A method and device for optimizing financial fraud modeling language

Abstract

The present invention discloses an optimization processing method and device for a financial fraud modeling language, comprising: generating an FFML abstract syntax tree according to a fraud detection rule written in the financial fraud modeling language FFML; judging the node type of a node; if the node type of the node is SingleCondition, generating target conversion data according to the left return value, comparison return value and right return value of the node; generating SQL code corresponding to the fraud detection rule according to the target conversion data. The present invention can be used to quickly convert the fraud detection rule written in FFML into an SQL programming language that can be recognized by a streaming platform.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method and device for optimizing a financial fraud modeling language. Background Art

[0002] With the advancement of modern technologies such as the Internet and mobile computers, the number of types of financial fraud continues to increase. In order to deal with new types of financial fraud, automated financial fraud detection methods using computer technology have emerged. Automated financial fraud detection methods using computer technology are divided into passive fraud and active fraud. Active fraud detection introduces real-time stream processing technology into the field of financial fraud detection, making transaction request detection real-time.

[0003] Active fraud relies on detection rules developed by domain experts. Usually, domain experts first propose and explain new fraud detection rules to IT coders, who then write the actual streaming platform code before deploying it to the stream processing platform for real-time fraud monitoring.

[0004] However, due to the large industry differences between domain experts and IT coders, there are problems such as low communication efficiency and high misunderstanding rate, which leads to the fact that it takes a long time for new fraud detection rules to be deployed in practice, which may cause great economic losses. How to convert the modeling language used by domain experts for financial fraud into a programming language that can be recognized by the streaming platform is an unresolved problem. Summary of the invention

[0005] The present invention provides a method and device for optimizing a financial fraud modeling language, so as to overcome at least one technical problem existing in the prior art.

[0006] According to a first aspect of an embodiment of the present invention, there is provided a method for optimizing a financial fraud modeling language, comprising:

[0007] According to the fraud detection rules written in Financial Fraud Modeling Language (FFML), generating an FFML abstract syntax tree corresponding to the fraud detection rules;

[0008] By traversing each node in the FFML abstract syntax tree, determining the node type of the node;

[0009] If the node type of the node is SingleCondition, the Boolean expression in the data stream is transformed according to the left return value of the left expression child node of the node, the comparison return value of the comparison operator child node, and the right return value of the right expression child node to generate target transformation data;

[0010] A structured query language (SQL) code corresponding to the fraud detection rule is generated according to the target conversion data.

[0011] According to a second aspect of an embodiment of the present invention, there is provided an optimization processing device for a financial fraud modeling language, comprising:

[0012] A first generating module, a first judging module, a third generating module and a fourth generating module;

[0013] The first generating module is used to generate an FFML abstract syntax tree corresponding to the fraud detection rule according to the fraud detection rule written in the financial fraud modeling language FFML;

[0014] The first determination module is used to determine the node type of the node by traversing each node in the FFML abstract syntax tree;

[0015] The third generation module is used for converting the Boolean expression in the data stream to generate target conversion data according to the left return value of the left expression subnode of the node, the comparison return value of the comparison operator subnode and the right return value of the right expression subnode if the node type of the node is SingleCondition;

[0016] The fourth generating module is used to generate the SQL code corresponding to the fraud detection rule according to the target conversion data.

[0017] The innovative features of the embodiments of the present invention include:

[0018] 1. The present invention can generate an FFML abstract syntax tree corresponding to the fraud detection rule based on the fraud detection rule written in the financial fraud modeling language FFML, and then generate corresponding conversion data according to the node type of each node in the FFML abstract syntax tree. Finally, according to each conversion data, an SQL code corresponding to the fraud detection rule is generated. The fraud detection rule written in the financial fraud modeling language FFML can be quickly converted into the SQL programming language that can be recognized by the flow platform, with high processing efficiency and real-time performance, which is one of the innovative points of the embodiment of the present invention.

[0019] 2. The present invention can determine the processing flow for nodes of each node type according to the node type of each node in the FFML abstract syntax tree, so as to achieve accurate conversion using the financial fraud modeling language FFML, which is one of the innovative points of the embodiments of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0021] Figure 1 A schematic diagram of an embodiment of the present invention;

[0022] Figure 2 This is the overall framework diagram of the back-end design module in the present invention;

[0023] Figure 3 It is the first FFML abstract syntax tree in the present invention;

[0024] Figure 4 A schematic diagram of another embodiment of the present invention;

[0025] Figure 5 It is a process flow chart of the sub-steps of step 511 in the present invention;

[0026] Figure 6 It is the second FFML abstract syntax tree in the present invention;

[0027] Figure 7 It is a structural schematic diagram of the optimization processing device of the financial fraud modeling language of the present invention. DETAILED DESCRIPTION

[0028] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0029] With the advancement of modern technologies such as the Internet and mobile computers, the number of types of financial fraud continues to increase. In order to deal with new types of financial fraud, automated financial fraud detection methods using computer technology have emerged. Automated financial fraud detection methods using computer technology are divided into passive fraud and active fraud. Active fraud detection introduces real-time stream processing technology into the field of financial fraud detection, making transaction request detection real-time.

[0030] Active fraud relies on detection rules developed by domain experts. Usually, domain experts first propose and explain new fraud detection rules to IT coders, who then write the actual streaming platform code before deploying it to the stream processing platform for real-time fraud monitoring.

[0031] However, due to the large industry differences between domain experts and IT coders, there are problems such as low communication efficiency and high misunderstanding rate, which means that new fraud detection rules take a long time to be actually deployed, which may cause large economic losses.

[0032] In order to solve the above problems, the present invention proposes an optimization processing method and device for financial fraud modeling language, which can quickly convert fraud detection rules written in financial fraud modeling language FFML into SQL programming language recognizable by the streaming platform, with high processing efficiency and real-time performance.

[0033] The following is a detailed description of the optimization processing method and device for the financial fraud modeling language proposed by the present invention.

[0034] refer to Figure 1 , Figure 1 FIG. 1 is a schematic diagram of an embodiment of the present invention. Figure 1 As shown, the optimization processing method of the financial fraud modeling language includes the following processing steps:

[0035] Step 101: According to the fraud detection rules written in the financial fraud modeling language FFML, an FFML abstract syntax tree corresponding to the fraud detection rules is generated.

