Suspicious transaction report generation method, device, computer equipment and storage medium

Abstract

The present application relates to a method, device, computer equipment and storage medium for generating suspicious transaction reports in the field of big data. The method comprises: obtaining transaction data, identifying whether the transaction data is a suspicious transaction; when the transaction data is a suspicious transaction, identifying the risk type corresponding to the suspicious transaction; the risk type corresponds to multiple risk features; calculating the vector matrix corresponding to the multiple risk features; inputting the multiple vector matrices into a neural network model, and outputting a suspicious transaction report corresponding to the risk type through the neural network model. The use of this method can effectively improve the work efficiency of completing suspicious transaction reports.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method, apparatus, computer equipment and storage medium for generating a suspicious transaction report. Background Art

[0002] Money laundering is an act of legalizing illegal gains. It is an economic crime and poses a threat to the security and stability of the financial system. Therefore, financial institutions need to actively carry out anti-money laundering work. Financial institutions monitor transactions related to money laundering and report suspicious transactions in a timely manner if they are found. When reporting, financial institutions need to describe the suspicious transactions in the form of reports. In traditional methods, suspicious transaction reports are completed manually. If a large number of suspicious transactions are faced with manual preparation of corresponding reports, work efficiency will be low. Summary of the invention

[0003] Based on this, it is necessary to provide a method, device, computer equipment and storage medium for generating suspicious transaction reports that effectively improve work efficiency in response to the above technical problems.

[0004] A method for generating a suspicious transaction report, the method comprising:

[0005] Acquire transaction data, and identify whether the transaction data is a suspicious transaction;

[0006] When the transaction data is a suspicious transaction, identifying a risk type corresponding to the suspicious transaction; the risk type corresponds to a plurality of risk features;

[0007] Calculating a vector matrix corresponding to the plurality of risk features;

[0008] A plurality of vector matrices are input into a neural network model, and a suspicious transaction report corresponding to the risk type is output through the neural network model.

[0009] In one embodiment, the using the risk feature to identify whether the transaction data is a suspicious transaction includes:

[0010] Extracting a customer identifier and a plurality of transaction fields from the transaction data;

[0011] According to the customer identifier, searching for multiple characteristic fields corresponding to the risk characteristics through the big data platform;

[0012] Inputting the transaction field and the multiple feature fields searched by the big data platform into a monitoring model, and identifying suspicious transactions through the monitoring model;

[0013] When the transaction data is identified as a suspicious transaction, a corresponding warning event is generated.

[0014] In one embodiment, the identifying the risk type corresponding to the suspicious transaction includes:

[0015] Based on the search results of the big data platform, call the code corresponding to the risk feature;

[0016] Using the risk feature code to identify the risk of the corresponding feature field, and outputting the corresponding risk label;

[0017] The risk type corresponding to the suspicious transaction is identified according to the multiple risk tags.

[0018] In one embodiment, the method further comprises:

[0019] Acquire multiple historical suspicious transaction reports, and mark the historical suspicious transaction reports as sample files; the sample files include multiple sample sentences and risk types;

[0020] Identifying risk features corresponding to the sample sentences;

[0021] Obtaining a report template corresponding to the risk type and a mapping relationship between the report template and the risk characteristics;

[0022] Generate a training vector matrix corresponding to each sample sentence;

[0023] The neural network is trained using the training vector matrix and the mapping relationship.

[0024] In one embodiment, generating a training vector matrix corresponding to each sample sentence includes:

[0025] Segmenting the sample document to obtain a plurality of sample sentences;

[0026] Performing word segmentation processing on the sample sentence to obtain multiple sample words;

[0027] Counting the sample word frequency of each sample word in the sample file, and using the sample word frequency to calculate the word vector corresponding to each sample word;

[0028] The word vectors corresponding to multiple sample words in each sample sentence are used to generate a vector matrix corresponding to each sample sentence.

