Keyword processing method and device, electronic equipment, and storage medium

Abstract

The application discloses a keyword processing method and device, electronic equipment and a storage medium. The method comprises the following steps: obtaining a plurality of message files, extracting keywords and event types from the plurality of message files, obtaining an event type associated with each keyword, and the number of message files corresponding to each keyword under the associated event type; determining a target event type corresponding to each keyword based on the number of message files corresponding to each keyword under the associated event type; calculating a target risk value of each keyword under the corresponding target event type based on the number of message files corresponding to each keyword under the associated event type; and using the keyword whose target risk value is higher than a threshold value to determine the keyword label of the message file. The method can improve the efficiency and accuracy of determining the target risk value of the keyword under the target event type, and improve the efficiency and accuracy of determining the keyword label of the message file.

Description

Technical Field

[0001] This application relates to the field of computer technology, and more specifically, to a method, apparatus, electronic device, and storage medium for processing keywords. Background Technology

[0002] In the financial industry, determining the risk value of keywords under corresponding event types helps auditors quickly and comprehensively uncover potential risks in suspicious transactions during the review process. Currently, related technologies primarily rely on manual methods to determine the risk value of keywords under corresponding event types. However, manual methods suffer from low efficiency and high subjectivity, leading to both low efficiency and poor accuracy in determining the risk value of keywords under corresponding event types. Summary of the Invention

[0003] In view of the above problems, embodiments of this application propose a keyword processing method, apparatus, electronic device, and storage medium to improve the above problems.

[0004] In a first aspect, embodiments of this application provide a keyword processing method, the method comprising: acquiring multiple message files, each message file carrying at least one keyword and an event type, wherein each keyword in the same message file is associated with the same event type; extracting keywords and event types from the multiple message files to obtain the event type associated with each keyword in the multiple message files, and the number of message files corresponding to each keyword under the associated event type; determining the target event type corresponding to each keyword among the associated event types based on the number of message files corresponding to each keyword under the associated event type; calculating the target risk value of each keyword under the corresponding target event type based on the number of message files corresponding to each keyword under the associated event type, wherein the target risk value is used to characterize the degree of risk, and keywords with target risk values ​​higher than a threshold are used to determine the keyword tags of the message files.

[0005] Secondly, embodiments of this application provide a keyword processing apparatus, comprising: an acquisition module, an extraction module, a target event type determination module, and a target risk value calculation module. The acquisition module acquires multiple message files, each message file carrying at least one keyword and an event type, with each keyword in the same message file associated with the same event type. The extraction module extracts keywords and event types from the multiple message files, obtaining the event type associated with each keyword in the multiple message files, and the number of message files corresponding to each keyword under the associated event type. The target event type determination module determines the target event type corresponding to each keyword among the associated event types based on the number of message files corresponding to each keyword under the associated event type. The target risk value calculation module calculates the target risk value of each keyword under the corresponding target event type based on the number of message files corresponding to each keyword under the associated event type. The target risk value characterizes the degree of risk, wherein keywords with target risk values ​​higher than a threshold are used to determine the keyword tags of the message files.

[0006] Thirdly, embodiments of this application provide an electronic device, including a processor and a memory; one or more programs are stored in the memory and configured to be executed by the processor to implement the above-described method.

[0007] Fourthly, embodiments of this application provide a computer-readable storage medium storing program code, wherein the above-described method is executed when the program code is run by a processor.

[0008] Fifthly, embodiments of this application provide a computer program product or computer program that includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the method described above.

[0009] This application provides a keyword processing method, apparatus, electronic device, and storage medium. First, multiple message files are acquired. Then, keywords and event types are extracted from the multiple message files to obtain the event type associated with each keyword in the multiple message files, and the number of message files corresponding to each keyword under the associated event type. Next, based on the number of message files corresponding to each keyword under the associated event type, a target event type corresponding to each keyword is determined from the associated event types. Finally, based on the number of message files corresponding to each keyword under the associated event type, a target risk value for each keyword under the corresponding target event type is calculated. Keywords with target risk values ​​higher than a threshold are used to determine the keyword tags of the message files. Thus, by automatically processing multiple message files, the target risk value of a keyword under the target event type can be obtained, improving the efficiency of determining the target risk value of a keyword under the target event type. In addition, since the target risk value of each keyword under the corresponding target event type is calculated based on the number of message files corresponding to each keyword under the associated event type, the influence of human subjective factors can be eliminated, improving the accuracy of determining the target risk value of a keyword under the target event type. Furthermore, since keyword tags for message files can be determined using keywords with target risk values ​​higher than the threshold, the efficiency and accuracy of determining keyword tags for message files can also be improved. Attached Figure Description

[0010] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0011] Figure 1 A schematic diagram of an application environment proposed in an embodiment of this application is shown; Figure 2 A flowchart illustrating a keyword processing method proposed in an embodiment of this application is shown; Figure 3 A schematic diagram of an event type display interface according to an embodiment of this application is shown; Figure 4 A flowchart illustrating another keyword processing method proposed in an embodiment of this application is shown; Figure 5 A flowchart illustrating another keyword processing method proposed in an embodiment of this application is shown; Figure 6 It shows Figure 5A flowchart illustrating one implementation of S350 in a keyword processing method proposed in the illustrated embodiment; Figure 7 It shows Figure 5 A flowchart illustrating one implementation of S360 in a keyword processing method proposed in the illustrated embodiment; Figure 8 A flowchart illustrating another keyword processing method proposed in an embodiment of this application is shown; Figure 9 A block diagram of a keyword processing device according to an embodiment of this application is shown; Figure 10 A block diagram of a processing apparatus for another keyword proposed in an embodiment of this application is shown; Figure 11 A structural block diagram of an electronic device for performing a keyword processing method according to an embodiment of this application is shown. Detailed Implementation

[0012] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.

[0013] It should be noted that the multiple message files used in the keyword processing method disclosed in this application, as well as the target risk value of each keyword under the corresponding target event type, can be stored on the blockchain.

[0014] In the financial industry, various transaction behaviors occur, resulting in a massive amount of transaction data. To improve the speed of transaction review, audit models can be used for rapid preliminary review, monitoring suspicious transactions, and then compiling these suspicious transactions into cases for auditors to review. When reviewing these cases, auditors need to write corresponding analysis content, i.e., write reports, for suspicious cases, and submit them to regulatory agencies to help regulatory personnel accurately characterize the transaction behavior.

[0015] The message file is a descriptive file that records the transaction characteristics of suspicious cases and the corresponding event types. Transaction characteristics may include keywords, and the event type refers to the nature of the transaction in the suspicious case, including two types: normal transactions and criminal transactions. Normal transactions can be regarded as event types without risk, while criminal transactions can be regarded as event types with risk.

[0016] In one possible scenario, such as a financial anti-money laundering audit, the message file could be an anti-money laundering audit message. For example, the content of an anti-money laundering audit message could be: "This entity has recently engaged in frequent transactions with relatively consistent transaction amounts, and has also engaged in betting activities with substantial betting amounts. Preliminary judgment indicates that this entity is suspected of gambling activities; please conduct a thorough review." In this anti-money laundering audit message, the corresponding event type is "criminal transaction," specifically gambling activities. Keywords can be extracted from transaction characteristics, such as "frequent transactions," "transaction amounts," "consistent," "betting," and "substantial betting amounts."

