Account monitoring method, device, equipment and storage medium

Abstract

The present invention discloses an account monitoring method, device, equipment and storage medium. The method comprises: obtaining account data to be monitored; inputting the account data to be monitored into a monitoring fusion model, and obtaining a target account abnormal probability and a target account abnormal label corresponding to the account data to be monitored, wherein the monitoring fusion model comprises: a state feature model, a product feature model, an event feature model, a derivative feature model, a target XGBoost model and a target logistic regression model, wherein the state feature model, the product feature model, the event feature model and the derivative feature model are obtained by iteratively training a target model set with a first data sample set, the target XGBoost model is obtained by iteratively training an XGBoost model with the first data sample set, and the target logistic regression model is obtained by iteratively training a logistic regression model with a second data sample set, and the technical solution of the present invention can solve the problems of time lag and insufficient business interpretability.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of computer technology, and in particular to an account monitoring method, device, equipment and storage medium. Background Art

[0002] Among the existing bank account monitoring methods, one type is a rule-based monitoring method that sorts out relevant monitoring rules and manually sets relevant thresholds for early warning based on business experience, risk cases and regulatory requirements. Due to the high proportion of manual participation and historical experience, this type of method has weak prevention capabilities for new types of electronic fraud and has a certain time lag; the other type is based on existing black samples inside and outside the bank, combined with account feature indicators, input into the machine learning model for training and prediction, and outputs relevant probabilities. Since this type of model has different learning capabilities for various types of indicators and data for a single classifier, the final result has certain overfitting and underfitting problems; at the same time, due to the large number of features entering a model for training, the business interpretability of the final data results is insufficient, and it is impossible to further penetrate into the new type of electronic fraud case itself and conduct a certain degree of traceability. Summary of the invention

[0003] The embodiments of the present invention provide an account monitoring method, apparatus, device and storage medium, which can penetrate into multiple dimensions such as account opening, transaction, product, etc., use the underlying model that is most compatible with the data for processing, and use the upper-layer model for fusion at the top layer to solve the problems of time lag of the model and insufficient business interpretability.

[0004] In a first aspect, an embodiment of the present invention provides an account monitoring method, including:

[0005] Get the account data to be monitored;

[0006] The account data to be monitored is input into the monitoring fusion model to obtain the target account abnormal probability and the target account abnormal label corresponding to the account data to be monitored, wherein the monitoring fusion model includes: a state feature model, a product feature model, an event feature model, a derivative feature model, a target XGBoost model and a target logistic regression model, the state feature model, the product feature model, the event feature model and the derivative feature model are obtained by iteratively training the target model set with the first data sample set, the target XGBoost model is obtained by iteratively training the XGBoost model with the first data sample set, and the target logistic regression model is obtained by iteratively training the XGBoost model with the second data sample set. The first data sample set is obtained by iteratively training the logistic regression model according to the sample set, including: first state class feature data, first product class feature data, first event class feature data and first derivative class feature data; the second data sample set includes: account abnormality probability samples and account abnormality label samples output by the state class feature model, account type probability samples and account abnormality label samples output by the product class feature model, account abnormality probability samples and account abnormality label samples output by the event class feature model, account abnormality probability samples and account abnormality label samples output by the derivative class feature model, and account abnormality probability samples and account abnormality label samples output by the target XGBoost model.

[0007] Furthermore, the to-be-monitored account data is input into a monitoring fusion model to obtain target account abnormality probability and target account abnormality label corresponding to the to-be-monitored account data, including:

[0008] Inputting the to-be-monitored account data into a state-based feature model to obtain a first account abnormality probability and a first account abnormality label;

[0009] Inputting the to-be-monitored account data into a product feature model to obtain a second account abnormality probability and a second account abnormality label;

[0010] Inputting the to-be-monitored account data into an event-based feature model to obtain a third account abnormal probability and a third account abnormal label;

[0011] Inputting the to-be-monitored account data into a derivative feature model to obtain a fourth account abnormal probability and a fourth account abnormal label;

[0012] Input the monitored account data into the target XGBoost model to obtain the fifth account abnormal probability and the fifth account abnormal label;

[0013] The first account abnormal probability, the first account abnormal label, the second account abnormal probability, the second account abnormal label, the third account abnormal probability, the third account abnormal label, the fourth account abnormal probability, the fourth account abnormal label, the fifth account abnormal probability and the fifth account abnormal label are input into the target logistic regression model to obtain the target account abnormal probability and the target account abnormal label corresponding to the account data to be monitored.

[0014] Furthermore, before obtaining the account data to be monitored, it also includes:

[0015] Divide the historical data according to the business information to obtain first state type feature data, first product type feature data and first event type feature data;

[0016] Generate first derivative feature data according to the first state feature data, the first product feature data and the first event feature data;

[0017] The target model set is trained according to the first state-type feature data, the first product-type feature data, the first event-type feature data and the first derivative-type feature data to obtain a state-type feature model, a product-type feature model, an event-type feature model and a derivative-type feature model.

[0018] Further, the target model set is trained according to the first state feature data, the first product feature data, the first event feature data and the first derivative feature data to obtain a state feature model, a product feature model, an event feature model and a derivative feature model, including:

[0019] Inputting the first state feature data, the first product feature data, the first event feature data and the first derivative feature data into a first model set to obtain feature data scores, wherein the first model includes: at least one of an XGBoost model, a CatBoost model and an Lgbm model;

[0020] According to the feature data score, the first state feature data, the first product feature data, the first event feature data and the first derivative feature data are screened to obtain second state feature data, second product feature data, second event feature data and second derivative feature data;

[0021] Training the target model set according to the second state feature data, the second product feature data, the second event feature data, and the second derivative feature data to obtain a second model set, wherein the target model set includes: at least one of an XGBoost model, a CatBoost model, and an Lgbm model, an RF model, and an SVM model;

[0022] The models in the second model set are screened according to the evaluation indicators corresponding to the models in the second model set to obtain state-type feature models, product-type feature models, event-type feature models and derivative-type feature models.

