Business risk detection method, device and equipment and storage medium thereof

Abstract

The invention belongs to the technical field of artificial intelligence, and relates to a business risk detection method and device, equipment and a storage medium thereof.The business risk detection method comprises the steps that processing equipment information is recognized by obtaining and analyzing a processing request message; inputting the handling equipment information into the risk detection model, and outputting a risk value of the handling equipment information; and processing according to the risk value detection result. Compared with a previous risk detection mode, the application directly takes the handling equipment information for sending the handling request messages as the risk detection information, each handling request message inevitably corresponds to the sending equipment, the detection limitation caused by less individual business data is broken through, and the handling equipment information is directly utilized, so that the risk detection efficiency is improved. Malicious handling robots can be conveniently identified and forbidden; the method is applied to an insurance buying service launched by finance or health care, risk detection is carried out at least once according to the handling equipment sending the insurance buying request, the detection range of risk detection is improved, and meanwhile, the insurance fraud risk can be reduced as much as possible.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence technology, and is applied to the scenario of insurance fraud risk detection before the signing of an insurance contract, and relates to a business risk detection method, device, equipment and storage medium thereof. Background Art

[0002] In the financial industry, many risk control models have begun to use deep learning methods (such as large-scale pre-trained models and deep neural networks) for risk assessment and fraud detection. These models can generally capture complex nonlinear relationships through big data training, effectively identifying abnormal behavior and potential risks.

[0003] While large models offer improved detection accuracy, claims and fraud data remain relatively scarce, and this data imbalance remains a serious issue. Large models often bias detection towards the majority class (normal claims data) while ignoring the minority class (fraudulent claims data). Furthermore, for new service applicants, the lack of relevant historical business data significantly limits business risk detection. Summary of the Invention

[0004] The purpose of the embodiments of the present application is to provide a business risk detection method, apparatus, device and storage medium thereof to solve the problem that existing business risk detection has significant limitations.

[0005] In a first aspect, an embodiment of the present application provides a business risk detection method, which adopts the following technical solution:

[0006] A business risk detection method comprises the following steps:

[0007] Get the latest business processing user's processing request message;

[0008] Parsing the processing request message and identifying the processing device information corresponding to the latest service processing user sending the processing request message;

[0009] Inputting the processing equipment information into a preset risk detection model and outputting a risk value of the processing equipment information;

[0010] If the risk value does not exceed the preset risk threshold, the processing request message is sent to the target business processing terminal;

[0011] If the risk value exceeds the preset risk threshold, the processing request message is intercepted and transferred to manual review.

[0012] In a second aspect, the present application also provides a service risk detection device, which adopts the following technical solution:

[0013] A business risk detection device, comprising:

[0014] The processing request message acquisition module is used to obtain the processing request message of the latest business processing user;

[0015] A processing device information identification module is used to parse the processing request message and identify the processing device information corresponding to the processing request message sent by the latest service processing user;

[0016] a risk detection model detection module, configured to input the processing equipment information into a preset risk detection model and output a risk value of the processing equipment information;

[0017] A first branch processing module is configured to send the processing request message to a target business processing terminal if the risk value does not exceed a preset risk threshold;

[0018] The second branch processing module is used to intercept the processing request message and transfer it to manual review processing if the risk value exceeds a preset risk threshold.

[0019] In a third aspect, an embodiment of the present application further provides a computer device that adopts the following technical solution:

[0020] A computer device includes a memory and a processor, wherein the memory stores computer-readable instructions, and the processor implements the steps of the business risk detection method described above when executing the computer-readable instructions.

[0021] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium, which adopts the following technical solution:

[0022] A computer-readable storage medium stores computer-readable instructions, which, when executed by a processor, implement the steps of the business risk detection method described above.

[0023] Compared with the prior art, the embodiments of the present application have the following beneficial effects:

[0024] The business risk detection method described in this application obtains the latest business processing user's processing request message; parses the processing request message and identifies the processing device information; inputs the processing device information into a preset risk detection model and outputs the risk value of the processing device information; if the risk value does not exceed the preset risk threshold, the processing request message is sent to the target business processing terminal; if the risk value exceeds the preset risk threshold, the processing request message is intercepted and transferred to manual review. Compared with previous risk detection methods, this application directly uses the processing device information that sends the processing request message as risk detection information. Each processing request message must correspond to a corresponding sending device, breaking through the detection limitations caused by the lack of individual business data. Directly using the processing device information that sends the processing request message as risk detection information also facilitates the identification of malicious processing robots and their ban, reducing the risk of insurance fraud. It can be applied to insurance business related to finance or health and elderly care. When a user applies for insurance, at least one risk detection is first performed based on the processing device that sends the insurance request, thereby improving the detection breadth of risk detection and minimizing the risk of insurance fraud. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] In order to more clearly illustrate the solutions in this application, a brief introduction will be given below to the drawings required for use in the description of the embodiments of this application. Obviously, the drawings described below are some embodiments of this application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0026] Figure 1 is an exemplary system architecture diagram to which the present application may be applied;

[0027] Figure 2 is a flow chart of an embodiment of a business risk detection method according to the present application;

[0028] Figure 3 This is a flowchart of a specific embodiment of constructing a risk detection model in the business risk detection method described in this application;

[0029] Figure 4 yes Figure 3 A flowchart of a specific embodiment of step 301 is shown;

[0030] Figure 5 This is a flowchart of a specific embodiment of risk management for users who share the business sharing code in the business risk detection method described in this application;

