A method and device for identifying risk

Abstract

The present invention discloses a risk identification method and device, and relates to the field of computer technology. A specific implementation of the method includes: determining a training sample based on a plurality of historical transaction messages; inputting the training sample into a support vector machine model with current hyperparameters set to obtain an output result; updating the current hyperparameters according to the output result; determining whether a termination condition is met, and if so, inputting a prediction sample into a support vector machine model with updated current hyperparameters set to obtain a risk identification result; wherein the prediction sample is determined by the current transaction message. This implementation can timely and accurately identify transactions with risks, and ensure the safety of users' funds.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a risk identification method and device. Background Art

[0002] With the rapid development of electronic banking, users can conduct transactions such as transfers through mobile banking and online banking, making life more convenient. However, as the number of transactions increases, some criminals impersonate users to conduct transactions, causing serious economic losses to users.

[0003] To this end, existing technologies set rules based on the common methods used by criminals and identify risky transactions based on the rules.

[0004] However, as the criminals' methods change, the adjustment of rules has a large lag. Moreover, for some complex and hidden methods, the recognition accuracy of this method is low. Summary of the invention

[0005] In view of this, an embodiment of the present invention provides a risk identification method and device, which can timely and accurately identify risky transactions and ensure the safety of users' funds.

[0006] In a first aspect, an embodiment of the present invention provides a risk identification method, including:

[0007] Determine training samples based on multiple historical transaction messages;

[0008] Inputting the training sample into a support vector machine model with current hyperparameters set to obtain an output result;

[0009] Update the current hyperparameter according to the output result;

[0010] Determine whether the termination condition is met. If so, input the predicted sample into the support vector machine model with the updated current hyperparameters to obtain the risk identification result;

[0011] The predicted sample is determined by the current transaction message.

[0012] Optionally,

[0013] Updating the current hyperparameter according to the output result includes:

[0014] According to the output results, calculating individual fitness;

[0015] The current hyperparameter is updated according to the individual fitness.

[0016] Optionally,

[0017] The method further includes:

[0018] If the termination condition is not met, the following steps are performed according to the updated current hyperparameters: the training sample is input into a support vector machine model with the current hyperparameters set.

[0019] Optionally,

[0020] The step of determining the training samples according to the plurality of historical transaction messages includes:

[0021] Determine the type of each of the historical transaction messages; wherein the types include: positive messages and negative messages;

[0022] Features are extracted from the positive message and the negative message respectively; wherein the features provided by the positive message constitute positive training samples, and the features extracted from the negative message constitute negative training samples.

[0023] Optionally,

[0024] The current hyperparameters include: kernel function γ.

[0025] Optionally,

[0026] The current hyperparameters include: penalty factor C.

[0027] Optionally,

[0028] If the termination condition is not met, before inputting the training sample into the support vector machine model with the current hyperparameters set, the method further includes:

[0029] Increase the number of iterations by 1;

[0030] The termination condition includes: the number of iterations reaches a preset threshold.

[0031] Optionally,

[0032] The method further includes:

[0033] Determining a test sample according to the multiple historical transaction messages;

[0034] The support vector machine model is evaluated based on the test sample.

[0035] Optionally,

[0036] The ratio of the number of the training samples to the number of the test samples is 9:1.

[0037] Optionally,

[0038] When the risk identification result is that there is a risk, the method further includes:

[0039] The current transaction message is sent to the analysis platform.

[0040] In a second aspect, an embodiment of the present invention provides a risk identification device, including:

[0041] A determination module, configured to determine a training sample based on a plurality of historical transaction messages;

[0042] A training module, configured to input the training sample into a support vector machine model with current hyperparameters set to obtain an output result;

[0043] An updating module, configured to update the current hyperparameter according to the output result;

[0044] The prediction module is configured to determine whether the termination condition is met. If so, the prediction sample is input into the support vector machine model with the updated current hyperparameters to obtain the risk identification result; wherein, the prediction sample is determined by the current transaction message.

[0045] In a third aspect, an embodiment of the present invention provides an electronic device, including:

[0046] one or more processors;

[0047] a storage device for storing one or more programs,

[0048] When the one or more programs are executed by the one or more processors, the one or more processors implement the method described in any of the above embodiments.

