Early warning method, device and equipment for risk transaction, storage medium and program product

Abstract

The embodiment of the invention provides a risk transaction early warning method and device, equipment, a storage medium and a program product, and relates to the field of financial science and technology. The method comprises the steps of obtaining transaction behavior data of a target transaction, generating behavior characteristic data based on the transaction behavior data, matching the behavior characteristic data with a plurality of preset rules in a preset rule base to obtain a rule deviation degree of the target transaction, and matching the behavior characteristic data with a plurality of historical behavior characteristics to obtain a rule deviation degree of the target transaction. According to the method, the historical case deviation degree of the target transaction is obtained, then the risk index of the target transaction is determined based on the rule deviation degree and the historical case deviation degree, a hierarchical early warning mechanism is triggered based on the risk index, implicit illegal behaviors such as improper commitment and an abnormal operation chain are timely and comprehensively identified, and a more accurate risk detection result is obtained. Therefore, the accuracy and timeliness of risk detection are improved, and workers can process corresponding risk transactions in time based on differential early warning.

Description

Technical Field

[0001] This application relates to the field of financial technology, and in particular to a method, apparatus, device, storage medium, and program product for early warning of risky transactions. Background Technology

[0002] In the area of ​​compliance management of financial transactions, especially in scenarios involving high-risk financial products, financial institutions need to conduct strict compliance reviews of the transaction behavior between wealth managers and clients.

[0003] Existing compliance review technologies primarily rely on static rule base matching and post-transaction auditing to assess the compliance of transactions. Static rule base matching uses a pre-defined compliance rule base to match transaction parameters and determine compliance. Furthermore, after a transaction is completed, manual review of data such as recordings and operation logs is used to identify violations.

[0004] However, existing technologies cannot identify and warn of risky transactions in real time before transaction approval, and static rule base matching and post-audit schemes cannot efficiently and accurately identify hidden violations such as improper promises and abnormal operation chains through multimodal data. Summary of the Invention

[0005] This application provides a method, apparatus, device, storage medium, and program product for early warning of risky transactions, in order to solve the technical problems that existing technologies cannot provide timely early warning of risky transaction behaviors before transaction approval, and cannot efficiently and accurately identify hidden violations such as improper promises and abnormal operation chains through multimodal data.

[0006] Firstly, this application provides a method for early warning of risky transactions, including:

[0007] Acquire transaction behavior data of the target transaction and generate behavioral feature data based on this transaction behavior data;

[0008] The behavioral feature data is matched with multiple preset rules in the preset rule base to obtain the rule deviation degree of the target transaction;

[0009] By matching behavioral feature data with multiple historical behavioral features, the deviation of historical cases of the target transaction can be obtained;

[0010] The risk index of the target transaction is determined based on the deviation from the rules and the deviation from historical cases.

[0011] A tiered early warning mechanism is triggered based on the risk index.

[0012] In one possible implementation, the aforementioned transaction behavior data includes: operation logs and text data converted from voice dialogue. Based on this transaction behavior data, behavioral feature data is generated, including:

[0013] Identifying risk semantic representations from text data;

[0014] Perform time-series analysis on operation logs to identify abnormal operation sequences;

[0015] Extract risky operations from the document operation trajectory in the operation log;

[0016] Behavioral feature data is generated based on risk semantic representation, abnormal operation sequences, and risk operations.

[0017] In one possible implementation, behavioral feature data is matched against multiple preset rules in a preset rule base to obtain the rule deviation of the target transaction, including:

[0018] By analyzing the behavioral characteristic data, several key behavioral parameters of the target transaction are obtained;

[0019] Identify at least one first rule from multiple preset rules that does not conform to multiple key behavioral parameters;

[0020] The rule deviation of the target transaction is determined based on the difference between the standard threshold in each first rule and the corresponding key behavioral parameter.

[0021] In one possible implementation, behavioral feature data is matched with multiple historical behavioral features to obtain the deviation of the target transaction from historical cases, including:

[0022] Calculate the similarity between behavioral feature data and multiple historical behavioral features in the historical violation case database;

[0023] The maximum value in the similarity score is determined as the deviation from historical cases.

[0024] One possible implementation involves a tiered early warning mechanism triggered by a risk index, including:

[0025] The three-level early warning decision tree determines the preset range to which the risk index belongs and triggers the corresponding graded early warning mechanism for the preset range.

[0026] In one possible implementation, the three-level early warning decision tree is configured as follows: if the risk index is less than or equal to the first threshold, the first-level early warning mechanism is triggered to mark the target transaction as low risk and enter the fast approval process;

[0027] If the risk index is between the second threshold and the first threshold, a level-two early warning mechanism is triggered to mark the target transaction as medium risk and transfer it to the manual review process;

[0028] If the risk index is greater than or equal to the second threshold, a level 3 early warning mechanism is triggered to mark the target transaction as high risk and freeze the target transaction, and then proceed to the audit process;

[0029] The first threshold is less than the second threshold.

