Method and device for generating suspicious transaction statistical view based on big data

Abstract

The present application relates to a method and device for generating a suspicious transaction statistical view based on big data. The method comprises: obtaining transaction data within a preset time period, searching for associated data on a big data platform according to the transaction data; inputting the transaction data and the associated data into a monitoring model, and identifying whether the transaction data is a suspicious transaction through the monitoring model; when the transaction data is determined to be a suspicious transaction, obtaining the risk type corresponding to the suspicious transaction; and generating a statistical view of suspicious transactions using the suspicious transactions within the preset time period and the risk type corresponding to the suspicious transactions. The use of this method can effectively improve the accuracy of the statistical view of suspicious transactions.

Description

[0001] The present application relates to the field of computer technology, and in particular to a method and device for generating a suspicious transaction statistical view based on big data. Background Art

[0002] Money laundering has contributed to serious crimes such as smuggling, fraud, and drugs, disrupted the normal social and economic order, and has serious social harm. The channels for money laundering involve various fields such as banking, insurance, and securities. Anti-money laundering is conducive to maintaining economic security and preventing crimes, and is of great significance. Financial institutions need to report suspicious transactions related to money laundering to regulatory authorities in a timely manner. In order to facilitate the understanding of the overall situation of suspicious transactions, the relevant data of suspicious transactions can be used to create a view. In the traditional way, suspicious transactions are monitored and identified using the anti-money laundering rule model, and the data basis of the rule model is usually only the current transaction data or multiple transactions of the same customer. The rule model has deficiencies in identifying suspicious transactions, resulting in omissions and false positives of suspicious transactions. As a result, the statistical view of suspicious transactions is less accurate. Summary of the invention

[0003] Based on this, it is necessary to provide a method, device, computer equipment and storage medium for generating a suspicious transaction statistical view based on big data, which can effectively improve the accuracy of the statistical view of suspicious transactions in response to the above technical problems.

[0004] A method for generating a suspicious transaction statistical view based on big data, the method comprising:

[0005] Acquire transaction data within a preset time period, and search for related data on the big data platform based on the transaction data;

[0006] Inputting the transaction data and the associated data into a monitoring model, and identifying whether the transaction data is a suspicious transaction through the monitoring model;

[0007] When the transaction data is determined to be a suspicious transaction, obtaining a risk type corresponding to the suspicious transaction;

[0008] A statistical view of suspicious transactions is generated using suspicious transactions within a preset time period and risk types corresponding to the suspicious transactions.

[0009] In one embodiment, searching for related data on a big data platform according to the transaction data includes:

[0010] Obtaining a customer identifier and a plurality of transaction fields in the transaction data;

[0011] Acquire a plurality of monitoring features corresponding to the monitoring model;

[0012] Based on the big data platform, the feature fields associated with the transaction fields are searched according to the customer identification and monitoring features.

[0013] In one embodiment, the associated data includes a plurality of feature fields; and identifying whether the transaction data is a suspicious transaction by using the monitoring model includes:

[0014] Calling corresponding anti-money laundering rules according to the transaction field and the plurality of characteristic fields;

[0015] Using the anti-money laundering rules to perform rule judgment on the transaction field and the feature field to obtain corresponding rule scores;

[0016] Accumulating multiple rule scores to obtain a monitoring score corresponding to the transaction data;

[0017] When the monitoring score exceeds a threshold, the transaction data is marked as a suspicious transaction.

[0018] In one embodiment, the using the anti-money laundering rule to perform rule judgment on the transaction field and the feature field to obtain the corresponding rule score includes:

[0019] Obtaining a parameter, a parameter value or a parameter description corresponding to the transaction field or the feature field;

[0020] Matching the parameter, parameter value or parameter description with one or more corresponding anti-money laundering rules;

[0021] When the match is successful, the rule score corresponding to the corresponding anti-money laundering rule is recorded.

