Data processing method, device and electronic equipment

Abstract

The implementation method of the present application discloses a data processing method, device and electronic device, which relates to the field of financial technology. The method includes: obtaining a target file, wherein the target file carries multiple transaction records and predetermined marks; the predetermined marks are generated by a computer model and are used to characterize the relevance of the target file to non-compliant transaction behavior; obtaining an abnormal indicator set, wherein the abnormal indicator set includes multiple abnormal indicator items; determining the abnormal value of each abnormal indicator item of the target file according to a preset indicator calculation function and multiple transaction records; calling a preset threshold table, and obtaining the preset threshold corresponding to each abnormal indicator item from the threshold table; using the abnormal indicator item of the target file whose abnormal value exceeds the preset threshold as the abnormal indicator item hit by the target file. This scheme can effectively reduce the workload during the final compliance judgment, and solves the problems of large data processing volume and low identification efficiency in the process of misjudgment identification of non-compliant files.

Description

Technical Field

[0001] The present application relates to the field of financial technology, and in particular to data processing methods, devices and electronic equipment. Background Art

[0002] In order to conduct risk control on bank transactions, suspicious transaction reporting is generally adopted. Suspicious transaction reporting is generally a way for financial institutions to report to the control center when they follow the preset relevant indicators, or when the financial institution judges that there may be control risks in the funds of customers transacting with it.

[0003] Because banks need to process a huge volume of transactions, a large number of suspicious reports are reported every day. However, because these reports are only suspicious reports, they need to be further screened and checked. If the number is huge, then identification will increase the processing pressure of screening and checking.

[0004] There is currently no effective solution to improve the efficiency of checking suspicious reports. Summary of the invention

[0005] The purpose of the embodiments of the present application is to provide a data processing method, device and electronic device to solve the problem of large workload and low efficiency in report screening.

[0006] To solve the above technical problems, the embodiment of the present specification provides a data processing method, including: obtaining a target file, wherein the target file carries multiple transaction records and predetermined marks; the predetermined marks are generated by a computer model and are used to characterize that the target file is associated with non-compliant transaction behavior; obtaining an abnormal indicator set, wherein the abnormal indicator set includes multiple abnormal indicator items; determining the abnormal value of each abnormal indicator item of the target file according to a preset indicator calculation function and the multiple transaction records; calling a preset threshold table, and obtaining the preset threshold corresponding to each abnormal indicator item from the threshold table; using the abnormal indicator item of the target file whose abnormal value exceeds the preset threshold as the abnormal indicator item hit by the target file; returning the abnormal indicator item hit by the target file, wherein the hit abnormal indicator item is used to determine whether the target file is compliant.

[0007] The embodiment of the present specification also provides a data processing device, including: a first acquisition module, used to acquire a target file, wherein the target file carries multiple transaction records and predetermined marks; the predetermined marks are generated by a computer model and are used to characterize that the target file is associated with non-compliant transaction behavior; a second acquisition module, used to acquire an abnormal indicator set, wherein the abnormal indicator set includes multiple abnormal indicator items; a first determination module, used to determine the abnormal value of each abnormal indicator item of the target file according to a preset indicator calculation function and the multiple transaction records; a third acquisition module, used to call a preset threshold table, and obtain the preset threshold corresponding to each abnormal indicator item from the threshold table; a second determination module, used to use the abnormal indicator item of the target file whose abnormal value exceeds the preset threshold as the abnormal indicator item hit by the target file; a return module, used to return the abnormal indicator item hit by the target file, wherein the hit abnormal indicator item is used to determine whether the target file is compliant.