[0030] In one possible implementation, the method also includes:

[0031] Based on at least one risk rule in the preset rule base that does not match the behavioral feature data, determine the risk type of the target transaction;

[0032] Based on the historical correction operations corresponding to multiple historical risk types, determine the corresponding operational recommendations for each risk type.

[0033] Push the risk type and operational suggestions to the approval end.

[0034] Secondly, this application provides an early warning device for risky transactions, comprising:

[0035] The acquisition module is used to acquire transaction behavior data of the target transaction and generate behavioral feature data based on the transaction behavior data;

[0036] The matching module is used to match behavioral feature data with multiple preset rules in the preset rule base to obtain the rule deviation degree of the target transaction;

[0037] The matching module is also used to match behavioral feature data with multiple historical behavioral features to obtain the deviation of historical cases of the target transaction;

[0038] The determination module is used to determine the risk index of the target transaction based on the deviation from the rules and the deviation from historical cases;

[0039] The trigger module is used to trigger a tiered early warning mechanism based on the risk index.

[0040] In one possible implementation, the aforementioned transaction behavior data includes: operation logs and text data converted from voice dialogue; the aforementioned device further includes: a recognition module, an extraction module, and a generation module.

[0041] The identification module is used to identify risk semantic representations from text data;

[0042] The identification module is also used to perform time-series analysis on operation logs and identify abnormal operation sequences;

[0043] The extraction module is used to extract risky operations from the document operation trajectory in the operation log;

[0044] The generation module is used to generate behavioral feature data based on risk semantic representation, abnormal operation sequence, and risk operation.

[0045] In one possible implementation, the above-mentioned apparatus further includes: a parsing module;

[0046] The parsing module is used to parse behavioral feature data to obtain multiple key behavioral parameters of the target transaction;

[0047] The determination module is also used to determine at least one first rule from multiple preset rules where multiple key behavioral parameters do not conform;

[0048] The determination module is also used to determine the rule deviation of the target transaction based on the difference between the standard threshold in each first rule and the corresponding key behavioral parameter.

[0049] In one possible implementation, the above-mentioned device further includes: a computing module;

[0050] The calculation module is used to calculate the similarity between behavioral feature data and multiple historical behavioral features in the historical violation case database;

[0051] The determination module is also used to determine the maximum value in the similarity as the deviation from historical cases.

[0052] In one possible implementation, the determination module is also used to determine the preset range to which the risk index belongs through a three-level early warning decision tree;

[0053] The trigger module is specifically used to trigger the tiered early warning mechanism corresponding to the preset range.

[0054] In one possible implementation, the three-level early warning decision tree is configured as follows: if the risk index is less than or equal to the first threshold, the first-level early warning mechanism is triggered to mark the target transaction as low risk and enter the fast approval process;

[0055] If the risk index is between the second threshold and the first threshold, a level-two early warning mechanism is triggered to mark the target transaction as medium risk and transfer it to the manual review process;

[0056] If the risk index is greater than or equal to the second threshold, a level 3 early warning mechanism is triggered to mark the target transaction as high risk and freeze the target transaction, and then proceed to the audit process;

[0057] The first threshold is less than the second threshold.

[0058] In one possible implementation, the above-mentioned device further includes: a push module;

[0059] The determination module is also used to determine the risk type of the target transaction based on at least one risk rule in the preset rule base that does not match the behavioral feature data;

[0060] The determination module is also used to determine the operation recommendations corresponding to the risk type based on the historical correction operations corresponding to multiple historical risk types.

[0061] The push module is used to push risk types and operational suggestions to the approval end.

[0062] Thirdly, embodiments of this application provide an electronic device, including: a memory and a processor;

[0063] The aforementioned memory stores instructions executed by the computer;

[0064] The processor executes computer execution instructions stored in the memory, causing the processor to perform the first aspect and / or various possible implementations of the first aspect as described above.

[0065] Fourthly, embodiments of this application provide a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the first aspect and / or various possible implementations of the first aspect.

[0066] Fifthly, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, implements the first aspect and / or various possible implementations of the first aspect.

[0067] This application provides a risk transaction early warning method, apparatus, device, storage medium, and program product. The method acquires transaction behavior data of the target transaction, generates behavioral feature data based on this data, matches the behavioral feature data with multiple preset rules in a preset rule base to obtain the rule deviation degree of the target transaction, and matches the behavioral feature data with multiple historical behavioral features to obtain the historical case deviation degree of the target transaction. Based on the rule deviation degree and historical case deviation degree, a risk index for the target transaction is determined, and a tiered early warning mechanism is triggered based on this risk index. This method acquires transaction behavior data during the transaction process and, through the preset rule base and historical behavioral features, more comprehensively and accurately identifies hidden violations such as improper promises and abnormal operation chains, obtaining more accurate risk detection results and improving the accuracy and timeliness of risk detection. Furthermore, tiered early warning based on the risk detection results enables differentiated risk warnings, allowing staff to promptly handle corresponding risky transactions based on differentiated warnings. Attached Figure Description

[0068] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0069] Figure 1 Flowchart of the risk transaction early warning method provided in the embodiments of this application Figure 1 ;

[0070] Figure 2 Flowchart of the risk transaction early warning method provided in the embodiments of this application Figure 2 ;

[0071] Figure 3 A schematic diagram of the structure of the risk transaction early warning device provided in this application;

[0072] Figure 4 A schematic diagram of the structure of the electronic device provided in this application.

