Method and device for analyzing and warning transaction behavior of commercial bank employees

Abstract

The present invention discloses a method and device for analyzing and warning transaction behaviors of commercial bank employees, wherein the method comprises: establishing an employee transaction attribute model corresponding to each employee according to the identity attribute parameters and transaction behavior parameters of the commercial bank employees; establishing an employee abnormal transaction behavior model according to the employee abnormal transaction behavior items preset by the commercial bank; the employee abnormal transaction behavior model comprises abnormal transaction behavior characteristic variables corresponding to different employee abnormal transaction behavior items; for each employee, matching the employee transaction attribute model with the abnormal transaction behavior characteristic variables in the employee abnormal transaction behavior model; and issuing a warning message of abnormal employee transaction behavior when the matching is successful. The present invention can realize the automated analysis and warning of the transaction behaviors of commercial bank employees, improve the accuracy and efficiency of the analysis and warning of the transaction behaviors of commercial bank employees, and also improve the risk early warning capability of commercial banks.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method and device for analyzing and warning transaction behaviors of commercial bank employees. Background Art

[0002] This section is intended to provide a background or context to the embodiments of the invention recited in the claims. No admission is made that the description herein is prior art by inclusion in this section.

[0003] At present, analyzing and managing the employee behavior of commercial banks is the basis for ensuring the implementation of bank systems, safe operations, risk prevention, and employee care. In turn, employee behavior can be checked, which is an important task to strengthen risk prevention and control at all levels of institutions, links, and positions, and an important measure to strengthen case prevention and risk control responsibilities at all levels.

[0004] At present, commercial banks have the following problems in employee behavior management:

[0005] 1. Due to the large number of employees, data omissions and errors are prone to occur when managing employee transaction behaviors;

[0006] 2. As the current management method is mainly based on manual ledgers, it generally takes a lot of manpower and material resources to manually analyze employee transaction behaviors, resulting in low efficiency in bank transaction behavior analysis and poor risk warning capabilities of commercial banks.

[0007] Therefore, how to timely analyze and issue warnings on the transaction behaviors of commercial bank employees has become one of the urgent issues to be solved in the human resource management and even corporate development of various enterprises. Summary of the invention

[0008] The embodiment of the present invention provides a method for analyzing and warning transaction behaviors of commercial bank employees, so as to improve the efficiency and accuracy of analyzing and warning transaction behaviors of commercial bank employees. The method includes:

[0009] According to the identity attribute parameters and transaction behavior parameters of commercial bank employees, an employee transaction attribute model corresponding to each employee is established; the employee identity attribute parameters include the employee's identity information, proposed position and position; the employee transaction behavior parameters include the employee's consumption amount, credit card usage data, cash transaction volume and online platform transaction volume; the employee transaction attribute model includes transaction behavior parameters corresponding to the employee's identity attribute parameters;

[0010] According to the employee abnormal transaction behavior items preset by the commercial bank, an employee abnormal transaction behavior model is established; the employee abnormal transaction behavior model includes abnormal transaction behavior characteristic variables corresponding to different employee abnormal transaction behavior items; the abnormal transaction behavior characteristic variables include the transaction channel, transaction amount, transaction platform, transaction fund source and transaction fund purpose corresponding to the abnormal transaction behavior;

[0011] For each employee, the employee transaction attribute model is matched with the abnormal transaction behavior characteristic variables in the employee abnormal transaction behavior model;

[0012] When the match is successful, an alarm message is issued indicating abnormal employee transaction behavior.

[0013] The embodiment of the present invention also provides a device for analyzing and warning transaction behaviors of commercial bank employees, which is used to improve the efficiency and accuracy of analyzing and warning transaction behaviors of commercial bank employees. The device includes:

[0014] The employee transaction attribute model modeling module is used to establish an employee transaction attribute model corresponding to each employee according to the identity attribute parameters and transaction behavior parameters of the commercial bank employees; the employee identity attribute parameters include the employee's identity information, proposed position and position; the employee transaction behavior parameters include the employee's consumption amount, credit card usage data, cash transaction volume and network platform transaction volume; the employee transaction attribute model includes transaction behavior parameters corresponding to the employee's identity attribute parameters;

[0015] The employee abnormal transaction behavior model modeling module is used to establish an employee abnormal transaction behavior model according to the employee abnormal transaction behavior items preset by the commercial bank; the employee abnormal transaction behavior model includes abnormal transaction behavior feature variables corresponding to different employee abnormal transaction behavior items; the abnormal transaction behavior feature variables include the transaction channel, transaction amount, transaction platform, transaction fund source and transaction fund purpose corresponding to the abnormal transaction behavior;

[0016] A model matching module is used to match the employee transaction attribute model with the abnormal transaction behavior characteristic variables in the employee abnormal transaction behavior model for each employee;

[0017] The alarm information sending module is used to send an alarm message of abnormal employee transaction behavior when the match is successful.

[0018] An embodiment of the present invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned commercial bank employee transaction behavior analysis and alarm method when executing the computer program.

[0019] An embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program for executing the above-mentioned commercial bank employee transaction behavior analysis and alarm method.

[0020] In the embodiment of the present invention, an employee transaction attribute model corresponding to each employee is established based on the identity attribute parameters and transaction behavior parameters of the commercial bank employees; the employee identity attribute parameters include the employee's identity information, proposed position and position; the employee transaction behavior parameters include the employee's consumption amount, credit card usage data, cash transaction volume and network platform transaction volume; the employee transaction attribute model includes transaction behavior parameters corresponding to the employee's identity attribute parameters; based on the employee abnormal transaction behavior items preset by the commercial bank, an employee abnormal transaction behavior model is established; the employee abnormal transaction behavior model includes abnormal transaction behavior feature variables corresponding to different employee abnormal transaction behavior items; the abnormal transaction behavior feature variables include transaction channels, transaction amounts and transaction amounts corresponding to the abnormal transaction behaviors. amount, transaction platform, source of transaction funds and purpose of transaction funds; for each employee, match the employee transaction attribute model with the abnormal transaction behavior characteristic variables in the employee abnormal transaction behavior model; when the match is successful, issue an alarm message of abnormal employee transaction behavior, thereby realizing automated analysis and alarm of commercial bank employees' transaction behavior. By establishing an employee transaction attribute model for each employee, it is possible to avoid the problems of data omission and error caused by the large number of employees under the existing technology, thereby improving the accuracy of commercial bank employees' transaction behavior analysis and alarm; compared with the existing technology, it is no longer necessary to combine manual ledgers to analyze bank transaction behavior in a human way, thereby improving the efficiency of commercial bank employees' transaction behavior analysis and alarm, and also improving the risk warning ability of commercial banks. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the prior art descriptions. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0022] Figure 1 A flowchart of a method for analyzing and warning transaction behaviors of commercial bank employees in an embodiment of the present invention;

