A new method and device for training a suspect classification model based on an indicator set

Abstract

The present invention discloses a novel method and device for training a suspect classification model based on an indicator set. The method comprises: obtaining a preset transaction indicator set; wherein the transaction indicator set is determined by: obtaining at least two sub-suspect categories in a sub-suspect category library; based on an indicator calculation system, respectively determining the transaction indicators associated with the at least two sub-suspect categories to obtain a transaction indicator set; using the transaction indicator set to extract the transaction indicator data of the sample user from the historical transaction data of the sample user; using the transaction indicator data of the sample user and the sub-suspect category of the sample user to train a target suspect classification model. The embodiment of the present invention can improve the classification effect of the trained suspect classification model.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a novel suspect classification model training method and device based on an indicator set. Background Art

[0002] As the amount of business data in the financial system increases, the money laundering crimes involved are emerging in an endless stream. The traditional suspect determination method based on a large amount of manual work has a low processing rate and is difficult to meet the needs of quickly determining money laundering suspicions.

[0003] Based on the development of neural networks and artificial intelligence, more and more financial systems have begun to deploy risk control models to determine whether users are laundering money based on user transactions, such as risk control models based on expert experience. However, compared with the ever-changing criminal methods, the update speed of risk control models is limited and cannot effectively identify new criminal methods. Summary of the invention

[0004] The present invention provides a novel suspect classification model training method and device based on an indicator set to improve the classification effect of the trained suspect classification model.

[0005] According to one aspect of the present invention, a new method for training a suspect classification model based on an indicator set is provided, comprising:

[0006] Obtaining a preset transaction indicator set; wherein the transaction indicator set is determined by: obtaining at least two sub-suspicion categories in a sub-suspicion category library; and determining transaction indicators associated with the at least two sub-suspicion categories based on an indicator calculation system to obtain a transaction indicator set;

[0007] Extracting transaction indicator data of the sample user from the historical transaction data of the sample user using the transaction indicator set;

[0008] The target suspect classification model is trained using the transaction indicator data of the sample users and the sub-suspect categories of the sample users.

[0009] According to another aspect of the present invention, a new type of suspect classification model training device based on an indicator set is provided, comprising:

[0010] A transaction indicator determination module, used to obtain a preset transaction indicator set; wherein the transaction indicator set is determined by: obtaining at least two sub-suspicion categories in the sub-suspicion category library; based on the indicator calculation system, respectively determining the transaction indicators associated with the at least two sub-suspicion categories to obtain the transaction indicator set;

[0011] A transaction data extraction module, configured to extract transaction indicator data of a sample user from historical transaction data of the sample user using the transaction indicator set;

[0012] The classification model training module is used to train a target suspect classification model using the transaction indicator data of the sample user and the sub-suspect categories of the sample user.

[0013] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0014] at least one processor; and

[0015] a memory communicatively connected to the at least one processor; wherein,

[0016] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the new suspect classification model training method based on an indicator set described in any embodiment of the present invention.

[0017] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the new suspect classification model training method based on an indicator set described in any embodiment of the present invention when executed.

[0018] The embodiment of the present invention decouples the indicator calculation system from the sub-suspect category library, dynamically updates the sub-suspect category library, and updates the indicator calculation system on demand, thereby ensuring that the training samples are valid and have the ability to be updated, thereby improving the classification effect of the trained suspect classification model.

[0019] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0021] Figure 1 is a flow chart of a new type of suspect classification model training method based on an indicator set provided according to an embodiment of the present invention;

[0022] Figure 2A is a flow chart of a new type of suspect classification model training method based on an indicator set provided according to another embodiment of the present invention;

[0023] Figure 2Bis a schematic diagram of building and updating a suspect classification model according to another embodiment of the present invention;

[0024] Figure 3 is a structural schematic diagram of a novel suspect classification model training device based on an indicator set provided according to another embodiment of the present invention;

[0025] Figure 4 It is a schematic diagram of the structure of an electronic device for implementing an embodiment of the present invention. DETAILED DESCRIPTION

[0026] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0027] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0028] Figure 1 This is a flowchart of a new type of suspect classification model training method based on an indicator set provided by an embodiment of the present invention. This embodiment can be applied to the case where a model that can identify user suspects is obtained by training based on user data. The method can be executed by a new type of suspect classification model training device based on an indicator set. The device can be implemented in the form of hardware and / or software. The device can be configured in an electronic device with corresponding data processing capabilities. Figure 1 As shown, the method includes:

[0029] S110, obtaining a preset transaction indicator set; wherein the transaction indicator set is determined by: obtaining at least two sub-suspicion categories in a sub-suspicion category library; and based on an indicator calculation system, respectively determining transaction indicators associated with the at least two sub-suspicion categories to obtain a transaction indicator set.

