A data processing method, device and medium for real-time financial transaction anti-fraud

Abstract

The application discloses a kind of real-time financial transaction anti-fraud data processing method, equipment and medium, it is related to data processing technical field.The method includes: providing visual rule configuration interface, visual rule configuration interface includes transaction source node and alarm node, and the processing node of corresponding fraud detection logic;In response to user operation, in visual rule configuration interface, by dragging, connecting transaction source node, processing node and alarm node, obtain real-time anti-fraud rule data stream;Real-time anti-fraud rule data stream is converted into structured query language SQL statement, and the detection logic of processing node is integrated to SELECT query projection list;SQL statement is submitted to stream computing engine cluster, to carry out real-time fraud detection to the transaction data of inflow.The application realizes the detection logic of each processing node by the above method Integrated into SELECT query projection list, while maintaining the ease of use of low-code development, ensure the optimization of processing efficiency.

Description

Technical Field

[0001] This application relates to the field of data processing technology, and in particular to a data processing method, device and medium for real-time financial transaction anti-fraud. Background Technology

[0002] In existing technologies, developing directly using Flink's DataStream / DataSet API requires developers to have deep knowledge of programming and distributed systems, resulting in high learning costs and long development cycles. While some visual drag-and-drop tools lower the barrier to entry, they typically embed processing logic into pre-defined components, failing to meet the complex and ever-changing business logic computation needs and lacking the flexibility to implement advanced functions by writing custom SQL or code. Offline and real-time tasks often require different toolchains or programming models, leading to increased development, maintenance, and management costs, and making it impossible to complete all types of data development on a unified platform.

[0003] Furthermore, financial anti-fraud systems based on stream computing engines primarily employ two development models. One is the direct coding model, where developers manually write fraud detection rules using the DataStream API or SQL. While flexible, this approach demands high technical skills from developers, and rule changes require code modifications and job restarts, failing to meet the demands of rapid business iteration. The other is the visual drag-and-drop model, which assembles data streams graphically using pre-built components. This method has a lower technical barrier but lacks flexibility, making it difficult to implement complex custom rules. Moreover, multiple rules are often converted into multiple independent stream processing jobs, leading to resource waste and increased processing latency.

[0004] Based on the above analysis, the problems and shortcomings of the existing technology are as follows: Existing data processing methods for fraud prevention in financial transactions cannot simultaneously achieve ease of use and flexibility, nor support updates. Summary of the Invention

[0005] This application provides a data processing method, device, and medium for real-time financial transaction anti-fraud, which can solve the problem that existing financial transaction anti-fraud data processing methods cannot simultaneously achieve ease of use and flexibility, and support updates.

[0006] In a first aspect, embodiments of this application provide a data processing method for real-time financial transaction anti-fraud, the method comprising: providing a visual rule configuration interface, the visual rule configuration interface including transaction source nodes and alarm nodes, as well as processing nodes corresponding to fraud detection logic; responding to user operations, obtaining a real-time anti-fraud rule data stream by dragging and connecting transaction source nodes, processing nodes, and alarm nodes in the visual rule configuration interface; converting the real-time anti-fraud rule data stream into a structured query language (SQL) statement, and integrating the detection logic of the processing nodes into a SELECT query projection list; and submitting the SQL statement to a stream computing engine cluster to perform real-time fraud detection on the incoming transaction data.

[0007] In one implementation of this application, the real-time anti-fraud rule data stream is converted into a Structured Query Language (SQL) statement, and the detection logic of the processing nodes is integrated into a SELECT query projection list. Specifically, this includes: parsing the real-time anti-fraud rule data stream to identify common transaction data sources; traversing the processing nodes and converting the fraud detection logic corresponding to each processing node into a Boolean-type SQL expression; constructing a SELECT statement based on the transaction data source, combining all the generated Boolean-type SQL expressions using operators, and placing them in the projection list of the same SELECT statement to obtain a comprehensive fraud flag field; and constructing an INSERT INTO statement to insert the transaction data that triggered the rule into the alert target table when the comprehensive fraud flag field is true.