[0031] Figure 6 yes Figure 3 A flowchart of a specific embodiment of step 305 is shown;

[0032] Figure 7 yes Figure 3 A flowchart of a specific embodiment of step 306 is shown;

[0033] Figure 8 yes Figure 2 A flowchart of a specific embodiment of step 203 is shown;

[0034] Figure 9 This is a structural diagram of an embodiment of a business risk detection device according to the present application;

[0035] Figure 10 It is a structural diagram of an embodiment of a computer device according to the present application. DETAILED DESCRIPTION

[0036] Unless otherwise defined, all technical and scientific terms used herein have the same meanings as commonly understood by those skilled in the art to which this application belongs. The terms used in the specification of the application are for the purpose of describing specific embodiments only and are not intended to limit this application. The terms "including" and "having" and any variations thereof in the specification and claims of this application and the above-mentioned drawings are intended to cover non-exclusive inclusions. The terms "first", "second", etc. in the specification and claims of this application or the above-mentioned drawings are used to distinguish different objects, not to describe a specific order.

[0037] References herein to "embodiments" mean that a particular feature, structure, or characteristic described in connection with the embodiments may be included in at least one embodiment of the present application. The appearance of this phrase in various places in the specification does not necessarily refer to the same embodiment, nor does it constitute an independent or alternative embodiment that is mutually exclusive of other embodiments. It is understood, both explicitly and implicitly, by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0038] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the accompanying drawings.

[0039] like Figure 1 As shown, system architecture 100 may include a terminal device 101, a network 102, and a server 103. Terminal device 101 may be a laptop computer 1011, a tablet computer 1012, or a mobile phone 1013. Network 102 is a medium for providing a communication link between terminal device 101 and server 103. Network 102 may include various connection types, such as wired or wireless communication links or fiber optic cables.

[0040] The user can use the terminal device 101 to interact with the server 103 via the network 102 to receive or send messages, etc. Various communication client applications can be installed on the terminal device 101, such as web browser applications, shopping applications, search applications, instant messaging tools, email clients, social platform software, etc.

[0041] The terminal device 101 can be various electronic devices with a display screen and supporting web browsing. In addition to the laptop computer 1011, the tablet computer 1012 or the mobile phone 1013, the terminal device 101 can also be an e-book reader, an MP3 player (Moving Picture Experts Group Audio Layer III), an MP4 (Moving Picture Experts Group Audio Layer IV) player, a laptop computer and a desktop computer, etc.

[0042] The server 103 may be a server that provides various services, such as a background server that provides support for web pages displayed on the terminal device 101 .

[0043] It should be noted that the service risk detection method provided in the embodiment of the present application is generally executed by a server, and accordingly, a service risk detection device is generally set in the server.

[0044] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is merely illustrative. Any number of terminal devices, networks and servers may be provided as required.

[0045] Continue to refer Figure 2 , shows a flow chart of an embodiment of a business risk detection method according to the present application. The business risk detection method includes the following steps:

[0046] Step 201: Obtain the latest service request message from the user.

[0047] In this embodiment, the processing request message, for example, is an insurance application processing request message under the financial business application field, specifically, including a property insurance application processing request message, a health insurance application processing request message, and a pet insurance application processing request message.

[0048] Step 202: parse the processing request message and identify the processing device information corresponding to when the latest service processing user sends the processing request message.

[0049] In this embodiment, the processing device information, for example: the latest service processing user uses a personal mobile phone to send the processing request message, then the processing device information refers to the relevant information of the mobile phone, including the mobile phone brand, mobile phone model, mobile phone IP location and the User-Agent list information of the mobile phone device; for example: the latest service processing user uses a personal computer to send the processing request message, then the processing device information refers to the relevant information of the computer, including the computer brand, computer model, computer IP location and the computer's User-Agent list information.

[0050] Specifically, when a business processing user sends a processing request message, he / she also sends the processing device information. Afterwards, the processing request message is parsed and the processing device information corresponding to the processing request message sent by the latest business processing user is identified.

[0051] Step 203: input the processing equipment information into a preset risk detection model, and output the risk value of the processing equipment information.

[0052] In this embodiment, the processing device information, that is, the information related to the sending device of the processing request message, is used as risk detection information and input into the risk detection model, thereby outputting the corresponding risk value. Previous risk detection methods require a large amount of historical claim information of the insured user to perform risk value detection. Although this method combines the historical related information of the insured user, it has a large limitation in risk business detection. For example, if the insured user is a new user or the insured user has less historical data, no data will be available, and risk detection cannot be performed for the new user. Compared with previous risk detection methods, the risk detection method provided by this application directly uses the processing device information that sends the processing request message as risk detection information. Each processing request message must correspond to a corresponding sending device, breaking through the above limitations. Directly using the processing device information that sends the processing request message as risk detection information also facilitates the identification of malicious processing robots, banning them, and reducing the risk of insurance fraud.

[0053] Step 204: If the risk value does not exceed the preset risk threshold, the processing request message is sent to the target business processing terminal.

[0054] Specifically, if the information of the processing device that sends the insurance application request message passes the risk value verification, the insurance application request message will be sent to the insurance application processing terminal to process the insurance business.

[0055] Step 205: If the risk value exceeds a preset risk threshold, the processing request message is intercepted and transferred to manual review processing.

[0056] Specifically, if the processing device information of the insurance application request message does not pass the risk value verification, the insurance application request message will be intercepted and forwarded for manual review to reduce the risk of insurance fraud.