[0017] To help auditors quickly and comprehensively identify risks in suspicious transactions and prepare reports during the audit process, auditors can record keywords encountered during the audit, determine the target event type corresponding to the keywords, and determine the target risk value for each keyword under the corresponding target event type. In this way, when auditors encounter the same keywords in suspicious transactions later, they can quickly identify suspicious cases and prepare reports based on the recorded keywords and the target risk value of the keyword under the corresponding target event type.

[0018] Here, the target event type corresponding to the keyword refers to the event type with the greatest relevance to the keyword. For example, if the keyword "betting" is most relevant to the event type "gambling," then the target event type corresponding to the keyword "betting" is "gambling." Similarly, if the keyword "exporting cultural relics" is most relevant to the event type "smuggling crime," then the target event type corresponding to the keyword "exporting cultural relics" is "smuggling crime."

[0019] However, the inventors discovered that in related technologies, determining the target risk value of keywords under the corresponding target event type is usually done manually by reviewers. However, given the large number of keywords in the message file, relying solely on manual collection and judgment of the correlation between keywords and event types to determine the target event type corresponding to the keywords and the target risk value of the keywords under that target event type is inefficient. Furthermore, different people have different biases, leading to inaccuracies in the final determined target event type corresponding to the keywords and the target risk value of the keywords under that target event type.

[0020] In view of this, the inventors have proposed a keyword processing method, apparatus, electronic device, and storage medium provided in this application. In this method, after acquiring multiple message files, keywords and event types are first extracted from the multiple message files to obtain the event type associated with each keyword in the multiple message files, as well as the number of message files corresponding to each keyword under the associated event type. Then, based on the number of message files corresponding to each keyword under the associated event type, the target event type corresponding to each keyword is determined from the associated event types. Finally, based on the number of message files corresponding to each keyword under the associated event type, the target risk value of each keyword under the corresponding target event type is calculated. Keywords with target risk values ​​higher than a threshold are used to determine the keyword tags of the message files.

[0021] In the aforementioned method, the target risk value of a keyword under the target event type can be obtained by automatically processing multiple message files. Compared with manually determining the target risk value of a keyword under the target event type, this method improves the efficiency of determining the target risk value of a keyword under the target event type. In addition, since the target risk value of each keyword under the corresponding target event type is calculated based on the number of message files corresponding to each keyword under the associated event type, the influence of human subjective factors can be eliminated, thus improving the accuracy of determining the target risk value of a keyword under the target event type. Furthermore, since keyword tags for message files can be determined using keywords with target risk values ​​higher than the threshold, the efficiency and accuracy of determining keyword tags for message files can also be improved.

[0022] Before providing a more detailed description of the embodiments of this application, an application environment related to the embodiments of this application will be introduced.

[0023] like Figure 1 As shown, Figure 1 The diagram illustrates the application environment involved in this application embodiment. It includes a client 110 and a server 120, which can be directly or indirectly connected via wired or wireless communication; this application does not impose any limitations on this connection. The number of clients can be multiple. Figure 1 We will use only 3 examples as examples.

[0024] In one optional implementation scenario, client 110 can be a client used by anti-money laundering auditors. The auditors can compose anti-money laundering messages on client 110 based on the actual audit situation. These messages can carry at least one keyword and an event type. The auditors can then upload these messages to server 120. Server 120 can then obtain the anti-money laundering messages uploaded by each client 110, extract keywords and event types from the multiple messages, obtain the event type associated with each keyword in the multiple messages, and the number of messages corresponding to each keyword under each associated event type. Based on the number of messages corresponding to each keyword under each associated event type, the server determines the target event type corresponding to each keyword among the associated event types. Finally, based on the number of messages corresponding to each keyword under each associated event type, the server calculates the target risk value for each keyword under the corresponding target event type. After calculating the target risk value of each keyword under the corresponding target event type, server 120 can send the target risk value of each keyword under the corresponding target event type to each client 110. This will help the anti-money laundering auditors of client 110 to quickly and comprehensively identify risk points from suspicious transactions based on the target risk value of each keyword under the corresponding target event type, thereby helping auditors to quickly discover suspicious cases and write report documents.

[0025] The keywords carried in the anti-money laundering message can be those specified in the anti-money laundering audit guidelines, such as those specified in the Anti-Money Laundering Law, or keywords accumulated by auditors in their daily audits.

[0026] It is understandable that the keyword processing method described above can also be completed on any terminal where client 110 is located. That is, any client 110 can directly or indirectly receive message files sent by other clients 110, and by combining these with its own message files, obtain multiple message files. Then, the terminal where that client is located can perform the same operations as the server described above, ultimately calculating the target risk value for each keyword under the corresponding target event type. Furthermore, client 110 can directly or indirectly send the target risk value for each keyword under the corresponding target event type to other clients 110, helping the anti-money laundering auditors of other clients 110 to quickly and comprehensively identify risk points, thereby helping them rapidly discover suspicious cases and compile message files.

[0027] It should be noted that the server can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms. It can also be a dedicated or platform server providing services such as vehicle networking, road network collaboration, vehicle-road collaboration, intelligent transportation, autonomous driving, industrial internet services, and data communication (such as 4G, 5G, etc.). The client's electronic device can be a smartphone, tablet, laptop, desktop computer, smart speaker, wearable device, smart robot, in-vehicle terminal, etc., but is not limited to these.

[0028] The embodiments of this application will now be described in detail with reference to the accompanying drawings.

[0029] Please see Figure 2 , Figure 2 The diagram shown is a flowchart of a keyword processing method according to an embodiment of this application. This method can be applied to electronic devices (e.g., Figure 1 The method includes: (the terminal or server where the client is located) S110, obtain multiple message files, each message file carries at least one keyword and an event type, and each keyword in the same message file is associated with the same event type.

[0030] There are several ways to obtain multiple message files.

[0031] One implementation method is to acquire multiple message files at preset time intervals. For example, time intervals of 1 / 3 / 5 / 7 / 30 days can be set to acquire multiple message files within the preset time intervals.

[0032] As another implementation method, multiple message files can be obtained according to a preset number. For example, 100 / 1000 / 10000 can be set as a preset number, so that multiple message files of the preset number can be obtained each time.

[0033] Exemplarily, in some alternative implementations, the method is described in detail when applied to a server, in conjunction with Figure 1 In the application environment shown, server 120 can receive all message files uploaded by multiple clients 110 every day at a time interval of one day, thereby enabling the server to obtain multiple message files.

[0034] Based on the foregoing, a message file is a descriptive file that records the transaction characteristics of suspicious cases and the corresponding event types. Transaction characteristics can include keywords; therefore, each message file can carry keywords and event types. Furthermore, it is understandable that in actual audits, auditors typically use at least one keyword to jointly determine the event type of a subject or object. Simultaneously, a subject or object usually has one possible event type. Therefore, in the message files written by auditors, each message file carries at least one keyword and one event type. In this case, the keywords in the same message file can be considered as having a correlation with the event type recorded in the same message file.

[0035] Continuing with the previous example, let's take a message containing the message: "This entity has been making frequent transactions recently, with relatively consistent transaction amounts, and has engaged in betting activities with substantial bets. Preliminary assessment suggests this entity is suspected of gambling; please conduct a thorough review." The keywords include "transactions," "frequent transactions," "transaction amounts," "betting," and "betting amount," while the event type is "gambling behavior." Therefore, in this message, the keywords "transactions," "frequent transactions," "transaction amounts," "betting," and "betting amount" are associated with the event type "gambling behavior."

[0036] S120: Extract keywords and event types from multiple message files to obtain the event type associated with each keyword in the multiple message files, as well as the number of message files corresponding to each keyword under the associated event type.

