Method, device, storage medium and processor for generating risk list

Abstract

The present invention discloses a method, device, storage medium, and processor for generating a risk list. The method comprises: obtaining user feature data and user transaction data in a business scenario; obtaining a historical risk list for the business scenario, wherein the historical risk list is a list of historically acquired risky user groups; extracting at least one indicator feature of the business scenario based on the user feature data and user transaction data; and filtering the historical risk list based on the at least one indicator feature to generate a target risk list. The present invention solves the technical problem of low accuracy of risk lists obtained in related technologies.

Description

Technical Field

[0001] The present invention relates to the field of Internet finance, and in particular to a method, device, storage medium and processor for generating a risk list. Background Art

[0002] In risk control, ensuring that risk lists are matched is a crucial risk interception strategy. A risk list is a collection of high-risk customers in a specific field or scenario, such as a running list for payment risk control or a list of overdue risk customers for credit risk control. Compared to predictive interception using risk control models, risk lists are lightweight and highly portable, allowing them to be used across similar scenarios without the need for re-mining and generation. Currently, risk lists are acquired through external procurement, either through purchase or by calling external query interfaces and relying on the accumulated experience of auditors. This incurs significant financial expenditure, results in a small list size and low recall rate, and cannot be customized or refined to serve the business. This can also result in low accuracy when scenarios vary significantly.

[0003] To address the above-mentioned problems, no effective solutions have been proposed so far. Summary of the Invention

[0004] Embodiments of the present invention provide a method, apparatus, storage medium, and processor for generating a risk list, so as to at least solve the technical problem of low accuracy of risk lists obtained in related technologies.

[0005] According to one aspect of an embodiment of the present invention, a method for generating a risk list is provided, the method comprising: obtaining user feature data and user flow data in a business scenario; obtaining a historical risk list of the business scenario, wherein the historical risk list is a list of risk user groups obtained historically; extracting at least one indicator feature of the business scenario based on the user feature data and user flow data; screening the historical risk list based on the at least one indicator feature to generate a target risk list.

[0006] Optionally, the method further includes: expanding the historical risk list to generate a target risk list.

[0007] Optionally, the historical risk list is screened based on at least one indicator feature to generate a target risk list, including: using at least one indicator feature to perform chi-square binning on the user groups in the historical risk list to generate binning results; determining the indicator feature threshold corresponding to each indicator feature based on the binning results; and screening the user groups in the historical risk list based on the indicator feature threshold and user feature data to generate a target risk list.

[0008] Optionally, the method further includes: performing a diversion test on the target risk list based on a preset strategy to generate a test result, wherein the test result is used to indicate the accuracy of the target risk list; and updating the indicator feature threshold based on the test result.

[0009] Optionally, the historical risk list is expanded to generate a target risk list, and the method includes: obtaining transaction information of the user group in the historical risk list; determining the first user who conducts a transaction with any user in the user group based on the transaction information; and merging the first user into the historical risk list to generate a target risk list.

[0010] Optionally, the historical risk list is expanded to generate a target risk list, and the method includes: obtaining characteristic information of the user group in the historical risk list; determining a second user based on the characteristic information, wherein the characteristic similarity between the second user and any user in the user group is greater than a first preset threshold; and merging the second user into the historical risk list to generate a target risk list.

[0011] Optionally, the historical risk list is expanded to generate a target risk list, and the method includes: obtaining location information of the user group in the historical risk list; determining a third user whose distance from any user in the user group is less than a second preset threshold based on the location information; and merging the third user into the historical risk list to generate a target risk list.

[0012] According to another aspect of an embodiment of the present invention, a device for generating a risk list is also provided, including: a first acquisition module for acquiring user feature data and user flow data in a business scenario; a second acquisition module for acquiring a historical risk list of the business scenario, wherein the historical risk list is a list of risk user groups acquired historically; an extraction module for extracting at least one indicator feature of the business scenario based on the user feature data and user flow data; and a generation module for screening and processing the historical risk list based on at least one indicator feature to generate a target risk list.