[0008] The data processing method, device and electronic device provided in the embodiments of this specification need to further determine whether the files marked as non-compliant are misjudgments. Under this requirement, it is determined whether there are abnormal indicator items in the file according to preset rules. When it is determined that there are abnormal indicator items, the abnormal indicator items of the file are returned, that is, the abnormal indicator items of the file that have been marked as non-compliant are pre-processed and identified, which can effectively reduce the workload of the final judgment node when making compliance judgments. The above scheme solves the technical problems of large data processing volume and low identification efficiency in the existing process of misjudgment identification of non-compliant files, and achieves the technical effect of effectively improving processing accuracy and processing efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] In order to more clearly illustrate the implementation methods of the present application or the technical solutions in the prior art, the drawings required for use in the implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some implementation methods recorded in this application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0010] Figure 1 A schematic diagram of an application scenario of an embodiment of the present invention is shown;

[0011] Figure 2 A logical structure diagram of a second electronic device is shown;

[0012] Figure 3 A flow chart of a data processing method according to an embodiment of this specification is shown;

[0013] Figure 4A principle block diagram of a data processing device according to an embodiment of this specification is shown;

[0014] Figure 5 A functional block diagram of an electronic device according to an embodiment of the present specification is shown. DETAILED DESCRIPTION

[0015] In order to enable those skilled in the art to better understand the technical solutions in this application, the technical solutions in the embodiments of this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this application.

[0016] Figure 1 A schematic diagram of an application scenario of an embodiment of the present invention is shown. In this application scenario, different business systems within a financial institution (for example, different business systems may be personal financial basic business systems, bank card acquiring business systems, online banking business systems, telephone banking center business systems) collect transaction records collected when users conduct transactions and are aggregated to a first electronic device within the financial institution. The data in these transaction records are input into a computer model (for example, a neural network model, a clustering algorithm model, etc.) to preliminarily determine which transaction records may correspond to non-compliant transaction behaviors, and place transaction records corresponding to transaction behaviors that may involve the same management and control risk or the same interpersonal network in the same file, and give the file a non-compliant mark to indicate that the file is associated with the non-compliant transaction behavior, and report it to a second electronic device within the financial institution.

[0017] In order to prevent the omission of transaction records corresponding to some actually non-compliant transactions, the judgment criteria of the computer model are relatively strict, which may cause some transaction records corresponding to actually compliant transactions to be misjudged as non-compliant. Therefore, files with non-compliant marks need to be further identified to determine whether they are compliant.

[0018] The embodiments of this specification provide a data processing method that can be used in a second electronic device to reduce the workload of further identifying non-compliant files. Figure 2The logical structure diagram of the second electronic device is shown. The second electronic device includes a service router, multiple computing engines, an indicator calculation function file, and a parameter table. Among them, the service router is responsible for managing the computing engine and assigning the computing task to the appropriate computing engine for processing; there are usually multiple indicator calculation function files, one indicator corresponds to one indicator calculation function, and the indicator calculation function defines the processing of the input data from the input data to the indicator through the source code. Usually, only one indicator calculation function source code is written in an indicator calculation function file, and all indicator calculation function files are uniformly placed in a specific folder; the computing engine has computing power, which is used to perform specific computing tasks, and the indicator calculation function is called from the indicator calculation function file in the process of performing the computing task; the parameter table may include the parameters required by the indicator calculation function during the execution process.

[0019] like Figure 3 As shown, the data processing method includes the following steps.

[0020] S10: Obtain a target file, wherein the target file carries a plurality of transaction records and predetermined marks; the predetermined marks are generated by a computer model and are used to characterize that the target file is associated with non-compliant transaction behavior.

[0021] The target file in this step is the file marked as non-compliant by the first electronic device, and the non-compliant mark is the predetermined mark in this step. The predetermined mark (or non-compliant mark) is generated by a computer model and is only used to characterize the association between the target file and the non-compliant transaction behavior, and does not mean that the target file has been determined to be a non-compliant file. Whether the target file is compliant requires further identification.

[0022] Each transaction record in the target file corresponds to a transaction behavior. The values ​​of each field in the transaction record are the original data collected during the transaction behavior, that is, the values ​​of each field have not been processed. Since the transaction records of the target file have been processed by the computer model, the values ​​of each field in these transaction records should comply with the format requirements of the field, and there is no need to perform data cleaning operations such as data filling and format conversion on the field values.