[0008] In one implementation of this application, the method further includes: generating a corresponding detailed rule trigger flag field for each Boolean type SQL expression in the SELECT statement; and inserting the detailed rule trigger flag field and transaction data together into a predefined fraud audit report.

[0009] In one implementation of this application, the method further includes: based on the processing node including rule nodes and model nodes; when the processing node is a rule node, mapping the configured logical judgment conditions based on transaction fields into Boolean type SQL expressions; when the processing node is a model node, calling the user-defined function UDF in the stream computing engine, the UDF encapsulating a pre-trained fraud detection machine learning model; taking transaction data as input parameters, and the Boolean type output result of the UDF as a Boolean type SQL expression.

[0010] In one implementation of this application, before submitting the SQL statement to the stream processing engine cluster, the method further includes: configuring a stream processing engine state retention time parameter that matches the fraud detection business logic for the stream processing task corresponding to the SQL statement; enabling the checkpointing mechanism of the stream processing engine and setting the checkpoint interval.

[0011] In one implementation of this application, the method further includes: receiving transaction data in real time while the SQL statement is running in the stream computing engine cluster; and dynamically displaying the real-time transaction throughput, the triggering frequency and statistics of fraud rules, and the current processing latency through a monitoring dashboard.

[0012] In one implementation of this application, the method further includes: providing an SQL encoding interface that allows users to write or modify SQL scripts; and submitting the SQL scripts to the stream computing engine cluster after performing syntax validation.

[0013] In one implementation of this application, the method further includes: generating a rule change instruction in response to a user's modification operation on the deployed and running real-time anti-fraud rule data stream in the visual rule configuration interface; and sending the rule change instruction to the stream computing engine cluster without stopping the SQL statement currently being executed in the stream computing engine cluster.

[0014] Secondly, embodiments of this application also provide a data processing device for real-time financial transaction anti-fraud, the device including at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to: provide a visual rule configuration interface, the visual rule configuration interface including transaction source nodes and alarm nodes, and processing nodes corresponding to fraud detection logic; in response to user operation, obtain a real-time anti-fraud rule data stream by dragging and connecting transaction source nodes, processing nodes, and alarm nodes in the visual rule configuration interface; convert the real-time anti-fraud rule data stream into a structured query language (SQL) statement, and integrate the detection logic of the processing nodes into a SELECT query projection list; and submit the SQL statement to a stream computing engine cluster to perform real-time fraud detection on the incoming transaction data.

[0015] Thirdly, embodiments of this application also provide a non-volatile computer storage medium for real-time financial transaction anti-fraud data processing, storing computer-executable instructions. These computer-executable instructions are configured to: provide a visual rule configuration interface, including transaction source nodes and alarm nodes, as well as processing nodes corresponding to fraud detection logic; respond to user operations by dragging and connecting transaction source nodes, processing nodes, and alarm nodes in the visual rule configuration interface to obtain a real-time anti-fraud rule data stream; convert the real-time anti-fraud rule data stream into a Structured Query Language (SQL) statement and integrate the detection logic of the processing nodes into a SELECT query projection list; and submit the SQL statement to a stream computing engine cluster for real-time fraud detection of the incoming transaction data.