[0057] In this embodiment, the process obtains the latest service request message from the user who processes the service; parses the request message and identifies the service device information; inputs the service device information into a preset risk detection model and outputs the risk value of the service device information; if the risk value does not exceed the preset risk threshold, the service request message is sent to the target service processing terminal; if the risk value exceeds the preset risk threshold, the service request message is intercepted and transferred to manual review and processing. Compared with the previous risk detection method, the present application directly uses the service device information that sends the service request message as risk detection information. Each service request message must correspond to a corresponding sending device, breaking through the detection limitations caused by the small amount of individual service data. Directly using the service device information that sends the service request message as risk detection information also facilitates the identification of malicious service robots and their blocking, thereby reducing the risk of insurance fraud. It can be applied to insurance business related to finance or health and elderly care. When a user applies for insurance, at least one risk detection is first performed based on the service device that sends the insurance request, thereby increasing the detection breadth of risk detection and minimizing the risk of insurance fraud.

[0058] Continue to refer Figure 3 In some optional implementations, before step 203, the method further includes the step of constructing a risk detection model. Figure 3 This is a flowchart of a specific embodiment of constructing a risk detection model in the business risk detection method described in this application, including the following steps:

[0059] Step 301: Screen out suspicious user groups based on a preset group screening strategy;

[0060] In this embodiment, the suspicious user group can be understood as a high-risk user group.

[0061] Step 302: Obtain the service processing device information of all users in the suspicious user group, wherein the service processing device information includes device brand, device model, device IP location, and device User-Agent list information;

[0062] By obtaining the business processing device information of all users in the suspicious user group, it is convenient to subsequently detect the processing devices commonly used by the high-risk user group, or the business risk values ​​corresponding to different processing device information based on the group's business processing device information.

[0063] Step 303: clustering the service processing device information;

[0064] Step 304: Based on the clustering results, the service processing device information of all users in the suspicious user group is normalized and formatted to obtain a device feature extraction data set;

[0065] Specifically, one-hot encoding may be used to normalize and format the business processing device information of all users in the clustered suspicious user group, so as to convert the text format fields in the processing device information into numerical formats.

[0066] Step 305: Input the device feature extraction data set into a preset feature extraction network to perform feature extraction to obtain risky device features corresponding to the suspicious user group;

[0067] Specifically, when performing the feature extraction, a compressed sparse matrix method may be used to perform matrix representation and limitation on the device feature extraction data set.

[0068] Step 306: construct a risk detection model based on the risky device characteristics.

[0069] Specifically, after obtaining all risk device features, a neural network integration method can be used to integrate the risk device features into the target neural network, thereby constructing a risk detection model.

[0070] In this embodiment, by collating all the processing device information of the suspicious user group, extracting the risk device features of all the processing device information, and constructing a risk detection model based on the extracted risk device features, in actual insurance business, when the user applies for insurance, at least one risk detection can be performed based on the processing device that sends the insurance request, thereby improving the detection breadth of risk detection and, at the same time, minimizing the risk of insurance fraud.

[0071] Continue with reference 4, Figure 4 yes Figure 3 The flowchart of a specific embodiment of step 301 shown includes the following steps:

[0072] Step 401: Acquire the processing request information of new service users in batches;

[0073] Specifically, when a new user applies for insurance, the processing request information of the new user is obtained in batches to facilitate subsequent use of the processing device information.

[0074] Step 402: parse the processing request information to obtain the service sharing code filled in by all new service processing users;

[0075] In this embodiment, the processing request information also includes a business sharing code. The business sharing code, for example, is a business promotion code launched by an insurance company to expand its customer base and to allocate business promotion codes to historical users. The historical users can share the business promotion codes with users who have not processed the business (non-business users). After scanning the code, the users who have not processed the business can obtain a business registration or application link to process the business and expand their customer base.

[0076] Specifically, the business sharing code filled in by all new business users is obtained by parsing the processing request information. The "filling in" here should be interpreted in an expanded manner. In addition to the manual interactive writing by the new business users, it also includes the automatic binding writing after the new business users scan the business sharing code.

[0077] Step 403: Identify all sharing amounts of the target user in a preset time period based on the service sharing code, and set a threshold for new service handling amount using the σ multiplication principle of normal distribution;

[0078] In this embodiment, the target user refers to the user who provides the service sharing code.

[0079] Step 404: clustering new users of the service from the same sharing source using the service sharing code to obtain a user clustering result;

[0080] Specifically, new business users who scan the same business sharing code to apply for business are clustered.

[0081] Step 405: Based on the user clustering results, the number of new users who have applied for services corresponding to different service sharing codes is counted;

[0082] Specifically, the number of expanded users corresponding to each business sharing code is counted.

[0083] Step 406: By comparison, determine whether the number of new users who have applied for the service corresponding to the current service sharing code exceeds the threshold value for new service applications;

[0084] Step 407: If the number of new users who have applied for services corresponding to the current service sharing code exceeds the threshold for new services, the user clustering result corresponding to the current service sharing code is marked as a suspicious user group;

[0085] Step 408: If the number of new users who have handled the service corresponding to the current service sharing code does not exceed the threshold value for the new service handling amount, the user clustering result corresponding to the current service sharing code is marked as a trusted user group.