[0023] Figure 2 This is a specific example diagram of a method for analyzing and warning transaction behaviors of commercial bank employees in an embodiment of the present invention;

[0024] Figure 3This is a specific example diagram of a method for analyzing and warning transaction behaviors of commercial bank employees in an embodiment of the present invention;

[0025] Figure 4 This is a specific example diagram of a method for analyzing and warning transaction behaviors of commercial bank employees in an embodiment of the present invention;

[0026] Figure 5 This is a specific example diagram of a method for analyzing and warning transaction behaviors of commercial bank employees in an embodiment of the present invention;

[0027] Figure 6 This is a schematic diagram of the structure of a device for analyzing and giving an alarm for transaction behavior of commercial bank employees in an embodiment of the present invention;

[0028] Figure 7 This is a specific example diagram of a device for analyzing and giving an alarm for transaction behavior of commercial bank employees in an embodiment of the present invention;

[0029] Figure 8 Schematic diagram of a computer device in an embodiment of the present invention. DETAILED DESCRIPTION

[0030] To make the purpose, technical solution and advantages of the embodiments of the present invention more clear, the embodiments of the present invention are further described in detail below in conjunction with the accompanying drawings. Here, the exemplary embodiments of the present invention and their descriptions are used to explain the present invention, but are not intended to limit the present invention.

[0031] Figure 1 The following is a flow chart of a method for analyzing and giving an alarm for a commercial bank employee's transaction behavior in an embodiment of the present invention. The method for analyzing and giving an alarm for a commercial bank employee's transaction behavior provided in an embodiment of the present invention may include:

[0032] Step 101: Establish an employee transaction attribute model corresponding to each employee based on the identity attribute parameters and transaction behavior parameters of the commercial bank employees; the employee identity attribute parameters include the employee's identity information, proposed position and position; the employee transaction behavior parameters include the employee's consumption amount, credit card usage data, cash transaction volume and online platform transaction volume; the employee transaction attribute model includes the transaction behavior parameters corresponding to the employee's identity attribute parameters;

[0033] Step 102: Establish an employee abnormal transaction behavior model based on employee abnormal transaction behavior items preset by the commercial bank; the employee abnormal transaction behavior model includes abnormal transaction behavior feature variables corresponding to different employee abnormal transaction behavior items; the abnormal transaction behavior feature variables include transaction channels, transaction amounts, transaction platforms, transaction fund sources, and transaction fund purposes corresponding to the abnormal transaction behaviors;

[0034] Step 103: For each employee, matching the employee transaction attribute model with the abnormal transaction behavior characteristic variables in the employee abnormal transaction behavior model;

[0035] Step 104: When the match is successful, an alarm message is issued indicating that the employee's transaction behavior is abnormal.

[0036] In the embodiment of the present invention, an employee transaction attribute model corresponding to each employee is established based on the identity attribute parameters and transaction behavior parameters of the commercial bank employees; the employee identity attribute parameters include the employee's identity information, proposed position and position; the employee transaction behavior parameters include the employee's consumption amount, credit card usage data, cash transaction volume and network platform transaction volume; the employee transaction attribute model includes transaction behavior parameters corresponding to the employee's identity attribute parameters; based on the employee abnormal transaction behavior items preset by the commercial bank, an employee abnormal transaction behavior model is established; the employee abnormal transaction behavior model includes abnormal transaction behavior feature variables corresponding to different employee abnormal transaction behavior items; the abnormal transaction behavior feature variables include the transaction channel, transaction amount, transaction platform and other variables corresponding to the abnormal transaction behavior. platform, the source of transaction funds and the purpose of transaction funds; for each employee, the employee transaction attribute model is matched with the abnormal transaction behavior characteristic variables in the employee abnormal transaction behavior model; when the match is successful, an alarm message of abnormal employee transaction behavior is issued, thereby realizing the automated analysis and alarm of commercial bank employees' transaction behavior. By establishing an employee transaction attribute model for each employee, the problems of data omission and error caused by the large number of employees under the existing technology can be avoided, thereby improving the accuracy of commercial bank employees' transaction behavior analysis and alarm; compared with the existing technology, it is no longer necessary to combine manual ledgers to analyze bank transaction behavior in a human way, thereby improving the efficiency of commercial bank employees' transaction behavior analysis and alarm, and also improving the risk warning ability of commercial banks.

[0037] In the specific implementation, firstly, according to the identity attribute parameters and transaction behavior parameters of commercial bank employees, an employee transaction attribute model corresponding to each employee is established;

[0038] Among them, the employee's identity attribute parameters may include the employee's identity information, intended position and position; the employee's transaction behavior parameters may include the employee's consumption amount, credit card usage data, cash transaction volume and online platform transaction volume; the employee transaction attribute model may include transaction behavior parameters corresponding to the employee's identity attribute parameters.

[0039] In an embodiment, the employee's identity information may include the employee's name, employee mobile phone number and ID number; the employee's consumption amount may include the consumption amount of each transaction made with each bank card under the employee's name; the credit card usage data includes credit card usage behavior information, such as the time, place, consumption type and funds flow of using the credit card for consumption; the employee's transaction behavior parameters may also include the employee's excessive consumption data.

[0040] In the above embodiment, based on basic data such as employee name, employee mobile phone number, ID number, proposed position, position currently held, etc., transaction behavior data such as counterparty information, overspending data, credit card usage behavior, cash flow and online platform transaction volume of commercial bank employees collected through multiple channels, it is possible to establish an employee transaction attribute model corresponding to each employee, thereby achieving the purpose of outlining the employee's transaction behavior profile in multiple dimensions.

[0041] In specific implementation, after establishing an employee transaction attribute model corresponding to each employee based on the identity attribute parameters and transaction behavior parameters of the commercial bank employees, an employee abnormal transaction behavior model is established based on the employee abnormal transaction behavior items preset by the commercial bank; the employee abnormal transaction behavior model includes abnormal transaction behavior characteristic variables corresponding to different employee abnormal transaction behavior items; the abnormal transaction behavior characteristic variables include the transaction channel, transaction amount, transaction platform, transaction fund source and transaction fund purpose corresponding to the abnormal transaction behavior.