[0037] Extracting keywords and event types from multiple message files can be divided into two parts: extracting keywords from message files and extracting event types from message files.

[0038] There are several ways to extract keywords from message files.

[0039] As one implementation method, if the keywords in the message file carry a preset identifier, the content in the preset identifier can be extracted by setting a regular expression that matches the preset identifier, thereby extracting the keywords in the message file.

[0040] In this approach, the specific extraction process for extracting keywords from message files includes: using a first regular expression to perform regular expression matching on multiple message files respectively to obtain the keywords included in the multiple message files. The first regular expression defines a string that matches a preset identifier.

[0041] Understandably, the message documents are drafted by reviewers. To help regulatory personnel accurately characterize transactions, reviewers can add pre-defined identifiers to keywords during drafting, such as using quotation marks, book titles, or underscores. This allows regulatory personnel to quickly identify keywords in the message document and accurately characterize transactions based on these identifiers. Therefore, when keywords in a message document carry pre-defined identifiers, keywords can be quickly extracted from the message document by setting a first regular expression that matches the string containing the pre-defined identifier.

[0042] For example, taking the keywords in the message file identified by quotation marks as an example, suppose the message file is "This entity has recently engaged in frequent transactions, with relatively regular transaction amounts, and has engaged in betting activities with substantial betting amounts. Preliminary judgment indicates that this entity is suspected of gambling activities; please conduct a review." In this case, the first regular expression can be set to match strings containing quotation marks, for example, the first regular expression could be "[\u4e00-\u9fa5]*?". This first regular expression can then be used to extract the keywords "frequent transactions," "transaction amounts," "betting," and "betting amounts" from the message file.

[0043] As another implementation method, the message file can be segmented using regular expressions to cut out each paragraph separated by punctuation marks. Then, text matching methods can be used to match the fields containing keywords. These fields can then be segmented into words, for example, using the Jieba word segmentation component. Finally, filtering can be used to extract the keywords from the message file.

[0044] There are multiple ways to extract event types from message files.

[0045] As one implementation method, if the message file contains descriptive text related to the event type, such as "the subject is suspected of gambling" or "the subject has engaged in gambling," where "the subject is suspected" or "the subject has engaged in gambling" are descriptive text, then regular expression matching can also be used for extraction. That is, by setting a regular expression that matches the preset text, the content after the preset text can be extracted, thereby extracting the event type in the message file.

[0046] In this approach, the specific extraction process for event types from message files includes: using a second regular expression to perform regular expression matching on multiple message files to obtain the event types included in the multiple message files. The second regular expression defines a string that matches a preset text.

[0047] For example, taking the event type in the message file described as "the entity is suspected of gambling" as an example, following the above example, suppose the message file is "This entity has recently engaged in frequent transactions with relatively regular transaction amounts, and has engaged in betting activities with substantial betting amounts. It is preliminarily determined that this entity is suspected of gambling activities. Please review this information." In this case, the second regular expression can be set to match the string "the entity is suspected of gambling," i.e., the second regular expression is "the entity is suspected of [\u4e00-\u9fa5]*?". This second regular expression can then be used to extract the event type "gambling activities" from the message file.

[0048] Understandably, the event type in the message file can also be described with other preset text. For example, it can be described as "the event type of this subject is". In this case, the second regular expression can be set to match the string "the event type of this subject is", that is, the second regular expression is "the event type of this subject is [\u4e00-\u9fa5]*?".

[0049] As another implementation method, a loop matching method can be used, which involves iterating through all event types in the message file, determining whether the currently traversed event type is in the message, and if so, extracting the event type from the message file.

[0050] In this embodiment, after extracting the keywords and event types included in multiple message files, the event type associated with each keyword can be obtained from multiple message files based on the principle that each keyword in the same message file is associated with the same event type. Furthermore, the number of message files corresponding to each keyword under the associated event type can be obtained.

[0051] Continuing with the example above, a message file reads, "This entity has recently engaged in frequent transactions with relatively regular transaction amounts, and has also engaged in betting activities with substantial betting amounts. It is preliminarily determined that this entity is suspected of gambling activities. Please conduct a review." In this case, we can see that the event type associated with the keywords "frequent transactions," "transaction amounts," "betting," and "betting amounts" is "gambling activities," and the number of message files corresponding to the keywords "frequent transactions," "transaction amounts," "betting," and "betting amounts" under the associated event type "gambling activities" is 1 for each.

[0052] Furthermore, by combining the remaining message files, we can obtain the event types associated with each keyword in multiple message files, as well as the number of message files corresponding to each keyword under the associated event type. For example, in another message file, there is a keyword "betting," and the event type carried by this message file is "gambling behavior." Then, by combining these two message files, we can obtain that the number of message files corresponding to the keyword "betting" under the associated event type "gambling behavior" is 2.

[0053] S130, based on the number of message files corresponding to each keyword under the associated event type, determine the target event type corresponding to each keyword in the associated event types.

[0054] It is understandable that the same keyword may appear in different message files, and these different message files may carry the same event type or different event types. Therefore, the same keyword may be associated with different event types in different message files.

[0055] Based on the foregoing, the target event type corresponding to a keyword refers to the event type with the highest relevance to the keyword. Therefore, in order to facilitate the subsequent calculation of the target risk value of each keyword under the corresponding target event type, we can first determine the target event type corresponding to each keyword among the associated event types based on the number of message files corresponding to each keyword under the associated event types.

[0056] As one implementation method, based on the number of message files corresponding to each keyword under the associated event type, the target event type corresponding to each keyword is determined among the associated event types, including: determining the event type with the largest number of message files corresponding to each keyword under the associated event type as the target event type corresponding to each keyword.

[0057] Understandably, for a given keyword, the number of message files corresponding to it under a certain associated event type can reflect the correlation between that keyword and that event type. The larger the number of message files corresponding to a keyword under a certain associated event type, the stronger the correlation between that keyword and that event type.

[0058] For example, suppose the keyword "betting" appears in 10 message files. Eight of these messages have an event type of "gambling," one has an event type of "smuggling," and one has an event type of "normal transaction." In this case, the number of messages with the keyword "betting" under the event type "gambling" is 8, the number of messages under the event type "smuggling" is 1, and the number of messages under the event type "normal transaction" is 1. Therefore, it can be seen that the keyword "betting" has the strongest correlation with the event type "gambling," thus "gambling" is identified as the target event type corresponding to the keyword "betting."

[0059] S140, based on the number of message files corresponding to each keyword under the associated event type, calculate the target risk value of each keyword under the corresponding target event type. The target risk value is used to characterize the degree of risk. Keywords with target risk values ​​higher than the threshold are used to determine the keyword tags of the message files.

[0060] After determining the target event type corresponding to each keyword, the target risk value of each keyword under the corresponding target event type can be calculated based on the number of message files corresponding to each keyword under the associated event type.

[0061] Specifically, the higher the target risk value of a keyword under the corresponding target event type, the greater the risk level of that keyword under that target event type. If the keyword is present in a suspicious transaction, it indicates that the event type of the suspicious transaction is likely to be the target event type corresponding to that keyword.

[0062] Furthermore, after calculating the target risk value of each keyword under the corresponding target event type based on the number of message files corresponding to each keyword under the associated event type, the keyword, the target event type corresponding to the keyword, and the target risk value of the keyword under the corresponding target event type can be written into the keyword database for storage. This will help auditors quickly identify suspicious cases and write message files when they encounter the same keyword during the review of suspicious transactions, based on the keyword, the target event type corresponding to the keyword, and the target risk value of the keyword under the corresponding target event type recorded in the keyword database.