[0023] The computer model can use big data analysis methods to extract transaction records corresponding to transaction behaviors that may have management and control risks from the values ​​of each field in a large number of transaction records. The input of the computer model can be the values ​​of the fields in a large number of transaction records, and the output can be the identification of the transaction record. According to the identification, the fields and values ​​of the corresponding transaction records can be collected together to form the target file described in step S10.

[0024] The target file may be in the form of a table or a data lake. Step S10 may be to obtain a table or a data lake when obtaining the target file.

[0025] S20: Obtain an abnormal indicator set, where the abnormal indicator set includes multiple abnormal indicator items.

[0026] Some examples of abnormal indicators are shown in Table 1. In practical applications, the names, meanings and corresponding thresholds of abnormal indicator items can be formulated according to actual business scenarios, and this specification will not describe them in detail one by one.

[0027] Table 1

[0028]

[0029] The abnormal indicator set can be a table stored in the second electronic device. Acquiring the abnormal indicator set means reading the table and copying the contents in the table. The table can also be opened and the contents in the table can be modified through the file manager of the electronic device. Alternatively, the abnormal indicator set can be fixedly written into an array in the program code, and each array member is an abnormal indicator item.

[0030] S30: Determine the abnormal value of each abnormal index item of the target file according to a preset index calculation function and a plurality of transaction records.

[0031] Step S30 is to calculate each abnormal index item by calling a preset index calculation function through the above-mentioned calculation engine to obtain an abnormal value.

[0032] Since different financial institutions customize different abnormal indicator items for further identifying transaction records, the above-mentioned abnormal indicator set may include all abnormal indicator items customized by only one financial institution, or all abnormal indicator items customized by multiple financial institutions to improve the scope of application of the method provided in the embodiments of this specification.

[0033] S40: Retrieve a preset threshold table, and obtain a preset threshold corresponding to each abnormal indicator item from the threshold table.

[0034] The threshold corresponding to an abnormal indicator item can be one (as shown in Table 2) or two or more. For example, there can be two abnormal indicator items, which means "the number of transfers within threshold 2 days exceeds threshold 1", where threshold 2 is 7 and threshold 1 is 20. It can be seen that the number of preset thresholds corresponding to an abnormal indicator item is determined by the meaning of the abnormal indicator item.

[0035] In some embodiments, the preset threshold may be embedded in the source program code and cannot be changed by the screening personnel.

[0036] In some embodiments, the screening personnel may still be unable to determine whether the target file is compliant through the threshold corresponding to the abnormal indicator item. He may need to gradually increase or decrease the threshold based on experience and check the hit trend of the abnormal indicator item, or adjust the threshold to several certain thresholds and check the hit trend of the abnormal indicator item, so as to determine whether the target file is compliant.

[0037] To this end, a user interaction interface can be set to change the threshold table. Specifically, the second electronic device receives an adjustment instruction uploaded through the user interaction interface, wherein the adjustment instruction carries the abnormal indicator item to be adjusted and the target value; according to the adjustment instruction, the preset threshold of the abnormal indicator item to be adjusted in the threshold table is modified to the target value.

[0038] S50: The abnormal index item whose abnormal value of the target file exceeds the preset threshold is used as the abnormal index item hit by the target file.

[0039] S60: Returning the abnormal index items hit by the target file, wherein the hit abnormal index items are used to determine whether the target file is compliant.

[0040] The returned results can be displayed on the WEB front end in an asynchronous query mode. Specifically, the Ajax (a WEB data interaction mode) request in the source code can trigger the call of the database instruction to query the abnormal index items and calculated abnormal values ​​stored in the database, and then display the returned results on the WEB page.

[0041] In some embodiments, only the abnormal index items that are hit by the target file may be returned without making special marks on the abnormal index items that are hit.

[0042] In some embodiments, all abnormal indicator items can be returned, and the abnormal indicator items that hit the target file can be specially marked. The special mark can be a special color, such as displaying the name of the hit abnormal indicator item in red font, or presenting the text background color of the hit abnormal indicator item as red or a preset background pattern. It can also be in the form of an identifier mark, such as placing a small red flag mark next to the text of the hit abnormal indicator item, or marking it with the text "Hit", as shown in Table 2 below.