[0036] In this step, the fraud detection rules written by domain experts using the financial fraud modeling language FFML first pass through a lexical analyzer to generate a symbol stream, and these symbol streams are then subjected to grammatical analysis to generate a syntax tree. The syntax tree cannot be directly used as input for semantic analysis, so it can be converted into an intermediate syntax representation, namely the FFML abstract syntax tree; next, through subsequent steps, semantic analysis is performed based on the FFML abstract syntax tree, and the technical effect of generating a programming language that can be recognized by the code generation flow platform is achieved.

[0037] It should be noted that a bridge is needed between grammatical analysis and semantic analysis. The grammatical analysis tree (also called concrete grammar tree) directly obtained from grammatical analysis contains a lot of redundant grammatical structure information and cannot be directly used as input for speech analysis. Therefore, it is necessary to construct an abstract syntax tree in the process of grammatical analysis as an intermediate representation of grammar connecting the front and back ends.

[0038] Step 103 , by traversing each node in the FFML abstract syntax tree, determine the node type of the node; if the node type of the node is SingleCondition, execute step 107 .

[0039] It should be noted that, in a specific implementation, step 101 can be implemented by a front-end design module of an optimization processing method of a financial fraud modeling language. Specifically, the function of the front-end design module is to convert fraud detection rules written in the financial fraud modeling language FFML into an FFML abstract syntax tree corresponding to the fraud detection rules.

[0040] Steps 103 to 109 can be implemented by a back-end design module of the optimization processing method of the financial fraud modeling language.

[0041] The overall framework of the backend design module can be referred to Figure 2 , Figure 2 The overall framework diagram of the back-end design module in the present invention. The visitor module is the main module in the entire back-end design module. It traverses the FFML abstract syntax tree generated by the front-end design module, constructs the code conversion logic during the traversal process, and then generates specific stream processing code by calling the template module. In the code conversion process, the symbol table and the built-in function module need to work together, and the generated stream processing code is optimized in a targeted manner according to the code optimization module. Figure 2 The part outlined by the dotted line is the specific composition of the entire conversion backend.

[0042] The specific functions of each module in the back-end design module are as follows:

[0043] Visitor module: The visitor module brings together the semantic actions required for code transformation, traverses the FFML abstract syntax tree, and collaborates with other modules during the traversal process to implement specific semantic analysis.

[0044] Symbol table: The symbol table is used to store some symbols and their attribute information encountered during the semantic analysis process, so that different parts of the visitor can access common information.

[0045] Built-in function module: FFML language allows users to call some built-in functions, such as TOTALDEBIT, BADACCOUNT, etc. The code conversion of these built-in functions is uniformly handled by the built-in function module.

[0046] Template module: When generating the target code, in order to avoid errors and unify the output format, built-in code templates are used, and the visitor fills in the corresponding template to generate the final code.

[0047] Code optimization module: For different stream processing codes, the execution efficiency of the operator graph finally generated by the stream processing system is also different. The code optimization template defines several different code optimization methods to guide visitors to generate efficient stream processing codes.

[0048] The present invention focuses on the visitor module.

[0049] The translation conversion methods of different languages ​​mainly include syntax-guided methods, rule-based methods and model-based methods. The present invention selects the model-based method, which is more flexible than the syntax-guided method, more efficient and easier to read than the rule-based method, and more commonly used in the industry.

[0050] The core of the model-based method is to establish an intermediate representation model of grammar, and then all speech-related actions are carried out around this model. The present invention uses an abstract syntax tree as an intermediate representation model, and then uses a visitor to traverse the abstract syntax tree to complete specific semantic conversion actions.

[0051] The visitor pattern defines a single visitor, which brings together the semantic actions for different abstract syntax tree nodes, takes the abstract syntax tree nodes as parameters, and performs different operations according to different node types. Compared with the semantic actions of the abstract syntax tree directly embedded in the heterogeneous abstract syntax tree, the visitor pattern of the present invention is more flexible and easy to expand.

[0052] The structure of the fraud detection rules written in the financial fraud modeling language FFML is shown in Table 1. It mainly includes four parts: rule naming, event sequence, condition definition, and action definition. "Rule naming" assigns an ID to the currently defined rule; "Event sequence" indicates when a certain event is detected, the following operations are executed; "Condition definition" defines when a triggering event is detected, it is necessary to check whether the variables in the event meet the conditions here; if the conditions are met, the related actions defined in "Action definition" are triggered. The main parts of the fraud detection rules written in the financial fraud modeling language FFML are the event sequence and condition definition.

[0053] In this step, the visitor module traverses each node in the FFML abstract syntax tree to determine the node type of the node; if the node type of the node is SingleCondition, step 107 is executed.

[0054] It should be noted that only the processing methods of these two node types are described in detail here, which does not mean that only these two node types can be processed. The processing methods of other node types are described later.

[0055] In a specific implementation, the visitor module determines the node type of the node by traversing each node in the FFML abstract syntax tree; if the node type of the node is SingleEvent, then according to the parameter requirements of the child nodes of the SingleEvent type node, the event that meets the parameter requirements can be screened from the preset data stream to generate the first conversion data.

[0056] The parameter requirements may include a time parameter time, an event sequence parameter events and operation information, and the operation information includes a channel and an operation behavior on the channel.

[0057] It should be noted that a node of the SingleEvent type includes two child nodes.

[0058] Specifically, they may include:

[0059] The first step is to access the two child nodes of the SingleEvent type node, save the return value of the first child node as the first variable, and save the return value of the second child node as the second variable.

[0060] Specifically, the first variable can be recorded as channel, and the second variable can be recorded as params.

[0061] The second step is to determine the event type defined by the node of the SingleEvent type according to the second variable.

[0062] Specifically, the SingleEvent type node defines two types of events, including simple independent events and complex sequence events. You can judge by the return value of the second child node, that is, the type of the second variable params. If the second variable params is a string, the event defined by the current SingleEvent type node is a simple independent event, and then enter the processing flow corresponding to the simple independent event. If the second variable params is a list, the event defined by the current SingleEvent type node is a complex sequence event, and then enter the processing flow corresponding to the complex sequence event.

[0063] The third step is to screen target events that meet the parameter requirements from the preset data stream by executing the processing flow corresponding to the event type, and generate first conversion data.

[0064] Specifically, according to the parameter requirements carried in the first variable channel or the second variable params, it may include selecting a target event that meets the conditions from all event lists, generating a new table corresponding to the target event, and recording the new table as the first conversion data.

[0065] Step 107, transform the Boolean expression in the data stream according to the left return value of the left expression subnode of the node, the comparison return value of the comparison operator subnode and the right return value of the right expression subnode to generate target transformation data.