[0049] In a fourth aspect, an embodiment of the present invention provides a computer-readable medium having a computer program stored thereon, wherein the program, when executed by a processor, implements the method described in any of the above embodiments.

[0050] One embodiment of the above invention has the following advantages or beneficial effects: the embodiment of the present invention optimizes the hyperparameters of the support vector machine model through training samples, and the optimized support vector machine model can more accurately identify risky transactions. When the means of criminals change, the parameters of the support vector machine model can be adjusted in time through training samples to ensure the safety of users' funds.

[0051] The further effects of the above-mentioned non-conventional optional manner will be described below in conjunction with the specific implementation manner. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] The accompanying drawings are used to better understand the present invention and do not constitute an improper limitation of the present invention.

[0053] Figure 1 is a flow chart of a risk identification method provided by an embodiment of the present invention;

[0054] Figure 2is a flow chart of a risk identification method provided by another embodiment of the present invention;

[0055] Figure 3 is a flow chart of a risk identification method provided by another embodiment of the present invention;

[0056] Figure 4 is a schematic diagram of a risk identification device provided by an embodiment of the present invention;

[0057] Figure 5 is an exemplary system architecture diagram to which embodiments of the present invention may be applied;

[0058] Figure 6 It is a schematic diagram of the structure of a computer system of a terminal device or a server suitable for implementing an embodiment of the present invention. DETAILED DESCRIPTION

[0059] The following is a description of exemplary embodiments of the present invention in conjunction with the accompanying drawings, including various details of the embodiments of the present invention to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present invention. Similarly, for clarity and conciseness, the description of well-known functions and structures is omitted in the following description.

[0060] The existing risk identification method is implemented through set rules, but it has the following two problems: On the one hand, compared with the changes in the means of criminals, the adaptation process of the existing method is delayed. The risk identification method based on rules is highly targeted, but it is easily affected by changes in means. When the means change, it takes a period of time to accumulate new risk events, and through expert analysis, the existing rules can be adjusted before they can take effect again; on the other hand, the existing method is limited by the characteristics of the rules themselves, as well as the requirements for indicators such as hit rate. For some relatively complex or hidden risk patterns, its discovery ability is relatively weak.

[0061] In view of this, an embodiment of the present invention provides a risk identification method, including:

[0062] Step 101: Determine training samples based on multiple historical transaction messages.

[0063] The historical transaction message is relative to the current transaction message to be identified. In actual application scenarios, the historical transaction message can be obtained by crawling, real-time interception, etc. The current transaction message is similar to it and will not be explained separately below.

[0064] Historical transaction messages include login information, registration information, transfer information, etc. Login, registration, transfer and other related features can be extracted from historical transaction messages to generate training samples.

[0065] The extracted features include but are not limited to: the number of terminal logins within a period of time, the number of users who register for a specified service on the same terminal within a period of time, the number of payments made to a specified user within a period of time, the number of payments with an amount greater than a specified threshold within a period of time, the city where the most recent specified number of transactions occurred, the number of online banking contracts signed within a period of time, the total number of transactions in the most recent specified days, whether the transfer object is a historical payee, and whether the province where the terminal logs in is the same as the province where the mobile banking contract is signed.

[0066] The training samples include positive training samples and negative training samples.

[0067] Positive training samples refer to historical transaction messages without risks, and negative training samples refer to historical transaction messages with risks. In actual application scenarios, historical transaction messages can be divided into different types, namely positive training samples or negative training samples, and then features can be extracted from different types of samples; or features can be extracted from historical transaction messages first, and then their corresponding types can be determined.

[0068] Step 102: Input the training sample into the support vector machine model with the current hyperparameters set to obtain the output result.

[0069] The extracted different features constitute training samples, which are input into the support vector machine model with current hyperparameters.

[0070] Step 103: Update the current hyperparameters according to the output results.

[0071] Update the current hyperparameters based on the deviation between the output result and the true result.

[0072] Step 104: Determine whether a termination condition is met.

[0073] In actual application scenarios, different termination conditions can be set according to the number of updates, the degree of deviation between the output result and the true result, etc.