[0042] In the embodiment, an employee abnormal transaction behavior model is established based on employee abnormal transaction behavior items preset by the commercial bank, such as Figure 2 As shown, the following steps may be included:

[0043] Step 201: Establishing an employee transaction behavior database according to employee abnormal transaction behavior items preset by the commercial bank;

[0044] Step 202: Establish an employee abnormal transaction behavior model based on the established employee transaction behavior database.

[0045] In an embodiment, the employee abnormal transaction behavior items preset by the commercial bank may include abnormal behavior clauses defined within the commercial bank. The employee abnormal transaction behavior items are used to describe what kind of transaction behavior within the bank is abnormal transaction behavior, that is, the consumption amount, credit card usage data, cash transaction volume and network platform transaction volume involved in such transaction behavior exceed the preset value. Different transaction behaviors correspond to different abnormal transaction behavior characteristic variables, such as the transaction channel, transaction amount, transaction platform, transaction fund source and transaction fund use corresponding to the abnormal transaction behavior. For example, abnormal transaction behavior may include illegal transaction behaviors such as employee participation in illegal fund-raising, financing, underground money bank activities, employee suspected anti-money laundering activities, employee misappropriation and theft of customer funds, employee illegal business and enterprise operation, etc. The employee abnormal transaction behavior items and abnormal transaction behavior characteristic variables preset by the commercial bank can be freely set and updated according to the use needs of the staff.

[0046] In the above embodiment, according to the regulations of commercial banks on employee behavior management, it is possible to analyze and summarize the suspicious behavior characteristics of employees, and then systematically define a variety of abnormal behavior model feature variables as a "portrait" of employee abnormal behavior. In the embodiment of the present invention, after constructing the employee transaction behavior database, it can also include: constructing a system library, model library and evaluation library for employee behavior management. By structurally designing the knowledge base based on the business model, the purpose of business model asset loading and data rule verification can be achieved, and the flexible display and query of the business model can be supported.

[0047] In specific implementation, an employee abnormal transaction behavior model is established based on the employee abnormal transaction behavior items preset by the commercial bank, and for each employee, the employee transaction attribute model is matched with the abnormal transaction behavior characteristic variables in the employee abnormal transaction behavior model.

[0048] In the embodiment, for each employee, the employee transaction attribute model is matched with the abnormal transaction behavior characteristic variables in the employee abnormal transaction behavior model, such as Figure 3 As shown, the following steps may be included:

[0049] Step 301: For each employee, the transaction behavior parameters in the employee transaction attribute model are matched one by one with the abnormal transaction behavior characteristic variables in the employee abnormal transaction behavior model;

[0050] Step 302: Generate an employee abnormal transaction behavior label based on the transaction behavior parameters that successfully match the abnormal transaction behavior characteristic variables; the employee abnormal transaction behavior label includes the identity attribute parameters corresponding to the employee and the abnormal transaction behavior parameters;

[0051] Issue warning messages for abnormal employee transaction behaviors, which may include:

[0052] Send out an alarm message about abnormal employee transaction behavior with the employee abnormal transaction behavior label.

[0053] In an embodiment, matching the transaction behavior parameters in the employee transaction attribute model with the abnormal transaction behavior characteristic variables in the employee abnormal transaction behavior model one by one can include: using pivot tables, data splitting, data deduplication, data classification and aggregation, etc. to screen, sort, and associate the transaction behavior parameters in the employee transaction attribute model with the abnormal transaction behavior characteristic variables in the employee abnormal transaction behavior model one by one, and capturing suspicious information through effective data analysis.

[0054] In the above embodiment, by matching the transaction behavior parameters in the employee transaction attribute model with the abnormal transaction behavior characteristic variables in the employee abnormal transaction behavior model one by one, it can be determined whether there are transaction behavior parameters in the employee transaction attribute model that match the abnormal transaction behavior characteristic variables. When there are transaction behavior parameters in the employee transaction attribute model that match the abnormal transaction behavior characteristic variables, it can be determined that the employee has committed abnormal transaction behavior; by generating an employee abnormal transaction behavior label based on the transaction behavior parameters that successfully match the abnormal transaction behavior characteristic variables, it is possible to quickly locate the employee's abnormal transaction behavior, and clearly display the transaction information corresponding to the employee's abnormal transaction behavior, such as transaction channels, transaction amounts, transaction platforms, and transaction funding sources.

[0055] For example, if an employee participates in illegal fund-raising, financing, underground banking activities and other illegal activities, or is suspected of anti-money laundering activities, or has misappropriated or stolen customer funds, or has violated regulations in business operations, etc. By matching the employee transaction attribute model with the abnormal transaction behavior characteristic variables in the employee abnormal transaction behavior model, it is possible to promptly determine whether the employee has committed the above abnormal transaction behaviors. Specifically, suspicious transaction clues can be locked from characteristic variables such as employee counterparties, loan consumption, credit card usage, cash flow, online platform transaction volume, and normal revenue and expenditure ratio, and labels can be attached to the employee's abnormal transaction behaviors.

[0056] In specific implementation, for each employee, the employee transaction attribute model is matched with the abnormal transaction behavior characteristic variables in the employee abnormal transaction behavior model. When the match is successful, an alarm message of abnormal employee transaction behavior is issued.

[0057] In the embodiment, by sending alarm information about abnormal employee transaction behavior, it helps relevant bank staff to promptly discover abnormal employee transaction behavior, effectively protect the bank's funds, improve the security of the bank's system, and instantly locate abnormal employee transaction behavior, thereby improving the intelligence level of abnormal transaction behavior identification.

[0058] In the embodiment, the alarm processing personnel can locate the abnormal transaction behavior of the employee according to the alarm information and perform abnormal processing. When there are too many repeated alarms, the processing efficiency of the alarm processing personnel will be reduced. The embodiment of the present invention may also include: selecting any alarm information from the acquired alarm information, and then determining the key feature information in the selected alarm information, through which the unique alarm information can be determined, for example, the key feature information includes the identity attribute parameters and transaction behavior parameters of the employee corresponding to the abnormal transaction behavior of the employee; judging whether other alarm information also contains the same key feature information according to the determined key feature information, and finally, identifying the alarm information with the same key feature information as duplicate alarm information, and filtering multiple duplicate alarm information, and retaining only one alarm information. It can enable the alarm processing personnel to quickly complete the alarm processing and improve work efficiency.