[0073] The accompanying drawings have illustrated specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to specific embodiments. Detailed Implementation

[0074] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0075] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of the relevant data all comply with the relevant laws, regulations, and standards of the relevant countries and regions, have taken necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation access points for users to choose to authorize or refuse.

[0076] Furthermore, the technical solution involved in this application, which involves big data analysis of user information (including but not limited to personal biometrics, identity data, consumption data, asset data, electronic terminal operation data, etc.) and the use of artificial intelligence technology for automated decision-making, and makes decisions that have a significant impact on personal rights based on the results of automated decision-making, provides users with corresponding operation entry points for users to choose to agree to or reject the results of automated decision-making; if the user chooses to reject, the process will proceed to the expert decision-making process.

[0077] It should be noted that the risk transaction early warning method, device, equipment, storage medium and program product provided in this application can be used in the financial technology field, or in any field other than financial technology. The application field of the risk transaction early warning method, device, equipment, storage medium and program product in this application is not limited.

[0078] In the area of ​​financial transaction compliance management, especially in scenarios involving high-risk financial products (such as private equity funds and derivatives), financial institutions must conduct rigorous compliance reviews of the transactions between wealth managers and clients. For example, when a client purchases a private equity product through a bank, the wealth manager must complete the transaction through multiple steps, including voice communication, system operation, and document signing. During this process, the wealth manager's behavior may contain hidden risks of non-compliance, such as inducing clients to trade through improper promises (such as "guaranteed principal and returns"), skipping the risk disclosure process to quickly facilitate the transaction, or failing to fully disclose the product's risk terms.

[0079] Existing compliance review technologies primarily rely on static rule base matching and post-transaction auditing to assess the compliance of transactions. Static rule base matching uses a pre-defined compliance rule base to match transaction parameters and determine compliance. Furthermore, after a transaction is completed, manual review of data such as recordings and operation logs is used to identify violations.

[0080] However, existing technologies cannot provide timely warnings of risky transactions before transaction approval, and static rule base matching and post-audit solutions cannot efficiently and accurately identify hidden violations such as improper promises and abnormal operation chains through multimodal data.

[0081] The risk transaction early warning method provided in this application generates behavioral feature data based on transaction behavior data. This behavioral feature data is then matched with multiple preset rules in a pre-defined rule base to obtain the rule deviation degree of the target transaction. Furthermore, the behavioral feature data is matched with multiple historical behavioral features to obtain the historical case deviation degree of the target transaction. Based on the rule deviation degree and the historical case deviation degree, a risk index for the target transaction is determined. This method more comprehensively and accurately identifies hidden violations such as improper promises and abnormal operation chains, resulting in more accurate risk detection results. In addition, a tiered early warning mechanism is triggered based on this risk index, enabling differentiated risk warnings and allowing staff to promptly handle corresponding risky transactions based on these differentiated warnings.

[0082] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.

[0083] Figure 1 Flowchart of the risk transaction early warning method provided in the embodiments of this application Figure 1 This method can be applied, for example, to the trading systems of financial institutions. Figure 1 As shown, the method includes:

[0084] S101. Obtain transaction behavior data of the target transaction and generate behavioral feature data based on the transaction behavior data.

[0085] Acquire multi-source interaction data and preprocess it to obtain transaction behavior data. This multi-source interaction data includes, but is not limited to, interactive voice, operation logs, and document trajectories. Preprocessing includes, but is not limited to, converting interactive voice into interactive text, serializing and structuring operational behaviors, quantifying document interaction trajectories, and data alignment.

[0086] Specifically, the interactive voice on the user interface is converted into interactive text and timestamped. Furthermore, system click flows, page dwell times, and other operational behaviors are encoded into time-series data to obtain operation logs. Document operation behaviors, such as reading time and modification records for risk warning bookmarks, are also recorded to generate document trajectories. Further, features are extracted from the interactive text, operation logs, and document trajectories. The extracted features are then fused, and the fused high-dimensional features are subjected to dimensionality reduction and standardization to obtain behavioral feature data.

[0087] This method unifies scattered behavioral data into structured feature vectors through multi-source data acquisition and preprocessing, providing foundational data for subsequent feature extraction and risk index calculation. This process, combined with technologies such as speech recognition and operation log parsing, solves the problem of isolated multi-source data in traditional solutions, improving the completeness and usability of behavioral data.

[0088] S102. Match the behavioral feature data with multiple preset rules in the preset rule base to obtain the rule deviation degree of the target transaction.