[0013] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is provided. The computer-readable storage medium includes a stored program, wherein when the program is running, the device where the computer-readable storage medium is located is controlled to execute any of the above-mentioned risk list generation methods.

[0014] According to another aspect of an embodiment of the present invention, a processor is further provided, which is used to run a program, wherein the program executes any of the above-mentioned methods for generating a risk list when running.

[0015] Using the above-described embodiments of the present invention, user feature data and user flow data from a business scenario are obtained; a historical risk list for the business scenario is obtained, wherein the historical risk list is a list of historically acquired risky user groups; at least one indicator feature of the business scenario is extracted based on the user feature data and user flow data; and the historical risk list is screened based on the at least one indicator feature to generate a target risk list, thereby improving the accuracy of the risk list. Because the historical risk list is screened based on data from the business scenario, the target risk list obtained through the screening process is primarily a risk list corresponding to the business scenario, making the target risk list more suitable for the business scenario, thereby achieving the technical effect of improving the accuracy of the target risk list and resolving the technical problem of low accuracy of risk lists obtained in related technologies. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0017] Figure 1 is a flow chart of a method for generating a risk list according to an embodiment of the present invention;

[0018] Figure 2 This is a schematic diagram of a risk control architecture in an example according to the present invention;

[0019] Figure 3 This is a schematic diagram of a risk list mining solution in an example according to the present invention;

[0020] Figure 4 2 is a schematic diagram of a risk list generating device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0021] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of the present invention.

[0022] It should be noted that the terms "first", "second", etc. in the description and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0023] First, the technical terms or technical terms that appear in the embodiments of the present invention are explained as follows:

[0024] Risk list: refers to a collection of customers with relatively high risks in a certain field or scenario, such as the payment risk control running list, the credit risk control overdue risk list, etc.

[0025] Euclidean distance: The Euclidean metric (also known as Euclidean distance) is a commonly used distance definition, referring to the true distance between two points in n-dimensional space, or the natural length of a vector (that is, the distance from the point to the origin). The Euclidean distance in two-dimensional and three-dimensional space is the actual distance between two points.

[0026] Split-group test (AB test): AB test is when we are hesitant between options A and B, we directly test and compare the two options to see which one is better, and use the test results as a reference.

[0027] Example 1

[0028] According to an embodiment of the present invention, an embodiment of a method for generating a risk list is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0029] Figure 1 is a flow chart of a method for generating a risk list according to an embodiment of the present invention. Figure 1 As shown, the method includes the following steps:

[0030] Step S102: Acquire user feature data and user flow data in the business scenario.

[0031] The above-mentioned business scenarios may be designated business scenarios, such as transaction scenarios, repayment scenarios, lending scenarios, etc.

[0032] The above-mentioned user characteristic data can be an identification provided to customers for user classification, such as ordinary customers, platinum customers, VIP customers, etc.

[0033] The above-mentioned user transaction data may be transaction information data occurring in the user account.

[0034] In an optional embodiment, field workers can obtain the required data through scenario analysis. Scenario analysis is a common technique used in this field to reflect and assess project risks. Acquiring user feature data and user transaction data in business scenarios in the above steps is part of the scope of scenario analysis.

[0035] In another optional embodiment, when conducting scenario analysis, business personnel and R&D personnel can extract the risk characteristics of the target population in a specified business demand scenario by understanding and analyzing the use areas, scenarios, and purposes of the risk list. Among them, the risk characteristics can roughly indicate various types of customer information. For example, from the credit risk list, the debt level information, consumption level information, historical repayment behavior information, and income information of the borrowing customer can be assessed. Among them, the customer's debt level information may include the loan request time, application amount, application success or failure information, approved credit limit, customer's total credit limit, loan scenario, etc.; the customer's consumption level information may include the amount, number of transactions, product type, and return behavior of the customer; the customer's historical repayment behavior information may include early repayment behavior, normal repayment behavior, overdue repayment behavior, and non-repayment behavior; the customer's income information may include the customer's occupation, salary level, asset evaluation, and the customer's own attribute information.

