding risk assessments, allowing branch staff and risk management teams to quickly understand the situation and make appropriate decisions.

[0103] Optionally, in the transaction anomaly detection method provided in an embodiment of the present invention, the anomaly detection model is constructed through the following steps: obtaining M historical cash withdrawal appointment sample data within the target outlet, wherein each historical cash withdrawal appointment sample data includes: historical comparison results, historical communication voice features and historical transaction behavior data, and M is a positive integer; for each historical cash withdrawal appointment sample data, the historical comparison results are marked with credibility to generate a first type of training label, the historical communication voice features are marked with an abnormality degree to generate a second type of training label, and the historical transaction behavior data are marked with a risk level to generate a third type of training label; based on the first type of training labels, the second type of training labels and the third type of training labels, the initial model is jointly trained in multiple dimensions to obtain an anomaly detection model.

[0104] It should be noted that the data collected from each historical cash withdrawal reservation sample at the target branch consists of three main components: historical comparison results, historical communication voice features, and historical transaction behavior data. The historical comparison results refer to the match between the user's voice and the voiceprint information in the pre-stored voiceprint database, which can be expressed as a sequence of Boolean values ​​or matching scores, reflecting the reliability of the user's identity verification during the reservation process. Historical communication voice features include intonation fluctuations, speech speed changes, and emotional state, reflecting the user's communication behavior patterns during the telephone reservation process. Historical transaction behavior data covers the user's account activities in the period before and after the reservation, such as fund flow, balance changes, transaction types, and user risk rating information.

[0105] Each historical appointment sample data is carefully labeled. The first type of training label is based on the credibility of the historical comparison results. For example, "identity authentication passed" or "voiceprint mismatch", respectively represented by positive and negative labels, serves as the identity authentication part of model training; the second type of training label is based on the abnormality of the historical communication voice features, such as "stable tone", "normal speaking speed" or "emotional instability", "speaking too fast", also distinguished by positive and negative labels, to optimize the model's ability to identify abnormal communication behaviors; the third type of training label is based on the risk level of historical transaction behavior data. The labels may include "low risk", "medium risk" and "high risk", which are used to guide the model on how to evaluate the risk level of the current appointment request based on transaction history.

[0106] Furthermore, multi-dimensional joint training involves simultaneously inputting three different types of training labels (identification results, degree of abnormality in communication voice features, and transaction risk level) into the model, allowing the model to learn how to integrate this information to predict whether a reservation is an abnormal transaction. By integrating data from multiple dimensions, the model can learn more complex risk manifestations and improve the recognition rate of abnormal transactions. During the training process, the model automatically adjusts the weights of different features to adapt to the distribution characteristics of the data, ensuring that identity verification, communication behavior, and historical transaction data play an appropriate role in risk assessment.

[0107] Optionally, in the transaction anomaly detection method provided in an embodiment of the present invention, the comparison results, communication voice features and historical transaction behavior data are input into the anomaly detection model, and the step of outputting the anomaly detection result includes: the anomaly detection model performs a credibility score on the target user based on the comparison result to obtain a first risk score; calculates a second risk score based on the intonation fluctuation characteristics, speech speed characteristics and / or emotional characteristics in the communication voice features, wherein the second risk score is used to indicate the degree of voice anomaly; quantifies the risk indicators of the historical transaction behavior data, and performs weighted calculation based on the quantified risk indicators to obtain a third risk score; performs weighted calculation on the first risk score, the second risk score and the third risk score to obtain a comprehensive risk score, and grades the comprehensive risk score according to a preset risk level threshold to obtain a risk level; and outputs the anomaly detection result including the risk level.

[0108] It should be noted that the credibility score of the voiceprint comparison result is calculated based on the voiceprint similarity score. It is used to reflect the degree of match between the user's voiceprint characteristics in the phone appointment and the stored samples. If the score exceeds the preset matching threshold, the identity verification is considered successful; otherwise, there may be risk. The process of converting the credibility score into the first risk score actually converts the subjective judgment of voiceprint recognition into a numerical form that the model can understand and process.

[0109] Furthermore, voice characteristics such as intonation fluctuations, speech rate changes, and emotional expression are all intuitive reflections of the user's psychological state. By analyzing these characteristics and calculating a secondary risk score, the degree of voice anomaly during a call can be quantified. Fluctuations in intonation may indicate nervousness or deception, while fast or slow speech rates may indicate a user's eagerness to complete a transaction or hesitation. Emotional characteristics such as nervousness, impatience, or avoidance are psychological markers of potentially risky behavior. By quantifying voice characteristics, the model can capture abnormal trends in user emotions and communication styles, improving the sensitivity and comprehensiveness of risk detection. This allows for accurate assessment of the risk level of user behavior even in non-visual telephone appointment environments.

[0110] Furthermore, historical transaction behavior data includes transaction frequency, amount, fund flow direction, and account balance level. This behavior data is quantified into specific risk indicators, such as "small amount trial card," "fast in and out," and holding a low balance. A third risk score is then calculated based on the importance of these indicators. This score reflects the degree to which a user's historical transaction patterns match the characteristics of abnormal cash withdrawal behavior.

[0111] Finally, the anomaly detection model weights the first, second, and third risk scores to obtain a comprehensive risk score. The weights are used to indicate the degree of influence of different risk scores on the overall score. The comprehensive risk score is graded according to the preset risk level threshold (for example, 0-50 is low risk, 51-80 is medium risk, and 81-100 is high risk), and finally outputs the anomaly detection result with risk level.