[0016] This application provides a data processing method, device, and medium for real-time financial transaction anti-fraud. By uniformly converting the visualized configuration of anti-fraud rule data streams into a single SQL statement and integrating the detection logic of each processing node into a SELECT query projection list, it achieves optimized processing efficiency while maintaining low-code development ease of use. It provides business personnel with an intuitive visualized rule configuration interface, lowering the technical threshold, and ensures processing performance through a unified SQL conversion and execution mechanism, avoiding resource waste and latency issues caused by multiple independent jobs. Simultaneously, it supports the integration of machine learning models and hot rule updates, enabling the anti-fraud system to quickly adapt to constantly changing fraud methods, greatly improving the system's practicality and reliability. Attached Figure Description

[0017] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings: Figure 1 A flowchart of a real-time financial transaction anti-fraud data processing method provided in this application embodiment; Figure 2 This is a schematic diagram of the internal structure of a data processing device for real-time financial transaction anti-fraud, provided as an embodiment of this application. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0019] This application provides a data processing method, device, and medium for real-time financial transaction anti-fraud, which solves the problem that existing financial transaction anti-fraud data processing methods cannot simultaneously achieve ease of use and flexibility, and support updates.

[0020] The technical solutions proposed in the embodiments of this application will be described in detail below with reference to the accompanying drawings.

[0021] Figure 1 This document provides a flowchart of a real-time financial transaction anti-fraud data processing method as an embodiment of this application. Figure 1 As shown in the figure, the data processing method for real-time financial transaction anti-fraud provided in this application embodiment specifically includes the following steps: Step 10: Provide a visual rule configuration interface, which includes transaction source nodes, alarm nodes, and corresponding fraud detection logic processing nodes.

[0022] This step provides users with a visual interface for dragging and connecting nodes. Transaction source nodes represent the source of streaming transaction data, such as a transaction topic in Kafka. Users can configure connection parameters through the properties panel. Processing nodes correspond to specific fraud detection logic units, which can be further divided into: Rule nodes: used to configure Boolean judgment logic based on transaction fields, such as a "amount greater than threshold" node, where users can set specific judgment conditions through the properties panel; Model nodes: used to integrate complex machine learning models, where users can specify the path to the trained model file or the model service address through the properties panel. Data target nodes, such as alert nodes, are used to define the output target of risky transactions, such as another Kafka topic, a relational database, or a real-time alert system.

[0023] Step 20: In response to user actions, real-time anti-fraud rule data streams are obtained by dragging and connecting transaction source nodes, processing nodes, and alarm nodes in the visual rule configuration interface.

[0024] In this step, the system responds in real-time to user actions on the visual rule configuration interface. Users drag and drop desired transaction source nodes, processing nodes (one or more), and alert nodes from the node library onto the canvas, connecting these nodes according to data processing logic. For example, a user can connect a transaction source node to a node whose amount exceeds a threshold, and then connect the output of that rule node to an alert node. The background continuously monitors these graphical operations and constructs a directed acyclic graph (DAG) in memory, consisting of nodes and edges, that fully expresses the anti-fraud business logic—the real-time anti-fraud rule data stream. Internally, this data stream is typically represented as a structured JSON object, recording the unique identifier, type, configuration parameters, and connection relationships between each node.

[0025] Step 30: Convert the real-time anti-fraud rule data stream into Structured Query Language (SQL) statements and integrate the detection logic of the processing nodes into the SELECT query projection list; As an optional embodiment, the real-time anti-fraud rule data stream is converted into a structured query language (SQL) statement, and the detection logic of the processing node is integrated into the SELECT query projection list. Specifically, it may include: Step 301: Parse the real-time anti-fraud rule data stream and identify common transaction data sources.

[0026] In this step, the task parsing engine first parses and performs semantic analysis on the rule data stream to confirm that all processing nodes in the entire data stream originate from and share the same logical data source, namely the transaction data source node. This ensures that all transformation logic can ultimately be combined under the same FROM clause. If the parsing finds multiple incompatible independent data sources, the system will prompt the user to make corrections or adopt other transformation strategies.

[0027] Step 302: Traverse the processing nodes and convert the fraud detection logic corresponding to each processing node into a boolean SQL expression.

[0028] In this step, the engine traverses each processing node in the data stream. Based on the type and configuration, it atomically converts the fraud detection logic into an independent Boolean SQL expression to judge a single transaction record. A TRUE result indicates that the rule corresponding to that node is triggered. For rule nodes, the configured logical judgment conditions are directly mapped to Boolean SQL expressions; for example, a large transaction node might be converted to: amount>10000. For model nodes, the conversion process generates a call to a preset user-defined function (UDF).

