Financial business data automatic processing method and system

Abstract

The invention relates to the field of financial data processing, in particular to a financial business data automatic processing method and system. The financial business data automatic processing system comprises a data acquisition and analysis module, a tense relation writing module, an index calculation trigger module, a risk score fusion module and a decision generation module. According to the invention, through event-driven temporal relationship modeling and sliding window index calculation, a transaction flow and external unstructured information are fused in a millisecond level, and instant updating of an account-customer-transaction opponent relationship and dynamic refreshing of a risk index are realized; compared with traditional daily end batch processing, the method can find hidden risks such as over-high concentration degree and split money laundering when the transaction occurs, greatly shortens the risk identification time delay, and improves the timeliness and accuracy of risk control.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of financial data processing, in particular to a financial business data automatic processing method and system. BACKGROUND

[0002] With the popularity of open banking, mobile payment and real-time clearing network, the transaction volume handled by commercial banks grows exponentially: not only does the core accounting system generate a large amount of structured flow, but also Internet payment callback, cross-border platform reconciliation, regulatory announcements and guarantee contracts continue to pour in the form of PDF, web pages or emails; this multi-source heterogeneous pattern makes the "transaction itself" and its associated customer, account, contract information highly dispersed, bringing great challenges to unified collection and real-time risk analysis.

[0003] The current risk control framework focuses on end-of-day batch processing: the system extracts transactions and customer master data after closing business, and then writes the "customer-account-transaction counterparty" relationship into a relational database; this method cannot reflect the release of guarantees, changes in beneficiaries or transfers of control within the trading day in a timely manner, resulting in insufficient timeliness for money laundering detection and concentration monitoring, and potential regulatory penalties; at the decision-making level, hard compliance rules, human experience and machine learning models have long been operated as isolated components, and the risk conclusions of each component are often "stitched" by static weights or manual meetings; once the rule engine and model prediction give opposite judgments, the system can only force manual review, and cannot achieve real-time automatic negotiation and weight self-adaptive adjustment, which not only slows down the approval process, but also increases the misjudgment rate.

[0004] In addition, domestic and foreign regulatory agencies have continuously upgraded the requirement for interpretability, and traditional text logs or static reports cannot meet the dual needs of differentiated display and machine-readable audit.

[0005] Therefore, the present application proposes a financial business data automatic processing method and system, which, in the face of the business reality of millisecond-level transaction flow and minute-level external information changing simultaneously, completes the whole-process real-time closed loop of "collection-association modeling-index calculation-conflict negotiation-differentiated interpretation". SUMMARY

[0006] The present application realizes the real-time update of the account-customer-transaction counterparty relationship and the dynamic refresh of the risk index by fusing the transaction flow and external unstructured information within milliseconds through event-driven temporal relationship modeling and sliding window index calculation; compared with the traditional end-of-day batch processing, it can discover hidden risks such as excessive concentration and money laundering at the moment of transaction occurrence, greatly shorten the risk identification time delay, and improve the timeliness and accuracy of risk control.

[0007] A financial business data automatic processing method, comprising:

[0008] Acquire bank transaction flow data and external unstructured information related thereto, perform semantic analysis, and obtain an event five-tuple with subject identification, relationship type, object identification, event action, and event time as fields;

[0009] Write the subject identification, relationship type, and object identification in the event five-tuple into a relationship record table together with the effective time and invalid time, and write the event source identification and sequence number when writing, to construct a relationship record table that can be retrieved by time interval;

[0010] Divide the event five-tuple into a fixed-length sliding window according to the event time, and in each window, count the total transaction amount, the number of transactions, and the number of opposite accounts of the same subject to generate three types of indicators: amount concentration, amount abnormality, and transaction frequency; encapsulate each indicator value and the event five-tuple set in the window into a risk data packet, and generate a reasoning trigger signal when any indicator exceeds a preset threshold or a new relationship record is generated during the window;

[0011] After receiving the reasoning trigger signal, score the risk data packet using rule-based reasoning, historical case retrieval, and machine learning models to obtain first, second, and third risk scores, and perform a weighted operation to synthesize a comprehensive risk score;

[0012] Compare the comprehensive risk score with preset release and block thresholds to generate a release instruction, a manual review instruction, or a block instruction; record the trigger input, the three risk scores, the weight configuration, the negotiation process, and the final instruction to form a decision chain; after mapping the decision chain to a bank business knowledge graph, generate an explanation file by cutting fields according to four role templates: technical operation, business manager, auditor, and supervisor, and write the explanation file together with the event source identification into persistent storage.