[0066] The Boolean expression includes a comparison expression, such as a>1, b<=2, that is, it has a comparison operator, and the comparison operators include: >, <, =, <=, >=, !=.

[0067] It should be noted that the child nodes of the SingleCondition node type are in the form of a fixed left expression, a comparison operator, and a right expression.

[0068] In this step, when the node type of the node is SingleCondition, first, access the first child node, that is, the left expression node, to obtain its return value lhs. After recursive downward processing, the node is divided into three types of child nodes: simple event variable (EventParam), query (Query), and historical query (HistStatement).

[0069] For nodes of the simple event variable (EventParam) class, their events and variables are returned directly; for nodes of the query (Query) class, the streaming window aggregation transformation method or the stream processing system user-defined function (UDF) transformation method is used; for nodes of the historical query (HistStatement) class, the corresponding processing method of the HistStatement type node is used for processing.

[0070] Next, visit the second child node, which is the comparison operator node, and get its return value op.

[0071] Then, visit the third child node, which is the right expression node, and get its return value rhs.

[0072] Finally, the comparison expression code is converted through lhs, op and rhs. The specific conversion is achieved through the connection (Join) and conditional selection (Where) in the SQL language. First, lhs and rhs are connected through connection (Join), and then the conditional selection (Where) syntax is used to perform conditional judgment.

[0073] For example, Figure 3 Take the FFML abstract syntax tree in as an example to illustrate:

[0074] like Figure 3 As shown, for the first SingleCondition node, it corresponds to the FFML code QUERYTOTALDEBIT(ATM,2)<=500.

[0075] The first step is to access its first child node, the left expression node. This node is a query node. You can use built-in function optimization or streaming window aggregation transformation method. If the streaming window aggregation transformation method is used, the specific process is as follows:

[0076] (a) The TOTALDEBIT function is used to query the total transaction amount in the last n days. Here, the total transaction amount through the ATM channel in the last two days is queried. First, the transaction amount is aggregated using two days as a window, that is:

[0077] CREATE TEMPORARY VIEW`procedure_1`AS(SELECT accountnumber,

[0078] SUM(`value`),AS totaldebit,TUMBLE_END(rowtime,INTERVAL`2`DAY)ASrowtime FROM event_8GROUP BY accountnumber,TUMBLE(rowtime,INTERVAL`2`DAY))

[0079] Get the new table procedure_1.

[0080] (b) Since TOTALDEBIT only requires data from the last n days, we need to take the last item in the table above and use the TOP_N syntax, that is,

[0081] CREATE TEMPORARY VIEW`procedure_2`AS(SELECT accountnumber,totaldebit,rowtime FROM(SELECT*,ROW_NUMBER()OVER(PARTITION BY accountnumber ORDER BYrowtime DESC)as rownum FROM produce_1)WHERE rownum<=1)

[0082] (c) The returned left operand lhs is (procedure_2, totaldebit).

[0083] The second step is to visit the second child node, which is the comparison operator node, and obtain op as <=.

[0084] The third step is to access the third child node, which is the right expression node, and get rhs as 500.

[0085] The fourth step is to convert the comparison expression using the WHERE syntax, that is,

[0086] CREATE TEMPORARY VIEW`comparison_1`AS(SELECT accountnumber,rowtimeFROM procedure_2 WHERE`totaldebit`<=500.0)

[0087] The fifth step is to select all the information from the complete event table, namely:

[0088] CREATE TEMPORARY VIEW`condition_1`AS(SELECT*FROM event_7,comparison_1WHERE event_7.accountnumber=comparison_1.accountnumber AND event_7.rowtime>=comparison_1.rowtime)

[0089] like Figure 3 As shown, for the second SingleCondition node, it corresponds to transfer.`value`>=500.

[0090] The first step is to access its left expression node, which is a simple variable node. Simply return its event variable, i.e. ("transfer", "value").

[0091] The second step is to access its comparison operator node and obtain op as >=.

[0092] The third step is to access its right expression node and obtain rhs as 500.

[0093] The fourth step is to directly select the events that meet the condition through the SELECT syntax, that is:

[0094] CREATE TEMPORARY VIEW`comparison_2`AS(SELECT*FROM transfer WHERE`value`>=500.0)

[0095] Step 5: Read the current table in the symbol table, recorded as condition_1, and find the intersection of comparison_2 and condition_1, that is:

[0096] CREATE TEMPORARY VIEW`condition_2`AS(SELECT*FROM comparison_2 WHEREid IN(SELECT id FROM condition_1)).

[0097] like Figure 3 As shown, for the third SingleCondition node, it corresponds to HISTORY(4)[QUERYTOTALDEBIT(ONL)>=100]>=1, which is a historical data query point. For its specific process, please refer to the relevant description of the node of the HistStatement type.

[0098] Step 109: Generate SQL code corresponding to the fraud detection rule according to the target conversion data.

[0099] In this step, by using corresponding processing methods for different types of nodes, the fraud detection rules written in the financial fraud modeling language FFML are converted into the SQL programming language that the streaming platform can recognize, with high processing efficiency and real-time performance.

[0100] In a specific implementation, the SQL code corresponding to the fraud detection rule may be generated based on the first conversion data and the target conversion data.

[0101] It can be seen that in the optimization processing method of a financial fraud modeling language proposed in the present invention, it is possible to generate an FFML abstract syntax tree corresponding to the fraud detection rule based on the fraud detection rule written in the financial fraud modeling language FFML, and then generate corresponding conversion data according to the node type of each node in the FFML abstract syntax tree, and finally generate SQL code corresponding to the fraud detection rule according to each conversion data, so that the fraud detection rule written in the financial fraud modeling language FFML can be quickly converted into the SQL programming language that can be recognized by the flow platform, with high processing efficiency and real-time performance.

[0102] In one implementation, a node of the HistStatement type is used to query data that meets conditions from historical data. It has two child nodes, one is the number of table items to be queried, and the other is the query condition.

[0103] The processing method for the HistStatement type node is as follows:

[0104] The first step is to access the first child node of the HistStatement type node, obtain the number of table items to be queried, record it as d, and write it into the hist_days position in the symbol table, which will be used later when accessing the conditional node.

[0105] The second step is to access the second child node of the HistStatement type node, that is, the condition node, and store the return values ​​​​as t and k, where t is the newly generated table and k is the key value corresponding to the query condition.

[0106] The third step is to restore hist_days to 1 in the symbol table.

[0107] The fourth step is to perform count aggregation using the items with the same k in t as a new column, create a new table and return it.