[0036] Through the above steps, in addition to obtaining user feature data for the business scenario, user transaction data is also required to more accurately understand the customer information in the business scenario. By analyzing these user feature data and user transaction data, we can extract the risk characteristics of the target population in the specified business requirement scenario.

[0037] Step S104: Obtain a historical risk list for the business scenario.

[0038] Among them, the historical risk list is a list of risk user groups obtained historically, which can be the basic list data obtained before this work is carried out, generally including the blacklist accumulated by the business, the outsourced list, etc.

[0039] In an optional embodiment, the risk list has an important application in the main steps of risk control interception, wherein risk control interception refers to when the current transaction is in violation of regulations or risks and is intercepted by the risk control system of the relevant platform. Relevant workers can arrange risk list strategies in the authentication stage before the user enters the platform, the user's transaction stage, and the user's subsequent management and control stage, and comprehensively manage users before, during, and after the event to identify risks. Therefore, the generation of the risk list is critical, and improving the quality of the risk list is also very important. On the one hand, it can help the business intercept risks, and on the other hand, it can also reduce accidental injuries and interruptions. In this application, the acquisition of the target risk list is mainly based on the historical risk list.

[0040] Figure 2 is a schematic diagram of a risk control architecture according to an embodiment of the present invention, such as Figure 2 As shown, after a user registers and undergoes real-name authentication, risk control interception and risk detection can be implemented. The risk control architecture generally includes authentication risk control interception, real-time transaction risk control interception, and historical customer risk control monitoring. Authentication risk control interception is typically accomplished through identity recognition, risk identification, and tiering. Identity recognition can include liveness detection, optical character recognition (OCR), visual risk control, and public opinion monitoring. OCR generally refers to optical character recognition. Risk identification can include risk list strategies, whitelist strategies, rule strategies, and model strategies. Tiers can include permission levels and monitoring levels. Real-time transaction risk control interception is typically accomplished through identity recognition and risk identification. Identity recognition can include liveness detection, optical character recognition (OCR), and anti-theft authentication. Risk identification can include risk list strategies, whitelist strategies, rule strategies, and model strategies. Historical customer risk control monitoring is typically accomplished through risk identification and assessment and supervision. Risk identification can include risk list-based strategies, rule strategies, and model strategies. Assessment and supervision can include tier adjustment and monitoring and disposal. After risk control interception and detection, the user can either voluntarily cancel their account, or the platform can forcibly cancel their account.

[0041] Step S106: extract at least one indicator feature of the business scenario based on the user feature data and the user flow data.

[0042] The above indicator characteristics refer to overall quantitative characteristics. Mining indicator characteristics from the risk list can be accomplished jointly by business personnel, R&D personnel, and data analysts.

[0043] In credit risk control scenarios, characteristic indicators are generally extracted from a customer's historical borrowing and repayment behavior data and their own attribute data. This refers to the comprehensive risk control and approval of credit loan customers based on their credit, income, assets, family, repayment willingness, and default costs. Commonly used indicators include: the amount and number of loan applications submitted by users within a specified period; the amount, number, and percentage of successful applications; the amount, number, and percentage of failed applications; the amount, number, and percentage of applications during unusual time periods; the average interval between loan applications; application scenarios; the amount, number, and percentage of early repayments made by users within a specified period; the amount, number, number of days, and percentage of overdue payments made by users within a specified period; the user's income, occupation, age, gender, credit limit, interest rate, and whether the credit limit has been increased or whether credit has been granted; user multi-consumption information (multi-consumption information refers to borrowers applying for loans from two or more financial institutions); the amount and number of failed payments made by users; consumption scenarios; and other indicators proposed by business personnel. Relevant personnel can obtain these indicators based on user characteristic data and user transaction data.

[0044] Step S108: Screen the historical risk list based on at least one indicator feature to generate a target risk list.

