Parameter updating method and device of suspicious transaction monitoring model, equipment, medium and product

Abstract

The invention discloses a parameter updating method and device for a suspicious transaction monitoring model, equipment, a medium and a product. The method can be applied to the technical field of artificial intelligence, and comprises the following steps: obtaining model input data and model to-be-adjusted parameters of a to-be-updated suspicious transaction monitoring model; according to the model index rule of the suspicious transaction monitoring model to be updated, constructing an initial parameter updating model; the model index rule comprises to-be-adjusted parameters of the model; if the to-be-adjusted parameters of the model are easy-to-separate parameters, performing model training on the initial parameter updating model by adopting model input data to obtain a target parameter updating model; and updating model parameters of the model by adopting the target parameter updating model, and updating model to-be-adjusted parameters of the to-be-updated suspicious transaction monitoring model. According to the technical scheme, the model parameters of the suspicious transaction monitoring model are automatically updated or adjusted, the updating or adjusting efficiency of the model parameters is improved, and then the hit efficiency and precision of the suspicious transaction monitoring model are improved.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence technology, and in particular to a method, apparatus, device, medium and product for updating parameters of a suspicious transaction monitoring model. Background Technology

[0002] With the increasing volume of financial transactions within banks, the daily transaction volume is constantly rising, making the accurate identification of suspicious transactions an indispensable technical means for financial institutions. Traditionally, suspicious transactions are mainly identified by expert rule engines or models. These expert rule engines or models are primarily built on a "three-dimensional model," namely, case featureization, feature indexization, and index modeling. Through a three-layer structure of indicators, rules, and models, complex and diverse transactional characteristics are organized to form an expert rule engine or model with easily adjustable parameters.

[0003] In conclusion, adjusting the model parameters of the expert rule model is crucial, as it affects the accuracy of identifying suspicious transactions in different scenarios. Therefore, how to accurately adjust or update the model parameters of the expert rule model, i.e., the suspicious transaction monitoring model, to improve the accuracy and efficiency of the suspicious transaction monitoring model, has become an urgent problem to be solved. Summary of the Invention

[0004] This invention provides a method, apparatus, device, medium, and product for updating parameters of a suspicious transaction monitoring model, so as to realize the automatic updating or adjustment of model parameters of the suspicious transaction monitoring model, improve the efficiency of updating or adjusting model parameters, and thus improve the hit efficiency and accuracy of the suspicious transaction monitoring model.

[0005] According to one aspect of the present invention, a method for updating parameters of a suspicious transaction monitoring model is provided, the method comprising:

[0006] Obtain the model input data and model parameters to be adjusted for the suspicious transaction monitoring model to be updated;

[0007] Based on the model indicator rules of the suspicious transaction monitoring model to be updated, an initial parameter update model is constructed; the model indicator rules include the model parameters to be adjusted.

[0008] If the parameters to be adjusted in the model are easily separable parameters, then the model input data is used to train the initial parameter update model to obtain the target parameter update model;

[0009] The model parameters of the model are updated using the target parameters, and the model parameters to be adjusted of the suspicious transaction monitoring model to be updated are also updated.

[0010] According to another aspect of the present invention, a parameter updating device for a suspicious transaction monitoring model is provided, the device comprising:

[0011] The parameter acquisition module is used to acquire the model input data and the model parameters to be adjusted of the suspicious transaction monitoring model to be updated.

[0012] The initial model building module is used to build an initial parameter update model based on the model indicator rules of the suspicious transaction monitoring model to be updated; the model indicator rules include the model parameters to be adjusted.

[0013] The target model training module is used to train the initial parameter update model using the model input data if the parameters to be adjusted in the model are easily separable parameters, so as to obtain the target parameter update model.

[0014] The parameter update module is used to update the model parameters of the model using the target parameters, and to update the model parameters to be adjusted of the suspicious transaction monitoring model to be updated.

[0015] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0016] At least one processor; and

[0017] A memory communicatively connected to the at least one processor; wherein,

[0018] The memory stores a computer program that can be executed by the at least one processor, which enables the at least one processor to perform the parameter update method of the suspicious transaction monitoring model according to any embodiment of the present invention.

[0019] According to another aspect of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium storing computer instructions for causing a processor to execute and implement the parameter update method of the suspicious transaction monitoring model according to any embodiment of the present invention.

[0020] According to another aspect of the present invention, a computer program product is provided, comprising a computer program that, when executed by a processor, implements the parameter update method of the suspicious transaction monitoring model described in any embodiment of the present invention.

[0021] This invention's technical solution constructs an initial parameter update model based on the model indicator rules of the suspicious transaction monitoring model to be updated. If the parameters to be adjusted in the model are easily separable, the initial parameter update model is trained using the model input data to obtain a target parameter update model. The model parameters of the target parameter update model are then used to update the parameters to be adjusted in the suspicious transaction monitoring model to be updated. This technical solution achieves automatic updating or adjustment of the model parameters of the suspicious transaction monitoring model by using the trained model parameters to update the model parameters of the suspicious transaction monitoring model. During training, the parameter types of the parameters to be adjusted and the corresponding model indicator rules of the suspicious transaction monitoring model to be updated are comprehensively considered, improving the model training accuracy of the target parameter update model, thereby improving the accuracy of adjusting the model parameters of the suspicious transaction monitoring model, and ultimately improving the hit efficiency and accuracy of the suspicious transaction monitoring model. This solves the drawback of traditional model tuning processes heavily relying on expert experience, saves human resources, and improves the efficiency of updating or adjusting model parameters.