[0030] Among them, the sub-suspicion category is the suspect label in the risk control system, such as normal users, money laundering users in type A, and money laundering users in type B. The sub-suspicion category library (historical label library) records the currently known suspect categories, and each sub-suspicion category is stored in the historical label library in the form of a label. The label in the historical label library is presented in the form of a suspect report. The most original suspect report can be obtained based on transaction indicator data or third-party import. In the subsequent model working process, the generated new label can be stored in the historical label library (the appearance of a new label represents the generation of a new money laundering type and identification rules) to update the historical label library. The label in the historical label library contains at least the necessary data fields of customer number (customer_no), card number (card_no), model number (model_id), suspect type (report_type), and generation time (create_time). For different suspect categories, the indicators that can reflect whether the user has a suspect of this category are different. For the transaction indicator that can reflect a certain sub-suspicion category, it is called the transaction indicator associated with the sub-suspicion category. The transaction indicator set is a set of transaction indicators associated with each sub-suspicion category. For example, for sub-suspicion categories A, B, and C, transaction indicators 1, 2, and 3 are associated respectively, and the transaction indicator set should include at least three indicators: 1, 2, and 3.

[0031] Specifically, according to the identification requirements of the risk control system, at least two sub-suspicion labels and sample users with these labels are obtained from the historical labels, and based on the content of these labels and the sample users, the transaction indicators associated with each label are obtained from the indicator calculation system.

[0032] It should be noted that the construction system of the label calculation system is as follows: At the beginning, for the user's suspicion (suspect subcategory), the relevant indicators are screened according to the expert's manual experience, and sufficient indicators are selected according to the user's public and private transactions. Then, the aggregation logic is solidified to obtain the indicator calculation system, so that by inputting the user account and calling the indicator system, the corresponding user's various indicator data can be output. For the use of the indicator calculation system, it can only be used to determine the transaction indicators associated with the label, or the indicator calculation system can be given the authority to call the user's historical transaction data, so that the transaction indicator data of the transaction indicators associated with the label can be directly determined based on the indicator calculation system. Every change and development of money laundering means will generate new labels. On the basis of storing known labels in the historical label library, if new labels representing new money laundering means appear during subsequent risk control, these labels will be stored in the historical label library, so as to achieve the effect of dynamic update of the historical label library. After the dynamic update of the historical label library, due to the appearance of new labels in the historical labels, the indicator calculation system must determine the transaction indicators associated with these new labels, and update them according to the transaction indicators associated with these new labels, so as to realize the on-demand update of the indicator calculation system.

[0033] S120: extracting transaction indicator data of the sample user from the historical transaction data of the sample user using the transaction indicator set.

[0034] Specifically, the data generated daily by the financial system is made into a transaction flow table. According to the transaction indicators associated with the sub-suspect category, the data under the transaction indicators are extracted from the transaction flow table of the sample user to obtain the labeled transaction indicator data.

[0035] S130: Use the transaction indicator data of the sample user and the sub-suspect categories of the sample user to train a target suspect classification model.

[0036] Specifically, the labeled transaction indicator data is used as the training set, and through sample sampling balance, indicator normalization, one-hot encoding and other feature engineering preprocessing techniques, the algorithm is adjusted based on the parameters to finally generate the optimal algorithm model file with the target performance indicator value as the target suspect classification model. The performance indicator value can be selected according to the needs of the financial risk control project as follows: recall rate, precision rate, f1 score, an indicator used in statistics to measure the accuracy of the binary classification model, AUC value, the area under the ROC curve and the coordinate axis, and ks value, an evaluation indicator used in the model to distinguish the degree of separation of positive and negative samples, or a combination of several of them.