[0045] In an optional embodiment, the acquired historical risk list can be filtered based on at least one characteristic indicator. Optionally, this can be achieved by setting a threshold and using a chi-square binning algorithm. The threshold, or critical value, refers to the minimum or maximum value that an effect can produce. In the above method, chi-square binning is first set to view the distribution range of users. Based on the binning results, relevant business personnel then determine the threshold for the corresponding indicator characteristic. Finally, customers who meet the threshold conditions are selected as the risk list customer set.

[0046] Through the above steps, user feature data and user transaction data for a business scenario are first obtained; a historical risk list for the business scenario is obtained, wherein the historical risk list is a list of historically acquired risky user groups; at least one indicator characteristic of the business scenario is extracted based on the user feature data and user transaction data; and the historical risk list is filtered based on the at least one indicator characteristic to generate a target risk list, thereby improving the accuracy of the risk list. Because the historical risk list is filtered based on data from the business scenario, the target risk list obtained through the filtering process is primarily a risk list corresponding to the business scenario, making the target risk list more suitable for the business scenario. This improves the accuracy of the target risk list, thereby resolving the technical issue of low accuracy of risk lists obtained in related technologies.

[0047] Optionally, the method further includes: expanding the historical risk list to generate a target risk list.

[0048] The above-mentioned expansion processing refers to mining relevant information data based on the existing basic list data.

[0049] Figure 3 FIG. 1 is a schematic diagram of a risk list mining solution according to an embodiment of the present invention. Figure 3 As shown, a scenario analysis is first performed. After the analysis is complete, data is acquired. Once the target data is acquired, it is determined whether the base list needs to be expanded. The base list can be the historical risk list mentioned above. If so, the risk list is expanded. During the expansion process, options include mining close contacts, mining those with similar characteristics, or mining those with similar distances. If the acquired data does not require base list expansion, business requirement indicator features are extracted. After extracting the characteristic indicators, the indicator feature thresholds can be adjusted to screen out a list of risky customers. During the screening process, the risk list generated from each step can be organized and combined with the business department's strategy to conduct a diversion test or A / B test. The diversion test involves grouping the data on the target risk list according to a pre-set strategy, then performing a test. The test results serve as a reference to indicate the accuracy of the risk list, and relevant personnel can adjust the indicator feature thresholds based on the results. Furthermore, after the screening is completed, a risk list can be generated. Based on this, the generated risk list needs to undergo a business evaluation. Risk lists that pass the evaluation can then be used.

[0050] Among them, when mining close contacts, you can count their close transaction counterparts based on the basic list, such as the customer's emergency contacts, payers, friend collection, and customers who share bank cards, mobile phone numbers, devices or device fingerprints, or share delivery addresses. You can also use graph mining algorithms to obtain close contacts of risky customers. The above-mentioned graph mining algorithm is a commonly used algorithm in the Internet field, which can discover and extract useful knowledge and information from massive data through graph models.

[0051] Among them, when mining those with similar features, in the embodiment of the present invention, the following two methods can be used:

[0052] Method 1: Train a clustering model and use clusters with a high number of customers on the risk list, or customers with similarities to those on the risk list, as the expanded list. Euclidean distance can be used to measure similarity. A clustering model involves collecting and classifying data based on similarity. From a machine learning perspective, clusters are equivalent to hidden patterns. Clustering is an unsupervised learning process for searching for clusters. The formula for calculating Euclidean distance in n-dimensional space is:

[0053]

[0054] Among them, d(x, y) is the coordinate of the point in n-dimensional space, from which we can get the distance from the point to the origin, (x1, y1)(x2, y2)...(x n ,y n ) represent the coordinates of different points.

[0055] The Euclidean distance in two-dimensional and three-dimensional space is the actual distance between two points. The calculation formula of the Euclidean distance in two-dimensional space is:

[0056]

[0057] Where ρ is the Euclidean distance between the point (x2, y2) and the point (x1, y1), and |X︳ is the Euclidean distance from (x2, y2) to the origin.

[0058] The calculation formula of Euclidean distance in three-dimensional space is:

[0059]

[0060] Where ρ is the Euclidean distance between the point (x2, y2, z2) and the point (x1, y1, z1), and |X︳ is the Euclidean distance from (x2, y2, z2) to the origin.