[0063] The keyword database can be understood as a lexicon that stores keywords, the target event types corresponding to the keywords, and the target risk values ​​corresponding to the keywords under the corresponding target event types. Within the keyword database, keywords, their corresponding target event types, and the target risk values ​​corresponding to the keywords under the corresponding target event types can be stored in the form of keyword phrases. For example, a keyword phrase could be "gambling behavior - betting - 0.85".

[0064] In some potential application scenarios, keyword groups in the keyword database can be used for retrieval. For example, if the keyword "betting" appears in a suspicious transaction reviewed by an auditor, searching the keyword database will yield the keyword group "gambling behavior - betting - 0.85". Since 0.85 is a relatively high target risk value, the auditor can quickly draft a message stating, "This entity has engaged in betting behavior; this entity is highly likely to be involved in gambling activities. Please review."

[0065] In other potential application scenarios, keyword phrases from the keyword library can be used for display on the interface. The client can display keyword phrases from the keyword library on the front-end interface. As one display method, reviewers can select the corresponding event type on the event type selection page and then enter the corresponding event type display interface, such as... Figure 3 As shown, the event type display interface displays event type 1 and its corresponding keywords. The keywords are displayed in a specific order based on their risk values ​​within the event type. Figure 3 In the table, the target risk values ​​corresponding to keywords 1 to 6 decrease sequentially.

[0066] In some other possible application scenarios, keyword groups in the keyword library can be used to generate keyword tags for message files. The specific process includes: obtaining the target message file; using the keyword library to perform keyword matching on the target message file to obtain the target risk value of each keyword included in the target message file under the corresponding target event type; and determining the keyword tags corresponding to the target message file based on the target risk value of each keyword under the corresponding target event type.

[0067] Target message files refer to message files written by reviewers for subsequent determination of keyword tags. In some scenarios, to facilitate regulatory personnel in quickly identifying suspicious transactions, keyword tags can be added to message files, and this process can be automated by electronic devices.

[0068] After drafting the message, the reviewer can submit it to the electronic device. The electronic device then obtains the target message and uses a keyword database to perform keyword matching on the target message, obtaining each keyword included in the target message and the target risk value of each keyword under the corresponding target event type. Based on the target risk value of each keyword under the corresponding target event type, the electronic device determines the keyword tags corresponding to the target message.

[0069] There are several ways to determine the keyword tags for the target message file based on the target risk value of each keyword under the corresponding target event type. Optionally, keywords with target risk values ​​higher than a threshold can be determined as keyword tags for the message file. Optionally, a preset number of keywords with the highest target risk values ​​can be determined as keyword tags for the message file.

[0070] In some implementations, to more intuitively display the risk level of keywords and further assist auditors in quickly identifying suspicious cases and drafting reports, after obtaining the target risk value of a keyword under the corresponding target event type, the target risk value can be converted into a corresponding risk level. Then, the keyword, the target event type corresponding to the keyword, and the risk level of the keyword under the corresponding target event type are written into the keyword database. At this point, the keyword database can store keywords, the target event type corresponding to the keyword, and the corresponding risk level of the keyword under the corresponding target event type in the form of keyword phrases. In this case, the keyword phrase could be "gambling behavior - betting - high". Thus, auditors do not need to judge the probability of the target risk value but can directly write relevant descriptive text based on the risk level. This makes drafting reports more intuitive and efficient for auditors.

[0071] The process of converting the target risk value into the corresponding risk level can be achieved by pre-setting multiple risk levels, and pre-setting a corresponding target risk value range for each risk level. In this way, the target risk value can be converted into the corresponding risk level based on which target risk value range the keyword falls into under the corresponding target event type.

[0072] This application provides a keyword processing method, which first obtains multiple message files, then extracts keywords and event types from the multiple message files to obtain the event type associated with each keyword in the multiple message files, as well as the number of message files corresponding to each keyword under the associated event type. Then, based on the number of message files corresponding to each keyword under the associated event type, the target event type corresponding to each keyword is determined from the associated event types. Finally, based on the number of message files corresponding to each keyword under the associated event type, the target risk value of each keyword under the corresponding target event type is calculated. Among them, keywords with target risk values ​​higher than a threshold are used to determine the keyword tags of the message files. Therefore, by automatically processing multiple message files, the target risk value of keywords under the target event type can be obtained. Compared with manually determining the target risk value of keywords under the target event type, this method improves the efficiency of determining the target risk value of keywords under the target event type. In addition, since the target risk value of each keyword under the corresponding target event type is calculated based on the number of message files corresponding to each keyword under the associated event type, the influence of human subjective factors can be eliminated, improving the accuracy of determining the target risk value of keywords under the target event type. Furthermore, since keyword tags for message files can be determined using keywords with target risk values ​​higher than the threshold, the efficiency and accuracy of determining keyword tags for message files can also be improved.

[0073] Furthermore, in this embodiment of the application, since the message file is processed directly, the target risk value of each keyword under the corresponding target event type can be obtained. Since the message file is a document written by the reviewer during the review process, the reviewer does not need to perform any additional operations to write keywords and event types, thus reducing the workload of the reviewer.

[0074] Please see Figure 4 , Figure 4 The diagram shown is a flowchart of a keyword processing method according to another embodiment of this application. This method can be applied to electronic devices (e.g., Figure 1 The method includes: (the terminal or server where the client is located) S210, acquire multiple message files, each message file carries at least one keyword and an event type, and each keyword in the same message file is associated with the same event type.

[0075] S220: Extract keywords and event types from multiple message files to obtain the event type associated with each keyword in the multiple message files, as well as the number of message files corresponding to each keyword under the associated event type.

[0076] S230, based on the number of message files corresponding to each keyword under the associated event type, determine the target event type corresponding to each keyword among the associated event types.

[0077] S240, based on the number of message files corresponding to each keyword under the associated event type, determine the probability of each keyword appearing under the associated event type.

[0078] It is understandable that multiple message files are obtained randomly. Therefore, the keywords and event types in the message files are also random. Therefore, in order to objectively determine the target event type corresponding to the keyword and the target risk value of the keyword under the corresponding target event type, and improve the accuracy of keyword processing, we can first calculate the probability of the keyword appearing under each associated event type.

[0079] As one implementation method, the probability of a keyword appearing under a certain associated event type can be calculated by the ratio of the number of message files corresponding to the keyword under that associated event type to the sum of the number of message files corresponding to the keyword under all associated event types.

[0080] Continuing with the example above, suppose the keyword "betting" appears in 10 message files. Of these, 8 messages have an event type of "gambling," 1 message has an event type of "smuggling," and 1 message has an event type of "normal transaction." In this case, the number of messages with the keyword "betting" under the event type "gambling" is 8, the number under the event type "smuggling" is 1, and the number under the event type "normal transaction" is 1. Therefore, we can calculate that the probability of the keyword "betting" appearing under the event type "gambling" is 0.8, the probability of the keyword "betting" appearing under the event type "smuggling" is 0.1, and the probability of the keyword "betting" appearing under the event type "normal transaction" is 0.1.

[0081] Therefore, by using the above method, based on the number of message files corresponding to each keyword under the associated event type, the probability of each keyword appearing under the associated event type can be determined.

[0082] S250, based on the probability of each keyword appearing under the associated event type, calculate the risk value of each keyword and the risk concentration value of each keyword under the corresponding target event type. The risk concentration value is a value that characterizes the degree of risk concentration of the keyword under the corresponding target event type.