[0037] The embodiment of the present invention decouples the indicator calculation system from the sub-suspect category library, dynamically updates the sub-suspect category library, and updates the indicator calculation system on demand, thereby ensuring that the training samples are valid and have update capabilities, thereby improving the classification effect of the trained suspect classification model.

[0038] Figure 2A This is a flowchart of a suspect classification model method provided by another embodiment 2 of the present invention. This embodiment is optimized and improved on the basis of the above embodiment. Figure 2A As shown, the method includes:

[0039] S210, obtaining a preset transaction indicator set; wherein the transaction indicator set is determined by: obtaining at least two sub-suspicion categories in a sub-suspicion category library; and determining transaction indicators associated with the at least two sub-suspicion categories based on an indicator calculation system to obtain a transaction indicator set;

[0040] S220, extracting transaction indicator data of the sample user from the historical transaction data of the sample user using the transaction indicator set;

[0041] S230, using the transaction indicator data of the sample user and the sub-suspect categories of the sample user to train a target suspect classification model;

[0042] S240, determining whether the target suspect classification model meets an update condition according to an actual performance indicator value of the target suspect classification model;

[0043] Specifically, for the trained target suspect classification model, new labels will be generated due to the changes in money laundering methods and money laundering identification rules. As new labels continue to appear, the actual processing capacity of the model will continue to decline. When the model is used, it is necessary to monitor the actual performance indicators of the model. When the actual performance indicators are lower than the pre-set requirements, it is determined that the model meets the update conditions.

[0044] Optionally, determining whether the suspect classification model meets an update condition according to an actual performance indicator value of the suspect classification model includes:

[0045] According to the classification results and manual review results of the target suspect classification model, determine the actual performance index value of the target suspect classification model; judge whether the actual performance index value of the target suspect classification model meets the target performance index value; if the actual performance index value of the target suspect classification model does not meet the target performance index value, determine that the target suspect classification model meets the update conditions.

[0046] Specifically, after the trained model file is deployed online, when a new batch of lead users need to be predicted, the transaction characteristics of the lead users are first obtained through the indicator calculation system, and after determining the transaction indicator data, the classification results of the new lead users are determined based on the lead user's transaction indicator data and the model to predict the user's suspicion. The classification results are output to the manual recognition terminal. The results are manually reviewed to determine whether the classification results representing the predicted suspicion are correct and valid, and a suspicion report or non-suspect report is generated for each user based on the actual suspicion, and the suspicion report or non-suspect report is added to the historical label library. Based on the initial classification results of the model and the final manual judgment results, the failure and success of the model prediction are determined, and then the actual performance indicator value of the target suspicion classification model is obtained. The actual performance indicator value is compared with the target performance indicator value. If the actual performance indicator value is higher than the target performance indicator value, it means that the model still has a certain classification ability for the current lead user and does not need to be updated. On the contrary, if the actual performance index value is lower than the target performance index value, it means that the current model cannot effectively identify the suspects of this group of clue users, and the target suspect classification model needs to be retrained. By setting the target performance index value, the model update is triggered when the actual performance index of the model is lower than the target performance index, so as to effectively monitor the recognition ability of the model and avoid financial risks caused by the long-term inefficient operation of the model. The final manual confirmation method is used to determine whether the model needs to be retrained, rather than blindly training and comparing every time, which improves efficiency.

[0047] S250: When the update condition is met, the transaction indicator set is updated using the pre-updated sub-suspicion category library, and the target suspect classification model is retrained using the updated transaction indicator set.

[0048] Specifically, in addition to the labels that existed when the model was first trained, the pre-updated sub-suspicion category library (historical label library) also contains new labels that were identified by the model during use and did not exist during training. These new labels can be real and valid new labels that have been manually reviewed. The specific process of retraining the model using the updated transaction indicator set is no different from the above embodiment except that there are new labels that have not been trained in the historical label library, and will not be repeated here. The model is retrained based on the updated historical label library to improve the recognition effect of the model on new labels after retraining.