[0112] Optionally, in the transaction anomaly detection method provided in an embodiment of the present invention, the step of generating appointment feedback information corresponding to the cash withdrawal appointment information based on the anomaly detection result includes: determining the corresponding business processing strategy according to the risk level of the anomaly detection result, wherein the business processing strategy includes: intercepting the first type of risk business, reviewing the second type of risk business, and releasing the third type of risk business, the risk level of the first type of risk business is higher than that of the second type of risk business, and the risk level of the second type of risk business is higher than that of the third type of risk business; associating and packaging the business processing strategy with the cash withdrawal appointment information to obtain the appointment feedback information.

[0113] In a specific implementation scenario, executing the business processing strategy includes: when the risk level indicates high risk, generating an interception instruction containing a warning mark; when the risk level indicates medium risk, generating a review instruction containing supplementary verification requirements; when the risk level indicates low risk, generating a business release instruction.

[0114] It should be noted that the first type of risky business refers to appointment requests with the highest risk level, which require immediate action to intercept and avoid further expansion of the risk; the second type of risky business refers to appointments with the second lowest risk level, which may have certain abnormalities, but the evidence is not sufficient, and requires manual review and confirmation of its legitimacy through detailed inquiries and further identity verification; the third type of risky business has the lowest risk level and is regarded as a normal appointment, which can be released according to the normal process without additional intervention.

[0115] After determining a business handling strategy based on the risk level of the anomaly detection results, the strategy is then associated with the withdrawal appointment information and packaged to form the appointment feedback information. This packaging process includes encoding the risk level and corresponding business handling strategy as part of the appointment feedback information; retaining the original withdrawal appointment information, such as the scheduled withdrawal amount, scheduled branch, and scheduled date and time; and may also include detailed reasons for the anomaly detection to help branch staff understand the source of the risk.

[0116] Through the above steps S201 to S204, after obtaining authorization from the target user, cash withdrawal reservation information submitted by the target user to the target branch via telephone communication can be collected, wherein the cash withdrawal reservation information at least includes: a call recording and affiliated branch information. The call recording in the cash withdrawal reservation information is then analyzed to obtain cash withdrawal service information, wherein the cash withdrawal service information at least includes: the cash withdrawal amount scheduled by the target user, voiceprint information, and communication voice features, wherein the communication voice features include at least one of the following: a voice intonation fluctuation feature, a speech speed feature, and an emotional feature. Then, when it is verified that the cash withdrawal amount exceeds a preset limit threshold, a pre-stored voiceprint library is obtained based on the affiliated branch information, and the voiceprint information is compared with the pre-stored voiceprint library to obtain a comparison result, wherein the pre-stored voiceprint library pre-stores the trusted voiceprints of all registered users of the target branch who have been authenticated by a third-party trusted institution. Finally, historical transaction behavior data of the target user is obtained based on the affiliated branch information, the comparison result, the communication voice features, and the historical transaction behavior data are input into an anomaly detection model, an anomaly detection result is output, and appointment feedback information corresponding to the cash withdrawal reservation information is generated based on the anomaly detection result.

[0117] In an embodiment of the present invention, automated data collection and intelligent analysis are employed, integrating advanced methods such as voiceprint recognition and communication voice feature analysis to accurately identify the authenticity of large-scale cash withdrawal transactions scheduled by phone, thereby achieving the technical effects of enhancing pre-emptive risk warning capabilities and reducing false alarm rates. Specifically, the cash withdrawal reservation information submitted by the target user through the telephone communication channel, including call recordings and branch information, is collected with the target user's authorization. Subsequently, the call recordings are deeply analyzed to extract the target user's scheduled cash withdrawal amount, voiceprint features, and communication voice features, such as voice intonation, speech speed, and emotional fluctuations, which together constitute a multi-dimensional understanding of the user's communication behavior. Next, after confirming that the reserved amount exceeds a preset threshold, a pre-stored voiceprint database containing trusted voiceprints of all registered users certified by a third-party authority is used for accurate comparison, not only verifying the authenticity of the user's identity but also providing a comparison benchmark for the abnormality of the communication voice features. Finally, based on the user's historical transaction behavior data, the above comparison results, communication voice features, and historical data are used as input to drive an anomaly detection model for comprehensive evaluation, output an anomaly detection result, and generate reservation feedback information accordingly.

[0118] This series of steps not only significantly improved the ability to identify abnormal transactions through telephone appointment channels, but also built a comprehensive and efficient abnormal transaction early warning system for financial institutions. By introducing voiceprint recognition and communication voice feature analysis technology, it effectively filled the technical gap in the risk monitoring system in the scenario of large-scale cash withdrawals through telephone appointments, and thus solved the technical problem in related technologies that the risk monitoring system has low sensitivity to telephone appointment channel identification methods, resulting in blind spots in abnormal transaction supervision.

[0119] The present invention will be described below in conjunction with another specific embodiment.

[0120] The embodiments of the present invention provide a voiceprint recognition-based early warning method for large-amount scheduled cash withdrawals by phone, targeting the regulatory blind spots in the existing risk monitoring system for scheduled cash withdrawal channels. By automatically collecting branch phone recordings, combined with a preset large-amount cash withdrawal amount threshold, and using voiceprint recognition technology to detect abnormal voice tones and automatically extract key appointment information, a pre-warning model is constructed to efficiently identify suspicious large-amount scheduled cash withdrawal applications, accurately identify and pre-intercept concealed abnormal cash withdrawal behaviors using telephone channels, thus filling the monitoring gaps of existing technologies in non-standardized appointment channels and improving the comprehensiveness and timeliness of financial institutions' risk prevention and control of abnormal cash withdrawals.