[0086] In this embodiment, the actual business sharing code is used to randomly expand customers. Since most business sharing code customer expansion methods have corresponding thresholds in the number of expanded users, it is difficult for users who scan the code to achieve 100% registration; and when insurance fraud gangs use business sharing codes to handle batch insurance fraud business, they often pay more attention to applying for business every time they scan. Therefore, the number of new business users corresponding to the current business sharing code is compared with the preset new business handling volume threshold, and the suspicious user group and the trustworthy user group are distinguished as much as possible based on this distinguishing behavior, so as to provide certain data support basis for subsequent business risk detection.

[0087] In this embodiment, the step of identifying all sharing amounts of the target user in a preset time period based on the service sharing code and setting the threshold value of the new service processing amount using the σ multiplication principle of the normal distribution, i.e., step 403, specifically includes:

[0088] According to the service sharing code, all sharing amounts of the target user in a preset time period are counted, wherein the target user is the user who issued the service sharing code;

[0089] If the σ multiplication principle is the 1 times σ principle, then according to the preset algorithm formula:

[0090]

[0091] Calculate the threshold value of the new business volume, where m represents the threshold value of the new business volume, n represents the total sharing volume, and 0.6826 represents the calculation constant corresponding to the 1 times σ principle. Indicates that the calculation result is rounded up, "·" represents the calculation result;

[0092] If the σ multiplication principle is the 2 times σ principle, then according to the preset algorithm formula:

[0093]

[0094] Calculate the threshold value of the new business volume, where m represents the threshold value of the new business volume, n represents the total sharing volume, and 0.9544 represents the calculation constant corresponding to the 2 times σ principle. Indicates that the calculation result is rounded up, "·" represents the calculation result;

[0095] If the σ multiplication principle is the 3 times σ principle, then according to the preset algorithm formula:

[0096]

[0097] Calculate the threshold value of the new business volume, where m represents the threshold value of the new business volume, n represents the total shared volume, and 0.9974 represents the calculation constant corresponding to the 3 times σ principle. Indicates that the calculation result is rounded up, and “·” represents the calculation result.

[0098] Continue to refer Figure 5 In some optional implementations, after step 301, the method further includes a step of performing risk management on the user who shared the service sharing code. Figure 5 This is a flowchart of a specific embodiment of risk management for users sharing the business sharing code in the business risk detection method described in this application, including the following steps:

[0099] Step 501: Add the current service sharing code to a preset sharing code blacklist;

[0100] Step 502: Mark the user who sent the current service sharing code as a risky user;

[0101] Step 503: Manually review the risky user and obtain a manual review result;

[0102] Step 504: If the manual review result is a failure, the risky user is added to a preset user blacklist;

[0103] Step 505: If the manual review result is passed, the sharing user is updated and marked as a normal user, and a new service sharing code is generated for the sharing user.

[0104] Specifically, when the new business applicant group corresponding to a certain business sharing code is a suspicious user group, the user who shared the business sharing code is marked as a risky user, so as to identify whether the user is an actual risky user or there is a certain risk of insurance fraud in the business sharing code. User risk identification is performed or the business sharing code is abandoned and a new one is generated, which further ensures the security of business risk detection and reduces the risk of insurance fraud.

[0105] Continue to refer to 6, Figure 6 yes Figure 3 The flowchart of a specific embodiment of step 305 shown includes the following steps:

[0106] Step 601: deploying a preset unsupervised clustering algorithm as a feature extraction algorithm into the feature extraction network, wherein the unsupervised clustering algorithm includes a DBSCAN algorithm;

[0107] Step 602: clustering all data items in the device feature extraction dataset using a feature extraction algorithm in the feature extraction network;

[0108] Step 603 : setting the risky device features contained in the device feature extraction data set and the risk weight corresponding to each risky device feature according to the clustering result and the number of data entries contained in each cluster.

[0109] Specifically, since group characteristics are extracted from suspicious user groups and the risk characteristics corresponding to the equipment information are not known in advance, that is, risk characteristics are predicted without risk characteristic labels, the DBSCAN algorithm in the unsupervised clustering algorithm is used for clustering, and the risk equipment characteristics are simulated and generated based on the clustering results, and the corresponding risk weights are set.

[0110] Continue with reference 7, Figure 7 yes Figure 3 The flowchart of a specific embodiment of step 306 shown includes the following steps:

[0111] Step 701: Integrate the risky device features contained in the device feature extraction dataset as risk detection nodes into a preset neural network;

[0112] Step 702 : According to the risk weight corresponding to each risky device feature, the risk weight of each risk detection node in the neural network is set to obtain the risk detection model.

[0113] Specifically, the risk equipment characteristics and risk weights simulated and generated by the unsupervised clustering algorithm are integrated into a preset neural network to construct a risk detection model, which facilitates subsequent risk detection using the risk detection model.

[0114] In this embodiment, before executing the step of inputting the processing equipment information into a preset risk detection model and outputting the risk value of the processing equipment information, the method also includes: performing format standardization processing on the business processing equipment information to obtain equipment feature extraction data; that is, formatting preprocessing the processing equipment information of the latest business processing user before inputting it into the risk detection model, so that the data input into the risk detection model conforms to the detection data format.

[0115] Continue to refer to 8, Figure 8 yes Figure 2 The flowchart of a specific embodiment of step 203 shown includes the following steps:

[0116] Step 801: input the device feature extraction data into the preset risk detection model;

[0117] In step 802, the risk detection nodes hit by the device feature extraction data and the risk weights corresponding to each risk detection node are accumulated and summed to obtain the risk value.