[0043] In some embodiments, when returning the abnormal index items hit by the target file, the control risk items corresponding to the abnormal index items hit can also be returned. By introducing abnormal indicators, risk control items and the corresponding relationship between the two, the fund transaction situation can be reflected from multiple angles, the abnormal points of fund transactions can be accurately reflected, and the accuracy and effectiveness of processing can be further improved, thereby improving work efficiency.

[0044] The correspondence between abnormal indicator items and control risk items can be presented in the form of a table as shown in Table 2 below, or in the form of a mind map. The presentation method can be diverse.

[0045] Table 2 below shows a presentation method of the abnormal indicator items of the returned target file hits.

[0046] Table 2

[0047]

[0048] In some embodiments, abnormal indicator items and control risk items and the corresponding relationship between the two can be embedded in the source program code and cannot be changed by the screening personnel.

[0049] In some embodiments, different financial institutions use different abnormal indicator items; or use a combination of different abnormal indicator items to determine the same control risk item; or the screening personnel are still unable to determine whether the target file is compliant through a correspondence between the abnormal indicator item and the control risk item. He may need to adjust multiple correspondences between the abnormal indicator item and the control risk item based on experience, observe the changes in the corresponding relationships and the changes in the control risk items corresponding to the hit indicators, and then determine whether the target file is compliant.

[0050] To this end, a parameter table can be set to store the correspondence between the control risk item and the abnormal indicator item, and a user interaction interface can be set to change the parameter table. Specifically, the second electronic device receives an adjustment instruction uploaded through the user interaction interface, wherein the adjustment instruction carries the abnormal indicator item to be adjusted and the target control risk item corresponding thereto; according to the adjustment instruction, the control risk item corresponding to the abnormal indicator item to be adjusted in the parameter table is modified to the target control risk item.

[0051] The data processing method provided in the embodiments of this specification requires further determination of whether a file marked as non-compliant is a misjudgment. Under this requirement, it is determined whether there are abnormal indicator items in the file according to preset rules. When it is determined that there are abnormal indicator items, the abnormal indicator items of the file are returned, that is, the abnormal indicator items of the file that have been marked as non-compliant are pre-processed and identified, which can effectively reduce the workload of the final judgment node when making a compliance judgment. The above scheme solves the technical problems of large data processing volume and low identification efficiency in the existing process of misjudgment identification of non-compliant files, and achieves the technical effect of effectively improving processing accuracy and processing efficiency.

[0052] In some embodiments, each abnormal index item can be directly calculated through the original fields in the transaction record. Since the transaction records in the target folder come from different business systems (for example, different business systems can be personal financial basic business systems, bank card acquiring business systems, online banking business systems, telephone banking center business systems), the transaction fields collected by these systems are different. Therefore, the common fields of the transaction records collected by different business systems can be extracted first, and each abnormal index item can be calculated based on the common fields.

[0053] Table 3 below shows some common fields that may be included in a transaction record, as well as the meanings and examples of the fields. A transaction record may also include other fields, which are not listed here one by one.

[0054] Table 3

[0055] Fields Field meaning Example Our customer number A unique identification number for a bank customer. "123456789123456” Our customer name Used to display the customer name. "Zhang San" Our customer account number / card number Auxiliary information. Used to verify the situation. "400123456789” Currency Transaction currency. "RMB" Loan Sign Debit: inflow of funds; Credit: outflow of funds borrow Transaction Date Transaction Date 20210302 Trading Hours Trading Hours 14:49:23 Transaction amount Transaction amount 5000.00 The other party's account number / card number Account number / card number of the counterparty 6222021332013984320 Name of other party Counterparty Account Name Li Si Transaction Notes Transaction Notes WeChat transfer