[0023] Furthermore, before inputting the to-be-monitored account data into the target XGBoost model to obtain the fifth account abnormal probability and the fifth account abnormal label, the method further includes:

[0024] The XGBoost model is trained based on the fusion model algorithm to obtain the target XGBoost model.

[0025] Furthermore, the XGBoost model is trained based on the fusion model algorithm, and the target XGBoost model includes:

[0026] Training the XGBoost model according to the first state feature data, the first product feature data, the first event feature data, and the first derivative feature data to obtain a first XGBoost model;

[0027] Determining a parameter set according to the parameters of the first XGBoost model;

[0028] Generate at least one second XGBoost model according to the parameter set;

[0029] Extract at least one first sample set from the first state feature data, the first product feature data, the first event feature data, and the first derivative feature data;

[0030] Training the at least one second XGBoost model according to the at least one first sample set to obtain at least one third XGBoost model;

[0031] Perform model fusion on the at least one third XGBoost model to obtain a target XGBoost model.

[0032] Furthermore, it also includes:

[0033] If the first account abnormality probability is the highest among the first account abnormality probability, the second account abnormality probability, the third account abnormality probability and the fourth account abnormality probability, it is determined that the account status feature data is abnormal;

[0034] If the second account abnormality probability is the highest among the first account abnormality probability, the second account abnormality probability, the third account abnormality probability and the fourth account abnormality probability, it is determined that the product feature data is abnormal;

[0035] If the third account abnormality probability is the highest among the first account abnormality probability, the second account abnormality probability, the third account abnormality probability and the fourth account abnormality probability, it is determined that the event-type feature data is abnormal.

[0036] In a second aspect, an embodiment of the present invention further provides an account monitoring device, the device comprising:

[0037] The acquisition module is used to obtain the account data to be monitored;

[0038] A monitoring module is used to input the monitored account data into a monitoring fusion model to obtain the target account abnormal probability and target account abnormal label corresponding to the monitored account data, wherein the monitoring fusion model includes: a state feature model, a product feature model, an event feature model, a derivative feature model, a target XGBoost model and a target logistic regression model, wherein the state feature model, the product feature model, the event feature model and the derivative feature model are obtained by iteratively training a target model set with a first data sample set, the target XGBoost model is obtained by iteratively training an XGBoost model with the first data sample set, and the target logistic regression model is obtained by iteratively training an XGBoost model with the first data sample set. The result is obtained by iteratively training the logistic regression model with the second data sample set, wherein the first data sample set includes: first state class feature data, first product class feature data, first event class feature data and first derivative class feature data, and the second data sample set includes: account abnormality probability samples and account abnormality label samples output by the state class feature model, account type probability samples and account abnormality label samples output by the product class feature model, account abnormality probability samples and account abnormality label samples output by the event class feature model, account abnormality probability samples and account abnormality label samples output by the derivative class feature model, and account abnormality probability samples and account abnormality label samples output by the target XGBoost model.

[0039] In a third aspect, an embodiment of the present invention further provides a computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, an account monitoring method as described in any one of the embodiments of the present invention is implemented.

[0040] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements an account monitoring method as described in any one of the embodiments of the present invention.

[0041] The embodiment of the present invention obtains the account data to be monitored; inputs the account data to be monitored into a monitoring fusion model to obtain the target account abnormality probability and the target account abnormality label corresponding to the account data to be monitored, wherein the monitoring fusion model includes: a state feature model, a product feature model, an event feature model, a derivative feature model, a target XGBoost model and a target logistic regression model, the state feature model, the product feature model, the event feature model and the derivative feature model are obtained by iteratively training the target model set with a first data sample set, the target XGBoost model is obtained by iteratively training the XGBoost model with the first data sample set, and the target logistic regression model is obtained by iteratively training the logistic regression model with a second data sample set, and the first data sample set includes: A state-type feature data, a first product-type feature data, a first event-type feature data and a first derivative-type feature data, wherein the second data sample set includes: an account abnormality probability sample and an account abnormality label sample output by the state-type feature model, an account type probability sample and an account abnormality label sample output by the product-type feature model, an account abnormality probability sample and an account abnormality label sample output by the event-type feature model, an account abnormality probability sample and an account abnormality label sample output by the derivative-type feature model, and an account abnormality probability sample and an account abnormality label sample output by the target XGBoost model, which can penetrate into multiple dimensions such as account opening, transaction, and product, and use the underlying model that is most compatible with this type of data for processing, and use the upper-level model for fusion at the top level to solve problems such as model time lag and insufficient business interpretability. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments are briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.

[0043] Figure 1a is a flow chart of an account monitoring method in an embodiment of the present invention;

[0044] Figure 1b is a training flow chart of the target XGBoost model in an embodiment of the present invention;

[0045] Figure 1c is a diagram of a monitoring fusion model in an embodiment of the present invention;

[0046] Figure 2 is a structural diagram of an account monitoring device in an embodiment of the present invention;

[0047] Figure 3 is a schematic structural diagram of an electronic device in an embodiment of the present invention;

[0048] Figure 4 It is a schematic diagram of the structure of a computer-readable storage medium containing a computer program in an embodiment of the present invention. DETAILED DESCRIPTION

[0049] The present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the present invention, rather than to limit the present invention. It should also be noted that, for ease of description, only the parts related to the present invention, rather than all structures, are shown in the accompanying drawings. In addition, the embodiments of the present invention and the features in the embodiments may be combined with each other without conflict.