[0059] In specific implementation, the method for commercial bank employee transaction behavior analysis and alarm provided by the embodiment of the present invention may also include: before establishing an employee transaction attribute model corresponding to each employee, obtaining identity attribute parameters and transaction behavior parameters corresponding to different employees through big data technology; the employee's transaction behavior parameters also include the employee's counterparty information and past income and expenditure ratio information.

[0060] In the above embodiment, by making full use of big data technology, the purpose of instantly and efficiently acquiring the identity attribute parameters and transaction behavior parameters of different employees can be achieved, which is helpful to establish an employee transaction attribute model corresponding to each employee in subsequent steps, and to update and iterate the employee transaction attribute model of each employee.

[0061] In specific implementation, the method for analyzing and warning the transaction behavior of commercial bank employees provided by the embodiment of the present invention is as follows: Figure 4 As shown, the following steps may also be included:

[0062] Step 401: After establishing the employee transaction attribute model corresponding to each employee, continuously obtain the identity attribute parameters and transaction behavior parameters corresponding to different employees;

[0063] Step 402: based on the continuously acquired identity attribute parameters and transaction behavior parameters corresponding to different employees, the employee transaction attribute model of each employee is updated and iterated.

[0064] In the above embodiment, by updating and iterating the employee transaction attribute model of each employee, it helps to improve the established employee transaction attribute model corresponding to each employee, and improve the accuracy of each employee's employee transaction attribute model in portraying each employee. At the same time, it helps to match the employee transaction attribute model with the abnormal transaction behavior characteristic variables in the employee abnormal transaction behavior model for each employee in subsequent steps, thereby improving the efficiency and accuracy of commercial bank employee transaction behavior analysis and alarms.

[0065] In specific implementation, the commercial bank employee transaction behavior analysis and alarm method provided by the embodiment of the present invention may also include: scanning employee abnormal transaction behavior tags at a preset period to generate a data list of employee abnormal transaction behavior.

[0066] In an embodiment, the employee's abnormal transaction behavior labels are scanned at a preset period to generate a data list of the employee's abnormal transaction behavior, which helps the banking system to perform daily batch screening of suspicious data hit by feature variables for the employee's abnormal transaction behavior labels; the formed data list containing suspicious data can support in-depth analysis of historical data, which helps the staff to clearly understand the employee's abnormal transaction behavior and improves the accuracy of locating the employee's abnormal transaction behavior.

[0067] In specific implementation, the method for analyzing and warning the transaction behavior of commercial bank employees provided by the embodiment of the present invention is as follows: Figure 5 As shown, the following steps may also be included:

[0068] Step 501: after issuing an alarm message of abnormal employee transaction behavior, receiving a processing result of the alarm message;

[0069] Step 502: According to the processing result of the alarm information, the matching result of the employee transaction attribute model and the abnormal transaction behavior characteristic variable in the employee abnormal transaction behavior model is checked.

[0070] In the above embodiment, a complete process of discovering suspicious points, investigating and verifying, and transferring and handling is realized; through the co-governance and sharing of behavioral data, the abnormal transaction behavior data of employees can be collected and integrated through multiple channels, realizing the purpose of multi-dimensional analysis to capture suspicious information, as well as differentiated verification and analysis, and improving the intelligence and accuracy of employee abnormal behavior portraits. At the same time, by verifying the matching results of the employee transaction attribute model and the abnormal transaction behavior characteristic variables in the employee abnormal transaction behavior model, it can help to form a unified process for commercial banks to issue, verify and feedback problems, and promote the transformation of employee behavior management mode from decentralized to centralized. The embodiment of the present invention realizes the unified disposal of various risks by unifying the alarm and case handling process of abnormal behavior events.

[0071] In specific implementation, the method for analyzing and alerting commercial bank employees' transaction behaviors provided by the embodiment of the present invention may also include: sending to a mobile terminal the alert information of abnormal employee transaction behaviors, the processing results of the alert information, and the verification results of the matching results of the employee transaction attribute model and the abnormal transaction behavior characteristic variables in the employee abnormal transaction behavior model.

[0072] In the embodiment, by sending the alarm information of abnormal employee transaction behavior, the processing result of the alarm information and the verification result of the matching result of the employee transaction attribute model and the abnormal transaction behavior characteristic variable in the employee abnormal transaction behavior model to the mobile terminal, the alarm information of abnormal employee transaction behavior, the processing result of the alarm information and the verification result of the matching result of the abnormal transaction behavior characteristic variable in the employee transaction attribute model and the employee abnormal transaction behavior model can be conveniently displayed, so that relevant staff can discover and process the alarm information in time, thereby improving the automation level of employee behavior management;

[0073] Furthermore, the work processes such as daily management, compliance education, violation discovery, violation handling, and problem rectification are digitized, the mobile APP version is combined with the web version, and functions such as one-click performance of duties are developed to improve work convenience.

[0074] In the above embodiment, the entire process can be carried out online through the "data distribution center" platform, and the data security management requirements of "receiving basic data", "issuing suspicious data", "collecting verification feedback results" and other links are strictly implemented to ensure that employee and customer information is not leaked.

[0075] In specific implementation, the method for commercial bank employee transaction behavior analysis and alarm provided by the embodiment of the present invention may also include: displaying data on employee transaction attribute models and employee abnormal transaction behavior models, as well as the matching results between employee transaction attribute models and employee abnormal transaction behavior models, based on preset data acquisition cycles and data categories.

[0076] In the embodiment, the purpose of data display can be achieved through a pre-set data display rule engine; through authority configuration and the data acquisition cycle (such as data reporting period) and data category selected by the user, a personalized data report view can be displayed for the user. Flexible data views of different organizational dimensions can be displayed for different users, and configurable predefined indicators can be used to display data within the scope of the user's authority, making the various indicators of statistical data more intuitive.

[0077] In the above embodiment, the rule engine can realize the dynamic definition and visualization of employee behavior data, which helps the staff to more intuitively view the employee transaction attribute model and the employee abnormal transaction behavior model, as well as the matching results of the employee transaction attribute model and the employee abnormal transaction behavior model, thereby improving the work efficiency of bank staff. The embodiment of the present invention can help build employee behavior files, share risk information, and improve the security of bank risk management through the unified display of employee behavior management monitoring results.

[0078] In specific implementation, the commercial bank employee transaction behavior analysis and alarm method provided by the embodiment of the present invention may also include:

[0079] An offline strategy laboratory is established based on the identity attribute parameters and transaction behavior parameters of commercial bank employees.