[0022] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0023] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0024] Figure 1 This is a flowchart of a parameter update method for a suspicious transaction monitoring model provided in Embodiment 1 of the present invention;

[0025] Figure 2 This is a flowchart of a parameter update method for a suspicious transaction monitoring model according to Embodiment 2 of the present invention;

[0026] Figure 3 This is a flowchart of a parameter update method for a suspicious transaction monitoring model provided in Embodiment 3 of the present invention;

[0027] Figure 4 This is a schematic diagram of the structure of a parameter update device for a suspicious transaction monitoring model according to Embodiment 4 of the present invention;

[0028] Figure 5This is a schematic diagram of the structure of an electronic device that implements the parameter update method of the suspicious transaction monitoring model according to an embodiment of the present invention. Detailed Implementation

[0029] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0030] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0031] Example 1

[0032] Figure 1 This is a flowchart of a parameter update method for a suspicious transaction monitoring model provided in Embodiment 1 of the present invention. This embodiment is applicable to situations where the model parameters of expert models for suspicious transaction monitoring in different financial scenarios need to be accurately updated or adjusted. This method can be executed by a parameter update device for the suspicious transaction monitoring model, which can be implemented in hardware and / or software and can be configured in an electronic device. Figure 1 As shown, the method includes:

[0033] S110. Obtain the model input data and model parameters to be adjusted for the suspicious transaction monitoring model to be updated.

[0034] S120. Construct an initial parameter update model based on the model indicator rules of the suspicious transaction monitoring model to be updated; the model indicator rules include the model parameters to be adjusted.

[0035] S130. If the parameters to be adjusted in the model are easily separable parameters, then the model input data is used to train the initial parameter update model to obtain the target parameter update model.

[0036] S140. Update the model parameters of the model using the target parameters, and update the model parameters to be adjusted of the suspicious transaction monitoring model to be updated.

[0037] Among them, the suspicious transaction monitoring model to be updated can be an expert rule engine or expert rule model whose parameters need to be adjusted. The expert rule model differs for different financial transaction scenarios. In the case of identifying suspicious transactions using existing expert rule models, the model parameters of the expert rule model need to be set by experts regularly, which consumes a lot of human resources. At the same time, the model parameter update efficiency is low, and the accuracy of manually adjusted model parameters is not high due to human or environmental factors.

[0038] The expert rule model is constructed from suspicious characteristics in corresponding financial transaction scenarios, such as a large cash transaction volume for a user in a certain transaction scenario. Suspicious characteristics can be expressed using indicators, and the rules in the expert rule model consist of several indicators. For example, for the suspicious characteristic "large cash transaction volume for a user," the corresponding indicator is expressed as "the total amount of cash transactions by the user within DAY is greater than or equal to AMT and the number of transactions is greater than or equal to CNT." In this suspicious characteristic, "DAY," "AMT," and "CNT" are the parameters to be adjusted in the model. These parameters to be adjusted are the parameters in the suspicious transaction monitoring model that need to be updated in real time or periodically; specifically, they can be a parameter threshold, etc.

[0039] The model input data consists of the data required for the model to predict suspicious transactions, such as the amount of user transactions. Continuing the example above, in the indicator "Total cash transaction amount of users within DAY is greater than or equal to AMT and the number of transactions is greater than or equal to CNT", the model input data is the total cash transaction amount and the number of transactions.

[0040] The model indicator rules consist of several indicators, and the suspicious transaction monitoring model to be updated can be composed of several model indicator rules. For example, the mathematical expression of the indicator "Total cash transaction amount of users within DAY is greater than or equal to AMT and the number of transactions is greater than or equal to CNT" is as follows:

[0041] Y = H(X1-AMT) * H(X2-CNT);

[0042] Where X1 represents the total amount of cash transactions by the user; X2 represents the number of cash transactions by the user; AMT is the set threshold for transaction amount; CNT is the set threshold for number of transactions; AMT and CNY are parameters to be adjusted in the model; H(x) is defined as taking the value 1 when x is greater than or equal to 0, and taking the value 0 when x is less than 0. In actual business, expert rules predict a user as suspicious, but after business verification, the user may not actually be a suspicious user, i.e., a false positive; expert rules predict a non-suspicious user, but after business verification, the user may be a suspicious user, i.e., a false negative. The optimization direction for the parameters of the suspicious transaction monitoring model to be updated is to reduce the total false positive rate and false negative rate of the expert rule model.

[0043] For example, a model indicator rule can consist of several indicators, arranged in a specific manner, depending on the specific application scenario of the suspicious transaction monitoring model to be updated. For instance, the mathematical expression of model indicator rule M can be as follows:

[0044] M = Y1 * Y2 + Y3 * Y4;

[0045] Among them, Y1, Y2, Y3 and Y4 are the mathematical expressions of four different indicators; the actual meaning of this rule is that if indicator 1 (Y1) and indicator 2 (Y2) are hit at the same time, or if indicator 3 (Y3) and indicator 4 (Y4) are hit at the same time, then the indicator rule M of the model is considered to be hit.

[0046] The initial parameter update model can be an existing neural network model or machine learning model used for binary classification; for example, the initial reference update model can be a logistic regression model. Based on the model indicator rules of the suspicious transaction monitoring model to be updated, the objective function of the initial parameter update model is constructed. This objective function consists of the mathematical expression of several model indicator rules, representing the probability that the expert rule model predicts the suspicious nature of customer transaction behavior.