[0022] In one embodiment, the method further comprises:

[0023] Get multiple risk profile labels;

[0024] Searching for corresponding customer data through the big data platform according to the risk profile label;

[0025] Generate a customer risk profile using the user data;

[0026] The customer risk profile is added to the statistical view.

[0027] A device for generating a suspicious transaction statistical view based on big data, the device comprising:

[0028] A data acquisition module, used to acquire transaction data within a preset time period, and search for related data on the big data platform based on the transaction data;

[0029] A suspicious transaction identification module, used to input the transaction data and the associated data into a monitoring model, and identify whether the transaction data is a suspicious transaction through the monitoring model;

[0030] A risk type identification module, configured to obtain a risk type corresponding to the suspicious transaction when the transaction data is determined to be a suspicious transaction;

[0031] The view generation module is used to generate a statistical view of suspicious transactions using suspicious transactions within a preset time period and risk types corresponding to the suspicious transactions.

[0032] In one embodiment, the data acquisition module is also used to obtain a customer identifier and multiple transaction fields in the transaction data; obtain multiple monitoring features corresponding to the monitoring model; and based on the big data platform, search for feature fields associated with the transaction fields according to the customer identifier and monitoring features.

[0033] In one of the embodiments, the associated data includes multiple feature fields; the suspicious transaction identification module is also used to call corresponding anti-money laundering rules based on the transaction field and the multiple feature fields; use the anti-money laundering rules to perform rule judgment on the transaction field and the feature field to obtain corresponding rule scores; accumulate multiple rule scores to obtain a monitoring score corresponding to the transaction data; when the monitoring score exceeds a threshold, mark the transaction data as a suspicious transaction.

[0034] A computer device includes a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps in the above-mentioned method embodiments when executing the computer program.

[0035] A computer-readable storage medium stores a computer program, which implements the steps in the above-mentioned method embodiments when executed by a processor.

[0036] The above-mentioned suspicious transaction statistical view generation method, device, computer equipment and storage medium based on big data, by searching for multiple dimensions of associated data corresponding to transaction data in the big data platform, makes the data range for identifying suspicious transactions not limited to the historical transaction data of the same customer, but combines data of more dimensions, thereby effectively improving the accuracy of suspicious transaction identification. When a suspicious transaction is identified, the corresponding risk type can be accurately identified using the risk model. Therefore, a more accurate statistical view can be generated using suspicious transactions and risk types within a preset time period, effectively improving the accuracy of the suspicious transaction statistical view. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1This is an application scenario diagram of a suspicious transaction statistical view generation method based on big data in one embodiment;

[0038] Figure 2 It is a flowchart of a method for generating a suspicious transaction statistical view based on big data in one embodiment;

[0039] Figure 3 It is a flowchart of a step of searching for related data on a big data platform according to the transaction data in one embodiment;

[0040] Figure 4 A schematic diagram of a process for adding a risk profiling step in an embodiment;

[0041] Figure 5 It is a structural block diagram of a suspicious transaction statistical view generating device based on big data in one embodiment;

[0042] Figure 6 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0043] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0044] The suspicious transaction statistical view generation method based on big data provided in this application can be applied to Figure 1 In the application environment shown, the terminal 102 communicates with the server 104 through a network. The terminal 102 may be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, and portable wearable devices, and the server 104 may be implemented as an independent server or a server cluster consisting of multiple servers.

[0045] The server 104 obtains transaction data within a preset time period, searches for associated data on the big data platform based on the transaction data, inputs the transaction data and the associated data into the monitoring model, and identifies whether the transaction data is a suspicious transaction through the monitoring model. When the transaction data is determined to be a suspicious transaction, the server 104 identifies the risk type corresponding to the suspicious transaction. The server 104 generates a statistical view of the suspicious transaction using the suspicious transactions within the preset time period and the corresponding risk type. The supervisor can send a request to obtain the statistical view to the server 104 through the terminal 102, and the server 104 returns the statistical view of the suspicious transaction to the terminal 102 according to the request.