[0013] Preferably, the specific construction operation of the relationship record table is as follows:

[0014] When the event action is creation, a new record is inserted in the relationship record table, which contains the subject identification, relationship type, object identification, effective time field, and empty invalid time field, and the event source identification and sequence number are also written at the same time;

[0015] When the event action is cancellation or change, search for an existing record that completely matches the subject identification, relationship type, and object identification and has an empty invalid time field, and update the invalid time field in the record to the event time; if the event action is change, after the aforementioned update is completed, a new record is inserted, which has the same content as the changed relationship and an empty invalid time field;

[0016] Use the subject identification, object identification, effective time, and invalid time as a combined index key to establish a time interval index for the relationship record table.

[0017] Preferably, each indicator value is calculated, and each indicator value and the set of event five-tuples within the window are packaged as a risk data packet, in particular as follows:

[0018] The event five-tuples are divided into fixed-length sliding windows according to event time, and the event five-tuples falling within the same window are aggregated with the subject identifier as the grouping key; when the window slides, the events in the overlapping interval with the previous window are retained;

[0019] In each window, based on the aggregated events, the total transaction amount, the number of transactions, and the number of different counterpart accounts of the subject within the window are accumulated; according to the distribution concentration of the transaction amount within the window among different counterpart accounts, an amount concentration indicator is generated; according to the deviation degree of the accumulated transaction amount within the window relative to the historical reference period amount behavior, an amount anomaly indicator is generated; according to the deviation degree of the transaction frequency within the window relative to the historical reference period transaction frequency behavior, a transaction frequency indicator is generated; each indicator is represented in the form of a grade value or a score value; wherein the historical reference period refers to a continuous interval of N days back from the end time of the current window as the base point;

[0020] The start time and end time of the window, the subject identifier, the set of event five-tuples within the window, the amount concentration indicator, the amount anomaly indicator, the transaction frequency indicator, and all relationship records that are still in effect at the end time of the window and related to the subject identifier are packaged together as a risk data packet.

[0021] Preferably, a comprehensive risk score value is calculated, in particular as follows:

[0022] The risk data packet is compared with the preset deterministic rules, and the highest risk level of all triggered rules is taken as the first risk score value;

[0023] A feature vector is formed by the transaction amount, the number of transactions, the number of counterpart accounts, and the number of relationships, and the feature vector is compared with the records in the historical transaction case library for cosine similarity calculation, and the historical transaction records with the highest similarity to the current feature vector are selected from the case library, and the risk level value corresponding to the period label is numerically mapped, and the weighted average value is calculated as the second risk score value, which is a real number between 0 and 1;

[0024] The feature vector is input into the trained gradient boosting decision tree model, and the model output probability is taken as the third risk score value;

[0025] read a preset static weight vector (a, b, g), wherein a+b+g=1; based on the review record of the recently completed risk transaction, the accuracy performance of the rule inference score, the historical case search score and the machine learning score in the review success sample is counted, and the deviation degree relative to the overall accuracy is calculated respectively to form a dynamic correction increment vector (a, b, g); add the components to obtain (a+ a, b+ b, g+ g), and then divide the three components by their sum to make the current weight vector (w1, w2, w3) satisfy w1+w2+w3=1; apply the current weight vector (w1, w2, w3) to the first, second and third risk scores to obtain an initial comprehensive risk score;

[0026] If the difference between any two of the three scores exceeds the preset divergence threshold, the weighted result is abandoned, and the priority of the higher one is selected as the final comprehensive risk score from the two scores with the largest difference in the order of "rule score first, case score second, and model score third". Otherwise, the initial comprehensive risk score is the final comprehensive risk score.

[0027] Preferably, for the generation of the decision chain, the specific operation is as follows:

[0028] Compare the final comprehensive risk score with the release threshold and then with the blocking threshold one by one: if the comprehensive risk score is lower than the release threshold, a release instruction is generated; if the comprehensive risk score is higher than the blocking threshold, a blocking instruction is generated; if it is between the two, an artificial review instruction is generated, and the generated instruction is sent to the transaction processing system synchronously;

[0029] For the same risk data packet, the trigger input identifier, the first risk score, the second risk score, the third risk score, the current weight vector and the weight reallocation record in the divergence processing process are written into the log in the generation order; a globally unique decision identifier is allocated for a complete write, and the time order of the record is maintained in the log append mode;

[0030] With the decision identifier as the only index, the records belonging to the same identifier in the log are concatenated to form a complete decision chain containing the comprehensive risk score, the threshold comparison result and the output instruction, so that the subsequent decision identifier can retrieve all the information of the instruction and its generation process.