[0108] For example, see Figure 3 , Figure 3 This is the first FFML abstract syntax tree in the present invention. Figure 3 Take the FFML abstract syntax tree in as an example to illustrate:

[0109] like Figure 3 As shown, the first step is to access the first child node of the node of the HistStatement type, obtain the number of table entries to be queried d as 4, and set hist_days in the symbol table to 4.

[0110] The second step is to access the second child node of the HistStatement type node, that is, the conditional node, and generate the following three new tables, whose functions are aggregation, TOPN selection, and comparison expression data filtering.

[0111] CREATE TEMPORARY VIEW`procedure_3`AS(SELECT accountnumber,SUM(`value`)AS totaldebit,TUMBLE_END(rowtime,INTERVAL`1`DAY)AS rowtime FROM event_9GROUP BY accountnumber,TUMBLE(rowtime,INTERVAL`1`DAY))

[0112] CREATE TEMPORARY VIEW`procedure_4`AS(SELECT accountnumber,totaldebit,rowtime FROM(SELECT*,ROW_NUMBER()OVER(PARTITION BY accountnumber ORDER BYrowtime DESC)as rownum FROM procedure_3)WHERE rownum<=4)

[0113] CREATE TEMPORARY VIEW`comparison_3`AS(SELECT accountnumber,rowtimeFROM procedure_4 WHERE`totaldebit`>=100.0)

[0114] The third step is to restore hist_days to 1 in the symbol table.

[0115] The fourth step is to perform COUNT aggregation on the data in the comparison_3 table, as shown below, to generate a new table count_1.

[0116] CREATE TEMPORARY VIEW`count_1`AS(SELECT accountnumber,COUNT(*)ASdaycount,MAX(rowtime)AS rowtime FROM comparison_3GROUP BY accountnumber)

[0117] In a specific implementation, the present invention further proposes an optimization processing method for a financial fraud modeling language.

[0118] refer to Figure 4 , Figure 4 FIG. 2 is a schematic diagram of another embodiment of the present invention. Figure 4 As shown, the optimization processing method of the financial fraud modeling language includes the following processing steps:

[0119] Step 501: According to the fraud detection rules written in the financial fraud modeling language FFML, an FFML abstract syntax tree corresponding to the fraud detection rules is generated.

[0120] For detailed instructions on this step, refer to Figure 1 Step 101 in the optimization processing method of the financial fraud modeling language shown.

[0121] Step 503, by traversing each node in the FFML abstract syntax tree, determine the node type of the node; if the node type of the node is SingleEvent, execute step 505; if the node type of the node is SingleCondition, execute step 513; if the node type of the node is EventStatement, execute step 515; if the node type of the node is ConditionStatement, execute step 517.

[0122] It should be noted that only the processing methods of the nodes of these four node types are described in detail here, which does not mean that only the nodes of these four node types can be processed.

[0123] Step 505 , access the two child nodes of the node of the SingleEvent type, save the return value of the first child node as the first variable, save the return value of the second child node as the second variable, and execute step 507 .

[0124] Step 507, determine whether the second variable is a string or a list; if the second variable is a string, determine that the event type is a simple independent event, and execute step 509; if the second variable is a list, determine that the event type is a complex sequence event, and execute step 511.

[0125] Step 509: When the event type is a simple independent event, a first processing flow corresponding to the simple independent event is executed to screen target events that meet the parameter requirements from a preset data stream to generate first conversion data.

[0126] In this step, if the second variable params is a string, the event defined by the current SingleEvent type node is a simple independent event. Next, the first processing flow corresponding to the simple independent event is entered to select target events that meet the parameter requirements from the preset data stream and generate the first conversion data.

[0127] The first processing flow includes directly returning its events and variables. A simple independent event only defines an operation behavior a of an account in a channel c, so the SELECT syntax can be directly used to select all operations a of the account and execute them through the c channel.

[0128] Step 511 , when the event type is a complex sequence event, by executing the second processing flow corresponding to the complex sequence event, the target event that meets the parameter requirements is screened from the preset data stream, the first conversion data is generated, and step 521 is executed.

[0129] In this step, if the second variable params is a list, the event defined by the current node of the SingleEvent type is a responsible sequence event, and then the second processing flow corresponding to the complex sequence event is entered.

[0130] It should be noted that complex sequence events consist of two parts: sequence time and sequence event group. Sequence events define the maximum time span allowed for sequence events to occur, and sequence event groups define the order of events.

[0131] The second processing flow includes: first, obtaining the above-mentioned time span parameter time and event sequence parameter events through the params list; then, merging the tables corresponding to the events in events through the UNION ALL syntax, and merging only based on the common values ​​required to judge the events. The common values ​​required to judge the events include event ID, account ID, event type, and event time. The merged table is all_events; next, using the complex event processing (CEP) MATCH syntax, the events that meet the sequence time and sequence event group are generated from the all_events table to generate a new table m; finally, the new table m only stores the basic information of the hit event, and the complete information of the hit event is selected from the corresponding event table through the SELECT syntax to create and return the target event table n.

[0132] Complex sequence events include compound events. For example, ONL SEQ(10)(password_change, transfer) means that within 10 seconds / minutes, a certain account performs password change and transfer operations in the ONL channel.

[0133] Optional, reference Figure 5 , Figure 5 FIG. 5 is a flowchart of the sub-steps of step 511 of the present invention. Figure 5 As shown, step 611 specifically includes the following sub-steps:

[0134] Sub-step 61, obtaining the time span parameter time and the event sequence parameter events from the second parameter params.

[0135] Sub-step 62, merging the tables corresponding to the events in the event sequence parameter events to generate a merged table all_events, wherein the merged table all_events includes basic information of the events.

[0136] Sub-step 63, selecting target events that meet the time span parameter time requirement from the events in the merged table all_events, and generating a target event table.

[0137] For example, see Figure 3 , Figure 3 This is the first FFML abstract syntax tree in the present invention. Figure 3 Take the FFML abstract syntax tree in as an example to illustrate:

[0138] The first step, such as Figure 3As shown, for the first node of the SingleEvent type, corresponding to ONLSQE(5)[password_change,transfer] in the FFML rule, first access its two child nodes to obtain the variables channel and params, which are "ONL" and the list [5, "password_change", "transfer"] respectively. Since params is a list, it is a complex sequence event, and the complex sequence processing is performed below.

[0139] (a) The time span parameter time and event sequence parameter events obtained through params are 5 and ["password_change", "transfer"] respectively.