[0047] For example, if the model's indicator rules have exactly one indicator: "The total amount of cash transactions by users within a day is greater than or equal to AMT and the number of transactions is greater than or equal to CNT", then the mathematical expression of the corresponding objective function is as follows:

[0048]

[0049] Here, σ(·) is the Sigmoid activation function. The activation function can convert the differences between X1 and AMT, and X2 and CNT, into the range (0, 1), thus solving the gradient problem that the H(x) step function cannot calculate during model training.

[0050] It should be noted that the parameters to be adjusted in the model include two types: easily separable parameters and difficult-to-separate parameters. In the aforementioned indicator "total cash transaction amount of users within a day is greater than or equal to AMT and the number of transactions is greater than or equal to CNT," AMT and CNT are separable parameters to be adjusted, meaning they are weakly correlated and can be trained and optimized independently in the model. For difficult-to-separate parameters, taking frequent daily transfers by individual users as an example, the indicator is described as "users make CNT number of transfers on a certain day with a single transaction amount greater than or equal to AMT." In this indicator, AMT and CNT are strongly correlated. During the modeling process, if CNT or AMT is not treated as a constant, it is impossible to statistically determine the CNT or AMT that meets the conditions, making accurate modeling and parameter optimization impossible.

[0051] If the parameters to be adjusted in the model are easily separable, the model input data can be directly used to train the initial parameter update model, thus obtaining the target parameter update model. The model input data can be obtained by filtering historical transaction data predicted by the suspicious transaction monitoring model over a historical time period. In other words, the model input data is used as sample data for training the initial parameter update model, resulting in the trained target parameter model.

[0052] The model parameters of the model are updated using the target parameters that have been trained, such as CNT and AMT in the example above. The model parameters CNT and AMT of the suspicious transaction monitoring model to be updated are also updated.

[0053] This invention's technical solution constructs an initial parameter update model based on the model indicator rules of the suspicious transaction monitoring model to be updated. If the parameters to be adjusted in the model are easily separable, the initial parameter update model is trained using the model input data to obtain a target parameter update model. The model parameters of the target parameter update model are then used to update the parameters to be adjusted in the suspicious transaction monitoring model to be updated. This technical solution achieves automatic updating or adjustment of the model parameters of the suspicious transaction monitoring model by using the trained model parameters to update the model parameters of the suspicious transaction monitoring model. During training, the parameter types of the parameters to be adjusted and the corresponding model indicator rules of the suspicious transaction monitoring model to be updated are comprehensively considered, improving the model training accuracy of the target parameter update model, thereby improving the accuracy of adjusting the model parameters of the suspicious transaction monitoring model, and ultimately improving the hit efficiency and accuracy of the suspicious transaction monitoring model. This solves the drawback of traditional model tuning processes heavily relying on expert experience, saves human resources, and improves the efficiency of updating or adjusting model parameters.

[0054] Example 2

[0055] Figure 2This is a flowchart of a parameter update method for a suspicious transaction monitoring model provided in Embodiment 2 of the present invention. This embodiment is an optimization and improvement based on the above technical solutions.

[0056] Furthermore, the step "using model input data to train the initial parameter update model and obtain the target parameter update model" is refined to "generating model training samples based on model input data and labeling the model training samples to obtain the actual transaction types of the model training samples; inputting the model training samples and their corresponding actual transaction types into the initial parameter update model to obtain the predicted transaction types output by the model; training the initial parameter update model based on the actual transaction types and predicted transaction types of the model training samples to obtain the target parameter update model." This improves the model training method for the initial parameter update model.

[0057] It should be noted that for parts not described in detail in the embodiments of the present invention, please refer to the descriptions in other embodiments. For example... Figure 2 As shown, the method includes the following specific steps:

[0058] S210. Obtain the model input data and model parameters to be adjusted for the suspicious transaction monitoring model to be updated.

[0059] S220. Construct an initial parameter update model based on the model indicator rules of the suspicious transaction monitoring model to be updated; the model indicator rules include the model parameters to be adjusted.

[0060] S230. If the parameters to be adjusted in the model are easily separable parameters, then generate model training samples based on the model input data, and label the model training samples to obtain the actual transaction type of the model training samples.

[0061] S240. Input the model training samples and their corresponding actual transaction types into the initial parameter update model to obtain the predicted transaction types output by the model.

[0062] S250. Based on the actual transaction type and predicted transaction type of the model training samples, train the initial parameter update model to obtain the target parameter update model.

[0063] S260. Update the model parameters of the model using the target parameters, and update the model parameters to be adjusted of the suspicious transaction monitoring model to be updated.

[0064] The model training samples can be pre-generated by relevant technical personnel, specifically based on the model input data. The system can obtain the model input data for the suspicious transaction monitoring model to be updated over historical time periods, as well as the prediction results obtained by the model based on the input data. The prediction results can include whether a user is suspicious or not. For example, the model input data includes the total transaction amount and the number of transactions. The model input data will differ for different suspicious transaction monitoring models to be updated.

[0065] The model training samples have sample labels, which are the actual transaction types of the model training samples, such as user suspicious or user not suspicious.