[0046] In one embodiment, Figure 2As shown in the figure, a method for generating suspicious transaction statistical views based on big data is provided. Figure 1 The server in the example is used to illustrate the following steps:

[0047] Step 202, obtaining transaction data within a preset time period, and searching for related data on the big data platform based on the transaction data.

[0048] A database is deployed on the server. After each transaction is executed, the corresponding transaction data will be stored in the database. The server can obtain transaction data within a preset time period from the database at a preset frequency to identify whether there are suspicious transactions for anti-money laundering.

[0049] The big data platform stores a variety of customer-related data, including basic customer information, historical transaction data, related transactions, credit information, and risk management information. The basic customer information includes not only the basic information of the customer himself, but also the information of other people related to the customer, which can also be called the information of people who have social relations with the customer. For example, information of family members, relatives, and information of people with investment relations. In order to ensure the validity of the information in the big data platform, the data in the big data platform can also be updated according to a specific cycle.

[0050] After the server obtains the transaction data in the database, it can search for related data in the big data platform. The transaction data includes a customer identifier and multiple transaction fields, and the monitoring model has corresponding multiple monitoring features. The server searches for feature fields associated with the transaction fields in the big data platform based on the customer identifier and the monitoring features.

[0051] Step 204: input the transaction data and the associated data into the monitoring model, and use the monitoring model to identify whether the transaction data is a suspicious transaction.

[0052] The server inputs the transaction data and related data into the monitoring model. The monitoring model calls the corresponding anti-money laundering rules based on multiple transaction fields and multiple feature fields, and uses the anti-money laundering rules to make rule judgments on the transaction fields and feature fields to obtain the corresponding rule scores. The monitoring model accumulates the scores of multiple rules to obtain the monitoring score corresponding to the transaction data. When the monitoring score exceeds the threshold, the monitoring model marks the transaction data as a suspicious transaction.

[0053] By searching for related data of transaction data in the big data platform, multiple data related to the transaction data can be obtained. It is not limited to the historical transaction data of the same customer, but combines data of more dimensions, expanding the data scope for identifying suspicious transactions, thereby effectively improving the accuracy of suspicious transaction identification.

[0054] Step 206: When the transaction data is determined to be a suspicious transaction, the risk type corresponding to the suspicious transaction is obtained.

[0055] When the server identifies a suspicious transaction, it calls the code corresponding to the monitoring feature to perform risk analysis based on the multiple feature fields in the big data search results. When the feature field corresponding to the monitoring feature meets the risk rule, the server adds the corresponding risk tag to the big data search results. The risk tag can be similar to the monitoring feature. Since different risk models correspond to different monitoring indicators, that is, the corresponding risk tags are different, the server can accurately identify the risk type of the suspicious transaction based on the multiple risk tags corresponding to the suspicious transaction.

[0056] Step 208: Generate a statistical view of suspicious transactions using the suspicious transactions within a preset time period and the risk types corresponding to the suspicious transactions.

[0057] The server collects statistics on suspicious transactions and risk types within a preset time period and generates a statistical view of suspicious transactions. The statistical view can be in various forms, such as a bar chart, a pie chart, a line chart, etc. The server can also collect statistics on the total amount of transactions within a preset time period and generate a statistical view of suspicious transactions using the total amount of transactions, the number of suspicious transactions, and the risk type.

[0058] In this embodiment, by searching for multiple dimensions of associated data corresponding to transaction data in the big data platform, the data scope for identifying suspicious transactions is not limited to the historical transaction data of the same customer, but combines data of more dimensions, thereby effectively improving the accuracy of identifying suspicious transactions. When identifying suspicious transactions, the corresponding risk type can be accurately identified using the risk model. Therefore, a more accurate statistical view can be generated using suspicious transactions and risk types within a preset time period, effectively improving the accuracy of the suspicious transaction statistical view.