[0029] A suspicious transaction report generating device, the device comprising:

[0030] A first identification module, used to obtain transaction data and identify whether the transaction data is a suspicious transaction;

[0031] A second identification module is used to identify the risk type corresponding to the suspicious transaction when the transaction data is a suspicious transaction; the risk type corresponds to a plurality of risk features;

[0032] A vector calculation module, used to calculate the vector matrix corresponding to the plurality of risk features;

[0033] The report generation module is used to input multiple vector matrices into the neural network model, and output a suspicious transaction report corresponding to the risk type through the neural network model.

[0034] In one of the embodiments, the first identification module is also used to extract a customer identifier and multiple transaction fields in the transaction data; based on the customer identifier, multiple feature fields corresponding to the risk characteristics are searched through a big data platform; the transaction fields and the multiple feature fields searched by the big data platform are input into a monitoring model, and suspicious transactions are identified through the monitoring model; when the transaction data is identified as a suspicious transaction, a corresponding warning event is generated.

[0035] In one embodiment, the device further comprises:

[0036] A training module is used to obtain multiple historical suspicious transaction reports and mark the historical suspicious transaction reports as sample files; the sample files include multiple sample sentences and risk types; identify risk features corresponding to the sample sentences; obtain report templates corresponding to the risk types, and a mapping relationship between the report templates and the risk features; generate a training vector matrix corresponding to each sample sentence; and train a neural network using the training vector matrix and the mapping relationship.

[0037] A computer device includes a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps in the above-mentioned method embodiments when executing the computer program.

[0038] A computer-readable storage medium stores a computer program, which implements the steps in the above-mentioned method embodiments when executed by a processor.

[0039] The above-mentioned suspicious transaction report generation method, device, computer equipment and storage medium, when identifying the transaction data as a suspicious transaction, further identify the corresponding risk type. Since different risk types use different report templates, each risk type includes multiple risk features. By calculating the vector matrix corresponding to the risk features in the suspicious transaction, the vector matrix is ​​input into the neural network model, so that the neural network model can output a suspicious transaction report corresponding to the risk type. Thereby, the report of suspicious transactions is automatically completed. In this process, no human intervention is required, which effectively improves work efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 This is an application scenario diagram of a suspicious transaction report generation method in one embodiment;

[0041] Figure 2 A schematic diagram of a process for generating a suspicious transaction report in one embodiment;

[0042] Figure 3 A schematic diagram of a flow chart of a step of using the risk feature to identify whether the transaction data is a suspicious transaction in an embodiment;

[0043] Figure 4 A flowchart of a neural network model training step in one embodiment;

[0044] Figure 5 It is a structural block diagram of a suspicious transaction report generating device in one embodiment;

[0045] Figure 6 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0046] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0047] The suspicious transaction report generation method provided in this application can be applied to Figure 1 In the application environment shown. Among them, the terminal 102 communicates with the server 104 through the network. Among them, the terminal 102 can be but not limited to various personal computers, laptops, smart phones, tablet computers and portable wearable devices, and the server 104 can be implemented with an independent server or a server cluster composed of multiple servers. The server 104 obtains transaction data and identifies whether the transaction data is a suspicious transaction. When the transaction data is a suspicious transaction, the server 104 further identifies the risk type corresponding to the suspicious transaction, and the risk type corresponds to multiple risk features. The server 104 obtains the corresponding transaction field in the suspicious transaction according to the risk features involved in the suspicious transaction. The server 104 calculates the vector matrix using the transaction field corresponding to the risk feature and the feature field searched by the big data platform. A neural network model is pre-established on the server 104. The server 104 inputs multiple vector matrices into the neural network model, and outputs a suspicious transaction report corresponding to the risk type through the neural network model. The server 104 sends the suspicious transaction report to the terminal 102.

[0048] In one embodiment, Figure 2As shown, a method for generating a suspicious transaction report is provided, and the method is applied to Figure 1 The server in the example is used to illustrate the following steps:

[0049] Step 202: Acquire transaction data and identify whether the transaction data is a suspicious transaction.