[0066] It should be noted that, regarding the current suspicious transaction monitoring model's prediction of whether a user is suspicious or not, relevant business personnel will further evaluate the model's prediction results, resulting in four scenarios: data predicted as suspicious and actually suspicious; data predicted as suspicious and actually not suspicious; data predicted as not suspicious and actually suspicious; and data predicted as not suspicious and actually not suspicious. The actual transaction type of the model training samples can be the result of manual judgment by business personnel. That is, if the manual judgment result is that the user is suspicious, then the actual transaction type of the corresponding model training sample is suspicious; if the manual judgment result is that the user is not suspicious, then the actual transaction type of the corresponding model training sample is not suspicious.

[0067] Furthermore, to ensure a balance between positive and negative samples in the model training samples, so that the parameter prediction model can comprehensively learn the features of both types of samples during the model training process, thereby improving the model training accuracy.

[0068] In one optional embodiment, the model training samples include positive samples and negative samples; correspondingly, generating model training samples based on the model input data includes: obtaining historical prediction data obtained by the suspicious transaction monitoring model to be updated under historical time periods based on the model input data; the historical prediction data includes first prediction data, second prediction data, third prediction data, and fourth prediction data; the first prediction data is data whose prediction result is suspicious and whose actual result is suspicious; the second prediction data is data whose prediction result is suspicious and whose actual result is not suspicious; the third prediction data is data whose prediction result is not suspicious and whose actual result is suspicious; the fourth prediction data is data whose prediction result is not suspicious and whose actual result is not suspicious; and sampling the first prediction data, second prediction data, third prediction data, and fourth prediction data respectively based on the data volume of the first prediction data and the third prediction data to generate model training samples.

[0069] Taking any predicted data as an example, the predicted result is the result obtained by the suspicious transaction monitoring model to be updated based on the model input data, including whether the user is suspicious or not. The actual result is the result obtained by relevant business personnel through manual review of the model prediction result based on the model input data. It is generally considered that the result of the second review by business personnel is the accurate result. Therefore, the model input data corresponding to the first and third predicted data are used as negative samples, and the corresponding data labels are the labels of suspicious users.

[0070] Typically, whether a user is deemed suspicious by the model or by manual review by business personnel, the number of suspicious users is relatively small compared to the number of non-suspicious users, resulting in a significant difference between the number of positive and negative samples. Therefore, this embodiment employs stratified sampling to draw samples and balance the number of positive and negative samples.

[0071] Using the results of manual review as the standard, the first and third predicted data are considered negative samples, while the second and fourth predicted data are considered positive samples. Since the first predicted data is the data that both the model and the human reviewer predict is suspicious, based on the amount of data in the first predicted data, if the amount of data in the first predicted data is less than a preset sample data size threshold, then a sample equal to the difference between the amount of data in the first predicted data and the sample data size threshold is extracted from the third predicted data to obtain the third extracted data. The sum of the first predicted data and the third extracted data is then used as the negative sample data.

[0072] Since the fourth prediction data is data that both the model and the human team predict the user to be without suspicion, positive samples equal to the number of negative samples are extracted from the fourth prediction data first. If the amount of data in the fourth prediction data is insufficient, it is supplemented from the second prediction data.

[0073] If the amount of data in the first prediction data is not less than a preset sample data size threshold, then an amount of data equal to the sample data size threshold is extracted from the first prediction data as negative sample data. An amount of positive samples equal to the number of negative samples is extracted from the fourth prediction data. If the amount of data in the fourth prediction data is insufficient, it is supplemented from the second prediction data.

[0074] The above technical solution employs stratified sampling to extract positive and negative samples from four different types of historical prediction data, thereby balancing the number of positive and negative samples in the sample dataset, ensuring the comprehensiveness of feature learning during model training, and thus improving the model training accuracy for updating target parameters, which in turn improves the accuracy of parameter updates for the suspicious transaction monitoring model.

[0075] Based on the model indicator rules for constructing the suspicious transaction monitoring model to be updated, the objective function of the initial parameter update model is determined. This objective function consists of several rules, and each rule consists of several indicators. When the indicator parameters are easily separable, the objective function of the initial parameter update model can be accurately constructed. Different suspicious transaction monitoring models have different specific financial transaction application scenarios, rules, and indicators, resulting in different constructed objective functions. For example, a general expression for the initial parameter update model can be as follows:

[0076]

[0077] in, There are 1 to N rules; score1, score2, ..., score n Here are the scores for each of the 1 to N rules; SCORE is the score threshold; the hyperparameters in this model include score1, score2, ..., score n The hyperparameters are the parameters included in the SCORE and the metrics of 1 to N rules. The model hyperparameters are the parameters that are continuously optimized during training.

[0078] For example, if the rule The rule includes four indicators: Index1, Index2, Index3, and Index4. The relationship between the four indicators is expressed as (index1 & index2) | (index3 & index4). That is, if indicator 1 and indicator 2 are both hit, or if indicator 3 and indicator 4 are both hit, then the rule is considered to be true. If it hits, then The relationship is expressed as: Taking Index1 as "the total amount of cash transactions by users within a day is greater than or equal to AMT and the number of transactions is greater than or equal to CNT" as an example, then Index1 = σ(X1-AMT)*σ(X2-CNT). Where X1 and X2 are the model input data; AMT and CNT are the model hyperparameters, that is, the parameters to be adjusted in the model.

[0079] The model training samples and their corresponding actual transaction types are input into the initial parameter update model to obtain the predicted transaction type output by the model. Based on the actual transaction types and predicted transaction types of the model training samples, the initial parameter update model is trained to obtain the target parameter update model. It should be noted that, since in risk-based suspicious transaction operations, false negatives have more serious consequences than false positives, a penalty factor is added to the false negative rate in the loss function during model training, so that false negative cases greatly affect the value of the loss function.