[0059] Furthermore, the supervisor can send a request to obtain the statistical view to the server through the terminal, and the server returns the statistical view of the suspicious transaction to the supervisor according to the request, so that the supervisor can intuitively understand the status of the suspicious transaction within the preset time period.

[0060] In one embodiment, Figure 3 As shown, searching for related data on the big data platform based on transaction data includes:

[0061] Step 302, obtaining the customer identifier and multiple transaction fields in the transaction data.

[0062] Step 304: Acquire multiple monitoring features corresponding to the monitoring model.

[0063] Step 306: Based on the big data platform, search for characteristic fields associated with the transaction fields according to the customer identification and monitoring characteristics.

[0064] The big data platform stores a variety of data related to customers, including basic customer information, historical transaction data, related transactions, credit information, risk management information, etc. After the server obtains the transaction data in the database, it can search for related data in the big data platform.

[0065] Specifically, the transaction data includes the customer identification and multiple transaction fields. The transaction fields include transaction type, transaction amount, transaction time, transaction object, etc. For suspicious transactions for anti-money laundering, multiple monitoring features are pre-set on the server. These include basic customer information, frequent transactions, large transactions of dormant accounts, transaction amounts exceeding preset values ​​(such as RMB 5 million), false transaction addresses, expired transaction accounts, related transactions, and financial transactions with blacklisted customers. Each monitoring feature includes multiple feature fields. Monitoring features can also be regarded as monitoring dimensions. Different monitoring features are different dimensions. The server searches for multiple feature fields associated with the customer identification in the big data platform based on the customer identification. In this way, data associated with multiple dimensions of the transaction data can be obtained, which is no longer limited to the historical transaction data of the same customer, and the data range for identifying suspicious transactions is expanded, thereby effectively improving the accuracy of suspicious transaction identification.

[0066] In one embodiment, the associated data includes multiple feature fields; identifying whether the transaction data is a suspicious transaction through the monitoring model includes: calling corresponding anti-money laundering rules according to the transaction field and multiple feature fields; using the anti-money laundering rules to perform rule judgment on the transaction field and the feature field to obtain corresponding rule scores; accumulating multiple rule scores to obtain a monitoring score corresponding to the transaction data; when the monitoring score exceeds a threshold, marking the transaction data as a suspicious transaction.

[0067] After the server inputs the transaction fields in the current transaction data and the multiple feature fields searched by the big data platform into the monitoring model, the monitoring model calls the corresponding anti-money laundering rules based on the transaction fields and multiple feature fields. A transaction field or feature field can call one anti-money laundering rule or multiple anti-money laundering rules. Each anti-money laundering rule is preset with a corresponding score. The monitoring model obtains the rule score corresponding to each anti-money laundering rule based on the called anti-money laundering rule. The monitoring model can accumulate multiple rule scores to obtain the monitoring score corresponding to the transaction data.

[0068] In one of the embodiments, the use of the anti-money laundering rules to perform rule judgment on the transaction field and the feature field to obtain the corresponding rule score includes: obtaining parameters, parameter values ​​or parameter descriptions corresponding to the transaction field or feature field; matching the parameters, parameter values ​​or parameter descriptions with one or more corresponding anti-money laundering rules; when the match is successful, recording the rule score corresponding to the corresponding anti-money laundering rule.

[0069] The anti-money laundering rules can set corresponding parameter ranges or parameter descriptions. For example, the parameter range can be that the transaction behavior occurs more than 3 times a day within 10 working days. The parameter description can pay the natural person's premium through a third party, and cannot reasonably explain the relationship between the third party and the policyholder, the insured, and the beneficiary. Each transaction field and feature field contains a corresponding parameter, as well as a parameter value or parameter description corresponding to the parameter. The server calls one or more corresponding anti-money laundering rules based on the parameters in the transaction field and the feature field. The server matches the parameter value or parameter description in each transaction field and feature field with the corresponding anti-money laundering rules one by one. If the parameter value in the transaction field and the feature field falls within the parameter range of the anti-money laundering rule, the match is successful. If the parameter description in the transaction field and the feature field is consistent with the parameter description of the anti-money laundering rule, the match is successful. When the match is successful, the server records the rule score corresponding to the corresponding anti-money laundering rule.