[0050] A database is deployed on the server. After each transaction is executed, the corresponding transaction data will be stored in the database. The server can obtain transaction data from the database at a preset frequency to identify whether there are suspicious transactions for anti-money laundering. The server can also monitor the database in real time. When it monitors that transaction data is stored in the database, the server obtains the transaction data to identify whether it is a suspicious transaction.

[0051] A monitoring model is pre-established on the server. The monitoring model has multiple risk features, including basic customer information, frequent transactions, large transactions of dormant accounts, transaction amounts exceeding preset values, false transaction addresses, expired transaction accounts, related transactions, and financial transactions with blacklisted customers. Risk features can also be regarded as monitoring dimensions. Different risk features are different dimensions. Each risk feature includes multiple feature fields. Among them, the feature field can include a transaction field. The server searches for multiple associated feature fields in the big data platform based on the customer identifier. The results of the big data search and the transaction fields in the current transaction data can be used as fields corresponding to the risk features. The server inputs the transaction fields and the feature fields searched by the big data platform into the monitoring model, and identifies suspicious transactions through the monitoring model. Among them, the transaction field can also correspond to the risk feature, that is, the transaction field and the feature field can belong to the same risk feature. When the transaction data is identified as a suspicious transaction, a corresponding warning event is generated.

[0052] Step 204: When the transaction data is a suspicious transaction, identify the risk type corresponding to the suspicious transaction; the risk type corresponds to multiple risk features.

[0053] Different suspicious transactions may involve different risk features. If the search results on the big data platform do not include the feature field of a certain risk feature, it means that the suspicious transaction does not involve the risk feature. If the search results on the big data platform include the feature field corresponding to a certain risk feature, it means that the suspicious transaction involves the risk feature. Among the multiple risk features involved in a suspicious transaction, the feature field corresponding to each risk feature may be different.

[0054] When the server identifies a suspicious transaction, the risk characteristics involved in the suspicious transaction can be learned based on the big data search results. The server calls the code corresponding to these risk characteristics to perform risk analysis. When the feature field corresponding to the risk feature meets the risk rule, the server adds the corresponding risk label to the big data search results. The risk label can be the same as or similar to the risk feature. Since different risk models correspond to different monitoring indicators, that is, the corresponding risk labels are different, the server can accurately identify the risk type of the suspicious transaction based on the multiple risk labels corresponding to the suspicious transaction.

[0055] Step 206, calculating a vector matrix corresponding to a plurality of risk features.

[0056] The server obtains the corresponding transaction fields according to the risk features involved in the suspicious transaction. A risk feature can correspond to one transaction field or multiple transaction fields. The server calculates the vector matrix using the transaction fields corresponding to the risk features and the feature fields searched by the big data platform. The transaction fields include field names and field values. The feature fields searched by big data also include field names and field values.

[0057] Specifically, a training word library is pre-stored in the server. The training word library includes word vectors corresponding to multiple training words. Among them, the training words may include field names and field values. The server can perform word segmentation processing on the transaction field and feature field corresponding to the risk feature to obtain multiple words. The server searches for word vectors of multiple words corresponding to the risk feature in the training word library. For numbers such as time and amount, the server can use the word vector model to calculate the corresponding word vector. The server generates a corresponding vector matrix using multiple word vectors corresponding to each risk feature.

[0058] Step 208: Input multiple vector matrices into the neural network model, and output a suspicious transaction report corresponding to the risk type through the neural network model.

[0059] A neural network model is pre-established on the server. The neural network model may be a recurrent neural network. The neural network model may be pre-trained using a variety of sample files. Since suspicious transactions include a variety of different risk types, different risk types correspond to different report templates. Therefore, the server pre-trains the neural network using sample files of different risk types. During training, the server establishes corresponding mapping relationships between multiple sentences in the report template and multiple risk features according to the risk type of the suspicious transaction. Different report templates have different mapping relationships with risk features.

[0060] The server inputs the vector matrix corresponding to multiple risk features into the neural network model. The neural network model performs calculations based on the mapping relationship between the vector matrix and the sentences in the report template, and outputs the corresponding suspicious transaction report in the format of the report template.