[0056] However, since the transaction records often do not provide the customer type (i.e., whether the customer is an individual or a company), the industry to which they belong, which type of third-party transaction they belong to, which type of cash transaction they belong to (such as ATM withdrawals, cash deposits, bank card withdrawals, bank card deposits, and other types, other types can be, for example, face deposits and withdrawals), and which type of card they belong to (such as debit cards or credit cards). These transaction information cannot be directly obtained from the original fields of the transaction records. If the original fields are directly used to calculate the abnormal index items, the processing logic of the index calculation function will become more complicated. For this reason, after the target file is stored in the database, the database operation instructions can be called to extract the extended fields from the original public field values ​​of each business system of the transaction records stored in the database to determine the abnormal values ​​of the abnormal index items, thereby simplifying the processing logic of the index calculation function. These extended fields can be customer types (which can include customer types of our own customers and / or the other party's customers), industries to which they belong, types of third-party transactions, types of cash transactions, and types of cards.

[0057] Transaction records usually include a note field, which is usually a paragraph of text, which may have 20 to 30 words, recording the form of the transaction and other contents. In the case where the extended field is the type of third-party transaction, the type extended field of the third-party transaction can be extracted by the following method: determine a preset keyword set, where each keyword in the keyword set is used to identify a type of third-party transaction; retrieve keywords in the keyword set in the note field of the transaction record; in the case of retrieving keywords in the keyword set, use the retrieved keywords as the extended field of the transaction record. The keyword set may include the following keywords: WeChat transfer, WeChat change withdrawal, WeChat red envelope, merchant settlement, UnionPay deposit, payment service, Alipay transfer, Alipay withdrawal, Alipay consumption, QQ wallet withdrawal, QQ red envelope.

[0058] Transaction records usually include a comment field. The transaction comment is usually a paragraph of text, which may be 20 to 30 words, recording the form of the transaction and other contents. In the case where the extended field is the type of cash transaction, the cash transaction type extended field can be extracted by the following method: obtaining a preset keyword set, wherein each keyword in the keyword set is used to identify a type of cash transaction; searching for keywords in the keyword set in the comment field of the transaction record; in the case where the keywords in the keyword set are retrieved, the retrieved keywords are used as the extended fields of the transaction record. The keyword set may include the following keywords: ATM withdrawal, cash deposit, bank card deposit, bank card withdrawal, face deposit, face withdrawal.

[0059] Transaction records usually include the counterparty card number and the party's card number fields, and the card numbers all correspond to card bin rules, which refer to the correspondence between the value of the predetermined position in the card number and the region to which the card belongs, and the correspondence between the value of the predetermined position and the type of card. For example, a bank card with the first 6 digits of 621645 is a credit card in Pakistan, a bank card with the first 6 digits of 621647 is a credit card in Russia, a bank card with the first 5 digits of 62165 is a debit card in City X, and a bank card with the first 7 digits of 6216501, 6216502, and 6216503 are debit cards in three regions under City X.

[0060] When the extended field is the card type, the card type extended field can be extracted by the following method: obtain the preset card bin rule, match the card number in the transaction record with the preset card bin rule to determine the card type corresponding to the card number in the transaction record.

[0061] Specifically, when the card number is your own card number, since the card bin rule of your own account is fixed, you can directly match your card number with the card bin rule to determine the type of card corresponding to your card number. When the card number is the other party's card number, since the card bin rules of different banks are different, it is necessary to retrieve the corresponding card bin rule according to the bank mentioned in the other party's card number, and then match the other party's card number with the card bin rule to determine the type of card corresponding to the other party's card number.

[0062] In addition, according to the card bin rules, extended fields such as bank name and bank card account opening province branch can also be extracted. The bank name extended field can be used to calculate cross-bank related indicators, and the bank card account opening province branch extended field can be used to calculate cross-regional related indicators.

[0063] In addition to the above-mentioned extended fields, other extended fields such as customer type and industry can also be extracted from transaction records.

[0064] Specifically, the customer name can be matched with keywords through regular expressions according to the characteristics of the customer name field in the transaction record, and the customer can be marked as an individual customer or a corporate customer according to the matched keywords. The corporate customer in the embodiment of this specification is also called a corporate customer, which refers to a corporate customer who has a business relationship with the bank.