[0080] In one optional embodiment, the initial parameter update model is trained according to the actual transaction type and predicted transaction type of the model training samples to obtain the target parameter update model. This includes: determining the current loss value based on the actual transaction type and predicted transaction type of the model training samples and a preset loss function; the loss function includes a target weight parameter; the target weight parameter is determined based on the number of positive and negative samples in the model training samples; and training the initial parameter update model according to the current loss value until a preset model training termination condition is met to obtain the target parameter update model.

[0081] In this approach, a penalty factor is added to the false negative rate in the loss function, causing false negatives to significantly impact the calculation results. An example loss function is constructed as follows:

[0082]

[0083] ω=ω pos if y = 1

[0084] ω=ω neg if y = 0

[0085] Where ω=ω pos Much greater than ω neg ω pos and ω neg satisfy Where, N pos N is the number of positive samples; neg is the number of negative samples; N is the total number of samples.

[0086] For example, the model training sample M includes 100 training samples, of which 90 are negative samples and 10 are positive samples. Based on the above calculation formula, ω can be obtained. pos Equals 5; ω neg It equals 0.56.

[0087] Based on the aforementioned loss function, the current loss value is determined. Then, based on the current loss value, the initial parameter update model is trained until a preset model training termination condition is met, resulting in the target parameter update model. The model training termination condition can be that the current loss value is greater than a set loss threshold, the current loss value tends to stabilize, or the current iteration count reaches a set iteration count threshold, etc. This embodiment does not impose any restrictions on these conditions.

[0088] The above technical solution adds a penalty factor to the false negative rate in the constructed loss function, which makes the false negative cases greatly affect the value of the loss function. This improves the accuracy of calculating the current loss value during model iteration, thereby improving the accuracy of model training for updating the initial parameters, resulting in a more accurate target parameter update model, and thus improving the accuracy of adjusting or updating the model parameters.

[0089] This embodiment's technical solution generates model training samples based on model input data and labels these samples to obtain the actual transaction types. The model training samples and their corresponding actual transaction types are then input into the initial parameter update model to obtain the predicted transaction types output by the model. Based on the actual and predicted transaction types of the model training samples, the initial parameter update model is trained to obtain the target parameter update model. This achieves automated training of the target parameter update model when the parameters to be adjusted are easily separable. No parameter separation and adjustment are required during training, improving the model training efficiency of the target parameter update model. Furthermore, by incorporating actual transaction types, the model continuously optimizes hyperparameters, improving the accuracy of updating or adjusting the parameters to be adjusted.

[0090] Example 3

[0091] Figure 3 This is a flowchart of a parameter update method for a suspicious transaction monitoring model provided in Embodiment 3 of the present invention. This embodiment is an optimization and improvement based on the above technical solutions.

[0092] Furthermore, after the step "Construct an initial parameter update model according to the model indicator rules of the suspicious transaction monitoring model to be updated", the following step is added: "If the model parameter to be adjusted is a parameter that is not easily separable, then determine the target splitting parameter among the model parameters to be adjusted; fix the target splitting parameter in the initial parameter update model according to at least one preset parameter fixed value to obtain at least one candidate parameter update model; use the model input data to train each candidate parameter update model to obtain the first parameter update model after the training of each candidate parameter update model; update the model parameter to be adjusted of the suspicious transaction monitoring model to be updated based on the model parameters of each first parameter update model." This improves the method of updating or adjusting the model parameter to be adjusted when the model parameter to be adjusted is a parameter that is not easily separable.

[0093] It should be noted that for parts not described in detail in the embodiments of the present invention, please refer to the descriptions in other embodiments. For example... Figure 3 As shown, the method includes the following specific steps:

[0094] S310. Obtain the model input data and model parameters to be adjusted for the suspicious transaction monitoring model to be updated.

[0095] S320. Based on the model indicator rules of the suspicious transaction monitoring model to be updated, construct the initial parameter update model; the model indicator rules include the model parameters to be adjusted; if the model parameters to be adjusted are easily separable parameters, then execute S330-S340; if the model parameters to be adjusted are not easily separable parameters, then execute S350-S380.

[0096] S330. Using the model input data, train the initial parameter update model to obtain the target parameter update model.

[0097] S340. Update the model parameters of the model using the target parameters, and update the model parameters to be adjusted of the suspicious transaction monitoring model to be updated.

[0098] S350. Determine the target splitting parameter in the model's parameters to be adjusted.

[0099] S360. Based on at least one preset parameter fixed value, fix the target splitting parameter in the initial parameter update model to obtain at least one candidate parameter update model.

[0100] S370. Using the model input data, train the model for each candidate parameter update model to obtain the first parameter update model after the candidate parameter update model has been trained.

[0101] S380. Update the model parameters of the model based on each first parameter, and update the model parameters to be adjusted of the suspicious transaction monitoring model to be updated.

[0102] For parameters that are difficult to separate, taking frequent daily transfers by individual users as an example, the indicator is described as "the number of transfers by a user on a certain day that are CNT in number and the amount of a single transaction is greater than or equal to AMT yuan". In this indicator, there is a strong correlation between AMT and CNT. In the modeling process, if CNT or AMT is not treated as a constant, it is impossible to count the CNT or AMT that meet the conditions, and it is impossible to accurately model and optimize the parameters.