[0061] In this embodiment, when the transaction data is identified as a suspicious transaction, the corresponding risk type is further identified. Since different risk types use different report templates, each risk type includes multiple risk features. By calculating the vector matrix corresponding to the risk features in the suspicious transaction, the vector matrix is ​​input into the neural network model, so that the neural network model can output a suspicious transaction report corresponding to the risk type. Thus, the report of suspicious transactions is automatically completed. In this process, no human intervention is required, which effectively improves work efficiency.

[0062] In one embodiment, the step of using risk features to identify whether transaction data is a suspicious transaction is as follows: Figure 3 As shown, specifically including:

[0063] Step 302: extract the customer identifier and multiple transaction fields in the transaction data.

[0064] Step 304: Search multiple feature fields corresponding to risk features through the big data platform according to the customer identifier.

[0065] Step 306: Input the transaction field and the multiple feature fields searched by the big data platform into the monitoring model, and identify suspicious transactions through the monitoring model.

[0066] Step 308: When the transaction data is identified as a suspicious transaction, a corresponding warning event is generated.

[0067] The big data platform stores a variety of customer-related data, including basic customer information, historical transaction data, related transactions, credit information, and risk management information. The basic customer information includes not only the basic information of the customer himself, but also the information of other people related to the customer, which can also be called the information of people who have social relations with the customer. For example, information of family members, relatives, and information of people with investment relations. In order to ensure the validity of the information in the big data platform, the data in the big data platform can also be updated according to a specific cycle.

[0068] A monitoring model is pre-established on the server. The monitoring model has multiple risk features, including basic customer information, frequent transactions, large transactions in dormant accounts, transaction amounts exceeding preset values, false transaction addresses, expired transaction accounts, related transactions, and financial transactions with blacklisted customers.

[0069] The server extracts the customer ID and multiple transaction fields from the transaction data. The transaction data includes the customer ID and multiple transaction fields. The transaction fields include transaction type, transaction amount, transaction time, transaction object, etc. The server searches for multiple feature fields associated with the customer ID in the big data platform based on the customer ID. In this way, multiple data associated with the transaction data can be obtained, which is not limited to the historical transaction data of the same customer, but combines data of more dimensions, expands the data scope for identifying suspicious transactions, and can effectively improve the accuracy of identifying suspicious transactions.

[0070] The server can input the searched feature fields and transaction fields associated with the customer identification into the monitoring model. The monitoring model calls the corresponding anti-money laundering rules according to the transaction field and multiple feature fields. One transaction field or feature field can call one anti-money laundering rule or multiple anti-money laundering rules. Each anti-money laundering rule is preset with a corresponding score. The monitoring model obtains the rule score corresponding to each anti-money laundering rule according to the called anti-money laundering rule. The monitoring model can accumulate multiple rule scores to obtain the monitoring score corresponding to the transaction data. The monitoring model compares the monitoring score with the threshold. When the monitoring score exceeds the threshold, the transaction data is marked as a suspicious transaction. When the transaction data is identified as a suspicious transaction, the monitoring model warns the transaction data and outputs the corresponding warning event.

[0071] Furthermore, each risk feature can be regarded as a dimension, and each risk feature can be pre-set with a corresponding weight. The weights between different risk features can be the same or different. Different feature fields of the same risk feature can be set to the same weight. The server uses the weight to modify the score of each anti-money laundering rule separately, and accumulates the modified rule scores to obtain the monitoring score corresponding to the transaction data. Since risk features of different dimensions have different importance in anti-money laundering identification, by modifying the anti-money laundering rule scores, adjustments can be made to risk features of different dimensions, thereby obtaining a more reasonable monitoring score, which can more effectively improve the accuracy of identifying suspicious transactions.

[0072] In one embodiment, identifying the risk type corresponding to a suspicious transaction includes: calling a code corresponding to a risk feature based on search results from a big data platform; using the risk feature code to perform risk identification on a corresponding feature field and output a corresponding risk label; and identifying the risk type corresponding to the suspicious transaction based on multiple risk labels.