[0118] In this embodiment, the business risk detection method can be applied to the risk detection business scenario during insurance underwriting. When the latest business processing user makes an insurance request, the processing device information corresponding to the insurance request is obtained to perform risk detection. Compared with the previous risk detection based on the historical related information of the insured user, it can break through the detection limitations caused by the small amount of individual business data of the insured, and directly use the processing device information of the sending processing request message as risk detection information, which is also convenient for identifying malicious processing robots and banning them, thereby reducing the risk of insurance fraud.

[0119] In this embodiment, the process obtains the latest service request message from the user who processes the service; parses the request message and identifies the service device information; inputs the service device information into a preset risk detection model and outputs the risk value of the service device information; if the risk value does not exceed the preset risk threshold, the service request message is sent to the target service processing terminal; if the risk value exceeds the preset risk threshold, the service request message is intercepted and transferred to manual review and processing. Compared with the previous risk detection method, the present application directly uses the service device information that sends the service request message as risk detection information. Each service request message must correspond to a corresponding sending device, breaking through the detection limitations caused by the small amount of individual service data. Directly using the service device information that sends the service request message as risk detection information also facilitates the identification of malicious service robots and their blocking, thereby reducing the risk of insurance fraud. It can be applied to insurance business related to finance or health and elderly care. When a user applies for insurance, at least one risk detection is first performed based on the service device that sends the insurance request, thereby increasing the detection breadth of risk detection and minimizing the risk of insurance fraud.

[0120] The embodiments of the present application can acquire and process relevant data based on artificial intelligence technology. Artificial intelligence (AI) is the theory, method, technology, and application system that uses digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use knowledge to achieve optimal results.

[0121] Fundamental AI technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing, operating / interaction systems, and mechatronics. AI software technologies primarily encompass computer vision, robotics, biometrics, speech processing, natural language processing, and machine learning / deep learning.

[0122] In this embodiment, the process obtains the latest service request message from the user who processes the service; parses the request message and identifies the service device information; inputs the service device information into a preset risk detection model and outputs the risk value of the service device information; if the risk value does not exceed the preset risk threshold, the service request message is sent to the target service processing terminal; if the risk value exceeds the preset risk threshold, the service request message is intercepted and transferred to manual review and processing. Compared with the previous risk detection method, the present application directly uses the service device information that sends the service request message as risk detection information. Each service request message must correspond to a corresponding sending device, breaking through the detection limitations caused by the small amount of individual service data. Directly using the service device information that sends the service request message as risk detection information also facilitates the identification of malicious service robots and their blocking, thereby reducing the risk of insurance fraud. It can be applied to insurance business related to finance or health and elderly care. When a user applies for insurance, at least one risk detection is first performed based on the service device that sends the insurance request, thereby increasing the detection breadth of risk detection and minimizing the risk of insurance fraud.

[0123] Further references Figure 9 , as a response to the above Figure 2 In order to realize the method shown in the figure, the present application provides an embodiment of a business risk detection device. Figure 2 Corresponding to the method embodiment shown, the device can be specifically applied to various electronic devices.

[0124] like Figure 9 As shown, the business risk detection device 900 of this embodiment includes: a processing request message acquisition module 901, a processing device information identification module 902, a risk detection model detection module 903, a first branch processing module 904 and a second branch processing module 905. Among them:

[0125] The processing request message acquisition module 901 is used to obtain the latest processing request message of the service processing user;

[0126] The processing device information identification module 902 is used to parse the processing request message and identify the processing device information corresponding to the processing request message sent by the latest service processing user;

[0127] The risk detection model detection module 903 is used to input the processing equipment information into a preset risk detection model and output the risk value of the processing equipment information;

[0128] The first branch processing module 904 is configured to send the processing request message to a target service processing terminal if the risk value does not exceed a preset risk threshold;

[0129] The second branch processing module 905 is used to intercept the processing request message and transfer it to manual review processing if the risk value exceeds a preset risk threshold.

[0130] This application obtains the latest business processing user's processing request message; parses the processing request message and identifies the processing device information; inputs the processing device information into a preset risk detection model and outputs the risk value of the processing device information; if the risk value does not exceed the preset risk threshold, the processing request message is sent to the target business processing terminal; if the risk value exceeds the preset risk threshold, the processing request message is intercepted and transferred to manual review and processing. Compared with the previous risk detection method, this application directly uses the processing device information that sends the processing request message as risk detection information. Each processing request message must correspond to a corresponding sending device, breaking through the detection limitations caused by the lack of individual business data. Directly using the processing device information that sends the processing request message as risk detection information also facilitates the identification of malicious processing robots and bans them, reducing the risk of insurance fraud; it can be applied to insurance business involving finance or health and elderly care. When a user applies for insurance, at least one risk detection is first performed based on the processing device that sends the insurance request, thereby increasing the detection breadth of risk detection and minimizing the risk of insurance fraud.

[0131] In this embodiment, the business risk detection device 900 further includes a suspicious user group screening module, a processing device information acquisition module, a processing device information clustering module, a device feature extraction data set acquisition module, a risk device feature extraction module, and a risk detection model construction module. Among them:

[0132] Suspicious user group screening module, used to screen out suspicious user groups based on preset group screening strategies;

[0133] A processing device information acquisition module is used to obtain the service processing device information of all users in the suspicious user group, wherein the processing device information includes device brand, device model, device IP location and device User-Agent list information;

[0134] A processing equipment information clustering module, used for clustering the business processing equipment information;

[0135] A device feature extraction data set acquisition module is used to normalize and format the service processing device information of all users in the suspicious user group according to the clustering processing results to obtain a device feature extraction data set;

[0136] A risky device feature extraction module is used to input the device feature extraction data set into a preset feature extraction network to perform feature extraction to obtain risky device features corresponding to the suspicious user group;

[0137] The risk detection model building module is used to build a risk detection model according to the risk device characteristics.