[0089] The preset rules are based on the regulatory requirements and risk control strategies of the target transaction. For example, a preset rule could be: the net assets of the private equity product's clients must be ≥3 million. Furthermore, the aforementioned rule deviation is used to indicate the quantitative value of the degree to which the target transaction violates multiple preset rules.

[0090] Specifically, the behavioral feature data is analyzed to obtain multiple key behavioral data points of the target transaction. Each key behavioral data point is then assessed to determine whether it conforms to multiple preset rules. If it does not conform, the rule deviation of the target transaction is determined based on either a standard threshold corresponding to the preset rule or a deviation weight corresponding to the preset rule. The deviation weight is determined based on the degree of loss resulting from the transaction behavior not conforming to the preset rules.

[0091] For example, the preset rules include a standard threshold, and the difference between the actual value in the key behavior data and the standard threshold is calculated to determine the deviation of the target rule.

[0092] This method quantifies the risks of hidden violations such as improper promises and abnormal operation chains in target transactions by calculating the matching between behavioral feature data and multiple preset rules, which helps to obtain more accurate risk indicators.

[0093] S103. Match the behavioral feature data with multiple historical behavioral features to obtain the deviation of historical cases of the target transaction.

[0094] The method generates multiple historical behavioral features based on multiple historical abnormal transaction cases. These historical abnormal transaction cases can be, for example, historical violation transaction cases. The deviation of these historical cases is used to indicate the similarity between the target transaction and the historical abnormal transaction cases. This method is used to supplement the identification of risks not covered by the rule matching path in step S102 above.

[0095] Specifically, multiple historical behavioral features are stored in a feature library of historical abnormal transactions. The similarity between the behavioral feature data and each historical behavioral feature in the feature library is calculated; this similarity represents the degree of matching between the behavioral feature data and the historical behavioral features. From these multiple matching scores, at least one matching score that meets the deviation calculation criteria is selected, and based on this at least one matching score, the historical case deviation of the target transaction is calculated.

[0096] The deviation calculation condition can be, for example, sorting multiple matching scores from largest to smallest, and then selecting the top N matching scores from the sort. Further, a weighted average is calculated on these N matching scores to obtain the historical case deviation. The weight corresponding to each historical behavioral feature is determined based on the degree of loss caused by the corresponding historical abnormal transaction case.

[0097] Optionally, the cosine similarity between the behavioral feature vector and historical violation cases can be calculated using a pre-trained artificial intelligence model, and the deviation of the target transaction from historical cases can be output.

[0098] S104. Determine the risk index of the target transaction based on the deviation from the rules and the deviation from historical cases.

[0099] The risk index of the target transaction is obtained by weighting the deviation from the rules and the deviation from historical cases. The risk index can be, for example, compliance. For example, the compliance of the target transaction is calculated using the following formula: Compliance = 1 - (Rule deviation × 0.7 + Historical case deviation × 0.3).

[0100] S105. A graded early warning mechanism based on risk index triggering.

[0101] The tiered early warning mechanism is a multi-level early warning system, with each level corresponding to a different preset risk index range. Based on the preset risk index range to which the risk index belongs, the corresponding early warning mechanism is triggered, thus accurately triggering risk control resources corresponding to different risk levels. This ensures timely intervention in high-risk transactions while optimizing the allocation of risk control resources.

[0102] The risk transaction early warning method provided in this embodiment acquires transaction behavior data of the target transaction, generates behavioral feature data based on this data, matches the behavioral feature data with multiple preset rules in a preset rule base to obtain the rule deviation degree of the target transaction, and matches the behavioral feature data with multiple historical behavioral features to obtain the historical case deviation degree of the target transaction. Based on the rule deviation degree and the historical case deviation degree, a risk index for the target transaction is determined, and a tiered early warning mechanism is triggered based on this risk index. This method acquires transaction behavior data during the transaction process and, through the preset rule base and historical behavioral features, more comprehensively and accurately identifies hidden violations such as improper promises and abnormal operation chains, obtaining more accurate risk detection results and improving the accuracy and timeliness of risk detection. Furthermore, tiered early warning based on the risk detection results enables differentiated risk warnings, allowing staff to promptly handle corresponding risky transactions based on differentiated warnings.

[0103] Figure 2 Flowchart of the risk transaction early warning method provided in the embodiments of this application Figure 2 ,like Figure 2 As shown, in this embodiment... Figure 1 Based on the embodiments, a possible risk transaction early warning method is described in detail, the method including:

[0104] S201. Obtain transaction behavior data for the target transaction.

[0105] This step is similar to the explanation of step S101 above, and will not be repeated here.

[0106] S202. Identify risk semantic representations from text data.

[0107] The transaction behavior data includes: operation logs and text data converted from voice dialogues. The risk semantic expressions include, but are not limited to: principal protection, zero risk.

[0108] Natural language processing technology is used to analyze the text data of the target transaction, locate keywords from the text data, and combine dependency parsing to analyze the modification relationship between each keyword to obtain structured semantic information describing the degree of certainty of product attributes, scope of commitment and responsible party. Then, the semantic information is compared with multiple preset risk semantic expressions in the risk semantic expression library. If the above semantic information matches at least one preset risk semantic expression, the above text data is determined to be a risk semantic expression.