[0049] Optionally, the updating of the transaction indicator set using the pre-updated sub-suspicion category library includes:

[0050] If the updated transaction indicator set includes a recently updated sub-suspicion category and an early sub-suspicion category, a first weight is set for the recently updated sub-suspicion category, a second weight is set for the early sub-suspicion category, and the first weight is greater than the second weight; if the updated transaction indicator set includes a classification failure sub-suspicion category and a classification success sub-suspicion category, a third weight is set for the classification failure sub-suspicion category, a fourth weight is set for the classification success sub-suspicion category, and the third weight is greater than the fourth weight; based on each sub-suspicion category and the corresponding weight, an updated transaction indicator set is generated.

[0051] Specifically, for different labels in the trading indicator set, the recently updated and untrained new labels are undoubtedly more valuable for reference than the previously trained early labels, and are therefore given higher weights. For the early labels that failed to be classified and those that succeeded in classification, the former are undoubtedly more valuable for reference, and are therefore given higher weights. By setting higher weights for the recently updated and historically failed labels, the recognition effect of the model on these high-weight labels can be improved in a targeted manner.

[0052] Optionally, the sub-suspect category library is updated as follows:

[0053] Determine a first sub-suspicion category of the user to be classified by using the suspect classification model; determine a new sub-suspicion category obtained by manually reviewing and correcting the first sub-suspicion category; and add the new sub-suspicion category to the sub-suspicion category library.

[0054] Specifically, the user label classification results of the model are manually reviewed. If the model classification is successful, it will not be modified, and a user situation report will be generated based on the model classification results. If the model classification fails, the classification result that failed to be classified will be replaced with the correct real result after manual review, and the correct real result will generate a user situation report. In the form of a user situation report, the user's real label is added to the historical label library. By manually reviewing the model classification results, the historical label library is updated to improve the accuracy and training value of the labels in the historical label library.

[0055] S260, determining the first performance indicator data of the target suspect classification model, and determining the second performance indicator data of the backup suspect classification model; the construction algorithm of the backup suspect classification model is different from the construction algorithm of the target suspect classification model; if the second performance indicator data is better than the first performance indicator data, the backup suspect classification model is selected as the new target suspect classification model.

[0056] Specifically, when constructing the target suspect classification model, candidate models with different neural network structures are constructed based on different algorithms at the same time. For multiple candidate models, the same labeled indicator data is used for training, and the candidate model with the best training result is used as the target suspect classification model, and the remaining candidate models are used as backup suspect classification models. For each retraining process of the target suspect classification model, the target suspect classification model and the backup suspect classification model are trained simultaneously based on the updated transaction indicator set, and the first performance indicator data after the target suspect classification model is trained and the second performance indicator data after the backup suspect classification model is trained are obtained through the parameter grid search of the algorithm. If the second performance indicator data is better than the first performance indicator data, the backup suspect classification model is selected as the new target suspect classification model for use and deployment. Otherwise, the trained target suspect classification model continues to be used. Since different network structure models have different classification capabilities for different labels, the fact that a certain neural network structure has the best processing capability for a certain batch of labels does not mean that this neural network model can maintain the relatively optimal processing capability for all subsequent batches of new labels. By using a backup model of a new neural network structure to replace the target model of the old neural network structure when necessary, the problem that a single neural network structure cannot effectively identify some labels is solved.

[0057] For example, Figure 2B This is a schematic diagram of a suspect classification model construction and update provided by another embodiment of the present invention. The suspect classification model in the risk control system is trained offline and then deployed online. During the online use, when it is detected that the update conditions are met, the suspect classification model is retrained and updated using the updated historical label library.

[0058] The embodiment of the present invention retrains the model based on the updated historical label library to improve the recognition effect of the model on new labels after retraining; when necessary, a backup model of the new neural network structure is used to replace the target model of the old neural network structure, thereby solving the problem that a single neural network structure cannot effectively recognize some labels.

[0059] Figure 3 A structural diagram of a new type of suspect classification model training device based on an indicator set is provided in another embodiment of the present invention. Figure 3 As shown, the device comprises:

[0060] The transaction indicator determination module 310 is used to obtain a preset transaction indicator set; wherein the transaction indicator set is determined by: obtaining at least two sub-suspicion categories in the sub-suspicion category library; based on the indicator calculation system, respectively determining the transaction indicators associated with the at least two sub-suspicion categories to obtain the transaction indicator set;

[0061] A transaction data extraction module 320, configured to extract transaction indicator data of a sample user from historical transaction data of the sample user using the transaction indicator set;

[0062] The classification model training module 330 is used to train a target suspect classification model using the transaction indicator data of the sample user and the sub-suspicion categories of the sample user.