[0061] Method 2: Use the basic list as labels to train a supervised model, then use the model to predict the entire customer base. Supervised model training relies on predefined training examples. Finally, expand the list by selecting customers whose risk level exceeds a certain threshold. This threshold can be adjusted based on the size of the list, its actual application, the false positive rate, and the business disruption rate.

[0062] Among them, mining those with similar distances means mining those with the same transaction address, registered address, similar residential address, etc., and taking the above-mentioned those with similar distances as expansion objects. Generally, whether the those with similar distances are taken as expansion objects is determined by multiple distance relationships.

[0063] In an optional embodiment, after the expansion is completed, the risk list can be output, and then the output risk list will be subjected to risk list business evaluation. The evaluation indicators generally include business interruption rate, false injury rate, recall rate, hit rate, etc. According to the indicators, the thresholds in the corresponding callback list generation process can be set. The list with correct evaluation can be applied. The risk list can be applied in the scenario specified for the risk list. The business personnel set the strategy and observe the indicators of the list while performing risk control interception. At this point, a cycle of list mining is completed.

[0064] Optionally, the historical risk list is screened based on at least one indicator feature to generate a target risk list, including: using at least one indicator feature to perform chi-square binning on the user groups in the historical risk list to generate binning results; determining the indicator feature threshold corresponding to each indicator feature based on the binning results; and screening the user groups in the historical risk list based on the indicator feature threshold and user feature data to generate a target risk list.

[0065] The above chi-square binning is a data analysis method that can classify data.

[0066] In an embodiment of the present invention, the historical risk list is screened based on at least one indicator feature to generate a target risk list. The screening is mainly achieved by setting a threshold and a chi-square binning algorithm.

[0067] In an optional embodiment, chi-square binning is first set up, which can be used to view the distribution range of users. Then, based on the binning results, relevant business personnel determine the thresholds of the corresponding indicator characteristics. Finally, customers who meet the threshold conditions are screened out to generate a target risk list.

[0068] Optionally, the method further includes: performing a diversion test on the target risk list based on a preset strategy to generate a test result, wherein the test result is used to indicate the accuracy of the target risk list; and updating the indicator feature threshold based on the test result.

[0069] In an optional embodiment, the diversion test refers to grouping the data on the target risk list according to a pre-set strategy and then testing it, using the test results as a reference. The test results are used to indicate the accuracy of the risk list, and relevant personnel can judge whether it is necessary to adjust the determined indicator feature thresholds based on the results.

[0070] Optionally, the above-mentioned historical risk list is expanded to generate a target risk list, including: obtaining transaction information of the user group in the historical risk list; determining the first user who conducts transactions with any user in the user group based on the transaction information; and merging the first user into the historical risk list to generate a target risk list.

[0071] The first user mentioned above refers to a user who conducts direct transactions with any user in the historical risk list.

[0072] The transaction information of the above-mentioned user group may be loan information, repayment information, etc.

[0073] In an optional embodiment, transaction information for a user group on a historical risk list is obtained. Based on this transaction information, a user who has directly transacted with any user in the user group is identified as the first user. The first user is then combined with the aforementioned user and added to the historical risk list to generate a new target risk list. This operation can effectively improve the recall rate of the list, which is also known as the recall rate, a commonly used metric in data mining.

[0074] Optionally, in an optional embodiment, the above-mentioned historical risk list is expanded to generate a target risk list, including: obtaining characteristic information of the user group in the historical risk list; determining a second user based on the characteristic information, wherein the characteristic similarity between the second user and any user in the user group is greater than a first preset threshold; merging the second user into the historical risk list to generate a target risk list.

[0075] The second user mentioned above may be a user whose feature similarity with any user in the historical risk list is greater than a first preset threshold.

[0076] The first preset threshold mentioned above can be set by oneself.