[0109] For example, text data could be: "This product has an annualized return of over 8% and has never incurred a loss." Through text analysis, the identified entities include "annualized return" and "8%". Based on syntactic analysis, a quantitative relationship between "annualized return" and "8%" is identified. This quantitative relationship constitutes an implied commitment. Therefore, the above text data is determined to be a risk semantic statement.

[0110] S203. Perform time-series analysis on the operation log to identify abnormal operation sequences; extract risky operations from the document operation trajectory in the operation log.

[0111] The abnormal operation sequence includes a continuous sequence of behaviors in the operation log that are inconsistent with compliance procedures, such as skipping risk warning steps. Risk operations are used to indicate non-compliant operations on critical documents.

[0112] The purpose of this step is to identify risky behaviors at the process and document levels. Specifically, based on the timestamps corresponding to each transaction in the operation log, an operation sequence is generated, and this operation sequence is compared with a standard operation sequence to determine whether at least one standard operation step is missing. If so, the operation sequence is determined to be an abnormal operation sequence.

[0113] In addition, document operation logs include document reading time and modification history. Specifically, by analyzing document operation logs and based on operation data such as interaction duration and confirmation behavior, risky operations within the document operation logs can be identified.

[0114] For example, determine the difference between the document reading time and the minimum reading time, and mark what as a risky operation when this difference is less than 0. Additionally, examine the operation records of "I have read and understood" checkboxes or electronic signatures embedded in the document; if they are not checked or are checked when the reading time is insufficient, the confirmation action in the target transaction is identified as a risky operation.

[0115] S204. Generate behavioral feature data based on risk semantic representation, abnormal operation sequence, and risk operation.

[0116] Risk semantic representation, abnormal operation sequence, and risk operation are mapped to violation semantic features, abnormal operation features, and risk operation features, respectively. These violation semantic features, abnormal operation features, and risk operation features are then fused to obtain the aforementioned behavioral feature data.

[0117] This method extracts risk semantic representations from textual data, identifies abnormal operation sequences by analyzing operation logs, and detects risky operations in document operation trajectories. This enables the system to cover hidden risks that traditional rule bases cannot detect (such as improper promises and behaviors that circumvent standard procedures). This technique enhances the semantic parsing capabilities of multi-source data, avoids feature fragmentation caused by data silos, and thus significantly improves the comprehensiveness and accuracy of risk detection.

[0118] S205. Analyze the behavioral feature data to obtain multiple key behavioral parameters of the target transaction; determine at least one first rule from multiple preset rules that does not conform to the multiple key behavioral parameters.

[0119] According to a predefined mapping relationship, behavioral feature data is converted into multiple key behavioral parameters of the target transaction. For example, if the behavioral feature data is [3, 200, 1], it is parsed according to the predefined mapping relationship, where 3 represents the dwell time on the risk warning page = 15 seconds, 200 represents the customer's net assets = 2 million, and 1 represents the target transaction business as a private equity fund.

[0120] Multiple key behavioral parameters are matched with preset rules to determine whether they conform to the preset rules. If multiple key behavioral parameters do not conform to the preset rules, the corresponding preset rule is determined as the first rule.

[0121] Understandably, the above matching process is executed by a rule engine, which matches key behavioral parameters with the conditional part of each preset rule.

[0122] S206. Determine the rule deviation of the target transaction based on the difference between the standard threshold and the corresponding key behavioral parameter in each first rule.

[0123] When there are multiple first rules, the difference between the standard threshold in the first rule and the corresponding parameter in the key behavioral parameters is calculated to obtain the aforementioned difference value. This difference value is then normalized to obtain the first rule deviation. For example, the difference between the customer level in the target transaction and the preset customer level in the first rule is calculated, and the difference value is normalized. For example, if there are a total of 5 levels and the current difference value is 2, then 2 / 5 = 0.4. 0.4 is the first rule deviation value.

[0124] The deviation scores of the first rules corresponding to multiple first rules are weighted and summed to obtain the rule deviation score of the target transaction. The deviation score for each first rule is determined based on the degree of loss incurred due to violating that first rule.

[0125] S207. Calculate the similarity between behavioral feature data and multiple historical behavioral features in the historical violation case database; determine the maximum value of the similarity as the historical case deviation.

[0126] Optionally, an AI (Artificial Intelligence) model can be constructed to calculate the cosine similarity between behavioral feature data and multiple historical behavioral features, and output the deviation of historical cases.

[0127] This step, along with step S206 above, achieves comprehensive coverage of transaction risks through a dual-path approach of rule matching and AI-based matching of historical violation cases. For example, when a financial manager uses "stable returns" instead of "principal guaranteed," the rule base may not cover this expression, but the AI ​​model can identify its risk through similarity matching of historical cases. This technical approach significantly improves the accuracy and adaptability of risk indicator calculation, providing a more reliable basis for transaction risk assessment.