[0074] Step 105: When the termination condition is met, the predicted sample is input into the support vector machine model with the updated current hyperparameters to obtain the risk identification result.

[0075] Among them, the prediction sample is determined by the current transaction message.

[0076] When the termination condition is met, it means that the current hyperparameters do not need to be adjusted further and can be used in the subsequent risk identification process. The embodiment of the present invention optimizes the hyperparameters of the support vector machine model through training samples, and the optimized support vector machine model can more accurately identify risky transactions. When the means of criminals change, the parameters of the support vector machine model can be adjusted in time through training samples to ensure the safety of users' funds.

[0077] In one embodiment of the present invention, updating the current hyperparameters according to the output results includes:

[0078] According to the output results, calculate the individual fitness;

[0079] Update the current hyperparameters according to individual fitness.

[0080] The embodiment of the present invention can use a directional distance function or other existing methods to calculate the individual fitness of class members, select the highest individual fitness value, and update the current hyperparameter according to the highest individual fitness value.

[0081] In actual application scenarios, the teaching and learning optimization algorithm or the improved teaching and learning optimization algorithm can be used to determine the current hyperparameters.

[0082] In one embodiment of the present invention, the method further comprises:

[0083] If the termination condition is not met, the following steps are performed according to the updated current hyperparameters: the training samples are input into the support vector machine model with the current hyperparameters set.

[0084] When the termination condition is not met, the current hyperparameters need to be optimized further. The termination condition can be the number of iterations. The termination condition can be used to obtain better current hyperparameters, making the prediction results of the support vector machine model more accurate, while preventing the optimization process of the current hyperparameters from lasting too long.

[0085] In one embodiment of the present invention, determining a training sample according to a plurality of historical transaction messages includes:

[0086] Determine the type of each historical transaction message; wherein the type includes: positive message and negative message;

[0087] Features are extracted from positive messages and negative messages respectively; wherein, the features provided by the positive messages constitute positive training samples, and the features extracted from the negative messages constitute negative training samples.

[0088] In one embodiment of the present invention, the current hyperparameters may include a kernel function γ and a penalty factor C.

[0089] In one embodiment of the present invention, if the termination condition is not met, before the training sample is input into the support vector machine model with the current hyperparameters set, the method further includes:

[0090] Increase the number of iterations by 1;

[0091] The termination condition includes: the number of iterations reaches a preset threshold.

[0092] The embodiment of the present invention constrains the number of iterations according to a number threshold, thereby ensuring the optimization effect of the current hyperparameter optimization and avoiding the time spent in the optimization process.

[0093] In one embodiment of the present invention, the method further comprises:

[0094] Determine the test sample based on multiple historical transaction messages;

[0095] Evaluate the support vector machine model on the test sample.

[0096] In order to determine the performance of the obtained support vector machine model, the embodiment of the present invention obtains test samples through historical transaction messages. Specifically, the support vector machine model can be evaluated using a ten-fold crossover method, with the ratio of the number of training samples to the number of prediction samples being 9:1.

[0097] In an embodiment of the present invention, the method further includes: when the risk identification result is risky, sending the current transaction message to the analysis platform. The transaction message with risk will be sent to the analysis platform so that the technicians can analyze it in detail.

[0098] like Figure 2 As shown, an embodiment of the present invention provides a risk identification method, including:

[0099] Step 201: Collect multiple historical transaction messages.

[0100] Step 202: Determine the type of each historical transaction message; wherein the types include: positive message and negative message.

[0101] Historical transaction messages with risks are negative messages, and historical transaction messages without risks are positive messages.

[0102] Step 203: extract features from the positive message and the negative message respectively; wherein the features provided by the positive message constitute the positive training sample, and the features extracted from the negative message constitute the negative training sample.

[0103] The extracted features include: the number of logins of the terminal that sent historical transaction messages within 3 days, the number of users who registered for service A at the terminal within 1 hour, the number of quick payments to the payment platform within 10 minutes, the number of times the amount was greater than 100 yuan within 1 hour, the city where the three most recent transactions took place, the number of online banking contracts signed on the same day, the total number of transactions in the past seven days, whether the name of the transferee belongs to the historical payee, and whether the province where the terminal logged in is the same as the province where the mobile banking contract was signed.