[0070] In different transaction data, the specific transaction fields may be different. The multi-dimensional feature fields associated with the customer identifier searched in the big data platform may also be different. For example, for transaction A, the multi-dimensional feature fields searched in the big data platform include: account dormant time, account active time, number of collections after the account becomes active, collection amount and collection time, customer occupation, customer income, customer family member occupation and income, customer relative occupation and income, etc. Through the multi-dimensional feature fields, it can be found that the account has been dormant for 4 years and has become active half a year ago. There have been 5 large amounts of funds (more than 200,000) received and paid. The customer is currently unemployed and has no income, the customer's wife is an ordinary worker with a monthly income of 5,000, and one of the customer's relatives has a record of drug trafficking. The monitoring model calls the corresponding anti-money laundering rules for judgment based on the transaction fields and the multi-dimensional feature fields, and the rule score corresponding to each anti-money laundering rule is accumulated to obtain the monitoring score corresponding to the transaction data. Assuming that the monitoring score is 90 points, which exceeds the threshold of 60 points, the transaction is identified as a suspicious transaction.

[0071] In one embodiment, the monitoring model has multiple monitoring features; identifying the risk type corresponding to the suspicious transaction includes: calling the code corresponding to the monitoring feature according to the search results of the big data platform; using the code of the monitoring feature to identify the risk of the corresponding feature field and output the corresponding risk label; identifying the risk type corresponding to the suspicious transaction according to the multiple risk labels.

[0072] In the traditional way, when identifying the risk type of suspicious transactions, in order to ensure that all risk types are identified, the server needs to input the suspicious transactions into the risk model corresponding to each risk type. The risk model uses the characteristic fields of each monitoring feature for analysis to identify whether the suspicious transaction has a corresponding risk. The risk model in the traditional way is to bring together the code for analyzing each monitoring feature. Different risk models usually involve some of the same or similar monitoring features. For example, the risk model of illegal fundraising and the risk model of pyramid schemes are similar in terms of fundraising methods, recipients, amounts, etc. If the code for each risk model is written separately, it will cause a lot of repetitive work.

[0073] In this embodiment, for the monitoring features corresponding to each risk model, corresponding codes are written according to the risk rules, and each monitoring feature has a corresponding risk label. When the server identifies a suspicious transaction, the code corresponding to the monitoring feature is called according to the multiple feature fields in the big data search results to perform risk analysis. When the feature field corresponding to the monitoring feature meets the risk rules, the server adds a corresponding risk label to the big data search results. The risk label can be similar to the monitoring feature. Since different risk models correspond to different monitoring indicators, that is, the corresponding risk labels are different, the server can accurately identify the risk type of the suspicious transaction based on the multiple risk labels corresponding to the suspicious transaction.

[0074] In this embodiment, by writing code for each monitoring indicator, the code corresponding to the monitoring indicator can be used to identify the risk of the feature field, which effectively saves the repetitive work of code writing. In addition, the code of the monitoring indicator can cover all the original risk models. After the risk label is output through the code of the monitoring indicator, each risk type involved in the suspicious transaction can be identified, thereby ensuring the comprehensiveness and accuracy of the risk type of the suspicious transaction.

[0075] In one embodiment, the method further includes: adding a risk profile. Figure 4 As shown, this step specifically includes:

[0076] Step 402, obtaining multiple risk profile labels.

[0077] Step 404: Search the corresponding customer data through the big data platform according to the risk profile label.

[0078] Step 406, using user data to generate a customer risk profile.