[0128] S208. Determine the risk index of the target transaction based on the deviation from the rules and the deviation from historical cases.

[0129] This step is similar to the explanation of step S104 above, and will not be repeated here.

[0130] S209. Through a three-level early warning decision tree, determine the preset range to which the risk index belongs, and trigger the corresponding graded early warning mechanism for the preset range.

[0131] Different risk management measures are triggered based on the range of the risk index value, such as green channel approval, manual review, or mandatory freezing.

[0132] Optionally, the three-level early warning decision tree is configured as follows: if the risk index is less than or equal to the first threshold, a level-one early warning mechanism is triggered to mark the target transaction as low-risk and initiate a fast-track approval process; if the risk index is between the second and first thresholds, a level-two early warning mechanism is triggered to mark the target transaction as medium-risk and initiate a manual review process; if the risk index is greater than or equal to the second threshold, a level-three early warning mechanism is triggered to mark the target transaction as high-risk and initiate a freeze on the target transaction, initiating an audit process. The first threshold is less than the second threshold.

[0133] For example, after the risk index is calculated, this step triggers a tiered early warning mechanism based on its numerical range. For instance, when the risk index is ≥0.9, the target transaction is marked as "low risk" and transferred to a fast-track approval process; when 0.6 < risk index < 0.9, supplementary materials are requested and manual review is required; when the risk index is ≤0.6, the transaction is forcibly frozen and an audit process is initiated. This process dynamically allocates risk control resources through a differentiated response early warning mechanism, avoiding the omission of high-risk transactions and excessive intervention in low-risk transactions.

[0134] Optionally, to improve the efficiency of processing risky transactions, a method is provided here to generate corresponding operational suggestions based on the risks present in the target transaction. The method includes: determining the risk type of the target transaction based on at least one risk rule in a preset rule base that does not match the behavioral feature data; determining the operational suggestions corresponding to the risk type based on the historical correction operations corresponding to multiple historical risk types; and pushing the risk type and operational suggestions to the approval end.

[0135] Specifically, based on the mapping table between risk rules and risk types, the risk type of the target transaction is determined according to at least one risk rule that does not match the behavioral characteristic data, and operation suggestions corresponding to the risk type of the target transaction are generated based on the historical correction operations corresponding to multiple historical risk types.

[0136] The risk transaction early warning method provided in this embodiment acquires transaction behavior data of the target transaction, identifies risk semantic expressions from text data, performs time-series analysis on operation logs to identify abnormal operation sequences, and extracts risky operations from document operation trajectories in the operation logs. Then, it generates behavioral feature data based on risk semantic expressions, abnormal operation sequences, and risky operations. This method constructs a weighted risk identification system from interactive information to interactive processes through risk semantic expressions, abnormal operation sequences, and risky operations, achieving accurate capture of risky transaction behavior.

[0137] Furthermore, the behavioral feature data is analyzed to obtain multiple key behavioral parameters of the target transaction. At least one first rule is identified from multiple preset rules that fails to meet these key behavioral parameters. Then, based on the difference between the standard threshold in each first rule and the corresponding key behavioral parameter, the rule deviation degree of the target transaction is determined. Additionally, the similarity between the behavioral feature data and multiple historical behavioral features in a historical violation case database is calculated, and the maximum similarity is determined as the historical case deviation degree. Based on the rule deviation degree and the historical case deviation degree, the risk index of the target transaction is determined. This method not only ensures the rigid constraints of the preset rules through rule matching but also more comprehensively identifies the hidden risks in the target transaction by comparing the behavioral feature data with multiple historical behavioral features in the historical violation case database. This improves the comprehensiveness and accuracy of risk detection, facilitating more precise risk warnings.

[0138] After obtaining the risk index, a three-level early warning decision tree is used to determine the preset range to which the risk index belongs, triggering the corresponding tiered early warning mechanism within that range. This method, through the introduction of the three-level early warning decision tree, further optimizes the allocation efficiency of risk control resources. For example, high-risk transactions are automatically frozen and audited, while low-risk transactions are quickly approved, thereby reducing manual review workload and improving approval efficiency. This method, through a differentiated early warning mechanism, helps improve the response efficiency to transactions of different risk levels, covering the entire intelligent processing from risk behavior identification to risk disposal.

[0139] Figure 3 A schematic diagram of the structure of the risk transaction early warning device provided in this application. Figure 3 As shown, the risk transaction early warning device 30 provided in this embodiment is applied to the participating parties. The device includes:

[0140] The acquisition module 301 is used to acquire transaction behavior data of the target transaction and generate behavioral feature data based on the transaction behavior data;

[0141] The matching module 302 is used to match behavioral feature data with multiple preset rules in the preset rule base to obtain the rule deviation degree of the target transaction;

[0142] The matching module 302 is also used to match behavioral feature data with multiple historical behavioral features to obtain the deviation of historical cases of the target transaction;

[0143] Module 303 is used to determine the risk index of the target transaction based on the deviation from the rules and the deviation from historical cases.