[0080] In the embodiment, the offline strategy laboratory has the functions of data support, tool support and model sharing, which are as follows:

[0081] Data support: Automatically synchronize customer information data and business process data every day to build a quasi-production data environment, and retain a sufficient amount of historical data to provide data support for model mining and modeling;

[0082] Tool support: In the laboratory, a big data analysis tool platform based on SAS, TD Aster, Python, etc. was built to provide tool support for model mining and modeling, knowledge graph construction and data exploration and analysis.

[0083] Model sharing: In the laboratory, a set of management mechanisms including personnel management, model management, data sharing, and results sharing are established to realize the business autonomous model mining and analysis mechanism and the model exchange and sharing platform among branches.

[0084] 1. Data support can realize the automatic collection of abnormal trading behavior cases: the collected cases are from typical cases that have occurred or been discovered in the industry or institution. The risk information should be consistent with the development and changes of current personnel compliance management and have a certain degree of foresight. The relevant cases should at least reflect the main characteristics of compliance management and have strong representativeness, regularity and universality.

[0085] 2. Feature analysis: collect cases with industry-wide and typical characteristics; share cases with the branch’s own personalized characteristics; and analyze, summarize and conclude the cases:

[0086] For the collected cases, employees should be used as monitoring units. From the employee's identity, behavior, and the source, amount, frequency, flow, nature, etc. of funds in their transactions, identifiable abnormal features with typical representativeness, regularity or general applicability should be abstracted. The analysis dimensions include but are not limited to:

[0087] a. Employee identity. Typical identifiable characteristics include location, age, occupation, contact information, main source of income (wealth), actual beneficiary of the transaction, etc.;

[0088] b. Employee behavior. Typical identifiable characteristics include employee preferences for certain businesses and products, preferences for certain transaction channels, preferences for the use of financial services, deliberate concealment and concealment, and other behavioral characteristics;

[0089] c. Transaction characteristics. Typical identifiable characteristics include source of funds, transaction time, transaction volume, transaction frequency, transaction direction, etc.;

[0090] 3. Feature indexing

[0091] Extract and quantify the identifiable features in the collected cases, and design indicators that can identify, measure or reflect the abnormal features in the cases, including but not limited to indicator codes, indicator names, indicator rules, indicator thresholds and other formal requirements.

[0092] Indicator modeling: Arrange and combine different indicators that reflect specific types to form a model to achieve targeted monitoring of compliance management. Indicators and models can be used independently or in combination. The model can be used to monitor activities that involve a wide range of areas, are relatively complex and hidden, and have typical suspicious characteristics of employees and their transactions.

[0093] After the model is built, it is necessary to further establish a model verification and continuous optimization mechanism. Model verification helps to continuously monitor whether the monitoring model is effective in identifying suspicious transactions. Model verification is a review and evaluation of a series of model development and management work, including: model development foundation, development process, model performance benchmarking, model continuous management and other aspects.

[0094] In the above embodiment, a centralized data analysis and R&D environment is provided to achieve sharing of basic risk information.

[0095] A specific embodiment is given below to illustrate the specific application of the method of the present invention. In this embodiment, the following steps may be included:

[0096] (1) Data linkage leads and aggregates employee behavior information

[0097] Make full use of big data technology, with basic data such as employee name, employee mobile phone number, ID number, proposed position, and current position as the fulcrum, collect employee transaction behavior data such as counterparties, excessive consumption, credit card usage, cash flow, online platform transaction volume, and normal income and expenditure ratio through multiple channels, and outline the employee transaction behavior profile in multiple dimensions;

[0098] Using suspicious transaction parameters such as employee counterparties, excessive consumption, credit card usage, cash flow, online platform transaction volume, and normal revenue and expenditure ratio as points, and gathering points as lines, we outline the contours of employees' suspicious transactions in multiple dimensions, and use auditing methods to thoroughly investigate employees' violations of regulations and discipline.

[0099] (2) Extract abnormal features and form feature variables

[0100] According to the regulations of commercial banks on employee behavior management, the characteristics of employees' suspicious behaviors are analyzed and summarized, and the characteristic variables of abnormal behavior models are systematically defined as the "portrait" of employees' abnormal behaviors.

[0101] The system screens suspicious data hit by feature variables in batches on a daily basis, forms a list of suspicious data, and supports in-depth analysis of historical data.

[0102] Examples of abnormal trading behaviors are as follows:

[0103] a. Employees’ participation in illegal fund-raising, financing, underground banking activities and other illegal activities: Employees’ participation in large-scale risk investment activities, employees’ participation in illegal fund-raising activities (there are many counterparties and transaction characteristics such as centralized collection of funds or centralized payment of funds);

[0104] b. Employees suspected of anti-money laundering activities: suspicious customers involved in gambling, pyramid schemes, fund-raising, drug crimes, etc. in the anti-money laundering monitoring system have financial transactions with our employees, or our employees are on the list of suspicious anti-money laundering customers;

[0105] c. Employee misappropriation and theft of customer funds: Employees use their own mobile phones to sign up for electronic banking for others, employees use accounts under their names to collect customer funds, and employees collect customer funds to purchase financial products on behalf of customers;

[0106] (3) Verification of suspicious data

[0107] It can form a unified process for issuing, verifying and providing feedback on issues that can be used in commercial banks, and promote the transformation of the employee behavior management model from decentralized to centralized.

[0108] Based on the "portrait" of employee abnormal behavior (i.e., the employee abnormal transaction behavior model), suspicious transaction clues are locked from aspects such as employee transaction counterparties, loan consumption, credit card usage, cash flow, online platform transaction volume, and normal income and expenditure ratio, and abnormal employee behavior is "labeled" (i.e., the employee transaction attribute model is matched with the abnormal transaction behavior characteristic variables in the employee abnormal transaction behavior model):

[0109] 1. Investigate employees’ participation in illegal fund-raising, financing, underground banking and other abnormal trading behaviors: Screen single transaction amounts greater than or equal to RMB 1 million, involving trading scenarios such as “funds”, “stocks”, “futures”, “equity”, “micro loans”, “finance”, “guarantees”, “trusts”, “margins”, and “real estate”, with transaction data with more than or equal to 30 counterparties;

[0110] 2. Investigate employees’ abnormal behaviors suspected of anti-money laundering activities: Screen the transaction details of suspicious anti-money laundering customers whose single transaction amount is greater than or equal to RMB 1,000 and whose counterparties are provided by the compliance management department;