[0103] In the above example, CNT and AMT are parameters that are not easily separated. In this case, either CNT or AMT is regarded as a fixed parameter, that is, as the target splitting parameter, and a fixed value is set for it. This fixed value is preset by relevant technical personnel according to actual needs.

[0104] For example, regarding AMT, at least one parameter can be fixed as an array, such as AMT = [100,000 yuan, 200,000 yuan, 300,000 yuan, 400,000 yuan]. Taking 100,000 yuan as an example, AMT is fixed at 100,000 yuan, while the other trainable model parameters remain unchanged, resulting in a candidate parameter update model with an AMT value of 100,000 yuan. Using the same model input data, this candidate parameter update model is trained until the training termination condition is met, resulting in the first parameter update model after the candidate parameter update model has completed training, i.e., the first parameter update model with AMT fixed at 100,000 yuan.

[0105] It should be noted that, apart from fixing the AMT parameters, the other training processes are consistent with the model training process under the condition of easily separable parameters described above, and will not be repeated in this embodiment. Similarly, the first parameter update model with a fixed AMT of 200,000 yuan, the first parameter update model with a fixed AMT of 300,000 yuan, and the first parameter update model with a fixed AMT of 400,000 yuan can be trained.

[0106] Assume that Model A is the first parameter update model with a fixed AMT of 100,000 yuan, Model B is the first parameter update model with a fixed AMT of 200,000 yuan, Model C is the first parameter update model with a fixed AMT of 300,000 yuan, and Model D is the first parameter update model with a fixed AMT of 400,000 yuan. Models A, B, C, and D are validated using a pre-constructed sample test dataset, and the parameters to be adjusted in each model are updated based on the validation results.

[0107] In one optional embodiment, updating the model adjustment parameters of the suspicious transaction monitoring model to be updated based on the model parameters of each first parameter update model includes: performing model evaluation on each first parameter update model to obtain the model evaluation results of each first parameter update model; selecting a second parameter update model from each first parameter update model according to the model evaluation results; and updating the model adjustment parameters of the suspicious transaction monitoring model to be updated using the model parameters of the second parameter update model and the fixed values ​​of the target splitting parameters corresponding to the second parameter update model.

[0108] The model evaluation method for updating the first parameter can be based on several preset evaluation indicators. For example, the evaluation indicators can be precision, recall, and F1 score.

[0109] Each first-parameter update model is evaluated to obtain its evaluation results. Based on these results, the model with the best performance across all evaluation metrics is selected as the second-parameter update model. For example, continuing with models A, B, C, and D from the previous example, the model with the best performance in terms of accuracy, recall, and F1 score (e.g., higher accuracy, recall, and F1 score) is selected as the second-parameter update model.

[0110] The second parameter update model's model parameters, along with the fixed values ​​of the target splitting parameters corresponding to the second parameter update model, are used to update the model parameters to be adjusted in the suspicious transaction monitoring model to be updated. For example, continuing the previous example, if the selected second parameter update model is model C, then the fixed value of its corresponding target splitting parameter AMT is 300,000 yuan.

[0111] The above technical solution evaluates each first parameter update model to obtain the model evaluation results of each first parameter update model. Based on the model evaluation results, a second parameter update model is selected from each first parameter update model. The model parameters of the second parameter update model and the fixed values ​​of the target splitting parameters corresponding to the second parameter update model are used to update the model adjustment parameters of the suspicious transaction monitoring model to be updated. The second parameter update model used to update the model adjustment parameters is selected through the model evaluation results, thereby improving the model selection accuracy of the second parameter update model.

[0112] This embodiment enables the adjustment or updating of model parameters in scenarios where parameters are difficult to separate. By treating some parameters as hyperparameters and fixing the values ​​of others, the grid search method and the effective results of the model training process are used to train the first parameter update model for each cycle of fixed parameter values ​​set by the grid search method. The second parameter update model is then selected based on model evaluation metrics, such as the F1 score. This achieves accurate updating of model parameters in scenarios where parameters are difficult to separate. The grid search method improves parameter retrieval efficiency, further enhancing the efficiency of selecting the second parameter update model.

[0113] The information collected in this embodiment of the invention, such as user transaction information, is information and data authorized by the user or fully authorized by all parties. The collection, storage, use, processing, transmission, provision, disclosure and application of related data all comply with the relevant laws, regulations and standards of the relevant countries and regions, necessary confidentiality measures have been taken, and public order and good morals are not violated. Corresponding operation entry points are provided for users to choose to authorize or refuse.

[0114] Example 4

[0115] Figure 4 This is a schematic diagram of a parameter update device for a suspicious transaction monitoring model provided in Embodiment 4 of the present invention. The parameter update device for a suspicious transaction monitoring model provided in this embodiment of the present invention is applicable to situations where the model parameters of an expert model for suspicious transaction monitoring in different financial scenarios need to be accurately updated or adjusted. This parameter update device for the suspicious transaction monitoring model can be implemented in hardware and / or software, such as... Figure 4 As shown, the device includes: a parameter acquisition module 401, an initial model construction module 402, a target model training module 403, and a parameter update module 404. Among them,

[0116] The parameter acquisition module 401 is used to acquire the model input data and model parameters to be adjusted of the suspicious transaction monitoring model to be updated.

[0117] The initial model building module 402 is used to build an initial parameter update model according to the model indicator rules of the suspicious transaction monitoring model to be updated; the model indicator rules include the model parameters to be adjusted.