[0140] (b) Use the UNION ALL syntax to merge the events and obtain the following three new tables:

[0141] CREATE TEMPORARY VIEW`event_1`AS(SELECT*FROM`password_change`WHEREchange=`ONL`)

[0142] CREATE TEMPORARY VIEW`event_2`AS(SELECT*FROM`transfer`WHERE change=`ONL`)

[0143] CREATE TEMPORARY VIEW`event_3`AS(SELECT id,accountnumber,rowtime,eventtype FROM`event_1`)UNION ALL(SELECT id,accountnumber,rowtime,eventtypeFROM`event_2`))

[0144] Among them, event_1 selects the password_change event of the ONL channel, event_2 selects the transfer event, and event_3 merges the common event-related meta information in these two tables into one table.

[0145] (c) Perform complex event processing using the stream processing MATCH syntax, and you get the following code:

[0146]

[0147]

[0148] (d) Since table event_4 only stores basic information of the hit event, all the information of the hit event is selected from the corresponding event table through SELECT syntax, and the target event table event_5 is created.

[0149] (e) Return to the target event table event_5.

[0150] The second step is, Figure 3 As shown, for the second node of SingleEvent type, corresponding to ATM[transfer] in the FFML rule, first access its two child nodes to obtain the variable channel = "ATM", params is a string, so it is a simple independent event, and the simple independent event is processed below.

[0151] (a) Simple independent events directly use SELECT syntax to select channel events, that is, CREATE TEMPORARYVIEW `event_6` AS (SELECT * FROM transfer WHERE channel = `ATM`)

[0152] (b) Get and return the target event table event_6

[0153] Step 513, transform the Boolean expression in the data flow according to the left return value of the left expression child node of the node, the comparison return value of the comparison operator child node and the right return value of the right expression child node, generate target transformation data, and execute step 521.

[0154] For detailed instructions on this step, refer to Figure 1 Step 107 in the optimization processing method of the financial fraud modeling language shown.

[0155] Step 515, by traversing the child nodes of the node, executing the processing flow of the child nodes, obtaining the SQL table name of each child node, and saving the SQL table name in the events list, and executing step 516.

[0156] It should be noted that the EventStatement type node supports the definition of multiple or events, and the child node type of the EventStatement type node is SingleEvent, that is, a single independent event or a sequence event.

[0157] In this step, when the node type of the node is EventStatement, first, traverse the child nodes of the EventStatement type node, execute the SingleEvent processing flow corresponding to each child node of the SingleEvent type, obtain the SQL table of each child node of the SingleEvent type, and save the SQL table in the events list.

[0158] Step 516 , merge the contents of all SQL tables in the events list to generate third conversion data, and execute step 521 .

[0159] Specifically, the contents of all SQL tables in the events list may be merged through the UNION ALL operator.

[0160] In this step, since nodes of EventStatement type only support or events, the contents of all SQL tables in the events list can be merged, that is, SELECT all the contents in a single table, and then merge them through the UNIONALL operator to generate a new stream processing table, and write the new stream processing table to the event_table in the symbol table. The value is needed for the subsequent conditional definition of the processing of related nodes, and the new stream processing table is used as the third conversion data.

[0161] For example, see Figure 6 , Figure 6 This is the second FFML abstract syntax tree in the present invention. Figure 6 Take the FFML abstract syntax tree in as an example to illustrate:

[0162] like Figure 6 As shown, the first step is to traverse the child nodes of the EventStatement type node, that is, the two SingleEvent type child nodes, and access the SingleEvent type child nodes by calling the processing flow corresponding to the SingleEvent type node to obtain its return value, which is event event_5 and event event_6 respectively.

[0163] In the second step, you can use UNION ALL to merge the two events event_5 and event_6, that is,

[0164] CREATE TEMPORARY VIEW`event_7`AS((SELECT*FROM event_5)UNION ALL(SELECT*FROM event_6)).

[0165] The third step is to set event_table in the symbol table to event_7.

[0166] Step 517, visit each child node of the node of the ConditionStatement type in turn, and determine whether the logical operation after each child node is an "AND" operation or an "OR" operation; if the logical operation is an "AND" operation, update the current table in the symbol table to the top element of the stack; if the logical operation is an "OR" operation, update the current table in the symbol table to the value corresponding to the event_table in the symbol table, and execute step 519.

[0167] The ConditionStatement type node includes a plurality of SingleCondition type nodes connected by the logic symbol "AND" and the logic symbol "OR".

[0168] In this step, when the node type of the node is ConditionStatement, first, visit each child node of the node of ConditionStatement type in turn until all child nodes are visited. The processing flow for each child node is as follows:

[0169] The first step is to use the return value of the child node as the top element of the stack to determine the logical operation behind the child node; if the logical operation is an "and" operation, execute the "second step"; if the logical operation is an "or" operation, execute the "third step".

[0170] The second step is to update the top element of the stack of the current table in the symbol table and pop the top element of the stack.

[0171] The third step is to update the current table in the symbol table to the value corresponding to event_table in the symbol table.

[0172] For example, Figure 3 Take the FFML abstract syntax tree in as an example to illustrate:

[0173] like Figure 3 As shown, the first step is to access the first child node of the node of ConditionStatement type, obtain the return value condition_1 by calling the access function of SingleCondition, push it to the top of the stack, and then access the second child node to obtain the logical operation of the second child node as an "AND" operation.

[0174] The second step is to update the current table in the symbol table to condition_1 and pop the top element of the stack.

[0175] The third step is to access the second child node, obtain its return value condition_2, push it to the top of the stack, and then determine that the logical operation of the third child node is an "or" operation.

[0176] The fourth step is to update the current table in the symbol table to the value corresponding to event_table in the symbol table, that is, event_7.

[0177] Step 5: Visit the third child node and get its return value condition_3.

[0178] The sixth step is to merge the remaining two tables in the stack, namely:

[0179] CREATE TEMPORARY VIEW`condition_4`AS((SELECT*FROM condition_2)UNIONALL(SELECT*FROM condition_3))

[0180] Step 519: After all child nodes of the ConditionStatement type node are visited, all tables in the stack are merged to generate fourth conversion data.

[0181] In this step, after all child nodes of the node of the ConditionStatement type are visited, all tables in the stack are merged through UNION ALL to obtain a new table, and the new table is written to the condition_table in the symbol table.

[0182] Step 521: Generate SQL code corresponding to the fraud detection rule according to the first conversion data, the target conversion data, the third conversion data and the fourth conversion data.