[0121] Figure 3 : is a flow chart of an optional method for early warning of large-amount cash withdrawal by phone based on voiceprint recognition according to an embodiment of the present invention. Figure 3 As shown, the implementation body of this method includes the following real-time layers: data collection layer, feature extraction layer, identity verification layer, risk assessment layer, and early warning and disposal layer. The method includes the following steps:

[0122] Step 1: Automatically collect and standardize phone recordings.

[0123] We implement real-time monitoring of branch phone calls, generating a unique identifier (UID) for each recorded call. We also record key information such as the connection date, time, duration, branch location, and phone device ID. We encrypt recordings upon storage to ensure data privacy and prevent information leaks.

[0124] Step 2: Extract key features based on voiceprint recognition.

[0125] Use natural language processing technology and automatic speech recognition technology to convert the recording into text, and by extracting keywords such as "cash", "withdrawal", and "appointment", determine whether the call is for an appointment withdrawal service.

[0126] After confirming that it is a scheduled cash withdrawal service, the following key features are extracted using voiceprint recognition technology:

[0127] Abnormal tone analysis: Using sentiment analysis algorithms, we detect abnormal emotions in the recording, such as fluctuations in voice tone (such as sudden rises or falls), abnormal speech speed (such as rapid or long pauses), and emotional characteristics (such as nervousness, impatience, and evasion). We also analyze the text semantics to determine whether there are abnormal expressions such as "no need to prove" and "quickly process". Finally, we record the analysis results in the form of labels.

[0128] Extraction of key appointment information: Extract necessary fields such as customer name, ID number, contact number, scheduled cash withdrawal amount, scheduled cash withdrawal outlet, scheduled cash withdrawal date, scheduled cash withdrawal time, etc., and associate the UID of the telephone recording table into the database to facilitate subsequent data integration and analysis.

[0129] When the scheduled cash withdrawal amount exceeds the set cash withdrawal amount threshold (such as greater than 200,000), it is judged as a large-scale cash withdrawal, and further risk review is triggered based on this filtered data.

[0130] Step 3: Customer identity verification.

[0131] Verify the authenticity and consistency of customer identities through multiple channels, including:

[0132] Voiceprint feature library matching: Extract the customer's voiceprint feature vector from the call recording, compare it with the reserved samples in the bank's voiceprint feature library, and mark the matching results in the form of labels;

[0133] Online verification and authenticity check: Connect to the database of a third-party certification agency, and push the ID number and name provided by the customer to the third-party certification agency system in real time for verification. The authenticity of the customer's identity is determined based on whether the returned result can be obtained normally;

[0134] In-bank customer information consistency verification: The bank extracts the customer's reserved information when opening an account at the financial institution from the bank's data lake and basic account information interface, performs consistency verification on the name and ID number, and obtains the customer's contact information (phone number) and address (usually residential or work address). These are compared with the scheduled phone number and address of the scheduled branch to determine and mark any high-risk situations such as information inconsistency, use of uncommon contact information, and cross-regional cash withdrawals.

[0135] Step 4: Assess customer risk level.

[0136] Combined with the abnormal tone analysis results, the customer's risk level is assessed based on the customer's transaction behavior at the financial institution. Characteristics of high-risk customers include:

[0137] Customer level: whether the customer has a low star rating (asset) at the financial institution, has no business for a long time (sudden appointment for a long-term inactive account), has no job or no legitimate job, etc.;

[0138] Transaction characteristics: Whether the applicant holds a financial payment card with a zero balance or a low balance (e.g., the average daily balance of the account over the past seven days is ≤ 10,000 yuan) before the appointment date;

[0139] Abnormal behavior: Check for unusual transaction patterns such as "small-amount trial card" (3 or more transactions below 300 yuan within 7 days) and "quick in and quick out" (withdrawing the full amount within 24 hours of receipt of funds);

[0140] Historical risk: Whether the accounts are associated with the “two cards” (financial payment cards and mobile phone cards) involved in the case as certified by a third-party certification agency.

[0141] Step 5: Multi-dimensional data integration and risk assessment model construction.

[0142] The abnormal tone labels (emotional anomalies, semantic anomalies), identity verification results (matching anomalies, inconsistent key information), and customer risk levels (high-risk customer characteristics) extracted in Steps 2-4 are structured and integrated, and a density clustering algorithm is used to construct a risk assessment model. By setting a feature space density threshold (e.g., sample points containing ≥3 high-risk characteristics), dense data clusters with significant fund transfer risk characteristics are automatically identified, enabling the construction of a risk assessment model for suspicious transactions.

[0143] Step 6: Advance warning and model update.

[0144] Based on the assessment results, high-risk events are synchronized to designated outlets and third-party certification agencies to provide advance warnings and provide a basis for interception during the event. Subsequently, based on the historical warning accuracy (such as false positive rate and missed negative rate), a logistic regression algorithm is used to calculate feature weights. The density threshold is dynamically adjusted based on the distribution density of risk features to continuously optimize the model's ability to identify suspicious transactions.