[0031] Preferably, the explanation file is generated by tailoring the fields according to the role template, and the specific implementation is as follows:

[0032] Map the decision chain to the entities and attributes of the bank business knowledge graph according to the record fields: the rule number is mapped to the compliance clause node, the case number is mapped to the historical transaction node, the model feature contribution is mapped to the feature node, and the rest of the fields remain unchanged; after mapping, structured explanation data containing node references and original field values are generated;

[0033] For the four roles of technical operation, business manager, auditor and supervisor, field templates are preset respectively: the technical operation field template retains the execution log details and all feature contributions; the business manager field template retains the business process fields and main risk indicators; the auditor field template retains the event timeline, trigger rule number and weight adjustment record; the supervisor field template only retains the comprehensive risk score, output instruction and corresponding compliance clause number; the structured explanation data is field-cut according to the role template, and four role-specific explanation data are obtained;

[0034] The role-specific explanation data is serialized into an explanation file, which contains field key-value pairs and their node references in the bank business knowledge graph; each explanation file is named with the same decision identifier and annotated with a role suffix, and stored in a persistent storage; when queried by a role identity, the external system obtains the explanation file corresponding to the role according to the decision identifier.

[0035] A financial business data automatic processing system, comprising:

[0036] A data acquisition and analysis module for acquiring bank transaction stream data and related external unstructured information, performing semantic analysis, and obtaining event five-tuples with subject identifier, relationship type, object identifier, event action and event time as fields;

[0037] A time relationship writing module for constructing a relationship record table that can be retrieved by time interval;

[0038] An index calculation triggering module for dividing event five-tuples into fixed-length sliding windows according to event time, calculating the total transaction amount, transaction number and opposite account number of the same subject in each window, and generating three types of indicators: amount concentration, amount abnormality and transaction frequency; packaging each indicator value and the event five-tuple set in the window into a risk data packet, and generating a reasoning trigger signal when any indicator exceeds the preset threshold or a new relationship record is generated during the window;

[0039] A risk score fusion module for scoring the risk data packet using rule reasoning, historical case retrieval and machine learning model respectively after receiving the reasoning trigger signal, obtaining first, second and third risk scores, and performing weighted operation to synthesize a comprehensive risk score;

[0040] A decision generation module is configured to compare the comprehensive risk score with the release threshold and the blocking threshold, and generate a release instruction, a manual review instruction or a blocking instruction; and record the trigger input, the three risk scores, the weight configuration, the negotiation process and the final instruction to form a decision chain; after mapping the decision chain to a bank business knowledge graph, the decision chain is cut according to four role templates of technical operation, business manager, auditor and supervisor to generate an explanation file, and the explanation file is written into a persistent storage together with an event source identifier.

[0041] A computer readable storage medium having stored thereon computer programs / instructions, which, when executed by a processor, implement the steps of the above method.

[0042] The present application has the following advantages:

[0043] 1. The present application realizes real-time updating of account-customer-counterparty relationship and dynamic refreshing of risk indicators by fusing transaction flow and external unstructured information within milliseconds through event-driven temporal relationship modeling and sliding window index calculation; compared with traditional end-of-day batch processing, it can discover hidden risks such as excessive concentration and money laundering at the moment of transaction, greatly shortening the risk identification time delay and improving the timeliness and accuracy of risk control.

[0044] 2. The present application introduces three sources of scoring of rule reasoning, historical cases and machine learning, and automatically gives a unique decision through weight self-adaptation and priority mechanism, reducing manual intervention; at the same time, the decision chain is mapped to a bank business knowledge graph, and differentiated explanation files are generated according to role templates of technical operation, business manager, auditor and supervisor; this design not only ensures the absolute priority of hard compliance rules, but also provides transparent and traceable multi-level explanations, meeting the dual requirements of internal audit and external supervision. BRIEF DESCRIPTION OF DRAWINGS

[0045] Figure 1 The figure is a structural schematic diagram of a financial business data automatic processing system used in the embodiment of the present application. DETAILED DESCRIPTION

[0046] In order to enable personnel in the art to better understand the technical solutions in the present application, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application.