[0065] In actual applications, customer names may have a variety of features, and extraction rules and related regular expressions can be formulated based on the specific features of a large number of customer names. For example, Table 4 below shows some examples of the correspondence between the features of some customer name fields and the extracted customer types.

[0066] Table 4

[0067] Characteristics of the Customer Name Field Customer Type The customer name contains "·", for example, Xinjiang customer: Gulinaza Baiheti Individual Customers The customer name length is less than 4 Individual Customers The customer name contains: LTD, COMPANY, CO. Corporate Customers

[0068] Specifically, the customer name can be matched with keywords in the customer name field in the transaction record through regular expressions, and the industry to which the customer belongs can be marked according to the matched keywords. The corporate customer in the embodiment of this specification is also called the corporate customer, which refers to the corporate customer who has a business relationship with the bank.

[0069] In actual application, the correspondence between the keywords contained in the customer name and the industry to which the customer belongs can be formulated by oneself. Table 5 below shows some examples of the keywords contained in the customer name and the industry to which the customer belongs.

[0070] Table 5

[0071] Keywords contained in the customer name Customer Industry Gold, metallurgy, mining, jewelry, non-ferrous metals, mineral products Gold or Mining Waste, recycling, renewable resources Waste medicine medicine

[0072] For third-party payment companies such as Alipay (China) Network Technology Co., Ltd. and Tenpay Payment Technology Co., Ltd., since their names are fixed and can be found through network resources, these company names can be downloaded from the Internet to form a parameter table and updated regularly. When the customer name is the same as one of the names in these parameter tables, it is determined that the customer's industry is a third-party payment company.

[0073] The above content shows the specific extraction methods of five extension fields. The following Table 6 collectively shows these extension fields and their descriptions as well as examples of the values ​​of the extracted extension fields.

[0074] Table 6

[0075] Extension Fields Description of the extension field Extension Field Example Customer Type Indicates whether the counterparty is a corporate customer or an individual customer personal Industry Indicate the industry to which the counterparty belongs "Technology Company" Third-party transaction type Identify the specific type of third-party transaction WeChat transfer Cash transaction type Indicates the specific type of cash transaction ATM withdrawals Counterparty Card Type Indicates the type of counterparty card Credit Card

[0076] The present invention provides a data processing device that can be used to implement Figure 3 The data processing method described above. Figure 4As shown, the device includes a first acquisition module 10 , a second acquisition module 20 , a first determination module 30 , a third acquisition module 40 , a second determination module 50 and a return module 60 .

[0077] The first acquisition module 10 is used to acquire a target file, wherein the target file carries multiple transaction records and predetermined marks; the predetermined marks are generated by a computer model and are used to characterize the association between the target file and non-compliant transaction behavior. The second acquisition module 20 is used to acquire an abnormal indicator set, wherein the abnormal indicator set includes multiple abnormal indicator items. The first determination module 30 is used to determine the abnormal values ​​of each abnormal indicator item of the target file according to a preset indicator calculation function and multiple transaction records. The third acquisition module 40 is used to call a preset threshold table and obtain the preset threshold corresponding to each abnormal indicator item from the threshold table. The second determination module 50 is used to use the abnormal indicator item of the target file whose abnormal value exceeds the preset threshold as the abnormal indicator item hit by the target file. The return module 60 is used to return the abnormal indicator item hit by the target file, wherein the hit abnormal indicator item is used to determine whether the target file is compliant.

[0078] In some embodiments, the data processing device further includes a receiving module and a modifying module. The receiving module is used to receive an adjustment instruction uploaded through a user interaction interface, wherein the adjustment instruction carries an abnormal indicator item to be adjusted and a target value. The modifying module is used to modify the preset threshold of the abnormal indicator item to be adjusted in the threshold table to the target value according to the adjustment instruction.

[0079] The description and effects of the above-mentioned data processing device can be understood by referring to the data processing method, which will not be repeated here.