[0050] It should be mentioned before discussing exemplary embodiments in more detail that some exemplary embodiments are described as processes or methods depicted as flow charts. Although the flow charts describe various operations (or steps) as sequential processes, many operations therein can be implemented in parallel, concurrently or simultaneously. In addition, the order of various operations can be rearranged. The process can be terminated when its operation is completed, but can also have additional steps not included in the accompanying drawings. The process can correspond to methods, functions, procedures, subroutines, subprograms, etc. In addition, the embodiments in the present invention and the features in the embodiments can be combined with each other without conflict.

[0051] The term “including” and its variations used in the present invention are open inclusions, that is, “including but not limited to.” The term “based on” means “based at least in part on.” The term “one embodiment” means “at least one embodiment.”

[0052] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings. At the same time, in the description of the present invention, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0053] The acquisition, storage, use, and processing of data in the technical solution of this application comply with the relevant provisions of national laws and regulations.

[0054] Figure 1a A flowchart of an account monitoring method provided by an embodiment of the present invention. This embodiment is applicable to account monitoring. The method can be executed by an account monitoring device in an embodiment of the present invention. The account monitoring device can be implemented in software and / or hardware. Figure 1a As shown, the method specifically comprises the following steps:

[0055] S110, obtaining the account data to be monitored.

[0056] The account data to be monitored may be the acquired data corresponding to the account to be monitored, and the account data to be monitored is the data set to be public by the account A to be monitored.

[0057] S120, inputting the to-be-monitored account data into a monitoring fusion model to obtain a target account abnormal probability and a target account abnormal label corresponding to the to-be-monitored account data.

[0058] Among them, the monitoring fusion model includes: a state-class feature model, a product-class feature model, an event-class feature model, a derivative-class feature model, a target XGBoost model and a target logistic regression model. The state-class feature model, product-class feature model, event-class feature model and derivative-class feature model are obtained by iteratively training the target model set with the first data sample set, the target XGBoost model is obtained by iteratively training the XGBoost model with the first data sample set, and the target logistic regression model is obtained by iteratively training the logistic regression model with the second data sample set. The first data sample set includes: first state-class feature data, first product-class feature data, first event-class feature data and first derivative-class feature data.

[0059] The first data sample set includes: first state-type characteristic data, first product-type characteristic data, first event-type characteristic data and first derivative-type characteristic data. The first state-type characteristic data includes: account, state-type characteristic data and whether the account is abnormal; the first product-type characteristic data includes: account, product-type characteristic data and whether the account is abnormal; the first event-type characteristic data includes: account, event-type characteristic data and whether the account is abnormal. The first derivative-type characteristic data is data generated based on the first state-type characteristic data, the first product-type characteristic data and the first event-type characteristic data. The first derivative-type characteristic data can be generated by performing some technical derivation on the first state-type characteristic data, the first product-type characteristic data and the first event-type characteristic data, such as sorting technology and crossover technology.

[0060] Among them, the second data sample set includes: account anomaly probability samples and account anomaly label samples output by the state feature model, account type probability samples and account anomaly label samples output by the product feature model, account anomaly probability samples and account anomaly label samples output by the event feature model, account anomaly probability samples and account anomaly label samples output by the derivative feature model, and account anomaly probability samples and account anomaly label samples output by the target XGBoost model.

[0061] Among them, the account anomaly probability samples and account anomaly label samples output by the state-type feature model are the account anomaly probability and account anomaly label obtained by inputting any one of the first state-type feature data, the first product-type feature data, the first event-type feature data and the first derivative-type feature data into the state-type feature model after the state-type feature model is trained, and whether the account included in the input data is abnormal.

[0062] Among them, the account type probability samples and account abnormality label samples output by the product feature model are obtained by inputting any one of the first state feature data, the first product feature data, the first event feature data and the first derivative feature data into the product feature model after the product feature model is trained, and the account abnormality probability and account abnormality label, as well as whether the account included in the input data is abnormal.

[0063] Among them, the account type probability samples and account anomaly label samples output by the event-type feature model are obtained by inputting any one of the first state-type feature data, the first product-type feature data, the first event-type feature data and the first derivative-type feature data into the event-type feature model after the event-type feature model is trained, and the account anomaly probability and account anomaly label, as well as whether the account included in the input data is abnormal, are obtained.

[0064] Among them, the account type probability samples and account abnormality label samples output by the derivative feature model are obtained by inputting any one of the first state feature data, the first product feature data, the first event feature data and the first derivative feature data into the derivative feature model after the derivative feature model is trained, and the account abnormality probability and account abnormality label, as well as whether the account included in the input data is abnormal, are obtained.

[0065] Among them, the account type probability samples and account anomaly label samples output by the target XGBoost model are the account anomaly probabilities and account anomaly labels obtained by inputting any one of the first state class feature data, the first product class feature data, the first event class feature data and the first derivative class feature data into the target XGBoost model after the target XGBoost model is trained, and whether the account included in the input data is abnormal.