[0145] The beneficial effects of the embodiments of the present invention include: through voiceprint recognition and multi-dimensional data analysis, full-process monitoring of non-standardized telephone appointment channels is achieved, filling the blind spots in telephone channel supervision; automated collection, analysis and early warning processes replace traditional manual review, improving efficiency and reducing subjective judgment bias; combined with voiceprint matching, abnormal tone detection and transaction behavior analysis, comprehensive assessment of customer risks, reducing false alarms and omissions, and accurately intercepting hidden abnormal cash withdrawal behaviors; combined with the comparison of customer addresses and the geographical locations of appointment outlets, abnormal cross-regional / regional cash withdrawal behaviors are quickly discovered, enhancing regional risk prevention and control; before the customer completes the cash withdrawal operation, through real-time risk warnings and police-bank linkage, suspicious transactions are intercepted to avoid illegal transfer of funds.

[0146] The present invention is described below in conjunction with another optional embodiment.

[0147] Example 2

[0148] An embodiment of the present invention also provides a device for detecting transaction anomalies. It should be noted that the device for detecting transaction anomalies in the embodiment of the present invention includes multiple implementation units, which can be used to execute the transaction anomaly detection method provided in the above-mentioned embodiment one, and each implementation unit corresponds to each implementation step in the above-mentioned embodiment one.

[0149] Figure 4 is a schematic diagram of an optional transaction anomaly detection device according to an embodiment of the present invention, such as Figure 4 As shown, the device may include: a collection unit 41 , an analysis unit 42 , a comparison unit 43 , and a generation unit 44 .

[0150] The collection unit 41 is used to collect the cash withdrawal reservation information submitted by the target user to the target outlet via telephone communication with the authorization of the target user, wherein the cash withdrawal reservation information at least includes: call recording and affiliated outlet information.

[0151] The analysis unit 42 is used to analyze the call recording in the cash withdrawal reservation information to obtain cash withdrawal service information, wherein the cash withdrawal service information at least includes: the cash withdrawal amount reserved by the target user, voiceprint information and communication voice characteristics, and the communication voice characteristics include at least one of the following: intonation fluctuation characteristics, speech speed characteristics and emotional characteristics.

[0152] The comparison unit 43 is used to obtain the pre-stored voiceprint library based on the affiliated network information when verifying that the withdrawal amount exceeds the preset limit threshold, and compare the voiceprint information with the pre-stored voiceprint library to obtain a comparison result, wherein the pre-stored voiceprint library pre-stores the trusted voiceprints of all registered users in the target network who are authenticated by a third-party trusted organization.

[0153] The generation unit 44 is used to obtain the historical transaction behavior data of the target user based on the affiliated branch information, input the comparison results, communication voice features and historical transaction behavior data into the anomaly detection model, output the anomaly detection results, and generate reservation feedback information corresponding to the cash withdrawal reservation information based on the anomaly detection results.

[0154] The above-mentioned transaction abnormality detection device can first collect the cash withdrawal reservation information submitted by the target user to the target outlet through telephone communication through the collection unit 41 with the authorization of the target user, wherein the cash withdrawal reservation information at least includes: call recording and affiliated outlet information, and then analyze the call recording in the cash withdrawal reservation information through the analysis unit 42 to obtain cash withdrawal service information, wherein the cash withdrawal service information at least includes: the cash withdrawal amount reserved by the target user, voiceprint information and communication voice characteristics, and the communication voice characteristics include at least one of the following: intonation fluctuation characteristics, speech speed characteristics and emotional characteristics, and then compare the single When verifying that the withdrawal amount exceeds the preset limit threshold, Yuan 43 obtains the pre-stored voiceprint library based on the affiliated outlet information, and compares the voiceprint information with the pre-stored voiceprint library to obtain a comparison result, wherein the pre-stored voiceprint library pre-stores the trusted voiceprints of all registered users in the target outlet who have been authenticated by a third-party trusted agency. Finally, the generation unit 44 obtains the historical transaction behavior data of the target user based on the affiliated outlet information, inputs the comparison result, communication voice characteristics and historical transaction behavior data into the anomaly detection model, outputs the anomaly detection result, and generates appointment feedback information corresponding to the withdrawal appointment information based on the anomaly detection result.

[0155] In an embodiment of the present invention, automated data collection and intelligent analysis are employed, integrating advanced voiceprint recognition and communication voice feature analysis to accurately identify the authenticity of large-scale cash withdrawal transactions scheduled by phone. This, in turn, enhances pre-emptive risk warning capabilities and reduces false alarm rates. Specifically, the system ensures that the target user's authorized cash withdrawal reservation information, including call recordings and branch information, is collected. The call recordings are then analyzed to extract the target user's scheduled withdrawal amount, voiceprint features, and communication voice features, such as intonation, speech speed, and emotional state, collectively forming a multi-dimensional understanding of the user's communication behavior. Subsequently, upon confirming that the reserved amount exceeds a preset threshold, a pre-stored voiceprint database containing trusted voiceprints of all registered users certified by a third-party authority is used for precise comparison, not only verifying the authenticity of the user's identity but also providing a comparison benchmark for the abnormality of the communication voice features. Finally, based on the user's historical transaction behavior data, the system uses the comparison results, communication voice features, and historical data as input to drive an anomaly detection model for comprehensive evaluation, outputting an anomaly detection result, and generating reservation feedback information accordingly.