[0083] The risk value of a keyword refers to the degree of risk inherent in a particular keyword. For example, the risk value of the keyword "betting" is different from that of keywords such as "tonight" or "dinner".

[0084] There are several different ways to calculate the risk value of each keyword based on the probability of each keyword appearing under the associated event type.

[0085] As one implementation method, if the event types associated with a keyword include a first event type representing the presence of risk and a second event type representing the absence of risk, then, based on the probability of each keyword appearing under the associated event type, the risk value of each keyword is calculated, including: obtaining the difference between the probability of each keyword appearing under the associated first event type and the probability of each keyword appearing under the associated second event type; and selecting the larger value between the difference and a set value as the risk value of each keyword.

[0086] The probability of each keyword appearing under the associated first event type refers to the sum of the probabilities of each keyword appearing under each first event type representing the existence of risk, and the probability of each keyword appearing under the associated second event type refers to the probability of each keyword appearing under the event type representing the absence of risk.

[0087] Continuing with the previous example, the keyword "betting" is associated with two primary event types: "gambling" and "smuggling." The probability of "betting" appearing under "gambling" is 0.8, and under "smuggling" it is 0.1. It is also associated with a secondary event type, "normal transaction," and the probability of "betting" appearing under "normal transaction" is 0.1. Therefore, the probability of "betting" appearing under each of the associated primary event types is 0.9, and the probability of each keyword appearing under each of the associated secondary event types is 0.1. In this case, the difference between the probability of "betting" appearing under the associated primary event type and the probability of each keyword appearing under the associated secondary event type is 0.8.

[0088] Understandably, by calculating the difference between the probability of each keyword appearing under the first associated event type and the probability of each keyword appearing under the second associated event type, it is possible to determine whether each keyword belongs more to the first event type with risk or more to the second event type without risk, thereby determining the risk value of each keyword.

[0089] In some implementations, the set value can be 0. In this case, the difference between the probability of each keyword appearing under the first associated event type and the probability of each keyword appearing under the second associated event type is compared with the set value 0. When the difference between the probability of a keyword appearing under the first associated event type and the probability of that keyword appearing under the second associated event type is greater than 0, the difference is directly used as the risk value of that keyword. When the difference between the probability of a keyword appearing under the first associated event type and the probability of that keyword appearing under the second associated event type is less than 0, 0 is directly used as the risk value of that keyword, that is, the risk value of that keyword is 0.

[0090] In other implementations, the set value can also be a relatively small value such as 0.01 or 0.02, which can avoid the final calculated risk value of a certain keyword being 0, and is more in line with the actual scenario.

[0091] As another implementation method, based on the probability of each keyword appearing under the associated event type, a risk value for each keyword is calculated, including: obtaining the risk value for each keyword using a risk value calculation formula, which includes: , where x is the risk value of the keyword, and Pi is the probability of the keyword appearing under the i-th associated event type that represents a risk.

[0092] The risk concentration value of a keyword under the corresponding target event type refers to the degree of risk concentration of a certain keyword under the corresponding target event type. It can be understood that the more concentrated the risk of a certain keyword is under the corresponding target event type, the higher the target risk value of that keyword under the corresponding target event type.

[0093] As one implementation method, based on the probability of each keyword appearing under the associated event type, the risk concentration value of each keyword under the corresponding target event type is calculated, including: based on the probability of each keyword appearing under the associated event type and a preset constant, the risk concentration value calculation formula is used to obtain the risk concentration value of each keyword under the corresponding target event type, wherein the risk concentration value calculation formula includes: y is the risk concentration value of the keyword under the corresponding target event type, and a is a preset constant, and a is greater than 0.

[0094] S260, based on the product of the risk value of each keyword and the risk set value of each keyword under the corresponding target event type, the target risk value of each keyword under the corresponding target event type is obtained.

[0095] After obtaining the risk value of each keyword and the risk concentration value of each keyword under the corresponding target event type, the target risk value of each keyword under the corresponding target event type can be obtained by multiplying the risk value of each keyword under the corresponding target event type and the risk concentration value of each keyword under the corresponding target event type.

[0096] This application provides a keyword processing method. First, based on the number of message files corresponding to each keyword under the associated event type, the probability of each keyword appearing under that event type is determined. Then, based on the probability of each keyword appearing under the associated event type, the risk value of each keyword and the risk concentration value of each keyword under the corresponding target event type are calculated. Finally, the target risk value of each keyword under the corresponding target event type is obtained by multiplying the risk value of each keyword by the risk concentration value of each keyword under the corresponding target event type. This method considers the randomness of keywords and event types in message files, enabling objective determination of the target event type corresponding to the keyword and the target risk value of the keyword under the corresponding target event type, thus improving the accuracy of keyword processing results. Furthermore, since the final calculated target risk value of each keyword under the corresponding target event type considers both the risk level of the risky keyword itself and the degree of risk concentration of the risky keyword under the corresponding target event type, the keyword processing results are more meaningful, eliminating the influence of subjective human factors and further improving the accuracy of keyword processing results.

[0097] Please see Figure 5 , Figure 5 The diagram shown is a flowchart of a keyword processing method according to another embodiment of this application. This method can be applied to electronic devices (e.g., Figure 1 The method includes: (the terminal or server where the client is located) S310, acquire multiple message files, each message file carries at least one keyword and an event type, and each keyword in the same message file is associated with the same event type.

[0098] S320: Extract keywords and event types from multiple message files to obtain the event type associated with each keyword in the multiple message files, as well as the number of message files corresponding to each keyword under the associated event type.

[0099] S330, based on the number of message files corresponding to each keyword under the associated event type, determine the target event type corresponding to each keyword in the associated event types.

[0100] S340, based on the number of message files corresponding to each keyword under the associated event type, calculate the target risk value of each keyword under the corresponding target event type. The target risk value is used to characterize the degree of risk. Keywords with target risk values ​​higher than the threshold are used to determine the keyword tags of the message files.

[0101] S350 generates updated phrases based on keywords, the target event type corresponding to the keywords, and the target risk value of the keywords under the corresponding target event type.

[0102] In this embodiment, keywords, the target event types corresponding to keywords, and the target risk values ​​of keywords under the corresponding target event types can be written into the keyword thesaurus in the form of keyword phrases to facilitate querying and retrieval by auditors.

[0103] Among them, the updated phrase refers to a phrase consisting of a keyword to be written into the keyword database, the target event type corresponding to the keyword, and the target risk value of the keyword under the corresponding target event type.

[0104] Furthermore, considering the diverse character lengths of extracted keywords (which may contain one or more characters), and how keyword character length affects the target risk value for a given event type, for example, a keyword with only one character typically represents a risk that is too general and lacks practical significance. Therefore, in some implementations, such as... Figure 6 As shown, based on keywords, the target event types corresponding to those keywords, and the target risk values ​​of those keywords under the corresponding target event types, updated phrases are generated, including: S351: Extract target keywords with a character length greater than the preset character length from the keywords.

[0105] Target keywords refer to keywords selected from all keywords whose character length is greater than the preset character length.

[0106] In some implementations, the preset character length can be set to 1. In this case, the target keyword refers to a keyword with a character length greater than 1 character. It should be noted that the preset character length can also be set to other values, such as 2, 3, etc. The specific preset character length is set according to the actual scenario, and this implementation does not specifically limit the preset character length.

[0107] S352, based on the target keyword, the target event type corresponding to the target keyword, and the target risk value of the target keyword under the corresponding target event type, generate an updated phrase.