[0138] In this embodiment, the suspicious user group screening module includes a processing device information batch acquisition unit, a service sharing code acquisition unit, a threshold setting unit, a user clustering unit, a service processing new user number statistics unit, a comparison unit, a suspicious user group marking unit, and a trusted user group marking unit.

[0139] The processing device information batch acquisition unit is used to batch acquire the processing request information of new service processing users;

[0140] A service sharing code acquisition unit, configured to acquire the service sharing codes filled in by all new service application users by parsing the application request information;

[0141] A threshold setting unit, configured to identify all sharing amounts of a target user in a preset time period based on the service sharing code, and set a threshold for new service handling amount using the σ multiplication principle of a normal distribution;

[0142] A user clustering unit is used to perform user clustering processing on new service users with the same sharing source using the service sharing code to obtain a user clustering result;

[0143] A unit for counting the number of new business users, used to count the number of new business users corresponding to different business sharing codes based on user clustering results;

[0144] A comparison unit, configured to determine, by comparison, whether the number of new users who have processed the service corresponding to the current service sharing code exceeds the threshold value for the number of new users who have processed the service;

[0145] A suspicious user group marking unit is configured to mark the user clustering result corresponding to the current service sharing code as a suspicious user group if the number of new service processing users corresponding to the current service sharing code exceeds the new service processing volume threshold;

[0146] The trusted user group marking unit is configured to mark the user clustering result corresponding to the current service sharing code as a trusted user group if the number of new service processing users corresponding to the current service sharing code does not exceed the new service processing volume threshold.

[0147] In this embodiment, the business risk detection device 900 further includes a business sharing code blacklist adding module, a risk user marking module, a manual review module, a review failure processing module, and a review pass processing module.

[0148] A service sharing code blacklist adding module is used to add the current service sharing code to a preset sharing code blacklist;

[0149] A risky user marking module, configured to mark the sharing user who issues the current service sharing code as a risky user;

[0150] A manual review module is used to manually review the risky users and obtain manual review results;

[0151] An audit failure processing module is used to add the risky user to a preset user blacklist if the manual audit result is an audit failure;

[0152] The audit pass processing module is used to update the mark of the sharing user as a normal user if the manual audit result is audit pass, and generate a new business sharing code for the sharing user.

[0153] In this embodiment, the risky device feature extraction module includes a feature extraction algorithm deployment unit, a clustering processing unit, and a risky device feature and risk weight setting unit.

[0154] A feature extraction algorithm deployment unit, configured to deploy a preset unsupervised clustering algorithm as a feature extraction algorithm into the feature extraction network, wherein the unsupervised clustering algorithm includes a DBSCAN algorithm;

[0155] a clustering processing unit, configured to cluster all data entries in the device feature extraction dataset using a feature extraction algorithm in the feature extraction network;

[0156] The risk device feature and risk weight setting unit is used to set the risk device features contained in the device feature extraction data set and the risk weight corresponding to each risk device feature according to the clustering result and the number of data entries contained in each cluster.

[0157] In this embodiment, the risk detection model construction module includes a risk detection node integration unit and a risk detection model construction unit.

[0158] a risk detection node integration unit, configured to integrate the risky device features contained in the device feature extraction data set as risk detection nodes into a preset neural network;

[0159] The risk detection model construction unit is used to set the risk weight of each risk detection node in the neural network according to the risk weight corresponding to each risk device feature, so as to obtain the risk detection model.

[0160] Those skilled in the art will appreciate that all or part of the processes in the above-described method embodiments can be implemented by instructing related hardware via computer-readable instructions. The computer-readable instructions can be stored in a computer-readable storage medium, and when the program is executed, it can include the processes in the above-described method embodiments. The aforementioned storage medium can be a non-volatile storage medium such as a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0161] It should be understood that although the steps in the flowcharts of the accompanying drawings are shown in sequence as indicated by the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some of the steps in the flowcharts of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a portion of the sub-steps or stages of other steps.

[0162] To solve the above technical problems, the present application also provides a computer device. Figure 10 , Figure 10 This is a basic structural block diagram of the computer device in this embodiment.

[0163] The computer device 10 includes a memory 10a, a processor 10b, and a network interface 10c that are interconnected via a system bus. Figure 10Only a computer device 10 having components such as a memory 10a, a processor 10b, and a network interface 10c is shown. However, it should be understood that it is not required to implement all of the components shown, and more or fewer components may be implemented instead. It should be understood by those skilled in the art that a computer device herein is a device that can automatically perform numerical calculations and / or information processing according to pre-set or stored instructions, and its hardware includes but is not limited to a microprocessor, an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), a digital signal processor (DSP), an embedded device, etc.

[0164] The computer device may be a desktop computer, notebook computer, PDA, cloud server, etc. The computer device may interact with the user via a keyboard, mouse, remote control, touchpad, or voice control device.