[0029] Step 303: Based on the transaction data source, construct a SELECT statement, combine all generated Boolean SQL expressions using operators, and place them in the projection list of the same SELECT statement to obtain the comprehensive fraud flag field.

[0030] In this step, all generated Boolean SQL expressions are combined using a logical OR operator to form a comprehensive Boolean expression. This comprehensive expression is then placed in the projection list of the SELECT statement and defined as a comprehensive fraud flag field named is_fraud_alert. When this field is TRUE, it means that the transaction has triggered at least one anti-fraud rule.

[0031] Optionally, the audit field generation is to meet the stringent audit and traceability requirements of financial businesses. The engine also generates a corresponding detailed rule trigger flag field in the projection list for each original boolean SQL expression. For example, in addition to is_fraud_alert, fields such as rule_high_amount and rule_frequency will be generated to accurately record the triggering status of each rule.

[0032] Step 304: Construct an INSERT INTO statement to insert the transaction data that triggered the rule into the alert target table when the comprehensive fraud flag field is true.

[0033] In this step, the engine constructs a complete SQL INSERT INTO statement, outputting the SELECT query results to the specified data target. The main alert channel constructs an INSERT INTO alert_target_table SELECT ... FROM transaction_stream WHERE is_fraud_alert = TRUE statement, which is responsible for inserting transactions confirmed as risky into the alert target table in real time to trigger subsequent alert processes.

[0034] Optionally, the audit report channel can simultaneously construct another INSERT INTO audit_report_table SELECT ... FROM transaction_stream statement to persist all transaction details and their corresponding rule trigger flags to the audit report table for subsequent analysis, auditing, and model optimization.

[0035] As an optional embodiment, the method may further include: step 305: in the SELECT statement, generating a corresponding detail rule trigger marker field for each Boolean type SQL expression.

[0036] In this step, in addition to generating the comprehensive fraud flag field, a dedicated field with a clear business meaning is created in parallel for each independent fraud detection logic, i.e., the Boolean type SQL expression transformed from each processing node, in the projection list.

[0037] Step 306: Insert the detailed rule trigger flag field along with the transaction data into the predefined fraud audit report.

[0038] In this step, an audit data stream independent of the real-time alert channel is constructed. This involves creating a separate INSERTINTO statement that uses the same SELECT query as the main alert channel as its data source. Specifically, the target table is a predefined fraud audit report table used to store historical details. The inserted content includes all detailed rule trigger flag fields generated in S305, along with core raw transaction data fields from the transaction data stream, such as transaction ID, user ID, time, and amount. The execution logic is that this audit data stream is typically configured for full insertion, meaning that regardless of whether the overall fraud flag is true or not, all transaction records and rule trigger details flowing through the system will be persisted to the audit report.

[0039] As an optional embodiment, before submitting the SQL statement to the stream processing engine cluster, the method may further include: configuring a stream processing engine state retention time parameter that matches the fraud detection business logic for the stream processing task corresponding to the SQL statement; enabling the checkpointing mechanism of the stream processing engine and setting the checkpoint interval.

[0040] In this step, since anti-fraud rules often include time-window-based calculations, the stream processing engine needs to maintain an internal state to record the data within the window. Based on the logical requirements of all processing nodes in the real-time anti-fraud rule data stream, it automatically analyzes and calculates the required maximum time window length and configures the state retention time parameter for the corresponding stream processing task accordingly. This ensures that the engine can correctly clean up expired state data, prevents the state from growing indefinitely and consuming excessive resources, and guarantees the semantic accuracy of time-window-based calculations.