[0108] In this embodiment, since the target keyword with a character length greater than the preset character length is obtained, and an updated phrase is generated from the target keyword, the target event type corresponding to the target keyword, and the target risk value of the target keyword under the corresponding target event type, the keywords included in the updated phrase have practical significance and can meet the needs of actual scenarios, thereby further improving the accuracy of the keyword phrases in the keyword library.

[0109] S360 will perform deduplication on the updated phrases and the keyword phrases in the keyword database to obtain the deduplicated phrases.

[0110] On the one hand, considering that the writing habits of reviewers who draft message documents are not entirely the same, the keywords obtained at different times may have slight differences, but they express the same meaning in actual scenarios. For example, for different message documents, there may be two descriptions: "large bet amount" and "large bet," and the keywords extracted may be "bet amount" and "bet" respectively, while in fact, the keywords "bet amount" and "bet" express the same meaning. If the keyword database already contains other keyword phrases with the same meaning before the updated phrase is written into the keyword database, directly writing the updated phrase into the keyword database may result in duplicates in the keyword database. On the other hand, considering that multiple message documents are randomly obtained, the target risk value calculated for the same keyword under the corresponding target event type may differ at different times, resulting in non-unique content when the updated phrase is written into the keyword database. Therefore, to ensure the uniqueness of keyword phrases in the keyword database, the updated phrase and the keyword phrases in the keyword database can be deduplicated to obtain the deduplicated phrases.

[0111] As one implementation method, such as Figure 7 As shown, the updated phrases are compared with the keyword phrases in the keyword database to remove duplicates, resulting in the following deduplicated phrases: S361: Obtain multiple target keyword groups corresponding to the same event type from the set of keyword phrases and updated phrases.

[0112] In this embodiment, in order to ensure the accuracy of deduplication, that is, to avoid incorrectly deduplicating two keyword groups with similar meanings corresponding to different event types, multiple target keyword groups corresponding to the same event type can be obtained from the set of keyword groups and updated groups.

[0113] S362, when there is a first keyword and a second keyword in multiple target keyword groups that have an inclusion relationship, and the risk value of the first keyword under the corresponding target event type is less than or equal to the risk value of the second keyword under the corresponding target event type, delete the phrase containing the first keyword from the set composed of the keyword phrase and the updated phrase to obtain the deduplicated phrase, and the text information corresponding to the first keyword includes the text information corresponding to the second keyword.

[0114] In this context, keyword inclusion refers to a relationship between the text information corresponding to two keywords. Specifically, if one keyword includes all the text information of another keyword, then the two keywords have an inclusion relationship. For example, the keywords "bet tonight" and "bet" have an inclusion relationship. Furthermore, in two keywords with an inclusion relationship, the text information corresponding to the first keyword includes the text information corresponding to the second keyword. That is, in the example above, "bet tonight" is the first keyword, and "bet" is the second keyword.

[0115] It's important to note that the terms "first keyword" and "second keyword" are relative concepts, determined by the inclusion relationship between the textual information corresponding to each keyword. That is, for the same keyword, when compared with two different keywords, it might be the first keyword or the second keyword. For example, suppose the three target keyword phrases include the keywords "bet tonight," "bet tonight," and "bet." When comparing the risk values ​​of "bet tonight" and "bet tonight" under their respective target event types, "bet tonight" is the first keyword relative to "bet tonight," while "bet tonight" is the second keyword relative to "bet tonight." Conversely, when comparing the risk values ​​of "bet tonight" and "bet" under their respective target event types, "bet tonight" is the first keyword relative to "bet," while "bet" is the second keyword relative to "bet tonight."

[0116] The following is a detailed explanation of the process of deduplicating the updated phrases and keyword phrases in the keyword library to obtain the deduplicated phrases, using a specific example.

[0117] In some possible scenarios, suppose there are two phrases in the set of keywords and updated phrases: "betting-gambling behavior-0.85" and "betting tonight-gambling behavior-0.76". In this case, the event type corresponding to both phrases is gambling behavior. These two phrases can be identified as target keyword phrases. Then, it can be further determined that "betting tonight" is the first keyword and "betting" is the second keyword. The risk value of the first keyword under the corresponding target event type is less than the risk value of the second keyword under the corresponding target event type. Therefore, the phrase "betting tonight-gambling behavior-0.76" can be deleted.

[0118] In other possible scenarios, suppose there are two phrases in the set of keyword phrases and update phrases: "betting-gambling behavior-0.85" and "betting-gambling behavior-0.82". In this case, the event type corresponding to both phrases is gambling behavior. These two phrases can be identified as target keyword phrases. Either of the two keywords "betting" can be identified as the first keyword and the other as the second keyword. It can be found that the risk value of the first keyword under the corresponding target event type is less than the risk value of the second keyword under the corresponding target event type. Therefore, the phrase "betting-gambling behavior-0.82" can be deleted.

[0119] In this embodiment, by setting the text information corresponding to the first keyword to include the text information corresponding to the second keyword, and when the risk value of the first keyword under the corresponding target event type is less than or equal to the risk value of the second keyword under the corresponding target event type, the phrase containing the first keyword is deleted from the set composed of the keyword phrase and the updated phrase, thus obtaining the deduplicated phrase. This ensures that the deleted keyword phrase can be completely covered by the remaining keyword phrase, enabling the keyword phrase to adapt to suspicious transactions with different description habits. While improving the applicability of the keyword phrase, it effectively reduces the number of remaining keyword phrases in the keyword library.

[0120] S370: Write the deduplicated phrases into the keyword database.

[0121] The keyword processing method provided in this application does not directly write the updated phrase consisting of the keyword, the target event type corresponding to the keyword, and the target risk value of the keyword under the corresponding target event type into the keyword library. Instead, it first performs deduplication processing on the updated phrase and the keyword phrase in the keyword library to obtain the deduplicated phrase, and then writes the deduplicated phrase into the keyword library. This can reduce the number of duplicate words in the keyword library and improve the accuracy of the keyword phrase in the keyword library.

[0122] Please see Figure 8 , Figure 8The diagram shown is a flowchart of a keyword processing method according to another embodiment of this application. This method is applied to anti-money laundering audit scenarios, and is applicable to scenarios such as... Figure 1 In the application environment shown, where the server has a pre-stored keyword database, the method may specifically include the following steps: S410: Obtain multiple anti-money laundering message files.

[0123] Each message file carries at least one keyword and an event type, with each keyword in the same message file associated with the same event type. Furthermore, in each anti-money laundering message, anti-money laundering auditors use preset identifiers to mark the keywords.

[0124] S420: Use the first regular expression to perform regular expression matching on multiple anti-money laundering message files respectively to obtain the keywords included in the multiple anti-money laundering message files, and use the second regular expression to perform regular expression matching on multiple anti-money laundering message files respectively to obtain the event types included in the multiple anti-money laundering message files.

[0125] The first regular expression defines a string that matches a preset identifier, and the second regular expression defines a string that matches a preset text.

[0126] S430, based on the keywords included in multiple anti-money laundering message files and the event types included in multiple anti-money laundering message files, obtain the event type associated with each keyword in multiple anti-money laundering message files, and the number of anti-money laundering message files corresponding to each keyword under the associated event type.

[0127] S440, determine the event type with the largest number of anti-money laundering message files corresponding to each keyword under the associated event type as the target event type corresponding to each keyword.

[0128] S450, based on the number of message files corresponding to each keyword under the associated event type, determine the probability of each keyword appearing under the associated event type.