[0165] The memory 10a includes at least one type of readable storage medium, including flash memory, a hard disk, a multimedia card, a card-type memory (e.g., SD or DX memory), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, a magnetic disk, an optical disk, etc. In some embodiments, the memory 10a may be an internal storage unit of the computer device 10, such as the hard disk or memory of the computer device 10. In other embodiments, the memory 10a may also be an external storage device of the computer device 10, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the computer device 10. Of course, the memory 10a may also include both the internal storage unit of the computer device 10 and its external storage device. In this embodiment, the memory 10a is generally used to store the operating system and various application software installed on the computer device 10, such as computer-readable instructions of a business risk detection method. In addition, the memory 10a can also be used to temporarily store various types of data that have been output or are to be output.

[0166] In some embodiments, the processor 10b may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chip. The processor 10b is generally used to control the overall operation of the computer device 10. In this embodiment, the processor 10b is used to execute computer-readable instructions stored in the memory 10a or process data, such as computer-readable instructions for executing the business risk detection method.

[0167] The network interface 10c may include a wireless network interface or a wired network interface. The network interface 10c is generally used to establish a communication connection between the computer device 10 and other electronic devices.

[0168] The computer device proposed in this embodiment belongs to the field of artificial intelligence technology and is applied to insurance fraud risk detection scenarios before the signing of an insurance contract. This application obtains the latest service request message from the user who processes the service; parses the request message and identifies the service device information; inputs the service device information into a preset risk detection model and outputs a risk value for the service device information; if the risk value does not exceed a preset risk threshold, the request message is sent to the target service processing terminal; if the risk value exceeds the preset risk threshold, the request message is intercepted and transferred to manual review. Compared with previous risk detection methods, this application directly uses the processing device information that sends the processing request message as risk detection information. Each processing request message must correspond to a corresponding sending device, breaking through the detection limitations caused by less individual business data, and directly using the processing device information that sends the processing request message as risk detection information, it is also convenient to identify malicious processing robots, ban them, and reduce the risk of insurance fraud; it can be applied to insurance business involving finance or health and elderly care. When a user applies for insurance, at least one risk detection is first performed based on the processing device that sends the insurance request, thereby improving the detection breadth of risk detection and, at the same time, minimizing the risk of insurance fraud.

[0169] The present application also provides another embodiment, namely, providing a computer-readable storage medium, wherein the computer-readable storage medium stores computer-readable instructions, and the computer-readable instructions can be executed by a processor to enable the processor to perform the steps of a business risk detection method as described above.

[0170] The computer-readable storage medium proposed in this embodiment belongs to the field of artificial intelligence technology and is applied to insurance fraud risk detection scenarios before the signing of an insurance contract. This application obtains the latest service request message from the user who processes the service; parses the request message and identifies the service device information; inputs the service device information into a preset risk detection model and outputs the risk value of the service device information; if the risk value does not exceed the preset risk threshold, the request message is sent to the target service processing terminal; if the risk value exceeds the preset risk threshold, the request message is intercepted and transferred to manual review. Compared with previous risk detection methods, this application directly uses the processing device information that sends the processing request message as risk detection information. Each processing request message must correspond to a corresponding sending device, breaking through the detection limitations caused by less individual business data, and directly using the processing device information that sends the processing request message as risk detection information, it is also convenient to identify malicious processing robots, ban them, and reduce the risk of insurance fraud; it can be applied to insurance business involving finance or health and elderly care. When a user applies for insurance, at least one risk detection is first performed based on the processing device that sends the insurance request, thereby improving the detection breadth of risk detection and, at the same time, minimizing the risk of insurance fraud.

[0171] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus the necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for enabling a terminal device (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0172] Obviously, the embodiments described above are only some of the embodiments of the present application, rather than all of the embodiments. The preferred embodiments of the present application are given in the accompanying drawings, but they do not limit the patent scope of the present application. The present application can be implemented in many different forms. On the contrary, the purpose of providing these embodiments is to make the understanding of the disclosure of the present application more thorough and comprehensive. Although the present application has been described in detail with reference to the aforementioned embodiments, for those skilled in the art, it is still possible to modify the technical solutions recorded in the aforementioned specific embodiments, or to make equivalent replacements for some of the technical features therein. Any equivalent structure made using the contents of the specification and drawings of this application, directly or indirectly used in other related technical fields, is also within the scope of patent protection of this application. The non-company software tools or components that appear in the embodiments of this application are merely examples and do not represent actual use.

Claims

1. A business risk detection method, characterized in that: The steps include: Get the latest business processing user's processing request message; Parsing the processing request message and identifying the processing device information corresponding to the latest service processing user sending the processing request message; Inputting the processing equipment information into a preset risk detection model and outputting a risk value of the processing equipment information; If the risk value does not exceed the preset risk threshold, the processing request message is sent to the target business processing terminal; If the risk value exceeds the preset risk threshold, the processing request message is intercepted and transferred to manual review.

2. The business risk detection method according to claim 1, characterized in that: Before executing the step of inputting the processing equipment information into a preset risk detection model and outputting the risk value of the processing equipment information, the method further includes: Screen out suspicious user groups based on preset group screening strategies; Obtaining the service processing device information of all users in the suspicious user group, wherein the service processing device information includes the device brand, device model, device IP location, and device User-Agent list information; performing clustering processing on the business processing device information; Based on the clustering results, the business processing device information of all users in the suspicious user group is normalized and formatted to obtain a device feature extraction data set; Inputting the device feature extraction data set into a preset feature extraction network to perform feature extraction to obtain risky device features corresponding to the suspicious user group; A risk detection model is constructed based on the risk device characteristics.