[0104] Step 204: input the training sample into the support vector machine model with current hyperparameters to obtain output results; the current hyperparameters include: kernel function γ and penalty factor C.

[0105] Step 205: Calculate individual fitness based on the output results.

[0106] Step 206: Update the current hyperparameters according to the individual fitness.

[0107] Update the current hyperparameters according to the highest individual fitness corresponding to each training sample.

[0108] Step 207: Determine whether the number of iterations reaches a preset number threshold, if so, execute step 208, otherwise, execute step 209.

[0109] Step 208 : Input the predicted samples into the support vector machine model with the updated current hyperparameters to obtain the risk identification results, and execute step 210 .

[0110] Among them, the prediction sample is determined by the current transaction message.

[0111] Step 209: Increase the number of iterations by 1, and execute step 204 according to the updated current hyperparameters.

[0112] Step 210: When the risk identification result is that there is a risk, the current transaction message is sent to the analysis platform.

[0113] The embodiment of the present invention optimizes the hyperparameters of the support vector machine through an iterative process, so that the obtained support vector machine model is more optimized and the prediction result is more accurate.

[0114] like Figure 3 As shown, an embodiment of the present invention provides a risk identification method, including:

[0115] Step 301: Initialize the grades of class members.

[0116] Step 302: Encode the current hyperparameters.

[0117] Step 303: Input the training samples into the support vector machine model with the current hyperparameters.

[0118] Step 304: Calculate the fitness value of each class member based on the output results.

[0119] Step 305: Update the highest fitness value.

[0120] Step 306: Increase the number of iterations by 1.

[0121] Step 307: Update the grades of class members.

[0122] Step 308: Encode the current hyperparameters.

[0123] Step 309: Input the training samples into the support vector machine model with the current hyperparameters.

[0124] Step 310: Calculate the fitness values ​​of class members based on the output results.

[0125] Step 311: Update the current highest fitness value and the highest score.

[0126] Step 312: Determine whether the number of iterations reaches the number threshold, if yes, execute step 313, otherwise, execute step 306.

[0127] Step 313: Determine the current hyperparameters according to the highest fitness value and the highest score.

[0128] Step 314: Identify whether the predicted sample has risks based on the support vector machine model with current hyperparameters.

[0129] The embodiment of the present invention has improved the teaching and learning optimization algorithm by using the number threshold to perform boundary constraints, and uses the improved teaching and learning optimization algorithm to determine the hyperparameters of the model. The risk identification method based on the model has higher identification accuracy, can discover hidden risks in transactions, and respond to changes in means in a timely manner.

[0130] like Figure 4 As shown, an embodiment of the present invention provides a risk identification device, including:

[0131] A determination module 401 is configured to determine a training sample according to a plurality of historical transaction messages;

[0132] The training module 402 is configured to input the training sample into a support vector machine model with current hyperparameters set to obtain an output result;

[0133] An updating module 403 is configured to update the current hyperparameter according to the output result;

[0134] The prediction module 404 is configured to determine whether the termination condition is met. If so, the prediction sample is input into the support vector machine model with the updated current hyperparameters to obtain the risk identification result; wherein the prediction sample is determined by the current transaction message.

[0135] In one embodiment of the present invention, the updating module 403 is configured to calculate the individual fitness according to the output result; and update the current hyperparameter according to the individual fitness.

[0136] In one embodiment of the present invention, the prediction module 404 is configured to trigger the training module 402 according to the updated current hyperparameters if the termination condition is not met.

[0137] In one embodiment of the present invention, the determination module 401 is configured to determine the type of each of the historical transaction messages; wherein the types include: positive messages and negative messages; extracting features from the positive messages and the negative messages respectively; wherein the features provided by the positive messages constitute positive training samples, and the features extracted from the negative messages constitute negative training samples.

[0138] In one embodiment of the present invention, the current hyperparameters include: a kernel function γ, and / or a penalty factor C.

[0139] In one embodiment of the present invention, the prediction module 404 is configured to increase the number of iterations by 1 if the termination condition is not met;

[0140] The termination condition includes: the number of iterations reaches a preset threshold.