[0073] In the traditional way, when identifying the risk type of suspicious transactions, in order to ensure that all risk types are identified, the server needs to input the suspicious transactions into the risk model corresponding to each risk type. The risk model uses the characteristic fields of each risk feature for analysis to identify whether the suspicious transaction has a corresponding risk. The risk model in the traditional way is to bring together the code for analyzing each risk feature. Different risk models usually involve some of the same or similar risk features. For example, the risk model of illegal fundraising and the risk model of pyramid schemes are similar in terms of fundraising methods, recipients, amounts, etc. If the code for each risk model is written separately, it will cause a lot of repetitive work.

[0074] In this embodiment, for the risk features corresponding to each risk model, corresponding codes are written according to the risk rules, and each risk feature has a corresponding risk label. When the server identifies a suspicious transaction, the code corresponding to the risk feature is called according to the multiple feature fields in the big data search results to perform risk analysis. When the feature fields corresponding to the risk feature meet the risk rules, the server adds the corresponding risk label to the big data search results. Since different risk models correspond to different monitoring indicators, that is, the corresponding risk labels are different, the server can accurately identify the risk type of the suspicious transaction based on the multiple risk labels corresponding to the suspicious transaction.

[0075] In this embodiment, by writing code for each monitoring indicator, the code corresponding to the monitoring indicator can be used to identify the risk of the feature field, which effectively saves the repetitive work of code writing. In addition, the code of the monitoring indicator can cover all the original risk models. After the risk label is output through the code of the monitoring indicator, each risk type involved in the suspicious transaction can be identified, thereby ensuring the comprehensiveness and accuracy of the risk type of the suspicious transaction.

[0076] In one embodiment, the method further comprises: a step of training a neural network model, such as Figure 4 As shown, specifically including:

[0077] Step 402: Acquire multiple historical suspicious transaction reports and mark the historical suspicious transaction reports as sample files; the sample files include multiple sample sentences and risk types.

[0078] Step 404: Identify risk features corresponding to the sample sentences.

[0079] Step 406: Obtain a report template corresponding to the risk type and a mapping relationship between the report template and the risk characteristics.

[0080] Step 408: Generate a training vector matrix corresponding to each sample sentence.

[0081] Step 410: Train the neural network using the training vector matrix and the mapping relationship.

[0082] The sample files required for neural network model training can be historical suspicious transaction reports of various risk types in the database. The sample files can contain multiple paragraphs. Each paragraph includes multiple sentences. The sentences include multiple words. The server performs sentence segmentation processing on the sample files to obtain multiple sample sentences. The server performs word segmentation processing on the sample sentences to obtain multiple sample words. The server uses the sample words to generate a training vector matrix corresponding to each sample sentence.

[0083] In one embodiment, generating a training vector matrix corresponding to each sample sentence includes: performing sentence segmentation processing on a sample file to obtain a plurality of sample sentences; performing word segmentation processing on the sample sentences to obtain a plurality of sample words; counting the sample word frequency of each sample word in the sample file, and using the sample word frequency to calculate the word vector corresponding to each sample word; and using the word vectors corresponding to the plurality of sample words in each sample sentence to generate a vector matrix corresponding to each sample sentence.

[0084] The server counts the word frequency of each sample word in the sample file (that is, the proportion of each sample word in all sample words) and establishes an inverse word frequency matrix. The server uses the inverse word frequency matrix to obtain the word vector corresponding to each sample word. That is, each column in the inverse word frequency matrix can be extracted as the word vector corresponding to each sample word. The server can use multiple sample words and their corresponding word vectors to establish a training word library. The server obtains the corresponding word vectors in the training word library based on multiple sample words in the sample sentence, and uses multiple word vectors to generate a vector matrix corresponding to the sample sentence. The server can generate a vector matrix corresponding to each sample sentence in this way, thereby mapping the natural language to the vector space.