[0144] Trigger module 304 is used to trigger a graded early warning mechanism based on the risk index.

[0145] In one possible implementation, the transaction behavior data includes: operation logs and text data converted from voice dialogue; the device further includes: recognition module 305, extraction module 306 and generation module 307.

[0146] The identification module 305 is used to identify risk semantic representations from text data;

[0147] The identification module 305 is also used to perform time-series analysis on the operation log and identify abnormal operation sequences;

[0148] Extraction module 306 is used to extract risky operations from the document operation trajectory in the operation log;

[0149] The generation module 307 is used to generate behavioral feature data based on risk semantic representation, abnormal operation sequence and risk operation.

[0150] In one possible implementation, the above-mentioned device further includes: a parsing module 308;

[0151] The parsing module 308 is used to parse the behavioral feature data to obtain multiple key behavioral parameters of the target transaction;

[0152] The determination module 303 is also used to determine at least one first rule from multiple preset rules that does not conform to multiple key behavioral parameters;

[0153] The determination module 303 is also used to determine the rule deviation of the target transaction based on the difference between the standard threshold in each first rule and the corresponding key behavioral parameter.

[0154] In one possible implementation, the above-mentioned device further includes: a computing module 309;

[0155] Calculation module 309 is used to calculate the similarity between behavioral feature data and multiple historical behavioral features in the historical violation case database;

[0156] The determination module 303 is also used to determine the maximum value in the similarity as the deviation of historical cases.

[0157] In one possible implementation, the determination module 303 is also used to determine the preset range to which the risk index belongs through a three-level early warning decision tree;

[0158] Trigger module 304 is specifically used to trigger the hierarchical early warning mechanism corresponding to the preset range.

[0159] In one possible implementation, the three-level early warning decision tree is configured as follows: if the risk index is less than or equal to the first threshold, the first-level early warning mechanism is triggered to mark the target transaction as low risk and enter the fast approval process;

[0160] If the risk index is between the second threshold and the first threshold, a level-two early warning mechanism is triggered to mark the target transaction as medium risk and transfer it to the manual review process;

[0161] If the risk index is greater than or equal to the second threshold, a level 3 early warning mechanism is triggered to mark the target transaction as high risk and freeze the target transaction, and then proceed to the audit process;

[0162] The first threshold is less than the second threshold.

[0163] In one possible implementation, the above-mentioned device further includes: a push module 310;

[0164] The determination module 303 is also used to determine the risk type of the target transaction based on at least one risk rule in the preset rule base that does not match the behavioral feature data;

[0165] The determination module 303 is also used to determine the operation recommendations corresponding to the risk type based on the historical correction operations corresponding to multiple historical risk types.

[0166] The push module 310 is used to push risk types and operational suggestions to the approval end.

[0167] The risk transaction early warning device provided in this embodiment can execute the method provided in the above method embodiment. Its implementation principle and technical effect are similar, and will not be described in detail here.

[0168] Figure 4 A schematic diagram of the structure of the electronic device provided in this application. Figure 4 As shown, the electronic device 40 provided in this embodiment includes at least one processor 401 and a memory 402. Optionally, the device 40 further includes a communication component 403. The processor 401, memory 402, and communication component 403 are connected via a bus 404.

[0169] In a specific implementation, at least one processor 401 executes computer execution instructions stored in memory 402, causing at least one processor 401 to perform the above-described method.

[0170] The specific implementation process of processor 401 can be found in the above method embodiments, and its implementation principle and technical effect are similar. It will not be repeated here.

[0171] In the above embodiments, it should be understood that the processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this invention can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules within the processor.

[0172] The memory may include random access memory (RAM) and may also include non-volatile memory (NVM), such as at least one disk storage device.

[0173] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, the buses shown in the accompanying drawings are not limited to a single bus or a single type of bus.

[0174] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method.

[0175] This application also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the above-described method.

[0176] The aforementioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The readable storage medium can be any available medium accessible to a general-purpose or special-purpose computer.

[0177] An exemplary readable storage medium is coupled to a processor, enabling the processor to read information from and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can reside in an Application Specific Integrated Circuit (ASIC). Alternatively, the processor and the readable storage medium can exist as discrete components in the device.

[0178] The division of units is merely a logical functional division; in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces, devices, or units, and may be electrical, mechanical, or other forms.

[0179] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0180] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0181] If a function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0182] Those skilled in the art will understand that all or part of the steps of the above-described method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.

[0183] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this application. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily essential to this application.

[0184] It should be further noted that although the steps in the flowchart are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowchart may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the sub-steps or stages of other steps.

[0185] It should be understood that the above-described device embodiments are merely illustrative, and the device of this application can also be implemented in other ways. For example, the division of units / modules in the above embodiments is only a logical functional division, and there may be other division methods in actual implementation. For example, multiple units, modules, or components may be combined, or integrated into another system, or some features may be ignored or not executed.