[0047] Embodiment 1: a financial business data automatic processing method, comprising:

[0048] The bank transaction flow data and external unstructured information related thereto are acquired, semantic analysis is performed, and an event five tuple with subject identification, relationship type, object identification, event action, and event time as fields is obtained; wherein, the "bank transaction flow data" includes structured items such as the core accounting system's payment and receipt records, real-time payment gateway callback, and cross-border clearing messages; the "external unstructured information" refers to texts such as PDF contracts, regulatory announcements, news releases, and email bodies related to the same transaction or associated transactions; the system first directly reads the fields of the structured data, and uses word segmentation, named entity recognition, and relationship extraction models on the unstructured text to identify the fund subject, transaction counterparty, event type (such as guarantee establishment, guarantee release, and equity transfer), and occurrence time; then, the entity pair and relationship label are combined into a five tuple in the format of 〈subject identification, relationship type, object identification, event action, event time〉, and are uniformly written into a streaming pipeline, providing standardized input for subsequent relationship record table construction and risk indicator calculation;

[0049] The subject identification, relationship type, and object identification in the event five tuple are written into the relationship record table together with the effective time and invalid time, and the event source identification and sequence number are attached when writing, to construct a relationship record table that can be retrieved by time interval; in this operation, the system retrieves the records with empty current invalid time based on the joint search of the "subject identification-relationship type-object identification" three fields: if there is no hit, a new row is directly inserted and the invalid time is empty; if there is a hit and the event action is release or change, the invalid time of the row is first updated to the event time, and if it is a change, a new row carrying the new relationship content is inserted; the event source identification records the transaction flow number, contract hash, or announcement link corresponding to the five tuple, and the sequence number is generated by incrementing according to the arrival of the event in order to remove duplicates and restore the event order; the relationship record table establishes a composite index on the above four fields (subject identification, object identification, effective time, and invalid time), so that the system can retrieve the valid relationship set at any point in time;

[0050] According to the event time, the event five tuple is divided into a fixed length sliding window, and the total transaction amount, transaction number, and opposite account number of the same subject are counted in each window to generate three types of indicators: amount concentration, amount abnormality, and transaction frequency; the values of each indicator and the event five tuple set in the window are packaged into a risk data packet, and the risk data packet represents a series of data for risk calculation; any indicator exceeding the preset threshold or generating a new relationship record during the window period generates an inference trigger signal; wherein, the sliding window length and sliding step are set by system parameters, and can be consistent with the settlement period of the payment system;

[0051] After receiving the inference trigger signal, the risk data packet is scored by using rule-based reasoning, historical case retrieval, and machine learning models respectively to obtain first, second, and third risk scores, and the scores are weighted and combined into a comprehensive risk score;

[0052] The comparison of the comprehensive risk score and the preset release threshold and the blocking threshold is performed, wherein the release threshold and the blocking threshold are set by a professional in the related field according to a risk tolerance and a business policy, and can be dynamically configured according to currency, channel and the like; when the comprehensive risk score is lower than the release threshold, the system automatically generates an instruction for authorizing release; when the score is higher than the blocking threshold, the system generates an instruction for intercepting the transaction; if the score is between the two, the system generates an instruction for prompting manual review; and the triggering input, the three risk scores, the weight configuration, the negotiation process and the final instruction are recorded to form a decision chain; after the decision chain is mapped to a bank business knowledge graph, fields are cropped according to four role templates of technical operation, business manager, auditor and supervisor to generate an explanation file, which is written into a persistent storage together with an event source identifier for subsequent query according to the decision identifier; wherein the bank business knowledge graph refers to a graph data structure constructed by taking bank common business entities such as accounts, customers, transactions, rule clauses and historical cases as nodes and their business semantic relationships as edges; such a knowledge graph belongs to a general means widely used in the industry, and can be directly generated through a public framework or a mature commercial product, and only serves as regular supporting data required for explanation output;

[0053] The comparison logic of the comprehensive risk score and the threshold is controlled by a professional in the related field, and the release threshold and the blocking threshold can be dynamically adjusted according to currency and channel and left in the decision chain.

[0054] The specific construction operation of the relationship record table is as follows:

[0055] When the event action is creation, a new record is inserted in the relationship record table, the record contains a subject identifier, a relationship type, an object identifier, an effective time field and a null invalid time field, and the event source identifier and the sequence number are written at the same time;

[0056] When the event action is cancellation or change, an existing record that is completely matched with the subject identifier, the relationship type and the object identifier and has a null invalid time field is searched, and the invalid time field in the record is updated to the event time; if the event action is change, a record is inserted after the foregoing update is completed, the record content is consistent with the changed relationship and the invalid time field is null;

[0057] The relationship record table is established with a time interval index by taking the subject identifier, the object identifier, the effective time and the invalid time as a combination index key, so that the valid relationship in any specified time point or time interval can be directly searched.