[0156] This series of steps not only significantly improved the ability to identify abnormal transactions through telephone appointment channels, but also built a comprehensive and efficient abnormal transaction early warning system for financial institutions. By introducing voiceprint recognition and communication voice feature analysis technology, it effectively filled the technical gap in the risk monitoring system in the scenario of large-scale cash withdrawals through telephone appointments, and thus solved the technical problem in related technologies that the risk monitoring system has low sensitivity to telephone appointment channel identification methods, resulting in blind spots in abnormal transaction supervision.

[0157] Furthermore, the analysis unit includes: a first calling module, used to call the voice recognition engine, and convert the call recording into call recording text through the voice recognition engine; a recognition module, used to identify the target sentence in the call recording text used to describe the amount value, and determine the withdrawal amount reserved by the target user based on the target sentence; a second calling module, used to call the voice feature analysis engine, and analyze the call recording through the voice feature analysis engine to obtain voiceprint information and communication voice features; a first determination module, used to determine the withdrawal business information including the withdrawal amount, voiceprint information and communication voice features.

[0158] Furthermore, the second calling module includes: a first calculation submodule, which is used to perform spectral analysis on the call recording to obtain a fundamental frequency change curve, and calculate the intonation fluctuation characteristics based on the fundamental frequency change curve; a second calculation submodule, which is used to count the number of syllables in a preset unit time based on the call recording and the call recording text, and calculate the speaking speed characteristics based on the number of syllables; a third calculation submodule, which is used to identify emotional keywords and modal particles based on the call recording and the call recording text, and calculate the emotional characteristics based on the frequency of occurrence of emotional keywords and modal particles; a determination submodule, which is used to determine a speech feature that includes at least any one of the intonation fluctuation characteristics, speaking speed characteristics and emotional characteristics.

[0159] Furthermore, the comparison unit includes: a retrieval module for retrieving pre-stored voiceprint features associated with the target user from a pre-stored voiceprint library; a first calculation module for calculating the similarity score between the target user's voiceprint information and the pre-stored voiceprint features; a first judgment module for judging that the target user is a registered user in the target outlet when the similarity score is greater than or equal to a preset matching threshold; and a second judgment module for judging that the target user is a non-registered user when the similarity score is less than the preset matching threshold.

[0160] Furthermore, the transaction anomaly detection device also includes: a model construction unit for constructing an anomaly detection model, the model construction unit includes: an acquisition module for acquiring M historical cash withdrawal appointment sample data in the target outlet, wherein each historical cash withdrawal appointment sample data includes: historical comparison results, historical communication voice features and historical transaction behavior data, and M is a positive integer; a marking module for marking the credibility of the historical comparison results for each historical cash withdrawal appointment sample data to generate a first type of training label, marking the abnormality degree of the historical communication voice features to generate a second type of training label, and marking the risk level of the historical transaction behavior data to generate a third type of training label; a training module for performing multi-dimensional joint training on the initial model based on the first type of training labels, the second type of training labels and the third type of training labels to obtain an anomaly detection model.

[0161] Furthermore, the generation unit includes: a scoring module, which is used to use the anomaly detection model to perform a credibility score on the target user based on the comparison results to obtain a first risk score; a second calculation module, which is used to calculate a second risk score based on the intonation fluctuation characteristics, speech speed characteristics and / or emotional characteristics in the communication voice characteristics, wherein the second risk score is used to indicate the degree of voice abnormality; a third calculation module, which is used to quantify the risk indicators of historical transaction behavior data, and perform weighted calculation based on the quantified risk indicators to obtain a third risk score; a fourth calculation module, which is used to perform weighted calculation on the first risk score, the second risk score and the third risk score to obtain a comprehensive risk score, and grade the comprehensive risk score according to a preset risk level threshold to obtain a risk level; and an output module, which is used to output the anomaly detection result including the risk level.

[0162] Furthermore, the generation unit also includes: a second determination module, which is used to determine the corresponding business processing strategy based on the risk level of the anomaly detection result, wherein the business processing strategy includes: intercepting the first type of risk business, reviewing the second type of risk business, and releasing the third type of risk business, the risk level of the first type of risk business is higher than that of the second type of risk business, and the risk level of the second type of risk business is higher than that of the third type of risk business; an encapsulation module, which is used to associate and encapsulate the business processing strategy with the cash withdrawal appointment information to obtain appointment feedback information.

[0163] It should be noted that the above-mentioned acquisition unit 41, analysis unit 42, comparison unit 43, and generation unit 44 correspond to steps S201 to S204 in the first embodiment. The examples and application scenarios implemented by the above-mentioned units and corresponding steps are the same, but are not limited to the contents disclosed in the above-mentioned first embodiment. It should be noted that the above-mentioned modules or units can be hardware components or software components stored in a memory (e.g., memory 104) and processed by one or more processors (e.g., processors 102a, 102b, ..., 102n). The above-mentioned modules or units can also be part of the device and can be run in the computer terminal 10 provided in the first embodiment.

[0164] The present invention is described below in conjunction with another optional embodiment.

[0165] Example 3

[0166] An embodiment of the present invention may further provide an electronic device, Figure 5 is a structural block diagram of an electronic device for executing a method for detecting transaction anomalies according to an embodiment of the present invention. Figure 5 As shown, the electronic device may include: one or more ( Figure 5 Only one is shown) processor 502, memory 504, storage controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.