[0186] Furthermore, unless otherwise specified, the functional units / modules in the various embodiments of this application can be integrated into one unit / module, or each unit / module can exist physically separately, or two or more units / modules can be integrated together. The integrated units / modules described above can be implemented in hardware or as software program modules.

[0187] When integrated units / modules are implemented in hardware, the hardware can be digital circuits, analog circuits, etc. The physical implementation of the hardware structure includes, but is not limited to, transistors, memristors, etc. Unless otherwise specified, the processor can be any suitable hardware processor, such as a CPU, GPU, FPGA, DSP, and ASIC, etc. Unless otherwise specified, the storage unit can be any suitable magnetic or magneto-optical storage medium, such as Resistive Random Access Memory (RRAM), Dynamic Random Access Memory (DRAM), Static Random Access Memory (SRAM), Enhanced Dynamic Random Access Memory (EDRAM), High-Bandwidth Memory (HBM), Hybrid Memory Cube (HMC), etc.

[0188] If the integrated unit / module is implemented as a software program module and sold or used as an independent product, it can be stored in a computer-readable storage device (CMD). Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a memory and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned memory includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0189] In the above embodiments, the descriptions of each embodiment have their own emphasis. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments. The technical features of the above embodiments can be combined arbitrarily. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as the combination of these technical features does not contradict each other, it should be considered within the scope of this specification.

[0190] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this application are indicated by the following claims.

[0191] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.

Claims

1. A method for early warning of risky transactions, characterized in that, include: Acquire transaction behavior data of the target transaction, and generate behavioral feature data based on the transaction behavior data; The behavioral feature data is matched with multiple preset rules in a preset rule base to obtain the rule deviation degree of the target transaction; The behavioral feature data is matched with multiple historical behavioral features to obtain the historical case deviation of the target transaction; Based on the rule deviation and the historical case deviation, the risk index of the target transaction is determined; A tiered early warning mechanism is triggered based on the aforementioned risk index.

2. The method according to claim 1, characterized in that, The transaction behavior data includes: operation logs and text data converted from voice dialogue. The generation of behavioral feature data based on the transaction behavior data includes: Identify risk semantic representations from the text data; Perform time-series analysis on the operation logs to identify abnormal operation sequences; Extract risky operations from the document operation trajectory in the operation log; The behavioral feature data is generated based on the risk semantic representation, the abnormal operation sequence, and the risk operation.

3. The method according to claim 1, characterized in that, The step of matching the behavioral feature data with multiple preset rules in a preset rule base to obtain the rule deviation of the target transaction includes: The behavioral feature data is analyzed to obtain several key behavioral parameters of the target transaction; Determine at least one first rule that does not conform to the plurality of key behavioral parameters from the plurality of preset rules; The rule deviation of the target transaction is determined based on the difference between the standard threshold and the corresponding key behavioral parameter in each of the first rules.

4. The method according to claim 1, characterized in that, The step of matching the behavioral feature data with multiple historical behavioral features to obtain the historical case deviation of the target transaction includes: Calculate the similarity between the behavioral feature data and multiple historical behavioral features in the historical violation case database; The maximum value among the similarities is determined as the deviation of the historical cases.

5. The method according to claim 1, characterized in that, The risk index-based tiered early warning mechanism includes: The risk index is determined to be within a preset range by using a three-level early warning decision tree, and the corresponding graded early warning mechanism is triggered.

6. The method according to claim 5, characterized in that, The three-level early warning decision tree is configured as follows: If the risk index is less than or equal to the first threshold, a level one early warning mechanism is triggered to mark the target transaction as low risk and enter the fast approval process; If the risk index is between the second threshold and the first threshold, a secondary early warning mechanism is triggered to mark the target transaction as medium risk and transfer it to the manual review process; If the risk index is greater than or equal to the second threshold, a three-level early warning mechanism is triggered to mark the target transaction as high-risk and freeze the target transaction, and then proceed to the audit process; Wherein, the first threshold is less than the second threshold.

7. The method according to claim 3, characterized in that, The method further includes: Based on at least one risk rule in the preset rule base that does not match the behavioral feature data, the risk type of the target transaction is determined; Based on the historical correction operations corresponding to multiple historical risk types, determine the corresponding operation recommendations for the risk types. The risk type and operational suggestions will be pushed to the approval end.

8. A risk trading early warning device, characterized in that, include: The acquisition module is used to acquire transaction behavior data of the target transaction and generate behavioral feature data based on the transaction behavior data; The matching module is used to match the behavioral feature data with multiple preset rules in the preset rule base to obtain the rule deviation degree of the target transaction; The matching module is also used to match the behavioral feature data with multiple historical behavioral features to obtain the historical case deviation of the target transaction; The determination module is used to determine the risk index of the target transaction based on the rule deviation and the historical case deviation. The triggering module is used to trigger a graded early warning mechanism based on the risk index.

9. An electronic device, characterized in that, include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1 to 7.

11. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the method of any one of claims 1 to 7.

Images