[0058] The values of the indicators are calculated, and the values of the indicators and the five-tuple set of events in the window are packaged as a risk data packet, and the specific operation is as follows:

[0059] According to the event time, the event five-tuple is divided into a fixed-length sliding window, and the subject identifier is taken as a grouping key, and the event five-tuples falling into the same window are gathered; when the window slides, the events in the overlapping interval with the previous window are retained, and continuous statistics are realized;

[0060] In each window, based on the gathered events, the total transaction amount, the number of transactions and the number of different opposite accounts in the window of the subject are accumulated; according to the distribution concentration of the transaction amount in the window among different opposite accounts, the amount concentration index is generated; according to the deviation degree of the accumulated transaction amount in the window relative to the historical reference period amount behavior, the amount abnormality index is generated; according to the deviation degree of the transaction number in the window relative to the historical reference period transaction frequency behavior, the transaction frequency index is generated; each index is represented in the form of a grade value or a score; wherein, the historical reference period refers to a continuous interval of N days back from the end time of the current window as the base point, in which interval, the system re-counts the total transaction amount and the number of transactions of the same subject according to the same window width and sliding step as the real-time window, and compares the real-time window statistical value with the mean value or quantile number of the corresponding index of the reference period, to measure the deviation degree of the current behavior from the historical distribution of the subject;

[0061] The start time and end time of the window, the subject identifier, the event five-tuple set in the window, the amount concentration index, the amount abnormality index, the transaction frequency index, and all relationship records related to the subject identifier that are still in the effective state at the end time of the window, are composed into a risk data package.

[0062] The comprehensive risk score is calculated, and the specific operation is as follows:

[0063] The received risk data package is compared with the preset deterministic risk rule set piece by piece; for any rule meeting the triggering condition, the risk grade value corresponding to the rule is read, and the highest risk grade value of all triggered rules in the same risk data package is taken as the first risk score;

[0064] The transaction amount, the transaction number, the opposite end account number, and the relationship number related to the subject in the risk data packet are used to form a feature vector, and the feature vector is used for cosine similarity calculation with records in a historical transaction case library; the historical transaction case library is automatically generated by a bank business system in a daily transaction process, and the record content includes transaction data fields and processing results determined by manual review or system program as "normal", "suspicious", or "high risk" when executed; a plurality of historical transaction records with the highest similarity to the current feature vector are selected from the case library, and the risk level value corresponding to the period label is numerically mapped (for example: normal is 0, suspicious is 0.5, and high risk is 1.0), and a weighted average value is calculated as a second risk score, the second risk score is a real number between 0 and 1, and is used to reflect the average risk level corresponding to the current transaction in historical experience; wherein the relationship number refers to the number of all relationship record entries that are still in effect and related to the target subject at the end of the current sliding window (regardless of whether the subject is located at the main end or the guest end of the relationship), to measure the association complexity of the subject;

[0065] The feature vector is input into a gradient boosting decision tree model that has been trained; the model is composed of a plurality of serial decision trees, the input of each tree is the residual of the previous level, and the output is the probability that the transaction belongs to a risk category, which is denoted as a third risk score;

[0066] A preset static weight vector (α, β, γ) is read, where α+β+γ=1; based on the completed risk transaction review records in recent period, the accuracy of the rule reasoning score, the historical case retrieval score, and the machine learning score in the review successful samples is calculated, and the deviation degree relative to the overall accuracy is calculated to form a dynamic correction increment vector (Δα, Δβ, Δγ); the components are added to obtain (α+Δα, β+Δβ, γ+Δγ), and then the three components are divided by their sum to obtain a current weight vector (w1, w2, w3) that satisfies w1+w2+w3=1; the first, second, and third risk scores are weighted and summed by using the current weight vector (w1, w2, w3) to calculate w1x the first risk score+w2x the second risk score+w3x the third risk score, and an initial comprehensive risk score is obtained; wherein the specific process of obtaining the dynamic correction increment vector is: the system recovers all manual review results at the end of each day, compares the comprehensive risk decision output by the system with the final manual decision; if a certain scoring source is overturned by the manual multiple times, a negative increment is generated for the corresponding component in the error direction, and vice versa; the increments are smoothed by moving average to form (Δα, Δβ, Δγ), and a current weight vector that adapts to the latest manual feedback is obtained;

[0067] Differences between the first, second, and third risk scores are calculated; if all differences are not greater than a preset divergence threshold, the initial comprehensive risk score is directly confirmed as the final comprehensive risk score, wherein the divergence threshold is a preset scoring difference limit for judging whether there is a significant inconsistency in the scoring result, and the threshold can be determined based on the difference distribution statistics of historical scoring results; if at least one group of differences is greater than the divergence threshold, it is determined that there is a scoring divergence, the weighted result is abandoned, and the single risk score with a higher priority is selected from the group with the largest difference in the score as the final comprehensive risk score according to the priority of "rule reasoning score first, historical case score second, and machine learning score third".