3. The business risk detection method according to claim 2, characterized in that: The step of screening out suspicious user groups according to the preset group screening strategy specifically includes: Batch obtain the processing request information of new business users; By parsing the processing request information, the business sharing code filled in by all new business processing users is obtained; Based on the service sharing code, all sharing amounts of the target user in a preset time period are identified, and the threshold for new service handling amount is set using the σ multiplication principle of the normal distribution; Using the service sharing code, user clustering is performed on new service users from the same sharing source to obtain user clustering results; Based on the user clustering results, the number of new users who have applied for services corresponding to different service sharing codes is counted; By comparison, it is determined whether the number of new users who have applied for the service corresponding to the current service sharing code exceeds the threshold value for the new service application volume; If the number of new users who have applied for the service corresponding to the current service sharing code exceeds the threshold value for the new service application volume, the user clustering result corresponding to the current service sharing code is marked as a suspicious user group; If the number of new users who have handled the business corresponding to the current business sharing code does not exceed the new business handling volume threshold, the user clustering result corresponding to the current business sharing code is marked as a trusted user group.

4. The business risk detection method according to claim 3, characterized in that: The step of identifying all sharing amounts of the target user in a preset time period based on the service sharing code and setting a threshold for new service handling amount using the σ multiplication principle of the normal distribution specifically includes: According to the service sharing code, all sharing amounts of the target user in a preset time period are counted, wherein the target user is the user who issued the service sharing code; If the σ multiplication principle is the 1 times σ principle, then according to the preset algorithm formula: Calculate the threshold value of the new business volume, where m represents the threshold value of the new business volume, n represents the total sharing volume, and 0.6826 represents the calculation constant corresponding to the 1 times σ principle. Indicates that the calculation result is rounded up, "·" represents the calculation result; If the σ multiplication principle is the 2 times σ principle, then according to the preset algorithm formula: Calculate the threshold value of the new business volume, where m represents the threshold value of the new business volume, n represents the total sharing volume, and 0.9544 represents the calculation constant corresponding to the 2 times σ principle. Indicates that the calculation result is rounded up, "·" represents the calculation result; If the σ multiplication principle is the 3 times σ principle, then according to the preset algorithm formula: Calculate the threshold value of the new business volume, where m represents the threshold value of the new business volume, n represents the total shared volume, and 0.9974 represents the calculation constant corresponding to the 3 times σ principle. Indicates that the calculation result is rounded up, and "·" represents the calculation result.

5. The business risk detection method according to claim 3, characterized in that: After executing the step of marking the user clustering result corresponding to the current service sharing code as a suspicious user group, the method further includes: Add the current service sharing code to the preset sharing code blacklist; Marking the user who sent the current service sharing code as a risky user; Performing manual review on the risky user and obtaining a manual review result; If the manual review result is a failure, the risky user will be added to the preset user blacklist; If the manual review result is passed, the sharing user is updated and marked as a normal user, and a new business sharing code is generated for the sharing user.

6. The business risk detection method according to claim 2, characterized in that: The step of inputting the device feature extraction data set into a preset feature extraction network to perform feature extraction to obtain risky device features corresponding to the suspicious user group specifically includes: Deploying a preset unsupervised clustering algorithm as a feature extraction algorithm into the feature extraction network, wherein the unsupervised clustering algorithm includes a DBSCAN algorithm; clustering all data entries in the device feature extraction dataset using a feature extraction algorithm in the feature extraction network; According to the clustering results and the number of data entries contained in each cluster, setting the risk device features contained in the device feature extraction data set and the risk weight corresponding to each risk device feature; The step of constructing a risk detection model based on the risk device characteristics specifically includes: Integrating the risky device features contained in the device feature extraction data set into a preset neural network as risk detection nodes; According to the risk weight corresponding to each risk device feature, the risk weight of each risk detection node in the neural network is set to obtain the risk detection model.

7. The business risk detection method according to any one of claims 1 or 2, characterized in that: Before executing the step of inputting the processing equipment information into a preset risk detection model and outputting the risk value of the processing equipment information, the method further includes: Performing format standardization processing on the business processing device information to obtain device feature extraction data; The step of inputting the processing equipment information into a preset risk detection model and outputting the risk value of the processing equipment information specifically includes: Inputting the device feature extraction data into the preset risk detection model; The risk detection nodes hit by the device feature extraction data and the risk weights corresponding to each risk detection node are accumulated and summed to obtain the risk value.

8. A business risk detection device, characterized in that: The business risk detection device is used to implement the steps of the business risk detection method according to any one of claims 1 to 7, and the business risk detection device includes: The processing request message acquisition module is used to obtain the processing request message of the latest business processing user; A processing device information identification module is used to parse the processing request message and identify the processing device information corresponding to the processing request message sent by the latest service processing user; a risk detection model detection module, configured to input the processing equipment information into a preset risk detection model and output a risk value of the processing equipment information; A first branch processing module is configured to send the processing request message to a target business processing terminal if the risk value does not exceed a preset risk threshold; The second branch processing module is used to intercept the processing request message and transfer it to manual review processing if the risk value exceeds a preset risk threshold.

9. A computer device, characterized in that: The method comprises a memory and a processor, wherein the memory stores computer-readable instructions, and the processor implements the steps of the business risk detection method according to any one of claims 1 to 7 when executing the computer-readable instructions.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer-readable instructions, which, when executed by a processor, implement the steps of the business risk detection method according to any one of claims 1 to 7.

Images