[0066] Specifically, the method of inputting the account data to be monitored into the monitoring fusion model to obtain the target account abnormality probability and the target account abnormality label corresponding to the account data to be monitored can be: inputting the account data to be monitored into the state-type feature model to obtain the first account abnormality probability and the first account abnormality label; inputting the account data to be monitored into the product-type feature model to obtain the second account abnormality probability and the second account abnormality label; inputting the account data to be monitored into the event-type feature model to obtain the third account abnormality probability and the third account abnormality label; inputting the account data to be monitored into the derivative-type feature model to obtain the fourth account abnormality probability and the fourth account abnormality label; inputting the account data to be monitored into the target XGBoost model to obtain the fifth account abnormality probability and the fifth account abnormality label; inputting the first account abnormality probability, the first account abnormality label, the second account abnormality probability, the second account abnormality label, the third account abnormality probability, the third account abnormality label, the fourth account abnormality probability, the fourth account abnormality label, the fifth account abnormality probability and the fifth account abnormality label into the target logistic regression model to obtain the target account abnormality probability and the target account abnormality label corresponding to the account data to be monitored.

[0067] Optionally, inputting the to-be-monitored account data into a monitoring fusion model to obtain a target account abnormal probability and a target account abnormal label corresponding to the to-be-monitored account data includes:

[0068] Inputting the to-be-monitored account data into a state-based feature model to obtain a first account abnormality probability and a first account abnormality label;

[0069] Inputting the to-be-monitored account data into a product feature model to obtain a second account abnormality probability and a second account abnormality label;

[0070] Inputting the to-be-monitored account data into an event-based feature model to obtain a third account abnormal probability and a third account abnormal label;

[0071] Inputting the to-be-monitored account data into a derivative feature model to obtain a fourth account abnormal probability and a fourth account abnormal label;

[0072] Input the monitored account data into the target XGBoost model to obtain the fifth account abnormal probability and the fifth account abnormal label;

[0073] The first account abnormal probability, the first account abnormal label, the second account abnormal probability, the second account abnormal label, the third account abnormal probability, the third account abnormal label, the fourth account abnormal probability, the fourth account abnormal label, the fifth account abnormal probability and the fifth account abnormal label are input into the target logistic regression model to obtain the target account abnormal probability and the target account abnormal label corresponding to the account data to be monitored.

[0074] Optionally, before obtaining the account data to be monitored, the following steps are also included:

[0075] Divide the historical data according to the business information to obtain first state type feature data, first product type feature data and first event type feature data;

[0076] Generate first derivative feature data according to the first state feature data, the first product feature data and the first event feature data;

[0077] The target model set is trained according to the first state-type feature data, the first product-type feature data, the first event-type feature data and the first derivative-type feature data to obtain a state-type feature model, a product-type feature model, an event-type feature model and a derivative-type feature model.

[0078] Among them, the method of generating the first derivative type feature data according to the first state type feature data, the first product type feature data and the first event type feature data can be by performing feature engineering processing on the first state type feature data, the first product type feature data and the first event type feature data to obtain the first derivative type feature data.

[0079] Specifically, the target model set is trained according to the first state feature data, the first product feature data, the first event feature data and the first derivative feature data to obtain the state feature model, the product feature model, the event feature model and the derivative feature model by: inputting the first state feature data, the first product feature data, the first event feature data and the first derivative feature data into three models, XGBoost, CatBoost and Lgbm, respectively, to obtain the importance score of the feature data relative to the account anomaly; sorting the feature data according to the importance score of the feature data relative to the account anomaly, and taking the union of the top 30% of the feature data. The target model set is trained according to the filtered data training to obtain the state feature model, the product feature model, the event feature model and the derivative feature model.

[0080] Optionally, training a target model set according to the first state feature data, the first product feature data, the first event feature data and the first derivative feature data to obtain a state feature model, a product feature model, an event feature model and a derivative feature model includes:

[0081] Inputting the first state feature data, the first product feature data, the first event feature data and the first derivative feature data into a first model set to obtain feature data scores, wherein the first model includes: at least one of an XGBoost model, a CatBoost model and an Lgbm model;

[0082] According to the feature data score, the first state feature data, the first product feature data, the first event feature data and the first derivative feature data are screened to obtain second state feature data, second product feature data, second event feature data and second derivative feature data;

[0083] Training the target model set according to the second state feature data, the second product feature data, the second event feature data, and the second derivative feature data to obtain a second model set, wherein the target model set includes: at least one of an XGBoost model, a CatBoost model, and an Lgbm model, an RF model, and an SVM model;

[0084] The models in the second model set are screened according to the evaluation indicators corresponding to the models in the second model set to obtain state-type feature models, product-type feature models, event-type feature models and derivative-type feature models.

[0085] Among them, the first model set may include: at least one of the three models of XGBoost, CatBoost and Lgbm. Specifically, the number of models included in the target model set is strongly correlated with the number of first derivative class feature data. If the number of first derivative class feature data is greater than the quantity threshold, the target model set includes: XGBoost, CatBoost and Lgbm models.

[0086] Specifically, the first state-type feature data, the first product-type feature data, the first event-type feature data and the first derivative-type feature data are respectively input into the three models of XGBoost, CatBoost and Lgbm to obtain the importance score of the feature data relative to the account anomaly; the feature data are sorted according to the importance score of the feature data relative to the account anomaly, and the first 30% of the sorted feature data are taken as the union to obtain the second state-type feature data, the second product-type feature data, the second event-type feature data and the second derivative-type feature data.