[0063] The new type of suspect classification model training device based on an indicator set provided in the embodiment of the present invention can execute the new type of suspect classification model training method based on an indicator set provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0064] Optionally, the device further comprises:

[0065] An update condition judgment module, used to determine whether the target suspect classification model meets the update condition according to the actual performance index value of the suspect classification model;

[0066] The classification model updating module is used to update the transaction indicator set using the pre-updated sub-suspicion category library when the update conditions are met, and to retrain the target suspect classification model using the updated transaction indicator set.

[0067] Optionally, the update condition judgment module is specifically used to:

[0068] According to the classification results and manual review results of the target suspect classification model, determine the actual performance index value of the target suspect classification model; judge whether the actual performance index value of the target suspect classification model meets the target performance index value; if the actual performance index value of the target suspect classification model does not meet the target performance index value, determine that the target suspect classification model meets the update conditions.

[0069] Optionally, the classification model updating module is specifically used to:

[0070] If the updated transaction indicator set includes a recently updated sub-suspicion category and an early sub-suspicion category, a first weight is set for the recently updated sub-suspicion category, a second weight is set for the early sub-suspicion category, and the first weight is greater than the second weight; if the updated transaction indicator set includes a classification failure sub-suspicion category and a classification success sub-suspicion category, a third weight is set for the classification failure sub-suspicion category, a fourth weight is set for the classification success sub-suspicion category, and the third weight is greater than the fourth weight; based on each sub-suspicion category and the corresponding weight, an updated transaction indicator set is generated.

[0071] Optionally, the device further comprises a spare model replacement module, which is used to:

[0072] Determine the first performance indicator data of the target suspect classification model, and determine the second performance indicator data of the backup suspect classification model; the construction algorithm of the backup suspect classification model is different from the construction algorithm of the target suspect classification model; if the second performance indicator data is better than the first performance indicator data, the backup suspect classification model is selected as the new target suspect classification model.

[0073] The further described novel suspect classification model training device based on an indicator set may also execute the novel suspect classification model training method based on an indicator set provided by any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0074] Figure 4 A schematic diagram of the structure of an electronic device 40 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0075] like Figure 4 As shown, the electronic device 40 includes at least one processor 41, and a memory connected to the at least one processor 41, such as a read-only memory (ROM) 42, a random access memory (RAM) 43, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 41 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 42 or the computer program loaded from the storage unit 48 to the random access memory (RAM) 43. In the RAM 43, various programs and data required for the operation of the electronic device 40 can also be stored. The processor 41, the ROM 42, and the RAM 43 are connected to each other through a bus 44. An input / output (I / O) interface 45 is also connected to the bus 44.

[0076] A number of components in the electronic device 40 are connected to the I / O interface 45, including: an input unit 46, such as a keyboard, a mouse, etc.; an output unit 47, such as various types of displays, speakers, etc.; a storage unit 48, such as a disk, an optical disk, etc.; and a communication unit 49, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 49 allows the electronic device 40 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0077] The processor 41 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 41 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The processor 41 executes the various methods and processes described above, such as a new suspect classification model training method based on an indicator set.

[0078] In some embodiments, the new suspect classification model training method based on an indicator set may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 48. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 40 via the ROM 42 and / or the communication unit 49. When the computer program is loaded into the RAM 43 and executed by the processor 41, one or more steps of the new suspect classification model training method based on the indicator set described above may be performed. Alternatively, in other embodiments, the processor 41 may be configured to execute the new suspect classification model training method based on the indicator set in any other appropriate manner (e.g., by means of firmware).