[0167] The memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the transaction anomaly detection method and device in the embodiments of the present application. The processor executes the software programs and modules stored in the memory to perform various functional applications and data processing, thereby implementing the above-mentioned transaction anomaly detection method. The memory may include high-speed random access memory and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory may further include memory remotely located relative to the processor, and these remote memories may be connected to the terminal via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0168] The processor can call information and applications stored in the memory through a transmission device to perform the following steps: upon obtaining authorization from a target user, collecting cash withdrawal reservation information submitted by the target user to a target outlet via telephone communication, wherein the cash withdrawal reservation information includes at least: a call recording and affiliated outlet information; analyzing the call recording in the cash withdrawal reservation information to obtain cash withdrawal service information, wherein the cash withdrawal service information includes at least: a cash withdrawal amount reserved by the target user, voiceprint information, and communication voice characteristics, wherein the communication voice characteristics include at least one of the following: a tone fluctuation characteristic, a speech speed characteristic, and an emotional characteristic; upon verifying that the cash withdrawal amount exceeds a preset amount threshold, obtaining a pre-stored voiceprint library based on the affiliated outlet information, and comparing the voiceprint information with the pre-stored voiceprint library to obtain a comparison result, wherein the pre-stored voiceprint library pre-stores the trusted voiceprints of all registered users of the target outlet authenticated by a third-party trusted institution; obtaining historical transaction behavior data of the target user based on the affiliated outlet information, inputting the comparison result, the communication voice characteristics, and the historical transaction behavior data into an anomaly detection model, outputting an anomaly detection result, and generating appointment feedback information corresponding to the cash withdrawal reservation information based on the anomaly detection result.

[0169] The processor can also call the information and applications stored in the memory through the transmission device to perform the following steps: call the voice recognition engine, and convert the call recording into call recording text through the voice recognition engine; identify the target sentence used to describe the amount value in the call recording text, and determine the cash withdrawal amount reserved by the target user based on the target sentence; call the voice feature analysis engine, and analyze the call recording through the voice feature analysis engine to obtain voiceprint information and communication voice features; determine the cash withdrawal business information including the cash withdrawal amount, voiceprint information and communication voice features.

[0170] The processor can also call the information and application programs stored in the memory through the transmission device to perform the following steps: perform spectral analysis on the call recording to obtain a fundamental frequency change curve, and calculate the tone fluctuation characteristics based on the fundamental frequency change curve; and / or, count the number of syllables in a preset unit time based on the call recording and the call recording text, and calculate the speaking speed characteristics based on the number of syllables; and / or, identify emotional keywords and modal particles based on the call recording and the call recording text, and calculate the emotional characteristics based on the frequency of occurrence of emotional keywords and modal particles; determine a speech feature that includes at least any one of the tone fluctuation characteristics, speaking speed characteristics and emotional characteristics.

[0171] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: retrieve the pre-stored voiceprint features associated with the target user from the pre-stored voiceprint library; calculate the similarity score between the target user's voiceprint information and the pre-stored voiceprint features; when the similarity score is greater than or equal to a preset matching threshold, determine that the target user is a registered user in the target network; or, when the similarity score is less than the preset matching threshold, determine that the target user is a non-registered user.

[0172] The processor can also call the information and application programs stored in the memory through the transmission device to perform the following steps: obtain M sets of historical cash withdrawal appointment sample data in the target outlet, wherein each set of historical cash withdrawal appointment sample data includes: historical comparison results, historical communication voice features and historical transaction behavior data, and M is a positive integer; for each set of historical cash withdrawal appointment sample data, mark the historical comparison results with credibility to generate a first type of training label, mark the historical communication voice features with abnormality to generate a second type of training label, and mark the historical transaction behavior data with risk level to generate a third type of training label; based on the first type of training labels, the second type of training labels and the third type of training labels, perform multi-dimensional joint training on the initial model to obtain an anomaly detection model.

[0173] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: the anomaly detection model performs a credibility score on the target user based on the comparison result to obtain a first risk score; the second risk score is calculated based on the intonation fluctuation characteristics, speech speed characteristics and / or emotional characteristics in the communication voice characteristics, wherein the second risk score is used to indicate the degree of voice abnormality; the risk indicators of historical transaction behavior data are quantified, and a weighted calculation is performed based on the quantified risk indicators to obtain a third risk score; the first risk score, the second risk score and the third risk score are weighted to obtain a comprehensive risk score, and the comprehensive risk score is graded and determined according to a preset risk level threshold to obtain a risk level; and the anomaly detection result including the risk level is output.

[0174] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: determine the corresponding business processing strategy based on the risk level of the abnormality detection result, wherein the business processing strategy includes: intercepting the first type of risk business, reviewing the second type of risk business, and releasing the third type of risk business, the risk level of the first type of risk business is higher than that of the second type of risk business, and the risk level of the second type of risk business is higher than that of the third type of risk business; associate and package the business processing strategy with the cash withdrawal appointment information to obtain appointment feedback information.