[0183] In this step, by using corresponding processing methods for different types of nodes, the fraud detection rules written in the financial fraud modeling language FFML are converted into the SQL programming language that the streaming platform can recognize, with high processing efficiency and real-time performance.

[0184] It can be seen that in the optimization processing method of a financial fraud modeling language proposed in the present invention, it is possible to generate an FFML abstract syntax tree corresponding to the fraud detection rule based on the fraud detection rule written in the financial fraud modeling language FFML, and then generate corresponding conversion data according to the node type of each node in the FFML abstract syntax tree, and finally generate SQL code corresponding to the fraud detection rule according to each conversion data, so that the fraud detection rule written in the financial fraud modeling language FFML can be quickly converted into the SQL programming language that can be recognized by the flow platform, with high processing efficiency and real-time performance.

[0185] In one implementation, fraud detection rules written in the financial fraud modeling language FFML can be quickly converted into the SQL programming language that can be recognized by the Flink-based streaming platform. The present invention can optimize the performance of the generated SQL code based on the characteristics of the Flink stream processing system, specifically including the following four aspects:

[0186] The first one is UNION ALL optimization.

[0187] The UNION ALL operation of the stream processing system is essentially different from the merge operation of the database table and requires special processing. UNION ALL in the stream processing system actually simply merges two data streams together and flows them into the next operator. Since the operator operation of the stream processing system is driven by time, for example, the window operation will only be triggered when the watermark that exceeds the window end time reaches the current operator. Therefore, for the data stream merge, the merge and flow of time watermarks need extra attention. For operators with multiple input streams in the Flink stream processing system, the operator time takes the minimum value of the input stream time. This will result in that if there is no data arriving in one input stream, that is, no new watermark will arrive, then no matter how the other input stream times advance, the operator time of the combined operator will not advance, that is, no new time watermark will be sent to the downstream, and the stream processing system time will be blocked at the operator, and the subsequent operator operations that require time to trigger will not be executed.

[0188] In the present invention, UNION ALL is no longer used in the generated code to merge the data streams. Instead, a subsequent operator is configured for each data stream, that is, merging is avoided by doubling the operators.

[0189] For example, Figure 4 In the optimization processing method of a financial fraud modeling language shown, the example in the "Example Description" in step 516 is used as an example to illustrate the changes in the processing flow after using the "UNION ALL optimization", and specifically the changes are in the "second step" and the "third step".

[0190] Specifically, after using "UNION ALL optimization", the following example is given:

[0191] like Figure 6 As shown, the first step is to traverse the child nodes of the EventStatement type node, that is, the two SingleEvent type child nodes, and access the SingleEvent type child nodes by calling the processing flow corresponding to the SingleEvent type node to obtain its return value, which is event event_5 and event event_6 respectively.

[0192] The second step is to set the event_table in the symbol table to the list [event_5, event_6].

[0193] For example, Figure 4 In the optimization processing method of a financial fraud modeling language shown, taking the example in the "Example" in step 517 as an example, after using the "UNION ALL optimization", the table event_3 may not be created, and tables with different names but the same actual content may be merged into one, which can greatly reduce the number of tables and thus reduce the number of operators finally generated.

[0194] The present invention can check each newly created table by constructing a global view information table during conversion, and directly return the ID of the created table if it already exists. The key value of the global view information table is composed of a certain combination of the template name for creating the table and the value of its fill-in item, thereby ensuring that the specific meaning of the table can be accurately and uniquely expressed.

[0195] Specifically, after using "UNION ALL optimization", the "sixth step" was modified, and the improved process is as follows:

[0196] by Figure 3 Take the FFML abstract syntax tree in as an example to illustrate:

[0197] like Figure 3 As shown, the first step is to access the first child node of the node of ConditionStatement type, obtain the return value condition_1 by calling the access function of SingleCondition, push it to the top of the stack, and then access the second child node to obtain the logical operation of the second child node as an "AND" operation.

[0198] The second step is to update the current table in the symbol table to condition_1 and pop the top element of the stack.

[0199] The third step is to access the second child node, obtain its return value condition_2, push it to the top of the stack, and then determine that the logical operation of the third child node is an "or" operation.

[0200] The fourth step is to update the current table in the symbol table to the value corresponding to event_table in the symbol table, that is, event_7.

[0201] Step 5: Visit the third child node and get its return value condition_3.

[0202] Step 6: Perform "Step 1" to "Step 5" for all tables in the symbol table event_table, and get 4 new tables condition_1, condition_2, condition_3 and condition_4.

[0203] For example, Figure 4 In the optimization processing method of a financial fraud modeling language shown in the figure, taking the example in the "Example" under sub-step 63 as an example, after using the "UNION ALL optimization", the "UNION ALL operation" is removed in "(b)" in the "first step", that is, the table event_3 is not created, and tables with different names but the same actual content are merged into one, which can greatly reduce the number of tables and thus reduce the number of operators finally generated.

[0204] The second method is table deduplication optimization.

[0205] Table deduplication optimization is involved in the access of each node, and two tables with the same definition will be merged.

[0206] For example, CREATE TEMPPORARY VIEW`event_4`AS(SELECT*FROM transfer WHEREchannel=`ATM`)

[0207] CREATE TEMPPORARY VIEW `event_5` AS (SELECT * FROM transfer WHERE channel = `ATM`); Because event_4 and event_5 are exactly the same, after enabling table deduplication optimization, the two tables will be merged into one, that is, only event_4.

[0208] The third type is built-in function optimization.

[0209] Although built-in functions can be directly implemented through the window functions of the stream processing system, the efficiency of window operators is not necessarily high. There are many factors that affect it, such as the configuration of the stream processing system, the characteristics of the incoming data, etc., and the window operators need to maintain a large number of states and consume more resources. At the same time, the data that most built-in functions need to query is relatively simple, such as the total transfer amount of an account in the most recent day. This kind of data is also sensitive in practical applications, and the original database system will also record it. Therefore, when processing built-in functions, you do not need to use the stream processing method, but directly use the method of querying the external database, that is, use the underlying stream processing API to create the corresponding process, directly query the external database during the process, and return the result.

[0210] For example, based on Figure 5The example in sub-step 63 in the sub-step processing flow of step 511 shown in the figure illustrates the processing flow after "built-in function optimization". Compared with the example in sub-step 63, there is an improvement in the "first step":

[0211] The first step is to access its first child node, the left expression node, which is the query node. The specific process is as follows:

[0212] (a) Use the stream processing built-in function syntax to perform LATERAL JOIN, that is:

[0213] CREATE TEMPORARY VIEW`procedure_2`AS(SELECT S.id,S.rowtime,Tv AStotaldebit FROM event_4 AS S,LATERAL TABLE(TOTALDEBIT(accountnumber,`ATM`,2,1))AS T(v))

[0214] (b) The returned left operand lhs is (procedure_2, totaldebit).