[0077] In an optional embodiment, characteristic information of the user group on the historical risk list may be first obtained. Based on the similarity between the characteristic information of the user group and the characteristic information of other users, a user with a high similarity to the characteristic information of the user group may be identified among other users, and this user may be determined as the second user. Alternatively, whether the user can be selected as the second user may be determined based on whether the characteristic similarity between the user and any user on the historical risk list is greater than a first preset threshold. If the characteristic similarity between the user and any user on the historical risk list is greater than the first preset threshold, the user is determined as the second user.

[0078] Furthermore, after the second user is acquired, the second user may be added to the historical risk list to generate a target risk list. This operation may effectively improve the recall rate of the list.

[0079] Optionally, according to the above method, the historical risk list is expanded to generate a target risk list, including: obtaining the location information of the user group in the historical risk list; determining a third user whose distance from any user in the user group is less than a second preset threshold based on the location information; and merging the third user into the historical risk list to generate a target risk list.

[0080] The above-mentioned location information may be the IP address or geographic location of the terminal device used by the user group in the historical risk list.

[0081] The third user mentioned above may be a user whose location is less than a second preset threshold from any user in the historical risk list, wherein the second threshold may be set by oneself.

[0082] In an optional embodiment, the location information of a user group in the historical risk list is obtained, and users with similar location information may be selected as expansion targets. Generally, whether to select a user with similar location information as an expansion target is determined by a combination of multiple location relationships. Alternatively, whether to select a user as a third user may be determined based on whether the distance between the user and any user in the user group is less than a second preset threshold. If the distance between the user with similar location information and any user in the user group is less than the second preset threshold, the user is determined as a third user.

[0083] Furthermore, after obtaining the third user, the third user can be added to the historical risk list to generate a target risk list. This operation can effectively improve the recall rate of the list and provide more customized and refined services to the business.

[0084] Example 2

[0085] According to an embodiment of the present invention, a risk list generation device is also provided, which can execute the risk list generation method in the above embodiment. The specific implementation method and preferred application scenario are the same as the above embodiment and will not be repeated here.

[0086] Figure 4 FIG. 1 is a schematic diagram of a risk list generating device according to an embodiment of the present invention. Figure 4 As shown, the device includes:

[0087] The first acquisition module 402 is used to obtain user feature data and user flow data in the business scenario; the second acquisition module 404 is used to obtain the historical risk list of the business scenario, wherein the historical risk list is a list of risk user groups obtained historically; the extraction module 406 is used to extract at least one indicator feature of the business scenario based on the user feature data and user flow data; the generation module 408 is used to screen the historical risk list based on at least one indicator feature to generate a target risk list.

[0088] Optionally, the device further includes: an expansion module, configured to expand the historical risk list to generate a target risk list.

[0089] Optionally, the generation module includes: a binning unit, used to perform chi-square binning on the user groups in the historical risk list using at least one indicator feature to generate binning results; a determination unit, used to determine the indicator feature threshold corresponding to each indicator feature based on the binning results; and a screening unit, used to screen the user groups in the historical risk list based on the indicator feature threshold and user feature data to generate a target risk list.

[0090] Optionally, the generation module includes: a diversion unit, used to perform a diversion test on the target risk list based on a preset strategy and generate a test result, wherein the test result is used to indicate the accuracy of the target risk list; and an updating unit, used to update the indicator feature threshold based on the test result.

[0091] Optionally, the expansion module includes: a first acquisition unit, used to obtain transaction information of the user group in the historical risk list; a first determination unit, used to determine the first user who has conducted a transaction with any user in the user group based on the transaction information; and a first merging unit, used to merge the first user into the historical risk list to generate a target risk list.

[0092] Optionally, the expansion module includes: a second acquisition unit, used to obtain characteristic information of the user group in the historical risk list; a second determination unit, used to determine the second user based on the characteristic information, wherein the characteristic similarity between the second user and any user in the user group is greater than a first preset threshold; a second merging unit, used to merge the second user into the historical risk list to generate a target risk list.

[0093] Optionally, the expansion module includes: a third acquisition unit, used to obtain the location information of the user group in the historical risk list; a third determination unit, used to determine a third user whose distance from any user in the user group is less than a second preset threshold based on the location information; and a third merging unit, used to merge the third user into the historical risk list to generate a target risk list.