[0080] The embodiment of the present invention further provides an electronic device, such as Figure 5 As shown, the electronic device may include a processor 51 and a memory 52, wherein the processor 51 and the memory 52 may be connected via a bus or other means. Figure 5 The example of connecting through bus is taken in the following.

[0081] The processor 51 may be a central processing unit (CPU). The processor 51 may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or a combination of the above chips.

[0082] The memory 52 is a non-transitory computer-readable storage medium that can be used to store non-transitory software programs, non-transitory computer executable programs and modules, such as program instructions / modules corresponding to the data processing method in the embodiment of the present invention (for example, Figure 4 The processor 51 executes various functional applications and data processing of the processor by running the non-transient software programs, instructions and modules stored in the memory 52, that is, the data processing method in the above method embodiment is implemented.

[0083] The memory 52 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and applications required for at least one function; the data storage area may store data created by the processor 51, etc. In addition, the memory 52 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some embodiments, the memory 52 may optionally include a memory remotely arranged relative to the processor 51, and these remote memories may be connected to the processor 51 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0084] The one or more modules are stored in the memory 52 and when executed by the processor 51, perform the following steps: Figure 3 The data processing method in the illustrated embodiment.

[0085] For details of the above electronic equipment, please refer to Figure 3 The corresponding descriptions and effects in the embodiments can be understood and will not be repeated here.

[0086] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium, and when the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, the storage medium can be a disk, an optical disk, a read-only memory (ROM), a random access memory (RAM), a flash memory, a hard disk drive (HDD) or a solid-state drive (SSD), etc.; the storage medium can also include a combination of the above-mentioned types of memory.

[0087] In the 1950s, improvements to a technology could be clearly distinguished as hardware improvements (for example, improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the method flow). However, with the development of technology, many improvements to the method flow today can be regarded as direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that an improvement in a method flow cannot be implemented using a hardware entity module. For example, a programmable logic device (PLD) (such as a field programmable gate array (FPGA)) is such an integrated circuit whose logical function is determined by the user's programming of the device. Designers can "integrate" a digital system on a PLD by programming it themselves, without having to ask a chip manufacturer to design and produce a dedicated integrated circuit chip2. Moreover, nowadays, instead of manually making integrated circuit chips, this kind of programming is mostly implemented by "logic compiler" software, which is similar to the software compiler used when developing and writing programs, and the original code before compilation must also be written in a specific programming language, which is called hardware description language (HDL). There is not only one HDL, but many kinds, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog2. Those skilled in the art should also know that it is only necessary to program the method flow slightly in the above-mentioned hardware description languages ​​and program it into the integrated circuit, and then it is easy to obtain the hardware circuit that implements the logic method flow.

[0088] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the various embodiments can be referenced to each other, and each embodiment focuses on the differences from other embodiments.

[0089] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions.

[0090] For the convenience of description, the above device is described in various units according to their functions. Of course, when implementing the present application, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0091] It can be known from the description of the above implementation methods that those skilled in the art can clearly understand that the present application can be implemented by means of software plus a necessary general hardware platform. Based on such an understanding, the technical solution of the present application can be essentially or partly contributed to the prior art in the form of a software product, which can be stored in a storage medium such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute certain parts of the methods of each implementation method of the present application.

[0092] The present application can be used in many general or special computer system environments or configurations, such as personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronic devices, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc.

[0093] The present application may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present application may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0094] Although the present application has been described through embodiments, those skilled in the art will appreciate that there are many modifications and variations to the present application without departing from the spirit of the present application, and it is intended that the appended claims include these modifications and variations without departing from the spirit of the present application.