[0079] Step 408, adding the customer risk profile to the statistical view.

[0080] The server can also use big data to conduct risk profile analysis on customers. Specifically, the server obtains multiple risk profile tags and obtains data associated with the profile tags through the big data platform, including basic user information, historical suspicious transaction data, information about customer-related personnel, and abnormal transaction risk characteristics. Among them, basic user information includes the user's name, gender, contact information, transaction data, behavioral data, etc. Historical suspicious transaction data includes data on all suspicious transactions of the customer. Abnormal transaction risk characteristics include frequent fund collection and payment in a short period of time, transaction amounts close to large-value transaction standards, and dispersed transfers and concentrated transfers of funds in a short period of time. The server can use the profile tags and corresponding data to generate a risk profile for each customer. The server can add customer risk profiles to the statistical view.

[0081] The statistical view can also include multiple controls, including input boxes and view buttons. The supervisor can enter the customer ID through the terminal, click the view button, generate a view request for the customer risk profile, and upload the view request to the server. The server obtains the corresponding risk profile based on the customer ID and returns the risk profile to the terminal. The terminal can display the risk profile of the corresponding customer in the statistical view. The risk profile can present individual portrait tags, and when different portrait tags are clicked, the corresponding information can be displayed. By adding customer risk profiles to the statistical view of suspicious transactions, supervisors can understand which customers are more likely to engage in money laundering from more dimensions.

[0082] Furthermore, the server can also generate a statistical view of suspicious transactions corresponding to the customer identification for a specific customer. The statistical view includes the statistical number, risk type and risk profile of suspicious transactions of a specific customer within a preset time period. This can facilitate regulators to have a deeper understanding of the anti-money laundering risks of specific customers.

[0083] It should be understood that although Figure 2-4 The steps in the flowchart are shown in sequence as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified in this document, there is no strict order restriction for the execution of these steps, and these steps can be executed in other orders. Moreover, Figure 2-4At least part of the steps may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily executed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least part of the sub-steps or stages of other steps.

[0084] In one embodiment, Figure 5 As shown, a device for generating a suspicious transaction statistical view based on big data is provided, comprising: a data acquisition module 502, a suspicious transaction identification module 504, a risk type identification module 506, and a view generation module 508, wherein:

[0085] The data acquisition module 502 is used to acquire transaction data within a preset time period and search for related data on the big data platform based on the transaction data.

[0086] The suspicious transaction identification module 504 is used to input the transaction data and the associated data into the monitoring model, and identify whether the transaction data is a suspicious transaction through the monitoring model.

[0087] The risk type identification module 506 is used to obtain the risk type corresponding to the suspicious transaction when the transaction data is determined to be a suspicious transaction.

[0088] The view generation module 508 is used to generate a statistical view of suspicious transactions using suspicious transactions within a preset time period and risk types corresponding to the suspicious transactions.

[0089] In one embodiment, the data acquisition module is also used to obtain the customer identification and multiple transaction fields in the transaction data; obtain multiple monitoring features corresponding to the monitoring model; and search the big data platform for feature fields associated with the transaction fields based on the customer identification and the monitoring features.

[0090] In one embodiment, the associated data includes multiple feature fields; the suspicious transaction identification module is also used to call corresponding anti-money laundering rules according to the transaction field and the multiple feature fields; use the anti-money laundering rules to make rule judgments on the transaction field and the feature field to obtain corresponding rule scores; accumulate multiple rule scores to obtain a monitoring score corresponding to the transaction data; when the monitoring score exceeds a threshold, the transaction data is marked as a suspicious transaction.

[0091] In one embodiment, the suspicious transaction identification module is also used to obtain parameters, parameter values ​​or parameter descriptions corresponding to the transaction field or feature field; match the parameters, parameter values ​​or parameter descriptions with one or more corresponding anti-money laundering rules; when the match is successful, record the rule score corresponding to the corresponding anti-money laundering rule.