[0111] 3. Check for abnormal behavior of employees signing contracts on behalf of customers: filter the data where the personal customer's e-banking contract phone number is the same as the employee's mobile phone number, and select "telephone banking", "online banking", "mobile banking", or "SMS channel" as the contract type;

[0112] 4. Investigate employees’ abnormal behaviors in conducting business in violation of regulations:

[0113] First, filter the transaction data with a single transaction amount of ≥1,000 yuan and the counterparty's account name is a corporate customer;

[0114] Second, filter out data where the ID number of the person associated with the organization is the same as the employee’s ID number (excluding entrusted loan fund accounts);

[0115] The third is to screen data where the ID number of the authorized agent of the unit is the same as the ID number of the employee;

[0116] Fourth, screen the customer information of the centralized accounting reconciliation system. Combined with the suspicious data, check whether the employees have violated the rules by engaging in business and running enterprises;

[0117] For example, an employee works part-time in another economic entity without authorization, and uses credit card funds for investment and financial management, or to repay online loans:

[0118] An employee XXX made 24 credit card purchases totaling about 240,000 yuan, which is more than three times his salary. By matching the employee's transaction attribute model with the abnormal transaction behavior characteristic variables in the employee abnormal transaction behavior model, it is determined that the employee's transaction behavior is abnormal;

[0119] An alarm message is issued for abnormal transaction behavior of the employee, which includes specific parameters of the abnormal transaction behavior of the employee, such as the employee using the bank card controlled by himself to participate in the fund settlement business of his family members in business activities, and the employee using credit card funds for investment and financial management and repayment of online loans.

[0120] Another example: Employees use quick loan funds to repay online loans and credit card debts, and credit card funds flow into the housing market

[0121] An employee borrowed money through credit card swiping or microfinance companies, Weilidai and other online platforms, with a total loan amount of about 542,200 yuan (more than 4 times his salary income). By matching the employee's transaction attribute model with the abnormal transaction behavior characteristic variables in the employee's abnormal transaction behavior model, it is determined that the employee's transaction behavior is abnormal;

[0122] An alarm message is issued for abnormal transaction behavior of the employee, which includes specific parameters of the employee's abnormal transaction behavior, such as the employee withdrawing Quick Loan funds to repay Wechat Micro Loan and credit card debts; swiping credit cards at real estate companies; and using online loans through Wechat Micro Loan to repay credit cards and Quick Loan funds, etc.

[0123] After processing the alarm information, the relevant staff came to the following conclusion: In view of the member's serious violations, he has been given a warning.

[0124] (4) Data display

[0125] Through permission configuration and user-selected data reporting period, data category, etc., the data report view can be personalized for users. Flexible data views of different institutional dimensions can be displayed for different users, and configurable predefined indicators can be used to display data within the scope of the user's permission, making the various indicators of statistical data more intuitive.

[0126] Of course, it is understandable that the above detailed process may have other variations, and the relevant variations should all fall within the protection scope of the present invention.

[0127] In the embodiment of the present invention, an employee transaction attribute model corresponding to each employee is established based on the identity attribute parameters and transaction behavior parameters of the commercial bank employees; the employee identity attribute parameters include the employee's identity information, proposed position and position; the employee transaction behavior parameters include the employee's consumption amount, credit card usage data, cash transaction volume and network platform transaction volume; the employee transaction attribute model includes transaction behavior parameters corresponding to the employee's identity attribute parameters; based on the employee abnormal transaction behavior items preset by the commercial bank, an employee abnormal transaction behavior model is established; the employee abnormal transaction behavior model includes abnormal transaction behavior feature variables corresponding to different employee abnormal transaction behavior items; the abnormal transaction behavior feature variables include the transaction channel, transaction amount, transaction platform and other variables corresponding to the abnormal transaction behavior. platform, the source of transaction funds and the purpose of transaction funds; for each employee, the employee transaction attribute model is matched with the abnormal transaction behavior characteristic variables in the employee abnormal transaction behavior model; when the match is successful, an alarm message of abnormal employee transaction behavior is issued, thereby realizing the automated analysis and alarm of commercial bank employees' transaction behavior. By establishing an employee transaction attribute model for each employee, the problems of data omission and error caused by the large number of employees under the existing technology can be avoided, thereby improving the accuracy of commercial bank employees' transaction behavior analysis and alarm; compared with the existing technology, it is no longer necessary to combine manual ledgers to analyze bank transaction behavior in a human way, thereby improving the efficiency of commercial bank employees' transaction behavior analysis and alarm, and also improving the risk warning ability of commercial banks.

[0128] The present invention also provides a device for analyzing and warning the transaction behavior of commercial bank employees, such as the following embodiment. Since the principle of solving the problem by the device is similar to the method for analyzing and warning the transaction behavior of commercial bank employees, the implementation of the device can refer to the implementation of the method for analyzing and warning the transaction behavior of commercial bank employees, and the repeated parts will not be repeated.

[0129] Figure 6 FIG. 1 is a schematic diagram of a device for analyzing and giving an alarm for transaction behavior of commercial bank employees according to an embodiment of the present invention. Figure 6 As shown, the device for analyzing and warning the transaction behavior of commercial bank employees provided by the embodiment of the present invention may include:

[0130] The employee transaction attribute model modeling module 01 is used to establish an employee transaction attribute model corresponding to each employee according to the identity attribute parameters and transaction behavior parameters of the commercial bank employees; the employee identity attribute parameters include the employee's identity information, proposed position and position; the employee transaction behavior parameters include the employee's consumption amount, credit card usage data, cash transaction volume and network platform transaction volume; the employee transaction attribute model includes transaction behavior parameters corresponding to the employee's identity attribute parameters;

[0131] The employee abnormal transaction behavior model modeling module 02 is used to establish an employee abnormal transaction behavior model according to the employee abnormal transaction behavior items preset by the commercial bank; the employee abnormal transaction behavior model includes abnormal transaction behavior characteristic variables corresponding to different employee abnormal transaction behavior items; the abnormal transaction behavior characteristic variables include the transaction channel, transaction amount, transaction platform, transaction fund source and transaction fund purpose corresponding to the abnormal transaction behavior;

[0132] Model matching module 03, for matching the employee transaction attribute model with the abnormal transaction behavior characteristic variables in the employee abnormal transaction behavior model for each employee;

[0133] The alarm information sending module 04 is used to send an alarm message of abnormal transaction behavior of the employee when the matching is successful.