[0041] Furthermore, to provide fault recovery capabilities, this step automatically enables the checkpointing mechanism of the stream computing engine for the stream processing task, and presets a reasonable checkpointing time interval based on the balance between data consistency requirements and performance overhead. This way, when the task restarts due to a fault, it can recover from the most recent successful checkpoint, achieving exact once or at least once state consistency semantics and avoiding data loss or duplicate calculations.

[0042] Step 40: Submit the SQL statement to the stream computing engine cluster for real-time fraud detection of the incoming transaction data.

[0043] In this step, a unified SQL statement and related configuration parameters are encapsulated into a job description object through the stream computing engine client. This object is then submitted to the stream computing engine cluster via the cluster submission interface. The cluster's resource manager allocates computing resources for the task, performs final verification and optimization of the SQL statement, and generates a distributed execution plan. Specifically, it connects to external data sources and continuously consumes incoming transaction data streams; executes unified SQL logic in parallel on multiple computing nodes, synchronously calculating all fraud rules for each transaction; and writes transaction records that trigger alarms to the designated target system, with the engine automatically managing the status data during the computation process.

[0044] As an optional embodiment, the method may further include: based on the processing node including rule nodes and model nodes; when the processing node is a rule node, mapping the configured logical judgment conditions based on transaction fields into Boolean type SQL expressions; when the processing node is a model node, calling a user-defined function UDF in the stream computing engine, the UDF encapsulating a pre-trained fraud detection machine learning model; using transaction data as input parameters, and the Boolean type output result of the UDF as a Boolean type SQL expression.

[0045] In this step, when the processing node is a rule node, the logical judgment conditions based on transaction fields configured in the visualization interface are directly mapped to the corresponding Boolean SQL expressions. For example, the condition that the transaction amount is greater than the threshold is mapped to amount>10000. When the processing node is a model node, the system implements complex detection logic by calling user-defined functions in the stream computing engine. Specifically, the UDF encapsulates the inference logic of a pre-trained fraud detection machine learning model. During the SQL conversion process, the system generates a call statement for the UDF and uses the relevant transaction data fields as its input parameters. The Boolean return value after the UDF is executed serves as the Boolean SQL expression corresponding to this model node.

[0046] In this way, by differentiating the conversion mechanism between rule nodes and model nodes, the system can efficiently process simple judgments based on explicit rules, and also integrate complex machine learning models. This achieves the unified fusion and flexible expansion of simple rules and intelligent models, significantly improving the detection capability and adaptability of the anti-fraud system.

[0047] As an optional embodiment, the method may further include: step 501: receiving transaction data in real time while the SQL statement is running in the stream computing engine cluster; step 502: dynamically displaying real-time transaction throughput, the triggering frequency and statistics of fraud rules, and the current processing latency through a monitoring dashboard.

[0048] In this step, a real-time visual monitoring interface provides operations and maintenance personnel and business analysts with an intuitive view of the system's operational status, enabling performance bottlenecks and business anomalies to be quickly identified and located, significantly improving the system's observability and operational efficiency.

[0049] As an optional embodiment, the method may further include: providing an SQL encoding interface that allows users to write or modify SQL scripts; and submitting the SQL scripts to the stream computing engine cluster after performing syntax validation.

[0050] In this step, after the user submits the SQL script, it undergoes rigorous syntax and semantic validation to ensure its correctness. Once validated, the SQL script, like tasks generated visually, is submitted to the stream computing engine cluster for execution. By providing two complementary development modes—visual configuration and SQL coding—it satisfies the needs for rapid development and business personnel participation while retaining sufficient coding flexibility for complex scenarios, achieving a balance between ease of use and powerful functionality.

[0051] As an optional embodiment, the method may further include: generating a rule change instruction in response to a user's modification operation on the deployed and running real-time anti-fraud rule data stream in the visual rule configuration interface; and sending the rule change instruction to the stream computing engine cluster without stopping the SQL statement currently being executed in the stream computing engine cluster.