[0087] Specifically, the target model set is trained according to the second state feature data, the second product feature data, the second event feature data and the second derivative feature data to obtain the second model set. For example, each of the state features, product features, event features and derivative features is trained using XGBoost, CatBoost and Lgbm, RF, SVM to obtain 20 models and the account abnormality probability, account abnormality label, AUC and KS value output by each model, and the optimal model under the four features is obtained by screening according to the AUC and KS values, namely, the state feature model, the product feature model, the event feature model and the derivative feature model.

[0088] Optionally, before inputting the to-be-monitored account data into the target XGBoost model to obtain the fifth account abnormal probability and the fifth account abnormal label, the method further includes:

[0089] The XGBoost model is trained based on the fusion model algorithm to obtain the target XGBoost model.

[0090] Optionally, train an XGBoost model based on the fusion model algorithm to obtain a target XGBoost model including:

[0091] Training the XGBoost model according to the first state feature data, the first product feature data, the first event feature data, and the first derivative feature data to obtain a first XGBoost model;

[0092] Determining a parameter set according to the parameters of the first XGBoost model;

[0093] Generate at least one second XGBoost model according to the parameter set;

[0094] Extract at least one first sample set from the first state feature data, the first product feature data, the first event feature data, and the first derivative feature data;

[0095] Training the at least one second XGBoost model according to the at least one first sample set to obtain at least one third XGBoost model;

[0096] Perform model fusion on the at least one third XGBoost model to obtain a target XGBoost model.

[0097] In a specific example, Figure 1b As shown in the figure, to train the bagging XGBoost model, first train the XGBoost model for all features, determine a set of optimal parameters, let these parameters fluctuate randomly within a certain small range, randomly sample the features, train multiple XGBoost models for bagging, and finally use the mean or 1 / rank method to fuse the results to improve the differences in model parameters and features and the overall stability of the model.

[0098] Optionally, also include:

[0099] If the first account abnormality probability is the highest among the first account abnormality probability, the second account abnormality probability, the third account abnormality probability and the fourth account abnormality probability, it is determined that the account status feature data is abnormal;

[0100] If the second account abnormality probability is the highest among the first account abnormality probability, the second account abnormality probability, the third account abnormality probability and the fourth account abnormality probability, it is determined that the product feature data is abnormal;

[0101] If the third account abnormality probability is the highest among the first account abnormality probability, the second account abnormality probability, the third account abnormality probability and the fourth account abnormality probability, it is determined that the event-type feature data is abnormal.

[0102] In a specific example, according to the actual business situation and data situation of the bank, feature engineering processing is carried out, and the data is divided into first state feature data (basic information of the account, account opening situation, account status, etc.), first product feature data (product purchase situation, number of holdings, customer level, etc.), first event feature data (transaction events, consumption flow, login flow) and first derivative feature data according to its different types. The embedding method is used to screen the first state feature data, the first product feature data, the first event feature data and the first derivative feature data, and the three models of XGBoost, CatBoost and Lgbm are trained according to the full amount of features. The features of the top 30% of the feature importance ranking of each model are taken as the union set to obtain the second state feature data, the second product feature data, the second event feature data and the second derivative feature data. XGBoost, CatBoost, Lgbm, RF, and SVM were used to train the second state feature data, the second product feature data, the second event feature data, and the second derivative feature data. 20 models and the account abnormality probability, account abnormality label, AUC, and KS values ​​output by each model were obtained. The optimal models under the four types of feature data were obtained by screening based on AUC and KS, namely, the state feature model, the product feature model, the event feature model, and the derivative feature model. Figure 1cAs shown in the figure, the target XGBoost model (Baging XGB) is blended with the state feature model m1, product feature model m2, event feature model m3 and derivative feature model m4, and the account anomaly probability pred and account anomaly label y generated by each model are input into the upper model. The upper model selects the target logistic regression model, trains y and pred generated by each model, and predicts the data set to obtain the results y0 and p0 of the fusion model, as well as the account anomaly labels y1, y2, y3, y4 output by the intermediate models state feature model m1, product feature model m2, event feature model m3 and derivative feature model m4 and the account anomaly probabilities p1, p2, p3, p4 output by the state feature model m1, product feature model m2, event feature model m3 and derivative feature model m4. The business scenario can be judged according to p1, p2, p3, p4 (for example, a higher p3 means a higher transaction anomaly and capital link anomaly), and the risk probability can be judged according to p0, thereby reducing manual intervention and improving business explainability. The model and parameters can be adjusted later according to the business scenario type.

[0103] The technical solution of this embodiment is to obtain the account data to be monitored; input the account data to be monitored into the monitoring fusion model to obtain the target account abnormality probability and the target account abnormality label corresponding to the account data to be monitored, wherein the monitoring fusion model includes: a state feature model, a product feature model, an event feature model, a derivative feature model, a target XGBoost model and a target logistic regression model, the state feature model, the product feature model, the event feature model and the derivative feature model are obtained by iteratively training the target model set with the first data sample set, the target XGBoost model is obtained by iteratively training the XGBoost model with the first data sample set, and the target logistic regression model is obtained by iteratively training the logistic regression model with the second data sample set, and the first data sample set includes : first state-type feature data, first product-type feature data, first event-type feature data and first derivative-type feature data, the second data sample set includes: account abnormality probability samples and account abnormality label samples output by the state-type feature model, account type probability samples and account abnormality label samples output by the product-type feature model, account abnormality probability samples and account abnormality label samples output by the event-type feature model, account abnormality probability samples and account abnormality label samples output by the derivative-type feature model, and account abnormality probability samples and account abnormality label samples output by the target XGBoost model, which can penetrate into multiple dimensions such as account opening, transaction, product, etc., and use the underlying model that is most compatible with this type of data for processing, and use the upper-level model for fusion at the top level to solve problems such as model time lag and insufficient business interpretability.