[0134] In one embodiment, Figure 7 As shown, it also includes: a data acquisition module 05, which is used to:

[0135] Before the employee transaction attribute model modeling module establishes the employee transaction attribute model corresponding to each employee, the identity attribute parameters and transaction behavior parameters corresponding to different employees are obtained through big data technology; the employee's transaction behavior parameters also include the employee's counterparty information and past income and expenditure ratio information.

[0136] In one embodiment, the system further includes: an employee transaction attribute model update and iteration module, which is used to:

[0137] After the employee transaction attribute model modeling module establishes the employee transaction attribute model corresponding to each employee, the identity attribute parameters and transaction behavior parameters corresponding to different employees are continuously obtained;

[0138] Based on the continuously acquired identity attribute parameters and transaction behavior parameters corresponding to different employees, the employee transaction attribute model of each employee is updated and iterated.

[0139] In one embodiment, the employee abnormal transaction behavior modeling module is specifically used to:

[0140] Establish an employee transaction behavior database based on the employee abnormal transaction behavior items preset by commercial banks;

[0141] Based on the established employee trading behavior database, an employee abnormal trading behavior model is established.

[0142] In one embodiment, the model matching module is specifically used to:

[0143] For each employee, the transaction behavior parameters in the employee transaction attribute model are matched one by one with the abnormal transaction behavior characteristic variables in the employee abnormal transaction behavior model;

[0144] Generate an employee abnormal transaction behavior label based on the transaction behavior parameters that successfully match the abnormal transaction behavior characteristic variables; the employee abnormal transaction behavior label includes the identity attribute parameters corresponding to the employee and the abnormal transaction behavior parameters;

[0145] The alarm information sending module is specifically used for:

[0146] Send out an alarm message about abnormal employee transaction behavior with the employee abnormal transaction behavior label.

[0147] In one embodiment, it also includes: a data list generation module, which is used to: scan the employee's abnormal transaction behavior labels at a preset period to generate a data list of the employee's abnormal transaction behavior.

[0148] In one embodiment, the invention further comprises: a verification module, which is used to:

[0149] After issuing an alarm message of abnormal employee transaction behavior, receiving the processing result of the alarm message;

[0150] According to the processing result of the alarm information, the matching result of the employee transaction attribute model and the abnormal transaction behavior characteristic variable in the employee abnormal transaction behavior model is checked.

[0151] In one embodiment, it further includes: a data display module, which is used to:

[0152] Based on the preset data acquisition cycle and data category, data display is performed on the employee transaction attribute model and the employee abnormal transaction behavior model, as well as the matching results between the employee transaction attribute model and the employee abnormal transaction behavior model.

[0153] An embodiment of the present invention further provides a computer device, Figure 8 Schematic diagram of a computer device in an embodiment of the present invention. The computer device can implement all steps of the method for analyzing and alerting transaction behaviors of commercial bank employees in the above embodiment. The computer device specifically includes the following contents:

[0154] Processor 801

[0155] Memory 802

[0156] Communications interface 803 and communications bus 804;

[0157] The processor 801, the memory 802, and the communication interface 803 communicate with each other through the communication bus 804; the communication interface 803 is used to realize information transmission between related devices;

[0158] The processor 801 is used to call the computer program in the memory 802, and when the processor executes the computer program, the method for analyzing and warning the transaction behavior of commercial bank employees in the above embodiment is implemented.

[0159] An embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program for executing the above-mentioned commercial bank employee transaction behavior analysis and alarm method.

[0160] In the embodiment of the present invention, an employee transaction attribute model corresponding to each employee is established based on the identity attribute parameters and transaction behavior parameters of the commercial bank employees; the employee identity attribute parameters include the employee's identity information, proposed position and position; the employee transaction behavior parameters include the employee's consumption amount, credit card usage data, cash transaction volume and network platform transaction volume; the employee transaction attribute model includes transaction behavior parameters corresponding to the employee's identity attribute parameters; based on the employee abnormal transaction behavior items preset by the commercial bank, an employee abnormal transaction behavior model is established; the employee abnormal transaction behavior model includes abnormal transaction behavior feature variables corresponding to different employee abnormal transaction behavior items; the abnormal transaction behavior feature variables include transaction channels, transaction amounts and transaction amounts corresponding to the abnormal transaction behaviors. amount, transaction platform, source of transaction funds and purpose of transaction funds; for each employee, match the employee transaction attribute model with the abnormal transaction behavior characteristic variables in the employee abnormal transaction behavior model; when the match is successful, issue an alarm message of abnormal employee transaction behavior, thereby realizing automated analysis and alarm of commercial bank employees' transaction behavior. By establishing an employee transaction attribute model for each employee, it is possible to avoid the problems of data omission and error caused by the large number of employees under the existing technology, thereby improving the accuracy of commercial bank employees' transaction behavior analysis and alarm; compared with the existing technology, it is no longer necessary to combine manual ledgers to analyze bank transaction behavior in a human way, thereby improving the efficiency of commercial bank employees' transaction behavior analysis and alarm, and also improving the risk warning ability of commercial banks.