[0068] For the generation of the decision chain, the specific operations are as follows:

[0069] The final comprehensive risk score is compared with the release threshold and the blocking threshold one by one: if the comprehensive risk score is lower than the release threshold, a release instruction is generated; if the comprehensive risk score is higher than the blocking threshold, a blocking instruction is generated; if it is between the two, an artificial review instruction is generated, and the generated instruction is sent to the transaction processing system synchronously;

[0070] For the same risk data packet, the trigger input identifier, the first risk score, the second risk score, the third risk score, the current weight vector, and the weight reallocation record in the divergence processing process are written into the log in the generation order; wherein the trigger input identifier indicates the transaction window number or the risk event number that triggers this risk analysis, and is used to uniquely identify the starting data of this scoring process; the first risk score, the second risk score, and the third risk score correspond to the risk probability values obtained by rule reasoning scoring, case similarity scoring, and machine learning scoring, respectively, reflecting the independent judgment results of the three evaluation methods; the current weight vector refers to the optimal weight combination used for weighting the three types of risk scores; a globally unique decision identifier is allocated for a complete write, and the time sequence of the records is maintained in a log append manner;

[0071] Using the decision identifier as a unique index, the records belonging to the same identifier in the log are concatenated to form a complete decision chain containing the comprehensive risk score, the threshold comparison result, and the output instruction, so that the instruction and all information about its generation process can be retrieved according to the decision identifier subsequently.

[0072] The explanation file is generated by tailoring the fields according to the role template, and the specific implementation manner is as follows:

[0073] The decision chain is mapped to the entities and attributes of the bank business knowledge graph according to the record fields: the rule number is mapped to the compliance clause node, the case number is mapped to the historical transaction node, the model feature contribution is mapped to the feature node, and the remaining fields remain unchanged; after the mapping, structured explanation data containing node references and original field values are generated;

[0074] For the four roles of technical operation, business manager, auditor and supervisor, field templates are respectively preset: the technical operation field template retains the execution log details and all feature contributions; the business manager field template retains the business process fields and main risk indicators; the auditor field template retains the event timeline, trigger rule number and weight adjustment record; the supervisor field template only retains the comprehensive risk score, output instruction and corresponding compliance clause number; the structured explanation data is field-cut according to the role template, and four role-specific explanation data are obtained;

[0075] The role-specific explanation data is serialized into an explanation file, which contains field key-value pairs and their node references in the business knowledge graph; each explanation file is named with the same decision identifier and annotated with a role suffix, and stored in a persistent storage; when queried by a role identity, an external system obtains the explanation file corresponding to the role according to the decision identifier, to realize differential display of the same decision chain from different roles.

[0076] Embodiment 2, a financial business data automatic processing system, as shown in Figure 1 , comprising:

[0077] A data collection and analysis module is configured to obtain bank transaction stream data and related external unstructured information, perform semantic analysis, and obtain an event five-tuple with subject identifier, relationship type, object identifier, event action and event time as fields;

[0078] A time relationship writing module is configured to write the subject identifier, relationship type and object identifier in the event five-tuple together with the effective time and invalid time into a relationship record table, and write the event source identifier and sequence number when writing, to construct a relationship record table that can be retrieved by time interval;

[0079] An index calculation and trigger module is configured to divide the event five-tuple into a fixed-length sliding window according to the event time, and calculate the total transaction amount, transaction number and opposite account number of the same subject in each window to generate three types of indexes: amount concentration, amount abnormality and transaction frequency; encapsulate each index value and the event five-tuple set in the window into a risk data packet, and generate a reasoning trigger signal when any index exceeds a preset threshold or a new relationship record is generated during the window;

[0080] A risk score fusion module is configured to score the risk data packet using rule reasoning, historical case retrieval and machine learning model respectively after receiving the reasoning trigger signal, to obtain first, second and third risk scores, and perform weighted operation to integrate into a comprehensive risk score;

[0081] The decision generation module is used for comparing the comprehensive risk score with the release threshold and the blocking threshold, generating a release instruction, a manual review instruction or a blocking instruction, recording the trigger input, the three risk scores, the weight configuration, the negotiation process and the final instruction to form a decision chain, mapping the decision chain to a bank business knowledge graph, generating an explanation file according to four role templates of technical operation, business manager, auditor and supervisor, and writing the explanation file into a persistent storage together with an event source identifier for subsequent query according to a decision identifier.

[0082] A computer readable storage medium having stored thereon computer programs / instructions, which, when executed by a processor, implement the steps of the above method.