[0092] In one embodiment, the monitoring model has multiple monitoring features; the risk type identification module is also used to call the code corresponding to the monitoring feature according to the search results of the big data platform; use the code of the monitoring feature to identify the risk of the corresponding feature field and output the corresponding risk label; identify the risk type corresponding to the suspicious transaction according to the multiple risk labels.

[0093] In one embodiment, the device also includes: a risk profile generation module, used to obtain multiple risk profile labels; search for corresponding customer data through a big data platform according to the risk profile labels; generate a customer risk profile using user data; and add the customer risk profile to a statistical view.

[0094] For the specific definition of the suspicious transaction statistical view generation device based on big data, please refer to the definition of the suspicious transaction statistical view generation method based on big data in the above text, which will not be repeated here. Each module in the above-mentioned suspicious transaction statistical view generation device based on big data can be implemented in whole or in part by software, hardware and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory in the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0095] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 6 As shown. The computer device includes a processor, a memory, a network interface and a database connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store transaction data, etc. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a method for generating a suspicious transaction statistical view based on big data is implemented.

[0096] Those skilled in the art will understand that Figure 6 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0097] In one embodiment, a computer readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0098] Obtain transaction data within a preset time period, and search for related data on the big data platform based on the transaction data;

[0099] Input the transaction data and associated data into the monitoring model, and use the monitoring model to identify whether the transaction data is a suspicious transaction;

[0100] When the transaction data is determined to be a suspicious transaction, the risk type corresponding to the suspicious transaction is obtained;

[0101] Generate a statistical view of suspicious transactions using suspicious transactions within a preset time period and the risk types corresponding to the suspicious transactions.

[0102] In one embodiment, when the computer program is executed by a processor, it also implements:

[0103] Get the customer ID and multiple transaction fields in the transaction data;

[0104] Acquire multiple monitoring features corresponding to the monitoring model;

[0105] Based on the big data platform, feature fields associated with transaction fields are searched according to customer identification and monitoring features.

[0106] In one embodiment, the associated data includes a plurality of characteristic fields. When the computer program is executed by a processor, it also implements:

[0107] Call corresponding anti-money laundering rules based on transaction fields and multiple feature fields;

[0108] Use anti-money laundering rules to make rule judgments on transaction fields and feature fields to obtain corresponding rule scores;

[0109] Accumulate the scores of multiple rules to obtain the monitoring score corresponding to the transaction data;

[0110] When the monitoring score exceeds the threshold, the transaction data is marked as suspicious.

[0111] In one embodiment, when the computer program is executed by a processor, it also implements:

[0112] Get the parameter, parameter value or parameter description corresponding to the transaction field or feature field;

[0113] Matching one or more corresponding anti-money laundering rules according to parameters, parameter values ​​or parameter descriptions;

[0114] When the match is successful, the rule score corresponding to the corresponding anti-money laundering rule is recorded.

[0115] In one embodiment, when the computer program is executed by a processor, it also implements:

[0116] Get multiple risk profile labels;

[0117] Search for corresponding customer data through the big data platform based on risk profile tags;

[0118] Use user data to generate customer risk profiles;

[0119] Add customer risk profiles to statistical views.

[0120] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0121] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0122] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.

Claims

1. A method for generating suspicious transaction statistical views based on big data, characterized in that: The method comprises: Acquire transaction data within a preset time period, wherein the transaction data includes a customer identifier and a plurality of transaction fields; Acquire a plurality of monitoring features corresponding to the monitoring model; the monitoring features are used to characterize the dimensions of monitoring; Based on the big data platform, searching for a characteristic field associated with the transaction field according to the customer identifier and the monitoring feature, and obtaining associated data of the transaction data according to the characteristic field; Inputting the transaction data and the associated data into a monitoring model, and identifying whether the transaction data is a suspicious transaction through the monitoring model; When it is determined that the transaction data is a suspicious transaction, calling a code corresponding to the monitoring feature according to the search results of the big data platform; Using the code of the monitoring feature to identify the risk of the corresponding feature field, and outputting the corresponding risk label; identifying the risk type corresponding to the suspicious transaction according to the multiple risk labels; A statistical view of suspicious transactions is generated using suspicious transactions within a preset time period and risk types corresponding to the suspicious transactions.