[0104] Figure 2 This is a schematic diagram of the structure of an account monitoring device provided by an embodiment of the present invention. This embodiment is applicable to the case of account monitoring. The device can be implemented in software and / or hardware. The device can be integrated in any device that provides an account monitoring function, such as Figure 2 As shown, the account monitoring device specifically includes: an acquisition module 210 and a monitoring module 220.

[0105] Among them, the acquisition module is used to obtain the account data to be monitored;

[0106] A monitoring module is used to input the monitored account data into a monitoring fusion model to obtain the target account abnormal probability and target account abnormal label corresponding to the monitored account data, wherein the monitoring fusion model includes: a state feature model, a product feature model, an event feature model, a derivative feature model, a target XGBoost model and a target logistic regression model, wherein the state feature model, the product feature model, the event feature model and the derivative feature model are obtained by iteratively training a target model set with a first data sample set, the target XGBoost model is obtained by iteratively training an XGBoost model with the first data sample set, and the target logistic regression model is obtained by iteratively training an XGBoost model with the first data sample set. The result is obtained by iteratively training the logistic regression model with the second data sample set, wherein the first data sample set includes: first state class feature data, first product class feature data, first event class feature data and first derivative class feature data, and the second data sample set includes: account abnormality probability samples and account abnormality label samples output by the state class feature model, account type probability samples and account abnormality label samples output by the product class feature model, account abnormality probability samples and account abnormality label samples output by the event class feature model, account abnormality probability samples and account abnormality label samples output by the derivative class feature model, and account abnormality probability samples and account abnormality label samples output by the target XGBoost model.

[0107] The above-mentioned product can execute the method provided by any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0108] The technical solution of this embodiment is to obtain the account data to be monitored; input the account data to be monitored into the monitoring fusion model to obtain the target account abnormality probability and the target account abnormality label corresponding to the account data to be monitored, wherein the monitoring fusion model includes: a state feature model, a product feature model, an event feature model, a derivative feature model, a target XGBoost model and a target logistic regression model, the state feature model, the product feature model, the event feature model and the derivative feature model are obtained by iteratively training the target model set with the first data sample set, the target XGBoost model is obtained by iteratively training the XGBoost model with the first data sample set, and the target logistic regression model is obtained by iteratively training the logistic regression model with the second data sample set, and the first data sample set includes : first state-type feature data, first product-type feature data, first event-type feature data and first derivative-type feature data, the second data sample set includes: account abnormality probability samples and account abnormality label samples output by the state-type feature model, account type probability samples and account abnormality label samples output by the product-type feature model, account abnormality probability samples and account abnormality label samples output by the event-type feature model, account abnormality probability samples and account abnormality label samples output by the derivative-type feature model, and account abnormality probability samples and account abnormality label samples output by the target XGBoost model, which can penetrate into multiple dimensions such as account opening, transaction, product, etc., and use the underlying model that is most compatible with this type of data for processing, and use the upper-level model for fusion at the top level to solve problems such as model time lag and insufficient business interpretability.

[0109] Figure 3 FIG. 4 is a schematic diagram of the structure of an electronic device in an embodiment of the present invention. Figure 3 A block diagram of an exemplary electronic device 12 suitable for use in implementing embodiments of the present invention is shown. Figure 3 The electronic device 12 shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0110] like Figure 3 As shown, the electronic device 12 is in the form of a general purpose computing device. The components of the electronic device 12 may include, but are not limited to: one or more processors or processing units 16, a system memory 28, and a bus 18 that connects various system components (including the system memory 28 and the processing unit 16).

[0111] Bus 18 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor, or a local bus using any of a variety of bus architectures. For example, these architectures include, but are not limited to, Industry Standard Architecture (ISA) bus, Micro Channel Architecture (MCA) bus, Enhanced ISA bus, Video Electronics Standards Association (VESA) local bus, and Peripheral Component Interconnect (PCI) bus.

[0112] The electronic device 12 typically includes a variety of computer system readable media. These media can be any available media that can be accessed by the electronic device 12, including volatile and non-volatile media, removable and non-removable media.

[0113] The system memory 28 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 30 and / or cache memory 32. The electronic device 12 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, the storage system 34 may be used to read and write non-removable, non-volatile magnetic media ( Figure 3 not shown, usually called a "hard drive"). Although Figure 3 Not shown in the figure, a disk drive for reading and writing a removable non-volatile disk (e.g., a "floppy disk"), and an optical disk drive for reading and writing a removable non-volatile optical disk (Compact Disc-Read Only Memory, CD-ROM, Digital Video Disc-Read Only Memory, DVD-ROM, or other optical media) may be provided. In these cases, each drive may be connected to the bus 18 via one or more data medium interfaces. The system memory 28 may include at least one program product having a set (e.g., at least one) of program modules that are configured to perform the functions of various embodiments of the present invention.

[0114] A program / utility 40 having a set (at least one) of program modules 42 may be stored, for example, in system memory 28, such program modules 42 including, but not limited to, an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment. Program modules 42 generally perform the functions and / or methods of the embodiments described herein.