[0083] It should be understood that, for those skilled in the art, improvements or changes can be made according to the above description, and all these improvements and changes shall belong to the protection scope of the appended claims of the present application. The parts not described in detail in the specification belong to the prior art known to those skilled in the art.

Claims

1. A method for automating the processing of financial services data, comprising: The method comprises the following steps: acquiring bank transaction flow data and external unstructured information related thereto, performing semantic analysis to obtain an event five-tuple with subject identification, relationship type, object identification, event action and event time as fields; writing the subject identification, relationship type and object identification in the event five-tuple into a relationship record table together with the effective time and invalid time, and writing the event source identification and sequence number when writing, to construct a relationship record table that can be retrieved by time interval; dividing the event five-tuple into a fixed-length sliding window according to the event time, and in each window, counting the total transaction amount, the number of transactions and the number of opposite accounts of the same subject to generate three types of indicators, namely, the amount concentration, the amount abnormality and the transaction frequency; packaging each indicator value and the event five-tuple set in the window into a risk data packet, and generating a reasoning trigger signal when any indicator exceeds the preset threshold or a new relationship record is generated during the window; after receiving the reasoning trigger signal, scoring the risk data packet by using rule reasoning, historical case retrieval and machine learning model respectively to obtain first, second and third risk scores, and performing a weighting operation to synthesize a comprehensive risk score; comparing the comprehensive risk score with preset release threshold and blocking threshold to generate a release instruction, a manual review instruction or a blocking instruction; and recording the trigger input, the three risk scores, the weight configuration, the negotiation process and the final instruction to form a decision chain; after mapping the decision chain to a bank business knowledge graph, generating an explanation file by cutting the fields according to four role templates of technical operation, business manager, auditor and supervisor, and writing the explanation file together with the event source identification into a persistent storage.

2. The method for automating financial services data processing according to claim 1, wherein, The specific construction operation of the relationship record table is as follows: when the event action is creation, a new record is inserted in the relationship record table, which contains the subject identification, relationship type, object identification, effective time field and empty invalid time field, and the event source identification and sequence number are written at the same time; when the event action is cancellation or change, an existing record that completely matches the subject identification, relationship type and object identification and has an empty invalid time field is searched, and the invalid time field in the record is updated to the event time; if the event action is change, after the above-mentioned update is completed, a new record is inserted, and the record content is consistent with the changed relationship and the invalid time field is empty; establishing a time interval index for the relationship record table with the subject identification, object identification, effective time and invalid time as the combined index key.

3. The method for automating financial services data processing according to claim 2, wherein, The specific operation of calculating each indicator value and packaging each indicator value and the event five-tuple set in the window into a risk data packet is as follows: fixed-length sliding window division is performed on the event five-tuple according to the event time, the event five-tuple falling into the same window is gathered with the subject identification as the grouping key, and the events in the overlapping interval with the previous window are retained when the window slides. In each window, based on the aggregated events, the total transaction amount, the number of transactions and the number of different counterparty accounts of the principal in the window are accumulated; according to the distribution concentration of the transaction amount in the window among different counterparty accounts, the amount concentration index is generated; according to the deviation degree of the accumulated transaction amount in the window relative to the historical reference period amount behavior, the amount anomaly index is generated; according to the deviation degree of the number of transactions in the window relative to the historical reference period transaction frequency behavior, the transaction frequency index is generated; each index is represented in the form of grade value or score; wherein the historical reference period refers to the continuous interval of N days back from the end time of the current window as the base point; The start time and end time of the window, the principal identifier, the five-tuple set of events in the window, the amount concentration index, the amount anomaly index, the transaction frequency index, and all relationship records that are still in effect at the end time of the window and related to the principal identifier are combined to form a risk data package.

4. The method for automating financial services data processing according to claim 3, wherein, The comprehensive risk score is calculated as follows: Compare the risk data package with the pre-set deterministic rules, and take the highest risk level of all triggered rules as the first risk score; Take the transaction amount, the number of transactions, the number of counterparty accounts and the number of relationships as a feature vector, and perform cosine similarity calculation on the feature vector and the records in the historical transaction case library, select the historical transaction records with the highest similarity to the current feature vector from the case library, map the risk level value corresponding to the period label to a numerical value, and calculate the weighted average value as the second risk score, which is a real number between 0 and 1; Input the feature vector into the trained gradient boosting decision tree model, and take the model output probability as the third risk score; Read the pre-set static weight vector (α, β, γ), where α + β + γ = 1; based on the recently completed risk transaction review records, statistics the accuracy rate performance of rule reasoning score, historical case retrieval score and machine learning score in the review success samples, respectively calculate the deviation degree relative to the overall accuracy rate, and construct a dynamic correction increment vector (Δα, Δβ, Δγ); add the components to get (α + Δα, β + Δβ, γ + Δγ), then divide the three components by their sum to get the current weight vector (w1, w2, w3) that satisfies w1 + w2 + w3 = 1; apply the current weight vector (w1, w2, w3) to the first, second and third risk scores to get the initial comprehensive risk score; If the difference between any two of the three scores exceeds the pre-set disagreement threshold, discard the weighted result, and select the higher priority from the two scores with the largest difference as the final comprehensive risk score in the order of "rule score first, case score second, model score third"; Otherwise, the initial comprehensive risk score is the final comprehensive risk score.