[0052] In this step, in response to the user's editing operation on the already running rule data stream in the visual interface, the system generates a structured rule change instruction. This instruction precisely describes the differences in rules, such as additions, deletions, and modifications. The system then sends the rule change instruction to the stream computing engine cluster through the management interface provided by the stream computing engine, without stopping the currently executing SQL job. The cluster dynamically updates its runtime execution logic according to the instruction, ensuring that subsequent transaction data is immediately processed according to the new rule logic.

[0053] The above are embodiments of the method proposed in this application. Based on the same inventive concept, embodiments of this application also provide a data processing device for real-time financial transaction anti-fraud, the structure of which is as follows: Figure 2 As shown.

[0054] Figure 2 This is a schematic diagram of the internal structure of a data processing device for real-time financial transaction anti-fraud, provided as an embodiment of this application. Figure 2 As shown, the device includes: At least one processor 201; And a memory 202 that is communicatively connected to at least one processor; The memory 202 stores instructions executable by at least one processor. These instructions are executed by at least one processor 201 to enable the processor 201 to: provide a visual rule configuration interface, which includes transaction source nodes, alarm nodes, and processing nodes corresponding to fraud detection logic; in response to user operations, obtain a real-time anti-fraud rule data stream by dragging and connecting transaction source nodes, processing nodes, and alarm nodes in the visual rule configuration interface; convert the real-time anti-fraud rule data stream into a structured query language (SQL) statement and integrate the detection logic of the processing nodes into a SELECT query projection list; and submit the SQL statement to the stream computing engine cluster for real-time fraud detection of the incoming transaction data.

[0055] Some embodiments of this application provide corresponding to Figure 1A non-volatile computer storage medium for real-time financial transaction anti-fraud data processing stores computer-executable instructions. These instructions are configured to: provide a visual rule configuration interface, including transaction source nodes, alarm nodes, and corresponding fraud detection logic processing nodes; respond to user operations by dragging and connecting transaction source nodes, processing nodes, and alarm nodes within the visual rule configuration interface to obtain a real-time anti-fraud rule data stream; convert the real-time anti-fraud rule data stream into Structured Query Language (SQL) statements and integrate the detection logic of the processing nodes into a SELECT query projection list; and submit the SQL statements to a stream computing engine cluster for real-time fraud detection of the incoming transaction data.

[0056] The various embodiments in this application are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the embodiments for IoT devices and media are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0057] The systems, media, and methods provided in this application are one-to-one correspondences. Therefore, the systems and media also have similar beneficial technical effects as their corresponding methods. Since the beneficial technical effects of the methods have been described in detail above, the beneficial technical effects of the systems and media will not be repeated here.

[0058] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0059] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0060] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0061] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0062] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0063] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0064] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0065] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0066] The above description is merely an embodiment of this application and is not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A data processing method for real-time financial transaction anti-fraud, characterized in that, The method includes: A visual rule configuration interface is provided, which includes transaction source nodes and alarm nodes, as well as processing nodes corresponding to fraud detection logic; In response to user operations, real-time anti-fraud rule data streams can be obtained by dragging and connecting the transaction source node, processing node, and alarm node in the visual rule configuration interface; The real-time anti-fraud rule data stream is converted into a structured query language (SQL) statement, and the detection logic of the processing node is integrated into the SELECT query projection list. The SQL statement is submitted to the stream computing engine cluster to perform real-time fraud detection on the incoming transaction data.

2. The data processing method for real-time financial transaction anti-fraud according to claim 1, characterized in that, The process of converting the real-time anti-fraud rule data stream into Structured Query Language (SQL) statements and integrating the detection logic of the processing nodes into a SELECT query projection list specifically includes: The real-time anti-fraud rule data stream is analyzed to identify common transaction data sources; Iterate through the processing nodes and convert the fraud detection logic corresponding to each processing node into a Boolean SQL expression; Based on the transaction data source, a SELECT statement is constructed, and all generated Boolean-type SQL expressions are combined using operators and placed in the projection list of the same SELECT statement to obtain the comprehensive fraud flag field; Construct an INSERT INTO statement that, when the Comprehensive Fraud Flag field is true, inserts the transaction data that triggered the rule into the Alert Target table.