[0115] The electronic device 12 may also communicate with one or more external devices 14 (e.g., keyboard, pointing device, display 24, etc.), and may also communicate with one or more devices that enable a user to interact with the electronic device 12, and / or communicate with any device that enables the electronic device 12 to communicate with one or more other computing devices (e.g., network card, modem, etc.). Such communication may be performed through an input / output (I / O) interface 22. In addition, the electronic device 12 in this embodiment, the display 24 does not exist as an independent individual, but is embedded in the mirror surface. When the display surface of the display 24 is not displayed, the display surface of the display 24 and the mirror surface are visually integrated. In addition, the electronic device 12 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN) and / or a public network, such as the Internet) through a network adapter 20. As shown in the figure, the network adapter 20 communicates with other modules of the electronic device 12 through a bus 18. It should be understood that although not shown in the figures, other hardware and / or software modules may be used in conjunction with the electronic device 12, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, disk arrays (Redundant Arrays of Independent Disks, RAID) systems, tape drives, and data backup storage systems.

[0116] The processing unit 16 executes various functional applications and data processing by running the programs stored in the system memory 28, for example, implementing the account monitoring method provided in the embodiment of the present invention:

[0117] Get the account data to be monitored;

[0118] The account data to be monitored is input into the monitoring fusion model to obtain the target account abnormal probability and the target account abnormal label corresponding to the account data to be monitored, wherein the monitoring fusion model includes: a state feature model, a product feature model, an event feature model, a derivative feature model, a target XGBoost model and a target logistic regression model, the state feature model, the product feature model, the event feature model and the derivative feature model are obtained by iteratively training the target model set with the first data sample set, the target XGBoost model is obtained by iteratively training the XGBoost model with the first data sample set, and the target logistic regression model is obtained by iteratively training the XGBoost model with the second data sample set. The first data sample set is obtained by iteratively training the logistic regression model according to the sample set, including: first state class feature data, first product class feature data, first event class feature data and first derivative class feature data; the second data sample set includes: account abnormality probability samples and account abnormality label samples output by the state class feature model, account type probability samples and account abnormality label samples output by the product class feature model, account abnormality probability samples and account abnormality label samples output by the event class feature model, account abnormality probability samples and account abnormality label samples output by the derivative class feature model, and account abnormality probability samples and account abnormality label samples output by the target XGBoost model.

[0119] Figure 4 The present invention provides a computer-readable storage medium 61 on which a computer program 610 is stored. When the program is executed by one or more processors, the account monitoring method provided in all the embodiments of the present invention is implemented:

[0120] Get the account data to be monitored;

[0121] The account data to be monitored is input into the monitoring fusion model to obtain the target account abnormal probability and the target account abnormal label corresponding to the account data to be monitored, wherein the monitoring fusion model includes: a state feature model, a product feature model, an event feature model, a derivative feature model, a target XGBoost model and a target logistic regression model, the state feature model, the product feature model, the event feature model and the derivative feature model are obtained by iteratively training the target model set with the first data sample set, the target XGBoost model is obtained by iteratively training the XGBoost model with the first data sample set, and the target logistic regression model is obtained by iteratively training the XGBoost model with the second data sample set. The first data sample set is obtained by iteratively training the logistic regression model according to the sample set, including: first state class feature data, first product class feature data, first event class feature data and first derivative class feature data; the second data sample set includes: account abnormality probability samples and account abnormality label samples output by the state class feature model, account type probability samples and account abnormality label samples output by the product class feature model, account abnormality probability samples and account abnormality label samples output by the event class feature model, account abnormality probability samples and account abnormality label samples output by the derivative class feature model, and account abnormality probability samples and account abnormality label samples output by the target XGBoost model.

[0122] Any combination of one or more computer-readable media can be used. Computer-readable media can be computer-readable signal media or computer-readable storage media or any combination of the above two. Computer-readable storage media can be, for example, but not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or devices, or any combination of the above. More specific examples (non-exhaustive list) of computer-readable storage media include: electrical connections with one or more wires, portable computer disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), optical fibers, portable compact disk read-only memories (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the above. In this document, computer-readable storage media can be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device.

[0123] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, which carry computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0124] The program code embodied on the computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0125] In some embodiments, the client and the server may communicate using any currently known or future developed network protocol such as HTTP (Hyper Text Transfer Protocol), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0126] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0127] Computer program code for performing the operation of the present invention may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0128] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0129] The units involved in the embodiments described in the present disclosure may be implemented by software or hardware, wherein the name of a unit does not, in some cases, limit the unit itself.

[0130] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0131] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0132] Note that the above are only preferred embodiments of the present invention and the technical principles used. Those skilled in the art will understand that the present invention is not limited to the specific embodiments described herein, and that various obvious changes, readjustments and substitutions can be made by those skilled in the art without departing from the scope of protection of the present invention. Therefore, although the present invention has been described in more detail through the above embodiments, the present invention is not limited to the above embodiments, and may include more other equivalent embodiments without departing from the concept of the present invention, and the scope of the present invention is determined by the scope of the appended claims.