[0141] In one embodiment of the present invention, the determination module 401 is configured to determine a test sample according to the multiple historical transaction messages; and evaluate the support vector machine model according to the test sample.

[0142] In one embodiment of the present invention, the ratio of the number of the training samples to the number of the test samples is 9:1.

[0143] In one embodiment of the present invention, the prediction module 404 is configured to send the current transaction message to the analysis platform when the risk identification result is risky.

[0144] An embodiment of the present invention provides an electronic device,

[0145] a storage device for storing one or more programs,

[0146] When the one or more programs are executed by the one or more processors, the one or more processors implement the method described in any of the above embodiments.

[0147] An embodiment of the present invention provides a computer-readable medium having a computer program stored thereon, wherein the program, when executed by a processor, implements the method described in any of the above embodiments.

[0148] Figure 5 An exemplary system architecture 500 is shown to which the risk identification method or risk identification device according to the embodiment of the present invention can be applied.

[0149] like Figure 5As shown, system architecture 500 may include terminal devices 501, 502, 503, a network 504 and a server 505. Network 504 is used to provide a medium for communication links between terminal devices 501, 502, 503 and server 505. Network 504 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0150] Users can use terminal devices 501, 502, 503 to interact with server 505 through network 504 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 501, 502, 503, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only as examples).

[0151] The terminal devices 501 , 502 , and 503 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.

[0152] The server 505 may be a server that provides various services, such as a backend management server (only an example) that provides support for shopping websites browsed by users using the terminal devices 501, 502, and 503. The backend management server may analyze and process the received data such as product information query requests, and feed back the processing results (such as target push information, product information - only an example) to the terminal device.

[0153] It should be noted that the risk identification method provided in the embodiment of the present invention is generally executed by the server 505 , and accordingly, the risk identification device is generally disposed in the server 505 .

[0154] It should be understood that Figure 5 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0155] Reference below Figure 6 , which shows a schematic diagram of the structure of a computer system 600 of a terminal device suitable for implementing an embodiment of the present invention. Figure 6 The terminal device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0156] like Figure 6As shown, the computer system 600 includes a central processing unit (CPU) 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage part 608 into a random access memory (RAM) 603. In the RAM 603, various programs and data required for the operation of the system 600 are also stored. The CPU 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0157] The following components are connected to the I / O interface 605: an input section 606 including a keyboard, a mouse, etc.; an output section 607 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 608 including a hard disk, etc.; and a communication section 609 including a network interface card such as a LAN card, a modem, etc. The communication section 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the I / O interface 605 as needed. A removable medium 611, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 610 as needed, so that a computer program read therefrom is installed into the storage section 608 as needed.

[0158] In particular, according to the embodiments disclosed in the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present invention include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 609, and / or installed from the removable medium 611. When the computer program is executed by the central processing unit (CPU) 601, the above-mentioned functions defined in the system of the present invention are executed.

[0159] It should be noted that the computer-readable medium shown in the present invention may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present invention, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0160] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0161] The modules involved in the embodiments of the present invention may be implemented in software or hardware. The modules described may also be set in a processor. For example, they may be described as: a processor includes a sending module, an acquisition module, a determination module, and a first processing module. The names of these modules do not, in some cases, constitute limitations on the modules themselves. For example, the sending module may also be described as a "module for sending a picture acquisition request to the connected server."

[0162] As another aspect, the present invention further provides a computer-readable medium, which may be included in the device described in the above embodiment; or may exist independently without being assembled into the device. The above computer-readable medium carries one or more programs, and when the above one or more programs are executed by a device, the device includes:

[0163] Determine training samples based on multiple historical transaction messages;

[0164] Inputting the training sample into a support vector machine model with current hyperparameters set to obtain an output result;

[0165] Update the current hyperparameter according to the output result;

[0166] Determine whether the termination condition is met. If so, input the predicted sample into the support vector machine model with the updated current hyperparameters to obtain the risk identification result;

[0167] The predicted sample is determined by the current transaction message.