[0215] The second step is to visit the second child node, which is the comparison operator node, and obtain op as <=.

[0216] The third step is to access the third child node, which is the right expression node, and get rhs as 500.

[0217] The fourth step is to convert the comparison expression using the WHERE syntax, that is,

[0218] CREATE TEMPORARY VIEW`comparison_1`AS(SELECT accountnumber,rowtimeFROM procedure_2 WHERE`totaldebit`<=500.0)

[0219] The fifth step is to select all the information from the complete event table, namely:

[0220] CREATE TEMPORARY VIEW`condition_1`AS(SELECT*FROM event_7,comparison_1WHERE event_7.accountnumber=comparison_1.accountnumber AND event_7.rowtime>=comparison_1.rowtime)

[0221] like Figure 3 As shown, for the second SingleCondition node, it corresponds to transfer.`value`>=500.

[0222] The first step is to access its left expression node, which is a simple variable node. Simply return its event variable, i.e. ("transfer", "value").

[0223] The second step is to access its comparison operator node and obtain op as >=.

[0224] The third step is to access its right expression node and obtain rhs as 500.

[0225] The fourth step is to directly select the events that meet the condition through the SELECT syntax, that is:

[0226] CREATE TEMPORARY VIEW`comparison_2`AS(SELECT*FROM transfer WHERE`value`>=500.0)

[0227] Step 5: Read the current table in the symbol table, recorded as condition_1, and find the intersection of comparison_2 and condition_1, that is:

[0228] CREATE TEMPORARY VIEW`condition_2`AS(SELECT*FROM comparison_2 WHEREid IN(SELECT id FROM condition_1)).

[0229] like Figure 3 As shown, for the third SingleCondition node, it corresponds to HISTORY(4)[QUERYTOTALDEBIT(ONL)>=100]>=1, which is a historical data query point. For its specific process, please refer to the relevant description of the node of the HistStatement type.

[0230] Fourth, table update optimization: For database systems, table updates only require rewriting the data in the table. However, for stream processing systems, since tables are actually data streams, they cannot be rewritten. When a table item is updated, a new piece of data needs to be resent to the stream with an update flag. Obviously, this update operation is not efficient. If the table is updated very frequently, a large number of stream elements will appear in the stream processing system, causing system performance to degrade. Therefore, table update optimization converts the table update code in the generated code into code that does not require table updates.

[0231] Table update optimization is mainly reflected in the processing flow of HistStatement type nodes.

[0232] For example, taking the example in the "Example of How to Handle Nodes of the HistStatement Type" in the previous article as an example, the process improvement after "Table Update Optimization" is explained. The improvement is mainly in the "Fourth Step". The improved processing flow is as follows:

[0233] like Figure 3 As shown, the first step is to access the first child node of the node of the HistStatement type, obtain the number of table entries to be queried d as 4, and set hist_days in the symbol table to 4.

[0234] The second step is to access the second child node of the HistStatement type node, that is, the conditional node, and generate the following three new tables, whose functions are aggregation, TOPN selection, and comparison expression data filtering.

[0235] CREATE TEMPORARY VIEW`procedure_3`AS(SELECT accountnumber,SUM(`value`)AS totaldebit,TUMBLE_END(rowtime,INTERVAL`1`DAY)AS rowtime FROM event_9GROUP BY accountnumber,TUMBLE(rowtime,INTERVAL`1`DAY))

[0236] CREATE TEMPORARY VIEW`procedure_4`AS(SELECT accountnumber,totaldebit,rowtime FROM(SELECT*,ROW_NUMBER()OVER(PARTITION BY accountnumber ORDER BYrowtime DESC)as rownum FROM procedure_3)WHERE rownum<=4)

[0237] CREATE TEMPORARY VIEW`comparison_3`AS(SELECT accountnumber,rowtimeFROM procedure_4 WHERE`totaldebit`>=100.0)

[0238] The third step is to restore hist_days to 1 in the symbol table.

[0239] The fourth step is to perform tumbling window aggregation on the data in the comparison_3 table. The window time is set to 1 second, and the global COUNT aggregation is no longer used directly. That is,

[0240] CREATE TEMPORARY VIEW`count_1`AS(SELECT id,MAX(rowtime)AS rowtime,COUNT(*)AS daycount FROM comparison_3 GROUP BY id,TUMBLE(rowtime,INTERVAL`1`SECOND))

[0241] The present invention also provides an optimization processing device for financial fraud modeling language. Figure 7 , Figure 7 It is a structural schematic diagram of the optimization processing device of the financial fraud modeling language of the present invention.

[0242] like Figure 7 As shown, the device 80 includes: a first generating module 801, a first judging module 802, a third generating module 804 and a fourth generating module 805;

[0243] The first generating module 801 is used to generate an FFML abstract syntax tree corresponding to the fraud detection rule according to the fraud detection rule written in the financial fraud modeling language FFML;

[0244] The first determination module 802 is used to determine the node type of the node by traversing each node in the FFML abstract syntax tree;

[0245] The third generation module 804 is used to transform the Boolean expression in the data stream according to the left return value of the left expression subnode of the node, the comparison return value of the comparison operator subnode and the right return value of the right expression subnode to generate target transformation data if the node type of the node is SingleCondition;

[0246] The fourth generating module 805 is used to generate the SQL code corresponding to the fraud detection rule according to the target conversion data.

[0247] Optionally, the device further includes: an execution module and a fifth generation module;

[0248] The execution module is used for, if the node type of the node is EventStatement, traversing the child nodes of the node, executing the processing flow of the child nodes, obtaining the SQL table of each child node, and saving the SQL table in the events list;

[0249] The fifth generating module is used to merge the contents of all SQL tables in the events list to generate third conversion data.

[0250] Optionally, the fifth generating module is specifically configured to merge the contents of all SQL tables in the events list through a UNION ALL operator.