[0129] S460, based on the probability of each keyword appearing under the associated event type, calculate the risk value of each keyword and the risk concentration value of each keyword under the corresponding target event type.

[0130] Among them, the risk concentration value is a value that characterizes the degree of risk concentration of a keyword under the corresponding target event type.

[0131] S470, based on the product of the risk value of each keyword and the risk set value of each keyword under the corresponding target event type, the target risk value of each keyword under the corresponding target event type is obtained.

[0132] S480 generates updated phrases based on keywords, the target event type corresponding to the keywords, and the target risk value of the keywords under the corresponding target event type.

[0133] In some implementations, target keywords with a character length greater than a preset character length can be obtained from the keywords first, and then an updated phrase can be generated based on the target keywords, the target event type corresponding to the target keywords, and the target risk value of the target keywords under the corresponding target event type.

[0134] S490: The updated phrase and the keyword phrases in the keyword database are deduplicated to obtain the deduplicated phrases, and the deduplicated phrases are written into the keyword database.

[0135] It should be noted that the steps S410-S480 above can be executed for the first time or repeatedly at different times. When executed repeatedly, the keyword library can store keyword phrases. The keyword phrases include historical keywords obtained from executing the steps S410-S480 above, the target event types corresponding to the historical keywords, and the target risk values ​​of the historical keywords under the corresponding target event types.

[0136] In some implementations, the keyword database can be cleared before the deduplicated phrases are written into the keyword database, and then the deduplicated phrases can be imported.

[0137] This embodiment provides a keyword processing method that automatically processes multiple message files to obtain the target risk value of a keyword under a target event type, thus improving the efficiency of determining the target risk value of a keyword under a target event type. Furthermore, since the target risk value of each keyword under a corresponding target event type is calculated based on the number of message files corresponding to each keyword under the associated event type, the influence of subjective human factors can be eliminated, improving the accuracy of determining the target risk value of a keyword under a target event type. In addition, since keyword tags for message files can be determined using keywords with target risk values ​​higher than a threshold, the efficiency and accuracy of determining keyword tags for message files can also be improved.

[0138] It should be noted that the above-mentioned specific examples of implementable methods provided in this application can be arbitrarily combined without conflict to form a new keyword processing method. It should be understood that any new keyword processing method formed by combining any examples should fall within the protection scope of this application.

[0139] It should also be noted that in some alternative implementations, the execution order of some processes in the embodiments of the present invention may differ from the execution order described in the foregoing specific embodiments. For example, two consecutive processes may actually be executed in parallel, or they may sometimes be executed in reverse order, depending on the functions involved.

[0140] Please see Figure 9 , Figure 9 The diagram shows a block diagram of a keyword processing device 500 according to an embodiment of this application. The device 500 includes: an acquisition module 510, an extraction module 520, a target event type determination module 530, and a target risk value calculation module 540.

[0141] The acquisition module 510 is used to acquire multiple message files. Each message file carries at least one keyword and an event type. Each keyword in the same message file is associated with the same event type. The extraction module 520 is used to extract keywords and event types from multiple message files, and obtain the event types associated with each keyword in the multiple message files, as well as the number of message files corresponding to each keyword under the associated event type; The target event type determination module 530 is used to determine the target event type corresponding to each keyword in the associated event types based on the number of message files corresponding to each keyword under the associated event types. The target risk value calculation module 540 is used to calculate the target risk value of each keyword under the corresponding target event type based on the number of message files corresponding to each keyword under the associated event type. The target risk value is used to characterize the degree of risk. Keywords with target risk values ​​higher than the threshold are used to determine the keyword tags of the message files.

[0142] In one implementation, the extraction module 520 is used to perform regular expression matching on multiple message files respectively using a first regular expression to obtain the keywords included in the multiple message files. The first regular expression defines a string that matches a preset identifier. The module is also used to perform regular expression matching on multiple message files respectively using a second regular expression to obtain the event types included in the multiple message files. The second regular expression defines a string that matches a preset text. Based on the keywords included in the multiple message files and the event types included in the multiple message files, the module obtains the event type associated with each keyword in the multiple message files, and the number of message files corresponding to each keyword under the associated event type.

[0143] The target event type determination module 530 is used to determine the event type with the largest number of message files corresponding to each keyword as the target event type corresponding to each keyword.

[0144] As one implementation, the target risk value calculation module 540 includes: a probability calculation submodule, a risk value and risk concentration value calculation submodule, and a target risk value calculation submodule. The probability calculation submodule is used to determine the probability of each keyword appearing in an associated event type based on the number of message files corresponding to each keyword in the associated event type. The risk value and risk concentration value calculation submodule is used to calculate the risk value of each keyword and the risk concentration value of each keyword in the corresponding target event type based on the probability of each keyword appearing in the associated event type. The risk concentration value is a value characterizing the degree of risk concentration of a keyword in the corresponding target event type. The target risk value calculation submodule is used to obtain the target risk value of each keyword in the corresponding target event type by multiplying the risk value of each keyword by the risk concentration value of each keyword in the corresponding target event type.

[0145] As one implementation method, the risk value and risk concentration value calculation submodule is used to obtain the difference between the probability of each keyword appearing under the associated first event type and the probability of each keyword appearing under the associated second event type, and select the larger value between the difference and the set value as the risk value of each keyword.

[0146] As one implementation method, the risk value and risk concentration value calculation submodule is also used to obtain the risk value of each keyword using the risk value calculation formula, which includes: , where x is the risk value of the keyword, and Pi is the probability of the keyword appearing under the i-th associated event type that represents a risk.

[0147] As one implementation method, the risk value and risk concentration value calculation submodule is also used to obtain the risk concentration value of each keyword under the corresponding target event type based on the probability of each keyword appearing under the associated event type and a preset constant, using the risk concentration value calculation formula, wherein the risk concentration value calculation formula includes: y is the risk concentration value of the keyword under the corresponding target event type, and a is a preset constant, and a is greater than 0.

[0148] As one implementation method, please refer to Figure 10 The device 500 also includes a writing module 550 and a keyword tag determination module 560.

[0149] The writing module 550 is used to write keywords, the target event types corresponding to the keywords, and the target risk values ​​of the keywords under the corresponding target event types into the keyword library.

[0150] The keyword tag determination module 560 is used to obtain the target message file, use the keyword library to perform keyword matching on the target message file, obtain the target risk value of each keyword included in the target message file under the corresponding target event type, and determine the keyword tag corresponding to the target message file based on the target risk value of each keyword under the corresponding target event type.

[0151] As one implementation, the writing module 550 includes: an update phrase generation submodule, a deduplication submodule, and a writing submodule.

[0152] The updated phrase generation submodule is used to generate updated phrases based on keywords, the target event type corresponding to the keywords, and the target risk value of the keywords under the corresponding target event type.

[0153] The deduplication submodule is used to deduplicatize the updated phrases with the keyword phrases in the keyword library to obtain the deduplicated phrases.

[0154] The write submodule is used to write the deduplicated phrases into the keyword database.

[0155] As one implementation method, the deduplication submodule is used to obtain multiple target keyword groups corresponding to the same event type from the set of keyword phrases and updated phrases. When the keywords in the multiple target keyword groups have a first keyword and a second keyword with an inclusion relationship, and the risk value of the first keyword under the corresponding target event type is less than or equal to the risk value of the second keyword under the corresponding target event type, the phrase containing the first keyword is deleted from the set of keyword phrases and updated phrases to obtain the deduplicated phrases. The text information corresponding to the first keyword includes the text information corresponding to the second keyword.