[0175] The embodiment of the present invention provides a solution for detecting transaction anomalies. Using automated data collection and intelligent analysis, and integrating advanced voiceprint recognition with speech feature analysis, the system accurately identifies large-scale cash withdrawal transactions scheduled by phone, enhancing pre-emptive risk warning capabilities and reducing false alarm rates. Specifically, the system collects withdrawal reservation information submitted by target users via telephone communication channels, including call recordings and branch information, with their authorization. It then analyzes the call recordings to extract the target user's scheduled withdrawal amount, voiceprint characteristics, and speech characteristics, such as intonation, speech speed, and emotional fluctuations, collectively forming a multi-dimensional understanding of the user's communication behavior. If the reserved amount exceeds a preset threshold, the system utilizes a pre-stored voiceprint database containing trusted voiceprints of all registered users certified by a third-party authority. Through precise comparison, the system not only verifies the user's identity but also provides a benchmark for comparing abnormalities in speech features. Finally, based on the user's historical transaction behavior data, the system uses these comparison results, speech features, and historical data as input to drive a comprehensive evaluation of the anomaly detection model, outputting anomaly detection results and generating reservation feedback information accordingly.

[0176] This series of steps not only significantly improved the ability to identify abnormal transactions through telephone appointment channels, but also built a comprehensive and efficient abnormal transaction early warning system for financial institutions. By introducing voiceprint recognition and communication voice feature analysis technology, it effectively filled the technical gap in the risk monitoring system in the scenario of large-scale cash withdrawals through telephone appointments, and thus solved the technical problem in related technologies that the risk monitoring system has low sensitivity to telephone appointment channel identification methods, resulting in blind spots in abnormal transaction supervision.

[0177] It can be understood by those skilled in the art that Figure 5 The structure shown is for illustration only, and the electronic device may also be a terminal device such as a smart phone, a tablet computer, a PDA, a mobile Internet device (MID), or a PAD. Figure 5 It does not limit the structure of the above electronic device. For example, the electronic device may also include Figure 5 More or fewer components (such as network interfaces, display devices, etc.) shown in, or with Figure 5 Different configurations shown.

[0178] A person skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing the hardware related to the terminal device through a program, and the program can be stored in a computer-readable storage medium, which may include: a flash drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0179] The present invention is described below in conjunction with another optional embodiment.

[0180] Example 4

[0181] The embodiment of the present invention further provides a computer-readable storage medium. Optionally, in the embodiment of the present invention, the computer-readable storage medium can be used to store the program code executed by the transaction anomaly detection method provided in the first embodiment.

[0182] Optionally, in an embodiment of the present invention, the above-mentioned storage medium may be located in any computer terminal in a computer terminal group in a computer network, or in any mobile terminal in a mobile terminal group.

[0183] The embodiment of the present invention also provides a computer program product, which, when executed on a data processing device, is suitable for executing the steps of a method for detecting transaction anomalies: with the authorization of the target user, collecting cash withdrawal reservation information submitted by the target user to the target branch via telephone communication, wherein the cash withdrawal reservation information at least includes: call recording and affiliated branch information; analyzing the call recording in the cash withdrawal reservation information to obtain cash withdrawal service information, wherein the cash withdrawal service information at least includes: the cash withdrawal amount reserved by the target user, voiceprint information and communication voice characteristics, wherein the communication voice characteristics include at least one of the following: intonation fluctuation characteristics, speech speed characteristics and emotional characteristics; when verifying that the withdrawal amount exceeds the preset limit threshold, the pre-stored voiceprint library is obtained based on the affiliated outlet information, and the voiceprint information is compared with the pre-stored voiceprint library to obtain a comparison result, wherein the pre-stored voiceprint library pre-stores the trusted voiceprints of all registered users in the target outlet who are authenticated by a third-party trusted agency; based on the affiliated outlet information, the historical transaction behavior data of the target user is obtained, the comparison results, communication voice characteristics and historical transaction behavior data are input into the anomaly detection model, the anomaly detection result is output, and the appointment feedback information corresponding to the withdrawal appointment information is generated based on the anomaly detection result.

[0184] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0185] In the above embodiments of the present application, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0186] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0187] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0188] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0189] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, a server or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk.

[0190] The above is only a preferred embodiment of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A method for detecting transaction anomalies, characterized in that: include: With authorization from the target user, collecting cash withdrawal reservation information submitted by the target user to the target outlet via telephone communication, wherein the cash withdrawal reservation information at least includes: call recording and attribution outlet information; Analyzing the call recording in the withdrawal reservation information to obtain withdrawal service information, wherein the withdrawal service information includes at least: the withdrawal amount reserved by the target user, voiceprint information, and communication voice characteristics, wherein the communication voice characteristics include at least one of the following: intonation fluctuation characteristics, speech speed characteristics, and emotional characteristics; When it is verified that the withdrawal amount exceeds a preset limit threshold, obtaining a pre-stored voiceprint database based on the home network information, and comparing the voiceprint information with the pre-stored voiceprint database to obtain a comparison result, wherein the pre-stored voiceprint database pre-stores the credible voiceprints of all registered users of the target network that have been authenticated by a third-party trusted institution; Based on the belonging branch information, the historical transaction behavior data of the target user is obtained, the comparison result, the communication voice feature and the historical transaction behavior data are input into the anomaly detection model, the anomaly detection result is output, and the reservation feedback information corresponding to the cash withdrawal reservation information is generated based on the anomaly detection result.

2. The detection method according to claim 1, wherein The step of analyzing the call recording in the cash withdrawal reservation information to obtain the cash withdrawal service information includes: Invoking a speech recognition engine and converting the call recording into a text of the call recording through the speech recognition engine; Identifying a target sentence in the call recording text that is used to describe a numerical amount, and determining the withdrawal amount reserved by the target user based on the target sentence; Invoking a voice feature analysis engine, and analyzing the call recording by the voice feature analysis engine to obtain the voiceprint information and the communication voice features; Determine the cash withdrawal service information including the cash withdrawal amount, the voiceprint information, and the communication voice feature.