Claims

1. A data processing method, characterized in that: include: Acquire a target file, wherein the target file carries a plurality of transaction records and a predetermined mark; the predetermined mark is generated by a computer model and is used to indicate that the target file is associated with a non-compliant transaction behavior; Acquire an abnormal indicator set, wherein the abnormal indicator set includes multiple abnormal indicator items; Determine the abnormal value of each abnormal index item of the target file according to a preset index calculation function and the plurality of transaction records; Retrieving a preset threshold table, and obtaining a preset threshold corresponding to each abnormal indicator item from the threshold table; The abnormal index item whose abnormal value of the target file exceeds the preset threshold is used as the abnormal index item hit by the target file; Returning the abnormal index items hit by the target file and the control risk items corresponding to each abnormal index item, wherein the hit abnormal index items are used to determine whether the target file is compliant; The method further includes determining whether the target file is compliant by: Setting a parameter table to store the corresponding relationship between the control risk items and the abnormal indicator items, and setting a user interaction interface to change the parameter table; Receiving an adjustment instruction uploaded through a user interaction interface, wherein the adjustment instruction carries an abnormal indicator item to be adjusted and a target value; According to the adjustment instruction, the preset threshold of the abnormal indicator item to be adjusted in the threshold table is modified to the target value.

2. The method according to claim 1, characterized in that Before determining the abnormal value of each abnormal index item of the target file according to the preset index calculation function and the plurality of transaction records, the method further includes: An extended field is extracted from the transaction record for determining an abnormal value of each abnormal indicator, wherein the extended field includes at least one of the following: customer type, industry, type of third-party transaction, type of cash transaction, and type of card.

3. The method according to claim 2, characterized in that When the extended field is a type of third-party transaction, the extended field is extracted from the transaction record, including: Obtaining a preset keyword set, wherein each keyword in the keyword set is used to identify a type of third-party transaction; Retrieving keywords from the keyword set in a note field of a transaction record; In the case where a keyword in the keyword set is retrieved, the retrieved keyword is used as an extended field of the transaction record.

4. The method according to claim 2, characterized in that: In the case where the extended field is a cash transaction type, the extended field is extracted from the transaction record, including: Obtaining a preset keyword set, wherein each keyword in the keyword set is used to identify a type of cash transaction; Retrieving keywords from the keyword set in a note field of a transaction record; In the case where a keyword in the keyword set is retrieved, the retrieved keyword is used as an extended field of the transaction record.

5. The data processing method according to claim 2, characterized in that: When the extended field is the card type, the extended field is extracted from the transaction record, including: Retrieve the preset card bin rules; Matching the card number in the transaction record with the preset card bin rule to determine the type of card corresponding to the transaction record; The card type corresponding to the determined transaction record is used as an extension field of the transaction record.

6. A data processing device, characterized in that: include: A first acquisition module is used to acquire a target file, wherein the target file carries a plurality of transaction records and a predetermined mark; the predetermined mark is generated by a computer model and is used to indicate that the target file is associated with a non-compliant transaction behavior; A second acquisition module is used to acquire an abnormal indicator set, wherein the abnormal indicator set includes multiple abnormal indicator items; A first determination module, used to determine the abnormal value of each abnormal index item of the target file according to a preset index calculation function and the plurality of transaction records; A third acquisition module is used to call a preset threshold table and obtain a preset threshold corresponding to each abnormal indicator item from the threshold table; A second determination module is used to take the abnormal index item whose abnormal value of the target file exceeds a preset threshold as the abnormal index item hit by the target file; A return module, used to return the abnormal index items hit by the target file and the control risk items corresponding to each abnormal index item, wherein the hit abnormal index items are used to determine whether the target file is compliant; The device is provided with a parameter table to store the corresponding relationship between the control risk items and the abnormal indicator items, and is provided with a user interaction interface to change the parameter table; the device also includes: A receiving module, configured to receive an adjustment instruction uploaded through a user interaction interface, wherein the adjustment instruction carries an abnormal indicator item to be adjusted and a target value; A modification module is used to modify the preset threshold of the abnormal indicator item to be adjusted in the threshold table to the target value according to the adjustment instruction.

7. An electronic device, characterized in that: include: A memory and a processor, wherein the processor and the memory are communicatively connected to each other, the memory stores computer instructions, and the processor implements the steps of the method according to any one of claims 1 to 5 by executing the computer instructions.

8. A computer storage medium, characterized in that: The computer storage medium stores computer program instructions, and when the computer program instructions are executed, the steps of the method according to any one of claims 1 to 5 are implemented.

Images