3. The data processing method for real-time financial transaction anti-fraud according to claim 2, characterized in that, The method further includes: In the SELECT statement, a corresponding detail rule trigger flag field is generated for each of the Boolean type SQL expressions; The detailed rule trigger flag field is inserted together with the transaction data into a predefined fraud audit report.

4. The data processing method for real-time financial transaction anti-fraud according to claim 2, characterized in that, The method further includes: The processing nodes include rule nodes and model nodes; When the processing node is a rule node, the configured logical judgment conditions based on the transaction field are mapped to the Boolean type SQL expression; When the processing node is a model node, the user-defined function UDF in the stream computing engine is called, and the UDF encapsulates a pre-trained fraud detection machine learning model. The transaction data is used as input parameters, and the Boolean type output result of the UDF is used as the Boolean type SQL expression.

5. The data processing method for real-time financial transaction anti-fraud according to claim 1, characterized in that, Before submitting the SQL statement to the stream computing engine cluster, the method further includes: Configure the stream processing engine state retention time parameter that matches the fraud detection business logic for the stream processing task corresponding to the SQL statement; Enable the checkpointing mechanism of the stream computing engine and set the checkpoint interval.

6. The data processing method for real-time financial transaction anti-fraud according to claim 1, characterized in that, The method further includes: The transaction data is received in real time while the SQL statement is being executed in the stream computing engine cluster. The monitoring dashboard dynamically displays real-time transaction throughput, the frequency and statistics of fraud rule triggers, and current processing latency.

7. The data processing method for real-time financial transaction anti-fraud according to claim 1, characterized in that, The method further includes: Provides an SQL coding interface, allowing users to write or modify SQL scripts; After the SQL script is syntax-validated, it is submitted to the stream computing engine cluster.

8. The data processing method for real-time financial transaction anti-fraud according to claim 1, characterized in that, The method further includes: In response to the user's modification operation on the deployed and running real-time anti-fraud rule data stream in the visual rule configuration interface, a rule change instruction is generated; The rule change instruction is sent to the stream computing engine cluster without stopping the SQL statement currently being executed in the stream computing engine cluster.

9. A data processing device for real-time financial transaction anti-fraud, characterized in that, The device includes: At least one processor; And, a memory communicatively connected to the at least one processor; The memory stores instructions executable by the at least one processor, which, when executed by the at least one processor, enable the at least one processor to: A visual rule configuration interface is provided, which includes transaction source nodes and alarm nodes, as well as processing nodes corresponding to fraud detection logic; In response to user operations, real-time anti-fraud rule data streams can be obtained by dragging and connecting the transaction source node, processing node, and alarm node in the visual rule configuration interface; The real-time anti-fraud rule data stream is converted into a structured query language (SQL) statement, and the detection logic of the processing node is integrated into the SELECT query projection list. The SQL statement is submitted to the stream computing engine cluster to perform real-time fraud detection on the incoming transaction data.

10. A non-volatile computer storage medium for real-time financial transaction anti-fraud data processing, storing computer-executable instructions, characterized in that, The computer-executable instructions are set as follows: A visual rule configuration interface is provided, which includes transaction source nodes and alarm nodes, as well as processing nodes corresponding to fraud detection logic; In response to user operations, real-time anti-fraud rule data streams can be obtained by dragging and connecting the transaction source node, processing node, and alarm node in the visual rule configuration interface; The real-time anti-fraud rule data stream is converted into a structured query language (SQL) statement, and the detection logic of the processing node is integrated into the SELECT query projection list. The SQL statement is submitted to the stream computing engine cluster to perform real-time fraud detection on the incoming transaction data.

Images