[0168] According to the technical solution of the embodiment of the present invention, the hyperparameters of the support vector machine model are optimized through training samples, and the optimized support vector machine model can more accurately identify risky transactions. When the means of criminals change, the parameters of the support vector machine model can be adjusted in time through training samples to ensure the safety of users' funds.

[0169] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions may occur depending on design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A risk identification method, characterized in that: include: Determine training samples based on multiple historical transaction messages; Inputting the training sample into a support vector machine model with current hyperparameters set to obtain an output result; Updating the current hyperparameters according to the output results includes: step 1: initializing the grades of class members; step 2: encoding the current hyperparameters; step 3: inputting the training samples into the support vector machine model with the current hyperparameters; step 4: calculating the fitness values ​​of each class member according to the output results; step 5: updating the highest fitness value; step 6: adding 1 to the number of iterations; step 7: updating the grades of class members; step 8: encoding the current hyperparameters; step 9: inputting the training samples into the support vector machine model with the current hyperparameters; step 10: calculating the fitness values ​​of class members according to the output results; step 11: updating the current highest fitness value and the highest grade; step 12: determining whether the number of iterations reaches the number threshold, if so, executing step 13, otherwise, executing step 6; step 13: determining the current hyperparameters according to the highest fitness value and the highest grade; Determine whether the termination condition is met. If so, input the predicted sample into the support vector machine model with the updated current hyperparameters to obtain the risk identification result; The predicted sample is determined by the current transaction message.

2. The method according to claim 1, characterized in that The updating of the current hyperparameter according to the output result comprises: According to the output results, calculating individual fitness; The current hyperparameter is updated according to the individual fitness.

3. The method according to claim 1, characterized in that Further including: If the termination condition is not met, the following steps are performed according to the updated current hyperparameters: the training sample is input into a support vector machine model with the current hyperparameters set.

4. The method according to claim 1, characterized in that The step of determining the training samples according to the plurality of historical transaction messages includes: Determine the type of each of the historical transaction messages; wherein the types include: positive messages and negative messages; Features are extracted from the positive message and the negative message respectively; wherein the features provided by the positive message constitute positive training samples, and the features extracted from the negative message constitute negative training samples.

5. The method according to claim 1, characterized in that The current hyperparameters include: kernel function γ, and / or penalty factor C.

6. The method according to claim 3, characterized in that If the termination condition is not met, before the training sample is input into the support vector machine model with the current hyperparameters set, the method further includes: Increase the number of iterations by 1; The termination condition includes: the number of iterations reaches a preset threshold.

7. The method according to claim 1, characterized in that Further including: Determining a test sample according to the multiple historical transaction messages; The support vector machine model is evaluated based on the test sample.

8. The method according to claim 7, characterized in that The ratio of the number of the training samples to the number of the test samples is 9:

1.

9. The method according to claim 1, characterized in that When the risk identification result is that there is a risk, the method further includes: The current transaction message is sent to the analysis platform.

10. A risk identification device, characterized in that: include: A determination module, configured to determine a training sample based on a plurality of historical transaction messages; A training module, configured to input the training sample into a support vector machine model with current hyperparameters set to obtain an output result; The updating module is configured to update the current hyperparameters according to the output results, including: step 1: initializing the grades of class members; step 2: encoding the current hyperparameters; step 3: inputting the training samples into the support vector machine model with the current hyperparameters; step 4: calculating the fitness values ​​of each class member according to the output results; step 5: updating the highest fitness value; step 6: adding 1 to the number of iterations; step 7: updating the grades of class members; step 8: encoding the current hyperparameters; step 9: inputting the training samples into the support vector machine model with the current hyperparameters; step 10: calculating the fitness values ​​of class members according to the output results; step 11: updating the current highest fitness value and the highest grade; step 12: determining whether the number of iterations reaches the number threshold, if so, executing step 13, otherwise, executing step 6; step 13: determining the current hyperparameters according to the highest fitness value and the highest grade; The prediction module is configured to determine whether the termination condition is met. If so, the prediction sample is input into the support vector machine model with the updated current hyperparameters to obtain the risk identification result; wherein, the prediction sample is determined by the current transaction message.

11. An electronic device, characterized in that: include: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 9.

12. A computer readable medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 9 is implemented.

Images