3. The detection method according to claim 2, characterized in that The step of analyzing the call recording by the voice feature analysis engine to obtain the communication voice features includes: Performing a spectrum analysis on the call recording to obtain a fundamental frequency variation curve, and calculating the voice intonation fluctuation feature based on the fundamental frequency variation curve; and / or, Counting the number of syllables in a preset unit time based on the call recording and the call recording text, and calculating the speech rate feature based on the number of syllables; and / or, Identifying emotional keywords and modal particles based on the call recording and the call recording text, and calculating the emotional features based on the occurrence frequencies of the emotional keywords and modal particles; The speech feature including at least any one of the intonation fluctuation feature, the speech rate feature, and the emotion feature is determined.

4. The detection method according to claim 1, wherein The step of comparing the voiceprint information with a pre-stored voiceprint database to obtain a comparison result includes: Retrieving a pre-stored voiceprint feature associated with the target user from the pre-stored voiceprint database; Calculating a similarity score between the target user's voiceprint information and the pre-stored voiceprint feature; If the similarity score is greater than or equal to a preset matching threshold, determining that the target user is a registered user in the target network; or When the similarity score is less than the preset matching threshold, the target user is determined to be a non-registered user.

5. The detection method according to claim 1, wherein The anomaly detection model is constructed through the following steps: Obtaining M sets of historical cash withdrawal reservation sample data within the target outlet, wherein each set of historical cash withdrawal reservation sample data includes: historical comparison results, historical communication voice features, and historical transaction behavior data, where M is a positive integer; For each sample of historical cash withdrawal reservation data, the historical comparison results are marked for credibility to generate a first type of training label, the historical communication voice features are marked for abnormality to generate a second type of training label, and the historical transaction behavior data are marked for risk level to generate a third type of training label; Based on the first type of training labels, the second type of training labels and the third type of training labels, the initial model is trained in multiple dimensions to obtain the anomaly detection model.

6. The detection method according to claim 1, characterized in that The step of inputting the comparison result, the communication voice feature, and the historical transaction behavior data into an anomaly detection model and outputting an anomaly detection result includes: The anomaly detection model performs a credibility score on the target user based on the comparison result to obtain a first risk score; Calculating a second risk score based on the intonation fluctuation feature, the speech rate feature, and / or the emotion feature in the communication voice feature, wherein the second risk score is used to indicate the degree of voice abnormality; quantifying risk indicators of the historical transaction behavior data, and performing weighted calculation based on the quantified risk indicators to obtain a third risk score; Performing a weighted calculation on the first risk score, the second risk score, and the third risk score to obtain a comprehensive risk score, and grading the comprehensive risk score according to a preset risk level threshold to obtain a risk level; The abnormality detection result including the risk level is output.

7. The detection method according to claim 1, characterized in that The step of generating reservation feedback information corresponding to the cash withdrawal reservation information based on the abnormality detection result includes: Determining a corresponding business processing strategy based on the risk level of the anomaly detection result, wherein the business processing strategy includes: intercepting a first category of risky business, reviewing a second category of risky business, and releasing a third category of risky business, wherein the risk level of the first category of risky business is higher than that of the second category of risky business, and the risk level of the second category of risky business is higher than that of the third category of risky business; The business processing strategy is associated with the cash withdrawal reservation information and packaged to obtain the reservation feedback information.

8. A device for detecting transaction anomalies, characterized in that: include: A collection unit is configured to collect, upon authorization by a target user, cash withdrawal reservation information submitted by the target user to a target outlet via telephone communication, wherein the cash withdrawal reservation information includes at least: a call recording and information about the attribution outlet; an analysis unit configured to analyze the call recording in the withdrawal reservation information to obtain withdrawal service information, wherein the withdrawal service information includes at least: a withdrawal amount reserved by the target user, voiceprint information, and communication voice characteristics, wherein the communication voice characteristics include at least one of the following: a voice intonation fluctuation characteristic, a speech speed characteristic, and an emotional characteristic; a comparison unit, configured to, when verifying that the withdrawal amount exceeds a preset limit threshold, obtain a pre-stored voiceprint database based on the home branch information, and compare the voiceprint information with the pre-stored voiceprint database to obtain a comparison result, wherein the pre-stored voiceprint database pre-stores the credible voiceprints of all registered users of the target branch who have been authenticated by a third-party trusted institution; A generation unit is used to obtain the historical transaction behavior data of the target user based on the affiliated branch information, input the comparison result, the communication voice feature and the historical transaction behavior data into an anomaly detection model, output the anomaly detection result, and generate reservation feedback information corresponding to the cash withdrawal reservation information based on the anomaly detection result.

9. A computer-readable storage medium, characterized in that The computer-readable storage medium includes a stored computer program, wherein when the computer program is executed, the device where the computer-readable storage medium is located is controlled to execute the transaction anomaly detection method according to any one of claims 1 to 7.

10. An electronic device, characterized in that: The invention comprises one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the transaction anomaly detection method according to any one of claims 1 to 7.

11. A computer program product, characterized in that The method comprises computer instructions, wherein when the computer instructions are executed by a processor, the steps of the method for detecting transaction anomalies according to any one of claims 1 to 7 are implemented.

Images