[0079] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0080] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0081] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0082] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0083] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0084] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0085] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0086] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A new method for training a suspect classification model based on an indicator set, comprising: Obtaining a preset transaction indicator set; wherein the transaction indicator set is determined by: obtaining at least two sub-suspicion categories in a sub-suspicion category library; and determining transaction indicators associated with the at least two sub-suspicion categories based on an indicator calculation system to obtain a transaction indicator set; Extracting transaction indicator data of the sample user from the historical transaction data of the sample user using the transaction indicator set; Using the transaction indicator data of sample users and the sub-suspect categories of sample users, the target suspect classification model is trained; Wherein, after the training target suspect classification model, the method further includes: Determining whether the target suspect classification model meets an update condition according to an actual performance indicator value of the target suspect classification model; When the update condition is met, the transaction indicator set is updated using the pre-updated sub-suspicion category library, and the target suspect classification model is retrained using the updated transaction indicator set; The sub-suspect category library is updated through the following process: Determining a first sub-suspicion category of the user to be classified by using the suspect classification model; Determining a new sub-suspect category obtained by manually reviewing and correcting the first sub-suspect category; Adding the new sub-suspect category to the sub-suspect category library; The updating of the transaction indicator set using the pre-updated sub-suspicion category library includes: If the updated transaction indicator set includes a recently updated suspicious sub-category and an early suspicious sub-category, a first weight is set for the recently updated suspicious sub-category, and a second weight is set for the early suspicious sub-category, wherein the first weight is greater than the second weight; If the updated transaction indicator set includes a classification failure sub-suspicion category and a classification success sub-suspicion category, a third weight is set for the classification failure sub-suspicion category, a fourth weight is set for the classification success sub-suspicion category, and the third weight is greater than the fourth weight; Based on each sub-suspicion category and the corresponding weight, an updated transaction indicator set is generated.

2. The method according to claim 1, characterized in that The determining whether the suspect classification model meets the update condition according to the actual performance indicator value of the target suspect classification model includes: Determining an actual performance index value of the target suspect classification model according to the classification result of the target suspect classification model and the manual review result; Determining whether the actual performance index value of the target suspect classification model meets the target performance index value; If the actual performance index value of the target suspect classification model does not meet the target performance index value, it is determined that the target suspect classification model meets the update condition.

3. The method according to claim 1, characterized in that After retraining the target suspect classification model using the updated transaction indicator set, the method further includes: Determining first performance indicator data of the target suspect classification model, and determining second performance indicator data of the candidate suspect classification model; the construction algorithm of the candidate suspect classification model is different from the construction algorithm of the target suspect classification model; If the second performance indicator data is better than the first performance indicator data, the candidate suspect classification model is selected as a new target suspect classification model.

4. A new type of suspect classification model training device based on an indicator set, comprising: A transaction indicator determination module, used to obtain a preset transaction indicator set; wherein the transaction indicator set is determined by: obtaining at least two sub-suspicion categories in the sub-suspicion category library; based on the indicator calculation system, respectively determining the transaction indicators associated with the at least two sub-suspicion categories to obtain the transaction indicator set; A transaction data extraction module, configured to extract transaction indicator data of a sample user from historical transaction data of the sample user using the transaction indicator set; A classification model training module, for training a target suspect classification model using transaction indicator data of sample users and sub-suspect categories of sample users; Wherein, the device further comprises: An update condition judgment module, used to determine whether the target suspect classification model meets the update condition according to the actual performance index value of the suspect classification model; A classification model updating module, configured to update the transaction indicator set using the pre-updated sub-suspicion category library when an update condition is met, and to retrain the target suspect classification model using the updated transaction indicator set; The sub-suspect category library is updated through the following process: Determining a first sub-suspicion category of the user to be classified by using the suspect classification model; Determining a new sub-suspect category obtained by manually reviewing and correcting the first sub-suspect category; Adding the new sub-suspect category to the sub-suspect category library; Among them, the classification model updating module is specifically used to: if the updated transaction indicator set includes a recently updated sub-suspicion category and an early sub-suspicion category, then set a first weight for the recently updated sub-suspicion category, set a second weight for the early sub-suspicion category, and the first weight is greater than the second weight; if the updated transaction indicator set includes a classification failure sub-suspicion category and a classification success sub-suspicion category, then set a third weight for the classification failure sub-suspicion category, set a fourth weight for the classification success sub-suspicion category, and the third weight is greater than the fourth weight; based on each sub-suspicion category and the corresponding weight, generate an updated transaction indicator set.

5. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the new suspect classification model training method based on an indicator set as described in any one of claims 1-4.

6. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the new suspect classification model training method based on an indicator set as described in any one of claims 1 to 4 when executed.

Images