[0085] The server obtains report templates for various risk types. The report templates include: an overview of suspicious transactions, basic information about the subject of suspicious transactions, characteristics and background information of suspicious transactions, preliminary conclusions, and other paragraphs. Each paragraph includes multiple sentences. In report templates for different risk types, such as online gambling, illegal fundraising, and online pyramid schemes, the sentences in the paragraphs can be different. The server uses the vector matrix corresponding to the sentences in the sample file and the report template to train the recurrent neural network.

[0086] Specifically, the server can obtain the risk type corresponding to the suspicious transaction in the sample file, and mark the risk type as the risk type corresponding to the sample file. The server performs sentence processing on the sample files of different risk types, and calculates the vector matrix corresponding to the sample sentences. The server identifies the feature field corresponding to the sample sentence in the sample file according to the risk type, and establishes a mapping relationship between the feature field and the sentence in the report template. The server uses the mapping relationship and the vector matrix corresponding to each risk type to train the recurrent neural network. The recurrent neural network can be a bidirectional recurrent neural network, which is trained by bidirectional calculation of forward calculation and backward calculation. In this way, the trained neural network model can output a suspicious transaction report according to the format in the report template and the context of each sentence.

[0087] Furthermore, in order to ensure the accuracy of the content of the suspicious transaction report, after the neural network model completes the suspicious transaction report, the server can also distribute the suspicious transaction report to the corresponding staff for review. Specifically, the server obtains information of multiple staff members, including business areas, professional levels, task volumes, etc. The server will distribute the suspicious transaction report to the corresponding staff member based on the correspondence between the risk type of the suspicious transaction report and the business area, and based on the correspondence between the risk level in the suspicious transaction report and the professional level of the staff member. Through the review by the staff, problems in the suspicious transaction report can be corrected in a timely manner, thereby ensuring that the reported content is accurate.

[0088] It should be understood that although Figure 2-4 The steps in the flowchart are shown in sequence as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified in this document, there is no strict order restriction for the execution of these steps, and these steps can be executed in other orders. Moreover, Figure 2-4 At least part of the steps may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily executed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least part of the sub-steps or stages of other steps.

[0089] In one embodiment, Figure 5 As shown, a suspicious transaction report generating device is provided, comprising: a first identification module 502, a second identification module 504, a vector calculation module 506, and a report generating module 508, wherein:

[0090] The first identification module 502 is used to obtain transaction data and identify whether the transaction data is a suspicious transaction.

[0091] The second identification module 504 is used to identify the risk type corresponding to the suspicious transaction when the transaction data is a suspicious transaction; the risk type corresponds to multiple risk features.

[0092] The vector calculation module 506 is used to calculate the vector matrix corresponding to multiple risk features.

[0093] The report generation module 508 is used to input multiple vector matrices into the neural network model, and output a suspicious transaction report corresponding to the risk type through the neural network model.

[0094] In one embodiment, the first identification module is also used to extract the customer identifier and multiple transaction fields in the transaction data; based on the customer identifier, multiple feature fields corresponding to the risk characteristics are searched through the big data platform; the transaction field and the multiple feature fields searched by the big data platform are input into the monitoring model, and suspicious transactions are identified through the monitoring model; when the transaction data is identified as a suspicious transaction, a corresponding warning event is generated.

[0095] In one embodiment, the second identification module is also used to call the code corresponding to the risk feature based on the search results of the big data platform; use the risk feature code to identify the risk of the corresponding feature field and output the corresponding risk label; identify the risk type corresponding to the suspicious transaction based on multiple risk labels.

[0096] In one embodiment, the device also includes: a training module, which is used to obtain multiple historical suspicious transaction reports and mark the historical suspicious transaction reports as sample files; the sample files include multiple sample sentences and risk types; identify the risk characteristics corresponding to the sample sentences; obtain the report template corresponding to the risk type, and the mapping relationship between the report template and the risk characteristics; generate a training vector matrix corresponding to each sample sentence; and train the neural network using the training vector matrix and the mapping relationship.