[0118] The target model training module 403 is used to train the initial parameter update model using the model input data if the parameters to be adjusted in the model are easily separable parameters, so as to obtain the target parameter update model.

[0119] The parameter update module 404 is used to update the model parameters of the model using the target parameters, and to update the model parameters to be adjusted of the suspicious transaction monitoring model to be updated.

[0120] This invention's technical solution constructs an initial parameter update model based on the model indicator rules of the suspicious transaction monitoring model to be updated. If the parameters to be adjusted in the model are easily separable, the initial parameter update model is trained using the model input data to obtain a target parameter update model. The model parameters of the target parameter update model are then used to update the parameters to be adjusted in the suspicious transaction monitoring model to be updated. This technical solution achieves automatic updating or adjustment of the model parameters of the suspicious transaction monitoring model by using the trained model parameters to update the model parameters of the suspicious transaction monitoring model. During training, the parameter types of the parameters to be adjusted and the corresponding model indicator rules of the suspicious transaction monitoring model to be updated are comprehensively considered, improving the model training accuracy of the target parameter update model, thereby improving the accuracy of adjusting the model parameters of the suspicious transaction monitoring model, and ultimately improving the hit efficiency and accuracy of the suspicious transaction monitoring model. This solves the drawback of traditional model tuning processes heavily relying on expert experience, saves human resources, and improves the efficiency of updating or adjusting model parameters.

[0121] Optionally, the target model training module 403 includes:

[0122] The labeling unit is used to generate model training samples based on the model input data, and to label the model training samples to obtain the actual transaction type of the model training samples;

[0123] The model prediction unit is used to input the model training samples and their corresponding actual transaction types into the initial parameter update model to obtain the predicted transaction types output by the model.

[0124] The model training unit is used to train the initial parameter update model based on the actual transaction type and the predicted transaction type of the model training samples, so as to obtain the target parameter update model.

[0125] Optional, model training unit, specifically used for:

[0126] Based on the actual transaction type and the predicted transaction type of the model training samples, the current loss value is determined according to a preset loss function; the loss function includes a target weight parameter; the target weight parameter is determined based on the number of positive and negative samples in the model training samples.

[0127] Based on the current loss value, the initial parameter update model is trained until the preset model training termination condition is met, and the target parameter update model is obtained.

[0128] Optionally, the device further includes:

[0129] The splitting parameter determination module is used to determine the target splitting parameter among the model's parameters to be adjusted if the parameters to be adjusted in the model are difficult to separate.

[0130] The parameter fixing module is used to fix the target splitting parameters in the initial parameter update model according to at least one preset parameter fixing value, so as to obtain at least one candidate parameter update model.

[0131] The first model training module is used to train each of the candidate parameter update models using the model input data, so as to obtain the first parameter update model after the training of each of the candidate parameter update models.

[0132] The model parameter adjustment module is used to update the model parameters of the model based on each of the first parameters, and to update the model parameters to be adjusted of the suspicious transaction monitoring model to be updated.

[0133] Optional, the model parameter adjustment module is specifically used for:

[0134] The model evaluation is performed on each of the first parameter update models to obtain the model evaluation results of each of the first parameter update models;

[0135] Based on the evaluation results of each model, a second parameter update model is selected from each of the first parameter update models;

[0136] The model parameters of the updated model are updated using the second parameter, and the fixed value of the target splitting parameter corresponding to the updated model is used to update the model parameters to be adjusted of the suspicious transaction monitoring model.

[0137] Optionally, the model training samples include positive samples and negative samples; correspondingly, the label annotation unit is specifically used for:

[0138] Based on the input data of the model, obtain the historical prediction data obtained by the suspicious transaction monitoring model to be updated under the historical time period;

[0139] The historical prediction data includes first prediction data, second prediction data, third prediction data, and fourth prediction data; the first prediction data is data whose prediction result is suspicious and whose actual result is suspicious; the second prediction data is data whose prediction result is suspicious and whose actual result is not suspicious; the third prediction data is data whose prediction result is not suspicious and whose actual result is suspicious; the fourth prediction data is data whose prediction result is not suspicious and whose actual result is not suspicious.

[0140] Based on the amount of data in the first and third prediction data, data sampling is performed on the first, second, third, and fourth prediction data respectively to generate model training samples.

[0141] The parameter update device for the suspicious transaction monitoring model provided in this embodiment of the invention can execute the parameter update method for the suspicious transaction monitoring model provided in any embodiment of the invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0142] Example 5

[0143] Figure 5A schematic diagram of an electronic device 50 that can be used to implement embodiments of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0144] like Figure 5 As shown, the electronic device 50 includes at least one processor 51 and a memory, such as a read-only memory (ROM) 52 and a random access memory (RAM) 53, communicatively connected to the at least one processor 51. The memory stores computer programs executable by the at least one processor. The processor 51 can perform various appropriate actions and processes based on the computer program stored in the ROM 52 or loaded into the RAM 53 from storage unit 58. The RAM 53 can also store various programs and data required for the operation of the electronic device 50. The processor 51, ROM 52, and RAM 53 are interconnected via a bus 54. An input / output (I / O) interface 55 is also connected to the bus 54.