Claims

1. An account monitoring method, characterized in that: include: Get the account data to be monitored; The account data to be monitored is input into the monitoring fusion model to obtain the target account abnormal probability and the target account abnormal label corresponding to the account data to be monitored, wherein the monitoring fusion model includes: a state feature model, a product feature model, an event feature model, a derivative feature model, a target XGBoost model and a target logistic regression model, the state feature model, the product feature model, the event feature model and the derivative feature model are obtained by iteratively training the target model set with the first data sample set, the target XGBoost model is obtained by iteratively training the XGBoost model with the first data sample set, and the target logistic regression model is obtained by iteratively training the XGBoost model with the second data sample set. The first data sample set is obtained by iteratively training a logistic regression model according to the sample set, wherein the first data sample set includes: first state-type feature data, first product-type feature data, first event-type feature data, and first derivative-type feature data; the second data sample set includes: account abnormality probability samples and account abnormality label samples output by the state-type feature model, account type probability samples and account abnormality label samples output by the product-type feature model, account abnormality probability samples and account abnormality label samples output by the event-type feature model, account abnormality probability samples and account abnormality label samples output by the derivative-type feature model, and account abnormality probability samples and account abnormality label samples output by the target XGBoost model; Before obtaining the account data to be monitored, it also includes: Divide the historical data according to the business information to obtain the first state-type characteristic data, the first product-type characteristic data, and the first event-type characteristic data; Generate the first derivative feature data according to the first state feature data, the first product feature data and the first event feature data; Inputting the first state feature data, the first product feature data, the first event feature data and the first derivative feature data into a first model set to obtain feature data scores, wherein the first model includes: at least one of an XGBoost model, a CatBoost model and an Lgbm model; According to the feature data score, the first state feature data, the first product feature data, the first event feature data and the first derivative feature data are screened to obtain second state feature data, second product feature data, second event feature data and second derivative feature data; The target model set is trained according to the second state feature data, the second product feature data, the second event feature data and the second derivative feature data to obtain a second model set, wherein the target model set includes: at least one of an XGBoost model, a CatBoost model and an Lgbm model, an RF model and an SVM model; Screening the models in the second model set according to the evaluation indicators corresponding to the models in the second model set to obtain a state feature model, a product feature model, an event feature model, and a derivative feature model; The training method of the target XGBoost model is: training the XGBoost model according to the first state-class feature data, the first product-class feature data, the first event-class feature data and the first derivative-class feature data to obtain a first XGBoost model; determining a parameter set according to the parameters of the first XGBoost model; generating at least one second XGBoost model according to the parameter set; extracting at least one first sample set from the first state-class feature data, the first product-class feature data, the first event-class feature data and the first derivative-class feature data; training the at least one second XGBoost model according to the at least one first sample set to obtain at least one third XGBoost model; and performing model fusion on the at least one third XGBoost model to obtain the target XGBoost model.

2. The method according to claim 1, characterized in that Inputting the monitored account data into the monitoring fusion model to obtain the target account abnormal probability and target account abnormal label corresponding to the monitored account data includes: Inputting the to-be-monitored account data into a state-based feature model to obtain a first account abnormality probability and a first account abnormality label; Inputting the to-be-monitored account data into a product feature model to obtain a second account abnormality probability and a second account abnormality label; Inputting the to-be-monitored account data into an event-based feature model to obtain a third account abnormal probability and a third account abnormal label; Inputting the to-be-monitored account data into a derivative feature model to obtain a fourth account abnormal probability and a fourth account abnormal label; Input the monitored account data into the target XGBoost model to obtain the fifth account abnormal probability and the fifth account abnormal label; The first account abnormal probability, the first account abnormal label, the second account abnormal probability, the second account abnormal label, the third account abnormal probability, the third account abnormal label, the fourth account abnormal probability, the fourth account abnormal label, the fifth account abnormal probability and the fifth account abnormal label are input into the target logistic regression model to obtain the target account abnormal probability and the target account abnormal label corresponding to the account data to be monitored.

3. The method according to claim 1, characterized in that: Also includes: If the first account abnormality probability is the highest among the first account abnormality probability, the second account abnormality probability, the third account abnormality probability and the fourth account abnormality probability, it is determined that the account status feature data is abnormal; If the second account abnormality probability is the highest among the first account abnormality probability, the second account abnormality probability, the third account abnormality probability and the fourth account abnormality probability, it is determined that the product feature data is abnormal; If the third account abnormality probability is the highest among the first account abnormality probability, the second account abnormality probability, the third account abnormality probability and the fourth account abnormality probability, it is determined that the event-type feature data is abnormal.

4. An account monitoring device, the device being used to execute the method according to any one of claims 1 to 3, characterized in that: include: The acquisition module is used to obtain the account data to be monitored; A monitoring module is used to input the monitored account data into a monitoring fusion model to obtain the target account abnormal probability and target account abnormal label corresponding to the monitored account data, wherein the monitoring fusion model includes: a state feature model, a product feature model, an event feature model, a derivative feature model, a target XGBoost model and a target logistic regression model, wherein the state feature model, the product feature model, the event feature model and the derivative feature model are obtained by iteratively training a target model set with a first data sample set, the target XGBoost model is obtained by iteratively training an XGBoost model with the first data sample set, and the target logistic regression model is obtained by iteratively training an XGBoost model with the first data sample set. The result is obtained by iteratively training the logistic regression model with the second data sample set, wherein the first data sample set includes: first state class feature data, first product class feature data, first event class feature data and first derivative class feature data, and the second data sample set includes: account abnormality probability samples and account abnormality label samples output by the state class feature model, account type probability samples and account abnormality label samples output by the product class feature model, account abnormality probability samples and account abnormality label samples output by the event class feature model, account abnormality probability samples and account abnormality label samples output by the derivative class feature model, and account abnormality probability samples and account abnormality label samples output by the target XGBoost model.

5. An electronic device, characterized in that: include: one or more processors; A memory for storing one or more programs; When the one or more programs are executed by the one or more processors, the processors are enabled to implement the method according to any one of claims 1 to 3.

6. A computer-readable storage medium containing a computer program, wherein the computer program is stored thereon, characterized in that: When the program is executed by one or more processors, the method according to any one of claims 1 to 3 is implemented.

Images