5. The method for automating financial services data processing according to claim 4, wherein, For the generation of the decision chain, the specific operation is as follows: The final comprehensive risk score is compared with the release threshold and the blocking threshold one by one: if the comprehensive risk score is lower than the release threshold, a release instruction is generated; if the comprehensive risk score is higher than the blocking threshold, a blocking instruction is generated; if it is between the two, an artificial review instruction is generated, and the generated instruction is sent to the transaction processing system synchronously; For the same risk data packet, the trigger input identifier, the first risk score, the second risk score, the third risk score, the current weight vector, and the weight reallocation record in the divergence processing process are written into the log in the order of generation; a globally unique decision identifier is allocated for a complete write, and the time sequence of the record is maintained in the log append mode; The decision identifier is used as a unique index to concatenate the records belonging to the same identifier in the log to form a complete decision chain containing the comprehensive risk score, the threshold comparison result and the output instruction, so that the subsequent decision identifier can retrieve all the information of the instruction and its generation process.

6. The method for automating financial services data processing according to claim 5, wherein, The interpretation file is generated by tailoring the fields according to the role template, and the specific implementation is as follows: The decision chain is mapped to the entities and attributes of the bank business knowledge graph according to the record fields: the rule number is mapped to the compliance clause node, the case number is mapped to the historical transaction node, the model feature contribution is mapped to the feature node, and the remaining fields remain unchanged; after mapping, structured interpretation data containing node references and original field values are generated; For the four roles of technical operation, business manager, auditor and supervisor, field templates are preset respectively: the technical operation field template retains the execution log details and all feature contributions; The business manager field template retains the business process field and the main risk indicators; the auditor field template retains the event timeline, trigger rule number and weight adjustment record; the supervisor field template only retains the comprehensive risk score, the output instruction and the corresponding compliance clause number; The structured interpretation data is field-tailored according to the role template to obtain four role-specific interpretation data; The role-specific interpretation data is serialized into an interpretation file, which contains field key-value pairs and their node references in the bank business knowledge graph; each interpretation file is named with the same decision identifier and annotated with a role suffix, and stored in a persistent storage; When queried by a role identity, the external system obtains the interpretation file corresponding to the role according to the decision identifier.

7. An automated processing system for financial services data, characterized by The system is applied to the financial business data automatic processing method of any one of the above claims 1-6, comprising: A data acquisition and analysis module is used to obtain bank transaction stream data and related external unstructured information, perform semantic analysis, and obtain event five-tuples with subject identifier, relationship type, object identifier, event action and event time as fields; A time relationship writing module is used to build a relationship record table that can be retrieved by time interval; The index calculation triggering module is configured to divide the event five-tuple into a fixed-length sliding window according to the event time, count the total transaction amount, the number of transactions and the number of opposite accounts of the same principal in each window, and generate three types of indexes including the amount concentration, the amount abnormality and the transaction frequency; encapsulate each index value and the event five-tuple set in the window into a risk data packet, and generate a reasoning triggering signal when any index exceeds a preset threshold or a new relationship record is generated during the window; The risk score fusion module is configured to score the risk data packet by using rule reasoning, historical case retrieval and a machine learning model respectively after receiving the reasoning triggering signal, obtain first, second and third risk scores, and perform a weighted operation to synthesize a comprehensive risk score; The decision generation module is configured to compare the comprehensive risk score with a release threshold and a blocking threshold, generate a release instruction, a manual review instruction or a blocking instruction, record the triggering input, the three risk scores, the weight configuration, the negotiation process and the final instruction to form a decision chain, map the decision chain to a bank business knowledge graph, generate an explanation file according to four role templates including a technical operation, a business manager, an auditor and a supervisor, and write the explanation file into a persistent storage together with an event source identifier.

8. A computer readable storage medium having stored thereon computer programs / instructions, characterized in that, The computer program / instruction is executed by the processor to realize the steps of the method in claim 1.

Images