[0097] In one embodiment, the training module is also used to perform sentence segmentation on the sample file to obtain multiple sample sentences; perform word segmentation on the sample sentences to obtain multiple sample words; count the sample word frequency of each sample word in the sample file, and use the sample word frequency to calculate the word vector corresponding to each sample word; use the word vectors corresponding to multiple sample words in each sample sentence to generate a vector matrix corresponding to each sample sentence.

[0098] For the specific definition of the suspicious transaction report generating device, please refer to the definition of the suspicious transaction report generating method above, which will not be repeated here. Each module in the above-mentioned suspicious transaction report generating device can be implemented in whole or in part by software, hardware and their combination. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0099] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 6 As shown. The computer device includes a processor, a memory, a network interface and a database connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store transaction data, sample files, etc. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a method for generating a suspicious transaction report is implemented.

[0100] Those skilled in the art will understand that Figure 6 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0101] In one embodiment, a computer readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0102] Obtain transaction data and identify whether the transaction data is a suspicious transaction;

[0103] When the transaction data is a suspicious transaction, identify the risk type corresponding to the suspicious transaction; the risk type corresponds to multiple risk features;

[0104] Calculate the vector matrix corresponding to multiple risk features;

[0105] Multiple vector matrices are input into the neural network model, and the neural network model outputs suspicious transaction reports corresponding to the risk types.

[0106] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0107] Extract customer ID and multiple transaction fields from transaction data;

[0108] Based on the customer ID, multiple feature fields corresponding to risk features are searched through the big data platform;

[0109] Input the transaction fields and multiple feature fields searched by the big data platform into the monitoring model, and use the monitoring model to identify suspicious transactions;

[0110] When transaction data is identified as a suspicious transaction, a corresponding warning event is generated.

[0111] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0112] Based on the search results from the big data platform, call the code corresponding to the risk feature;

[0113] Use the risk feature code to identify the risk of the corresponding feature field and output the corresponding risk label;

[0114] Identify the risk type corresponding to suspicious transactions based on multiple risk tags.

[0115] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0116] Obtain multiple historical suspicious transaction reports, and mark the historical suspicious transaction reports as sample files; the sample files include multiple sample sentences and risk types;

[0117] Identify risk features corresponding to sample sentences;

[0118] Obtain the report template corresponding to the risk type, as well as the mapping relationship between the report template and the risk characteristics;

[0119] Generate a training vector matrix corresponding to each sample sentence;

[0120] The neural network is trained using the training vector matrix and mapping relationship.

[0121] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0122] Sentence processing is performed on the sample document to obtain multiple sample sentences;

[0123] Perform word segmentation on the sample sentences to obtain multiple sample words;

[0124] Count the sample word frequency of each sample word in the sample file, and use the sample word frequency to calculate the word vector corresponding to each sample word;

[0125] The word vectors corresponding to multiple sample words in each sample sentence are used to generate a vector matrix corresponding to each sample sentence.

[0126] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0127] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0128] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.

Claims

1. A method for generating a suspicious transaction report, the method comprising: Acquire transaction data, and extract a customer identifier and a plurality of transaction fields from the transaction data; According to the customer identifier, searching through the big data platform for multiple feature fields corresponding to multiple risk features of the monitoring model; Inputting the transaction field and the multiple feature fields searched by the big data platform into the monitoring model, performing suspicious transaction identification through the monitoring model, and identifying whether the transaction data is a suspicious transaction; When the transaction data is a suspicious transaction, the code corresponding to the risk feature is called according to the search results of the big data platform, the risk feature code is used to identify the risk of the corresponding feature field, the corresponding risk label is output, and the risk type corresponding to the suspicious transaction is identified according to the multiple risk labels; The risk type corresponds to a plurality of risk characteristics; Acquire corresponding transaction fields according to the plurality of risk features corresponding to the risk type; Searching the big data platform for a feature field that is associated with the customer identifier in the transaction data and corresponds to the risk feature; Performing word segmentation processing on the transaction field and the feature field corresponding to the risk feature to obtain a plurality of words; Searching for word vectors of multiple words corresponding to the risk features in a training word library, and generating vector matrices corresponding to the risk features respectively; A plurality of vector matrices are input into a neural network model, and the neural network model performs calculations according to a mapping relationship between the vector matrices and sentences in a report template corresponding to the risk type, and outputs a suspicious transaction report corresponding to the risk type in the format of the report template.