[0094] Example 3

[0095] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is provided. The computer-readable storage medium includes a stored program, wherein when the program is run, the device where the computer-readable storage medium is located is controlled to execute any of the above-mentioned risk list generation methods.

[0096] Example 4

[0097] According to another aspect of an embodiment of the present invention, a processor is provided, which is used to run a program, wherein the program executes any one of the above-mentioned methods for generating a risk list when running.

[0098] The serial numbers of the above embodiments of the present invention are for description only and do not represent the advantages or disadvantages of the embodiments.

[0099] In the above embodiments of the present invention, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0100] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only exemplary. For example, the division of the units can be a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0101] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0102] In addition, the functional units in the various embodiments of the present invention may be integrated into a single processing unit, each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0103] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk, etc. Various media that can store program codes.

[0104] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as within the scope of protection of the present invention.

Claims

1. A method for generating a risk list, characterized in that: include: Obtain user feature data and user flow data in business scenarios; Obtaining a historical risk list for the business scenario, wherein the historical risk list is a list of risky user groups obtained historically; Extracting at least one indicator feature of the business scenario based on the user feature data and the user flow data; Screening the historical risk list based on the at least one indicator feature to generate a target risk list; The method further comprises: Obtaining transaction information of the user group in the historical risk list; Determining, based on the transaction information, a first user who has conducted a transaction with any user in the user group, wherein the first user is used to represent a user who has conducted a direct transaction with any user in the historical risk list; Merging the first user into the historical risk list to generate the target risk list; Obtaining characteristic information of user groups in the historical risk list; Determining a second user based on the feature information, wherein a feature similarity between the second user and any user in the user group is greater than a first preset threshold; The second user is merged into the historical risk list to generate the target risk list.

2. The method according to claim 1, characterized in that Screening the historical risk list based on the at least one indicator feature to generate a target risk list includes: Performing chi-square binning on the user groups in the historical risk list using the at least one indicator feature to generate binning results; Determine an indicator feature threshold corresponding to each indicator feature based on the binning result; The user groups in the historical risk list are screened based on the indicator feature threshold and the user feature data to generate the target risk list.

3. The method according to claim 2, characterized in that The method further comprises: Performing a diversion test on the target risk list based on a preset strategy to generate a test result, wherein the test result is used to indicate the accuracy of the target risk list; The indicator feature threshold is updated based on the test result.

4. The method according to claim 1, wherein The method further comprises: Obtaining location information of user groups in the historical risk list; Determining, based on the location information, a third user whose distance from any user in the user group is less than a second preset threshold; The third user is merged into the historical risk list to generate the target risk list.

5. A device for generating a risk list, characterized in that: include: The first acquisition module is used to obtain user feature data and user flow data in the business scenario; A second acquisition module is configured to acquire a historical risk list of the business scenario, wherein the historical risk list is a list of risk user groups acquired historically; An extraction module, configured to extract at least one indicator feature of the business scenario based on the user feature data and the user flow data; A generating module, configured to screen the historical risk list based on the at least one indicator feature to generate a target risk list; The device is also used to obtain transaction information of the user group in the historical risk list; determine a first user who conducts transactions with any user in the user group based on the transaction information, wherein the first user is used to represent a user who conducts direct transactions with any user in the historical risk list; merge the first user into the historical risk list to generate the target risk list; obtain feature information of the user group in the historical risk list; determine a second user based on the feature information, wherein the feature similarity between the second user and any user in the user group is greater than a first preset threshold; merge the second user into the historical risk list to generate the target risk list.

6. A computer-readable storage medium, characterized in that The computer-readable storage medium includes a stored program, wherein when the program is executed, the device where the computer-readable storage medium is located is controlled to execute the method for generating a risk list according to any one of claims 1 to 4.

7. A processor, characterized in that: The processor is configured to run a program, wherein the program, when running, executes the method for generating a risk list according to any one of claims 1 to 4.

Images