2. The method according to claim 1, characterized in that The associated data includes a plurality of characteristic fields; and the identifying whether the transaction data is a suspicious transaction by the monitoring model includes: Calling corresponding anti-money laundering rules according to the transaction field and the plurality of characteristic fields; Using the anti-money laundering rules to perform rule judgment on the transaction field and the feature field to obtain corresponding rule scores; Accumulating multiple rule scores to obtain a monitoring score corresponding to the transaction data; When the monitoring score exceeds a threshold, the transaction data is marked as a suspicious transaction.

3. The method according to claim 2, characterized in that The using the anti-money laundering rule to perform rule judgment on the transaction field and the feature field to obtain corresponding rule scores includes: Obtaining a parameter, a parameter value or a parameter description corresponding to the transaction field or the feature field; Matching the parameter, parameter value or parameter description with one or more corresponding anti-money laundering rules; When the match is successful, the rule score corresponding to the corresponding anti-money laundering rule is recorded.

4. The method according to claim 1, characterized in that: The method further comprises: Collecting statistics on the total amount of transactions within the preset time period; The generating of a statistical view of suspicious transactions by using suspicious transactions within a preset time period and risk types corresponding to the suspicious transactions includes: A statistical view of the suspicious transactions is generated using the total transaction amount, the number of the suspicious transactions, and the risk type corresponding to the suspicious transactions.

5. The method according to claim 1, characterized in that The method further comprises: Get multiple risk profile labels; Searching for corresponding customer data through the big data platform according to the risk profile label; Generate a customer risk profile using the customer data; The customer risk profile is added to the statistical view.

6. A device for generating suspicious transaction statistical views based on big data, characterized in that: The device comprises: A data acquisition module is used to acquire transaction data within a preset time period, wherein the transaction data includes a customer identifier and a plurality of transaction fields; acquire a plurality of monitoring features corresponding to the monitoring model; the monitoring features are used to characterize the monitoring dimensions; based on the big data platform, search for a feature field associated with the transaction field according to the customer identifier and the monitoring features, and obtain associated data of the transaction data according to the feature field; A suspicious transaction identification module, used to input the transaction data and the associated data into a monitoring model, and identify whether the transaction data is a suspicious transaction through the monitoring model; A risk type identification module is used to call the code corresponding to the monitoring feature according to the search results of the big data platform when the transaction data is determined to be a suspicious transaction; use the code of the monitoring feature to identify the risk of the corresponding feature field and output the corresponding risk label; identify the risk type corresponding to the suspicious transaction according to multiple risk labels; The view generation module is used to generate a statistical view of suspicious transactions using suspicious transactions within a preset time period and risk types corresponding to the suspicious transactions.

7. The device according to claim 6, characterized in that The associated data includes multiple feature fields; the suspicious transaction identification module is also used to call corresponding anti-money laundering rules according to the transaction field and the multiple feature fields; use the anti-money laundering rules to perform rule judgment on the transaction field and the feature field to obtain corresponding rule scores; accumulate multiple rule scores to obtain a monitoring score corresponding to the transaction data; when the monitoring score exceeds a threshold, mark the transaction data as a suspicious transaction.

8. The device according to claim 6, characterized in that The suspicious transaction identification module is also used to obtain parameters, parameter values ​​or parameter descriptions corresponding to the transaction field or feature field; match the parameters, parameter values ​​or parameter descriptions with the corresponding one or more anti-money laundering rules; when the match is successful, record the rule score corresponding to the corresponding anti-money laundering rule.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 5 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

Images