[0161] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0162] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0163] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0164] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0165] The specific embodiments described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for analyzing and alerting transaction behaviors of commercial bank employees, characterized in that: include: According to the identity attribute parameters and transaction behavior parameters of commercial bank employees, an employee transaction attribute model corresponding to each employee is established; the employee identity attribute parameters include the employee's identity information, proposed position and position; the employee transaction behavior parameters include the employee's consumption amount, credit card usage data, cash transaction volume and online platform transaction volume; the employee transaction attribute model includes transaction behavior parameters corresponding to the employee's identity attribute parameters; According to the employee abnormal transaction behavior items preset by the commercial bank, an employee abnormal transaction behavior model is established; the employee abnormal transaction behavior model includes abnormal transaction behavior characteristic variables corresponding to different employee abnormal transaction behavior items; the abnormal transaction behavior characteristic variables include the transaction channel, transaction amount, transaction platform, transaction fund source and transaction fund purpose corresponding to the abnormal transaction behavior; For each employee, the employee transaction attribute model is matched with the abnormal transaction behavior characteristic variables in the employee abnormal transaction behavior model; When the match is successful, an alarm message is issued indicating abnormal employee transaction behavior; Establishing an employee abnormal transaction behavior model based on employee abnormal transaction behavior items preset by the commercial bank, including: establishing an employee transaction behavior database based on employee abnormal transaction behavior items preset by the commercial bank; establishing an employee abnormal transaction behavior model based on the established employee transaction behavior database; For each employee, matching the employee transaction attribute model with the abnormal transaction behavior characteristic variables in the employee abnormal transaction behavior model, including: for each employee, matching the transaction behavior parameters in the employee transaction attribute model with the abnormal transaction behavior characteristic variables in the employee abnormal transaction behavior model one by one; generating an employee abnormal transaction behavior label according to the transaction behavior parameters successfully matched with the abnormal transaction behavior characteristic variables; the employee abnormal transaction behavior label includes the identity attribute parameters corresponding to the employee and the abnormal transaction behavior parameters; issuing an alarm message of an abnormal employee transaction behavior, including: issuing an alarm message of an abnormal employee transaction behavior carrying the employee abnormal transaction behavior label; The method also includes: before establishing an employee transaction attribute model corresponding to each employee, obtaining identity attribute parameters and transaction behavior parameters corresponding to different employees through big data technology; the employee transaction behavior parameters also include employee transaction counterparty information and past income and expenditure ratio information; The method further includes: after establishing an employee transaction attribute model corresponding to each employee, continuously obtaining identity attribute parameters and transaction behavior parameters corresponding to different employees; and updating and iterating the employee transaction attribute model of each employee according to the continuously obtained identity attribute parameters and transaction behavior parameters corresponding to different employees; It also includes: scanning the employee's abnormal transaction behavior tags at a preset period to generate a data list of the employee's abnormal transaction behavior; The method further includes: after issuing an alarm message of abnormal employee transaction behavior, receiving a processing result of the alarm message; and verifying a matching result of an employee transaction attribute model and an abnormal transaction behavior characteristic variable in an employee abnormal transaction behavior model according to the processing result of the alarm message; It also includes: establishing an offline strategy laboratory based on the identity attribute parameters and transaction behavior parameters of commercial bank employees; the offline strategy laboratory automatically synchronizes customer information data and business process data every day to build a quasi-production data environment and retain historical data; the offline strategy laboratory builds a big data analysis tool platform based on SAS, TD Aster, and Python; the offline strategy laboratory establishes personnel management, model management, data sharing, and results sharing management mechanisms to realize business autonomous model mining and analysis mechanisms and a model exchange and sharing platform between branches.

2. The method according to claim 1, characterized in that Also includes: Based on the preset data acquisition cycle and data category, data display is performed on the employee transaction attribute model and the employee abnormal transaction behavior model, as well as the matching results between the employee transaction attribute model and the employee abnormal transaction behavior model.

3. A device for analyzing and warning transaction behavior of commercial bank employees, characterized in that: include: The employee transaction attribute model modeling module is used to establish an employee transaction attribute model corresponding to each employee according to the identity attribute parameters and transaction behavior parameters of the commercial bank employees; the employee identity attribute parameters include the employee's identity information, proposed position and position; the employee transaction behavior parameters include the employee's consumption amount, credit card usage data, cash transaction volume and network platform transaction volume; the employee transaction attribute model includes transaction behavior parameters corresponding to the employee's identity attribute parameters; The employee abnormal transaction behavior model modeling module is used to establish an employee abnormal transaction behavior model according to the employee abnormal transaction behavior items preset by the commercial bank; the employee abnormal transaction behavior model includes abnormal transaction behavior feature variables corresponding to different employee abnormal transaction behavior items; the abnormal transaction behavior feature variables include the transaction channel, transaction amount, transaction platform, transaction fund source and transaction fund purpose corresponding to the abnormal transaction behavior; A model matching module is used to match the employee transaction attribute model with the abnormal transaction behavior characteristic variables in the employee abnormal transaction behavior model for each employee; The alarm information sending module is used to send an alarm message of abnormal employee transaction behavior when the match is successful; The employee abnormal transaction behavior model modeling module is specifically used to: establish an employee transaction behavior database based on employee abnormal transaction behavior items preset by the commercial bank; establish an employee abnormal transaction behavior model based on the established employee transaction behavior database; The model matching module is specifically used to: for each employee, match the transaction behavior parameters in the employee transaction attribute model with the abnormal transaction behavior characteristic variables in the employee abnormal transaction behavior model one by one; generate an employee abnormal transaction behavior label according to the transaction behavior parameters that successfully match the abnormal transaction behavior characteristic variables; the employee abnormal transaction behavior label includes the identity attribute parameters corresponding to the employee and the abnormal transaction behavior parameters; the alarm information sending module is specifically used to: send an alarm message of abnormal employee transaction behavior carrying the employee abnormal transaction behavior label; It also includes: a data acquisition module, which is used to: before the employee transaction attribute model modeling module establishes the employee transaction attribute model corresponding to each employee, obtain the identity attribute parameters and transaction behavior parameters corresponding to different employees through big data technology; the employee transaction behavior parameters also include the employee's transaction counterparty information and past income and expenditure ratio information; It also includes: an employee transaction attribute model update and iteration module, which is used to: after the employee transaction attribute model modeling module establishes the employee transaction attribute model corresponding to each employee, continuously obtain the identity attribute parameters and transaction behavior parameters corresponding to different employees; according to the continuously obtained identity attribute parameters and transaction behavior parameters corresponding to different employees, update and iterate the employee transaction attribute model of each employee; It also includes: a data list generation module, which is used to: scan the employee's abnormal transaction behavior labels at a preset period to generate a data list of the employee's abnormal transaction behavior; It also includes: a verification module, which is used to: after issuing an alarm message of abnormal employee transaction behavior, receive a processing result of the alarm message; and verify the matching result of the employee transaction attribute model and the abnormal transaction behavior characteristic variable in the employee abnormal transaction behavior model according to the processing result of the alarm message; It also includes: establishing an offline strategy laboratory based on the identity attribute parameters and transaction behavior parameters of commercial bank employees; the offline strategy laboratory automatically synchronizes customer information data and business process data every day to build a quasi-production data environment and retain historical data; the offline strategy laboratory builds a big data analysis tool platform based on SAS, TD Aster, and Python; the offline strategy laboratory establishes personnel management, model management, data sharing, and results sharing management mechanisms to realize business autonomous model mining and analysis mechanisms and a model exchange and sharing platform between branches.

4. The device according to claim 3, characterized in that Also includes: Data display module, used for: Based on the preset data acquisition cycle and data category, data display is performed on the employee transaction attribute model and the employee abnormal transaction behavior model, as well as the matching results between the employee transaction attribute model and the employee abnormal transaction behavior model.

5. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 2 is implemented.

6. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program for executing the method according to any one of claims 1 to 2.

Images