2. The method according to claim 1, characterized in that The method further comprises: When the transaction data is identified as a suspicious transaction, a corresponding warning event is generated.

3. The method according to any one of claims 1 to 2, characterized in that: The method further comprises: Acquire multiple historical suspicious transaction reports, and mark the historical suspicious transaction reports as sample files; the sample files include multiple sample sentences and risk types; Identifying risk features corresponding to the sample sentences; Obtaining a report template corresponding to the risk type and a mapping relationship between the report template and the risk characteristics; Generate a training vector matrix corresponding to each sample sentence; The neural network is trained using the training vector matrix and the mapping relationship.

4. The method according to claim 3, characterized in that: Generating a training vector matrix corresponding to each sample sentence includes: Segmenting the sample document to obtain a plurality of sample sentences; Performing word segmentation processing on the sample sentence to obtain multiple sample words; Counting the sample word frequency of each sample word in the sample file, and using the sample word frequency to calculate the word vector corresponding to each sample word; The word vectors corresponding to multiple sample words in each sample sentence are used to generate a vector matrix corresponding to each sample sentence.

5. The method according to claim 4, characterized in that The calculating the word vector corresponding to each sample word by using the sample word frequency includes: Based on the sample word frequency of each sample word in the sample file, establish an inverse word frequency matrix; Each column vector in the inverse word frequency matrix is ​​extracted as the word vector corresponding to each sample word.

6. A suspicious transaction report generating device, characterized in that: The device comprises: A first identification module is used to obtain transaction data, extract a customer identifier and multiple transaction fields in the transaction data; search for multiple feature fields corresponding to multiple risk features of the monitoring model through the big data platform according to the customer identifier; input the transaction field and the multiple feature fields searched by the big data platform into the monitoring model, perform suspicious transaction identification through the monitoring model, and identify whether the transaction data is a suspicious transaction; A second identification module is used for, when the transaction data is a suspicious transaction, calling a code corresponding to the risk feature according to the search results of the big data platform, using the code of the risk feature to perform risk identification on the corresponding feature field, outputting a corresponding risk label, and identifying the risk type corresponding to the suspicious transaction according to multiple risk labels; the risk type corresponds to multiple risk features; The vector calculation module is used to obtain corresponding transaction fields according to the multiple risk features corresponding to the risk type; search the big data platform for feature fields corresponding to the risk features and associated with the customer identifier in the transaction data; perform word segmentation processing on the transaction fields and feature fields corresponding to the risk features to obtain multiple words; search for word vectors of the multiple words corresponding to the risk features in the training word library, and generate vector matrices corresponding to each of the risk features; The report generation module is used to input multiple vector matrices into a neural network model. The neural network model performs calculations based on the mapping relationship between the vector matrices and the sentences in the report template corresponding to the risk type, and outputs a suspicious transaction report corresponding to the risk type in the format of the report template.

7. The device according to claim 6, characterized in that The first identification module is further configured to generate a corresponding warning event when identifying the transaction data as a suspicious transaction.

8. The device according to claim 6, characterized in that The device also includes: A training module is used to obtain multiple historical suspicious transaction reports and mark the historical suspicious transaction reports as sample files; the sample files include multiple sample sentences and risk types; identify risk features corresponding to the sample sentences; obtain report templates corresponding to the risk types, and a mapping relationship between the report templates and the risk features; generate a training vector matrix corresponding to each sample sentence; and train a neural network using the training vector matrix and the mapping relationship.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein the processor implements the steps of the method according to any one of claims 1 to 5 when executing the computer program.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

Images