[0145] Multiple components in electronic device 50 are connected to I / O interface 55, including: input unit 56, such as keyboard, mouse, etc.; output unit 57, such as various types of monitors, speakers, etc.; storage unit 58, such as disk, optical disk, etc.; and communication unit 59, such as network card, modem, wireless transceiver, etc. Communication unit 59 allows electronic device 50 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0146] Processor 51 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 51 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 51 performs the various methods and processes described above, such as the parameter update method for a suspicious transaction monitoring model.

[0147] In some embodiments, the parameter update method for the suspicious transaction monitoring model can be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 58. In some embodiments, part or all of the computer program can be loaded and / or installed on electronic device 50 via ROM 52 and / or communication unit 59. When the computer program is loaded into RAM 53 and executed by processor 51, one or more steps of the parameter update method for the suspicious transaction monitoring model described above can be performed. Alternatively, in other embodiments, processor 51 can be configured to perform the parameter update method for the suspicious transaction monitoring model by any other suitable means (e.g., by means of firmware).

[0148] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0149] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0150] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0151] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0152] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0153] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0154] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0155] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A parameter update method for a suspicious transaction monitoring model, characterized in that, include: Obtain the model input data and model parameters to be adjusted for the suspicious transaction monitoring model to be updated; Based on the model indicator rules of the suspicious transaction monitoring model to be updated, an initial parameter update model is constructed; the model indicator rules include the model parameters to be adjusted. If the parameters to be adjusted in the model are easily separable parameters, then the model input data is used to train the initial parameter update model to obtain the target parameter update model; The model parameters of the model are updated using the target parameters, and the model parameters to be adjusted of the suspicious transaction monitoring model to be updated are also updated.

2. The method according to claim 1, characterized in that, The step of using the model input data to train the initial parameter update model to obtain the target parameter update model includes: Based on the model input data, model training samples are generated, and the model training samples are labeled to obtain the actual transaction type of the model training samples. The model training samples and their corresponding actual transaction types are input into the initial parameter update model to obtain the predicted transaction type output by the model. Based on the actual transaction type of the model training samples and the predicted transaction type, the initial parameter update model is trained to obtain the target parameter update model.

3. The method according to claim 2, characterized in that, The step of training the initial parameter update model based on the actual transaction type and the predicted transaction type of the model training samples to obtain the target parameter update model includes: Based on the actual transaction type and the predicted transaction type of the model training samples, the current loss value is determined according to a preset loss function; the loss function includes a target weight parameter; the target weight parameter is determined based on the number of positive and negative samples in the model training samples. Based on the current loss value, the initial parameter update model is trained until the preset model training termination condition is met, and the target parameter update model is obtained.

4. The method according to claim 1, characterized in that, The method further includes: If the parameters to be adjusted in the model are difficult to separate, then the target splitting parameter among the parameters to be adjusted in the model is determined; Based on at least one preset parameter fixed value, the target splitting parameter in the initial parameter update model is fixed to obtain at least one candidate parameter update model; Using the input data of the model, each of the candidate parameter update models is trained to obtain the first parameter update model after the candidate parameter update model has been trained. Based on the model parameters of each of the first parameters, update the model parameters of the suspicious transaction monitoring model to be updated, and then update the model parameters to be adjusted of the suspicious transaction monitoring model to be updated.

5. The method according to claim 4, characterized in that, The step of updating the model parameters of the model based on each of the first parameters, and updating the model parameters to be adjusted of the suspicious transaction monitoring model to be updated, includes: The model evaluation is performed on each of the first parameter update models to obtain the model evaluation results of each of the first parameter update models; Based on the evaluation results of each model, a second parameter update model is selected from each of the first parameter update models; The model parameters of the updated model are updated using the second parameter, and the fixed value of the target splitting parameter corresponding to the updated model is used to update the model parameters to be adjusted of the suspicious transaction monitoring model.

6. The method according to claim 2, characterized in that, The model training samples include positive samples and negative samples; correspondingly, generating model training samples based on the model input data includes: Based on the input data of the model, obtain the historical prediction data obtained by the suspicious transaction monitoring model to be updated under the historical time period; The historical prediction data includes first prediction data, second prediction data, third prediction data, and fourth prediction data; the first prediction data is data whose prediction result is suspicious and whose actual result is suspicious; the second prediction data is data whose prediction result is suspicious and whose actual result is not suspicious; the third prediction data is data whose prediction result is not suspicious and whose actual result is suspicious; the fourth prediction data is data whose prediction result is not suspicious and whose actual result is not suspicious. Based on the amount of data in the first and third prediction data, data sampling is performed on the first, second, third, and fourth prediction data respectively to generate model training samples.

7. A parameter update device for a suspicious transaction monitoring model, characterized in that, include: The parameter acquisition module is used to acquire the model input data and the model parameters to be adjusted of the suspicious transaction monitoring model to be updated. The initial model building module is used to build an initial parameter update model based on the model indicator rules of the suspicious transaction monitoring model to be updated; the model indicator rules include the model parameters to be adjusted. The target model training module is used to train the initial parameter update model using the model input data if the parameters to be adjusted in the model are easily separable parameters, so as to obtain the target parameter update model. The parameter update module is used to update the model parameters of the model using the target parameters, and to update the model parameters to be adjusted of the suspicious transaction monitoring model to be updated.

8. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the model parameter update method of the suspicious transaction monitoring model according to any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that, when executed by a processor, implement the model parameter update method of the suspicious transaction monitoring model according to any one of claims 1-6.

10. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the model parameter update method for the suspicious transaction monitoring model according to any one of claims 1-6.

Images