[0251] Optionally, the device further includes: a second determination module, a first update module, a second update module and a merging module;

[0252] The second judgment module is used for, if the node type of the node is ConditionStatement, accessing each child node of the node of the ConditionStatement type in sequence, and judging whether the logical operation after each child node is an "AND" operation or an "OR" operation;

[0253] The first updating module is used for updating the current table in the symbol table to the top element of the stack if the logical operation is an “AND” operation;

[0254] The second updating module is used for updating the current table in the symbol table to the value corresponding to event_table in the symbol table if the logical operation is an "or" operation;

[0255] The merging module is used to merge all tables in the stack to generate fourth conversion data after all child nodes of the ConditionStatement type node are visited; wherein the ConditionStatement type node includes multiple SingleCondition type nodes connected by the logic symbol "AND" and the logic symbol "OR".

[0256] Optionally, the fourth generating module 805 is specifically configured to generate an SQL code corresponding to the fraud detection rule according to the target conversion data, the third conversion data and the fourth conversion data.

[0257] It can be seen that the optimization processing device of the financial fraud modeling language proposed in the present invention can generate the FFML abstract syntax tree corresponding to the fraud detection rules based on the fraud detection rules written in the financial fraud modeling language FFML, and then generate corresponding conversion data according to the node type of each node in the FFML abstract syntax tree. Finally, according to each conversion data, it generates the SQL code corresponding to the fraud detection rules. The fraud detection rules written in the financial fraud modeling language FFML can be quickly converted into the SQL programming language that can be recognized by the flow platform, with high processing efficiency and real-time performance.

[0258] It should be noted that the terms "including" and "having" and any variations thereof in the embodiments of the present invention and the accompanying drawings are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device including a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to these processes, methods, products or devices.

[0259] A person skilled in the art can understand that the accompanying drawings are only schematic diagrams of an embodiment, and the modules or processes in the accompanying drawings are not necessarily necessary for implementing the present invention. A person skilled in the art can understand that the modules in the device in the embodiment can be distributed in the device in the embodiment according to the description of the embodiment, or can be changed accordingly and located in one or more devices different from the present embodiment. The modules in the above-mentioned embodiments can be combined into one module, or can be further divided into multiple sub-modules.

[0260] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for optimizing a financial fraud modeling language, characterized in that: include: According to the fraud detection rules written in the financial fraud modeling language FFML, generating the FFML abstract syntax tree corresponding to the fraud detection rules; By traversing each node in the FFML abstract syntax tree, determining the node type of the node; If the node type of the node is SingleCondition, the Boolean expression in the data stream is converted according to the left return value of the left expression child node of the node, the comparison return value of the comparison operator child node and the right return value of the right expression child node to generate target conversion data; wherein the child node of the node of the SingleCondition node type is in the form of a fixed left expression, a comparison operator and a right expression; Generating a structured query language SQL code corresponding to the fraud detection rule according to the target conversion data; The method further comprises: If the node type of the node is EventStatement, then by traversing the child nodes of the node, executing the processing flow of the child nodes, obtaining the SQL table of each child node, and saving the SQL table in the events list; wherein, the node of the EventStatement node type supports the definition of multiple or events, the type of the child node of the EventStatement node type is SingleEvent, and the SingleEvent is a single independent event or a sequence event; The contents of all SQL tables in the events list are merged to generate third conversion data.

2. The method according to claim 1, characterized in that The step of merging the contents of all SQL tables in the events list includes: The contents of all SQL tables in the events list are merged through the UNION ALL operator.

3. The method according to claim 1, characterized in that: The method further comprises: If the node type of the node is ConditionStatement, then access each child node of the node of the ConditionStatement type in turn to determine whether the logical operation after each child node is an "AND" operation or an "OR" operation; If the logical operation is an AND operation, the current table in the symbol table is updated to the top element of the stack; If the logical operation is an "or" operation, the current table in the symbol table is updated to the value corresponding to event_table in the symbol table; After all child nodes of the ConditionStatement type node are visited, all tables in the stack are merged to generate fourth conversion data; The ConditionStatement type node includes a plurality of SingleCondition type nodes connected by the logic symbol "AND" and the logic symbol "OR".

4. The method according to claim 3, characterized in that The step of generating a structured query language SQL code corresponding to the fraud detection rule according to the target conversion data includes: An SQL code corresponding to the fraud detection rule is generated according to the target conversion data, the third conversion data and the fourth conversion data.

5. An optimization processing device for a financial fraud modeling language, characterized in that: The device comprises: a first generating module, a first judging module, a third generating module and a fourth generating module; The first generating module is used to generate an FFML abstract syntax tree corresponding to the fraud detection rule according to the fraud detection rule written in the financial fraud modeling language FFML; The first determination module is used to determine the node type of the node by traversing each node in the FFML abstract syntax tree; The third generation module is used for converting the Boolean expression in the data stream to generate target conversion data according to the left return value of the left expression child node of the node, the comparison return value of the comparison operator child node and the right return value of the right expression child node if the node type of the node is SingleCondition; wherein the child node of the node of the SingleCondition node type is in the form of a fixed left expression, a comparison operator and a right expression; The fourth generating module is used to generate SQL code corresponding to the fraud detection rule according to the target conversion data; The device further comprises: an execution module and a fifth generation module; The execution module is used for, if the node type of the node is EventStatement, traversing the child nodes of the node, executing the processing flow of the child nodes, obtaining the SQL table of each child node, and saving the SQL table in the events list; wherein, the node of the EventStatement node type supports the definition of multiple or events, the type of the child node of the EventStatement node type is SingleEvent, and the SingleEvent is a single independent event or a sequence event; The fifth generating module is used to merge the contents of all SQL tables in the events list to generate third conversion data.

6. The device according to claim 5, characterized in that The fifth generating module is specifically used to merge the contents of all SQL tables in the events list through the UNION ALL operator.

7. The device according to claim 5, characterized in that The device further comprises: a second judgment module, a first updating module, a second updating module and a merging module; The second judgment module is used for, if the node type of the node is ConditionStatement, accessing each child node of the node of the ConditionStatement type in sequence, and judging whether the logical operation after each child node is an "AND" operation or an "OR" operation; The first updating module is used for updating the current table in the symbol table to the top element of the stack if the logical operation is an "AND" operation; The second updating module is used for updating the current table in the symbol table to the value corresponding to event_table in the symbol table if the logical operation is an "or" operation; The merging module is used to merge all tables in the stack to generate fourth conversion data after all child nodes of the ConditionStatement type node are visited; wherein the ConditionStatement type node includes multiple SingleCondition type nodes connected by the logical symbol "and" and the logical symbol "or".

8. The device according to claim 5, characterized in that The fourth generating module is specifically configured to generate an SQL code corresponding to the fraud detection rule according to the target conversion data, the third conversion data and the fourth conversion data.

Images