[0156] As one implementation method, the update phrase generation submodule is used to obtain target keywords with a character length greater than a preset character length from the keywords, and generate update phrases based on the target keywords, the target event types corresponding to the target keywords, and the target risk values ​​of the target keywords under the corresponding target event types.

[0157] This application provides a keyword processing device that automatically processes multiple message files to obtain the target risk value of a keyword under a target event type, thereby improving the efficiency of determining the target risk value of a keyword under a target event type. Furthermore, since the target risk value of each keyword under a corresponding target event type is calculated based on the number of message files corresponding to each keyword under the associated event type, the influence of subjective human factors can be eliminated, improving the accuracy of determining the target risk value of a keyword under a target event type. In addition, since keyword tags for message files can be determined using keywords with target risk values ​​higher than a threshold, the efficiency and accuracy of determining keyword tags for message files can also be improved.

[0158] It should be noted that the device embodiments in this application correspond to the aforementioned method embodiments. The specific principles in the device embodiments can be found in the content of the aforementioned method embodiments, and will not be repeated here.

[0159] The following will combine Figure 11 This application describes an electronic device.

[0160] Please see Figure 11 Based on the above-mentioned keyword processing method, this application embodiment also provides another electronic device 100 including a processor 102 capable of executing the aforementioned method. The electronic device 100 can be a server or a terminal device, and the terminal device can be a smartphone, tablet computer, computer or portable computer, etc.

[0161] The electronic device 100 also includes a memory 104. The memory 104 stores a program that can execute the contents of the foregoing embodiments, and the processor 102 can execute the program stored in the memory 104.

[0162] The processor 102 may include one or more cores for data processing and message matrix units. The processor 102 connects to various parts within the electronic device 100 using various interfaces and lines, and performs various functions and processes data by running or executing instructions, programs, code sets, or instruction sets stored in the memory 104, and by calling data stored in the memory 104. Optionally, the processor 102 may be implemented using at least one hardware form of Digital Signal Processing (DSP), Field-Programmable Gate Array (FPGA), or Programmable Logic Array (PLA). The processor 102 may integrate one or more of the following: Central Processing Unit (CPU), Graphics Processing Unit (GPU), and modem. The CPU primarily handles the operating system, user interface, and applications; the GPU is responsible for rendering and drawing the displayed content; and the modem handles wireless communication. It is understood that the modem may also not be integrated into the processor 102 and may be implemented separately using a communication chip.

[0163] The memory 104 may include random access memory (RAM) or read-only memory (ROM). The memory 104 can be used to store instructions, programs, code, code sets, or instruction sets. The memory 104 may include a program storage area and a data storage area. The program storage area may store instructions for implementing an operating system, instructions for implementing at least one function, instructions for implementing the various method embodiments described below, etc. The data storage area may also store data acquired by the electronic device 100 during use (e.g., data to be recommended and operating methods).

[0164] The electronic device 100 may also include a network module and a screen. The network module is used to receive and transmit electromagnetic waves, converting electromagnetic waves into electrical signals, thereby enabling communication with communication networks or other devices, such as audio playback devices. The network module may include various existing circuit elements used to perform these functions, such as antennas, radio frequency transceivers, digital signal processors, encryption / decryption chips, SIM cards, memory, etc. The network module can communicate with various networks such as the Internet, corporate intranets, and wireless networks, or communicate with other devices via wireless networks. The aforementioned wireless networks may include cellular telephone networks, wireless local area networks, or metropolitan area networks. The screen can display interface content and facilitate data interaction.

[0165] In some embodiments, the electronic device 100 may further include a peripheral interface and at least one peripheral device. The processor 102, memory 104, and peripheral interface 106 can be connected via a bus or signal line. Each peripheral device can be connected to the peripheral interface via a bus, signal line, or circuit board. Specifically, the peripheral device includes at least one of the following: a radio frequency component 108, a positioning component 112, a camera 114, an audio component 116, a display screen 118, and a power supply 122. Peripheral interface 106 can be used to connect at least one I / O (Input / Output) related peripheral device to processor 102 and memory 104. In some embodiments, processor 102, memory 104 and peripheral interface 106 are integrated on the same chip or circuit board; in some other embodiments, any one or two of processor 102, memory 104 and peripheral interface 106 can be implemented on separate chips or circuit boards, and this application embodiment does not limit this.

[0166] The radio frequency (RF) component 108 is used to receive and transmit RF (Radio Frequency) signals, also known as electromagnetic signals. The RF component 108 communicates with communication networks and other communication devices via electromagnetic signals. The RF component 108 converts electrical signals into electromagnetic signals for transmission, or converts received electromagnetic signals back into electrical signals. Optionally, the RF component 108 includes: an antenna system, an RF transceiver, one or more amplifiers, a tuner, an oscillator, a digital signal processor, a codec chipset, a user identity module card, etc. The RF component 108 can communicate with other terminals via at least one wireless communication protocol. This wireless communication protocol includes, but is not limited to: the World Wide Web, metropolitan area networks, intranets, various generations of mobile communication networks (2G, 3G, 4G, and 5G), wireless local area networks, and / or WiFi (Wireless Fidelity) networks. In some embodiments, the RF component 108 may also include circuitry related to NFC (Near Field Communication), which is not limited in this application.

[0167] The positioning component 112 is used to locate the current geographical location of the electronic device to enable navigation or LBS (Location Based Service). The positioning component 112 can be a positioning component based on GPS (Global Positioning System), BeiDou system, or Galileo system.

[0168] Camera 114 is used to capture images or videos. Optionally, camera 114 includes a front-facing camera and a rear-facing camera. Typically, the front-facing camera is located on the front panel of the electronic device 100, and the rear-facing camera is located on the back of the electronic device 100. In some embodiments, there are at least two rear-facing cameras, which are any one of a main camera, a depth-sensing camera, a wide-angle camera, and a telephoto camera, to achieve background blurring by fusion of the main camera and the depth-sensing camera, panoramic shooting by fusion of the main camera and the wide-angle camera, VR (Virtual Reality) shooting, or other fusion shooting functions. In some embodiments, camera 114 may also include a flash. The flash can be a single-color temperature flash or a dual-color temperature flash. A dual-color temperature flash refers to a combination of a warm light flash and a cool light flash, which can be used for light compensation at different color temperatures.

[0169] Audio component 116 may include a microphone and a speaker. The microphone is used to collect sound waves from the user and environment, converting them into electrical signals that are input to processor 102 for processing, or input to radio frequency component 108 for voice communication. For stereo sound acquisition or noise reduction purposes, multiple microphones may be used, each located at a different part of the electronic device 100. The microphone may also be an array microphone or an omnidirectional microphone. The speaker is used to convert electrical signals from processor 102 or radio frequency component 108 into sound waves. The speaker may be a conventional film speaker or a piezoelectric ceramic speaker. When the speaker is a piezoelectric ceramic speaker, it can convert electrical signals not only into audible sound waves but also into inaudible sound waves for purposes such as distance measurement. In some embodiments, audio component 116 may also include a headphone jack.

[0170] Display screen 118 is used to display a UI (User Interface). This UI may include graphics, text, icons, videos, and any combination thereof. When display screen 118 is a touch display screen, it also has the ability to collect touch signals on or above its surface. These touch signals can be input as control signals to processor 102 for processing. In this case, display screen 118 can also be used to provide virtual buttons and / or a virtual keyboard, also known as soft buttons and / or a soft keyboard. In some embodiments, there may be one display screen 118, which serves as the front panel of electronic device 100; in other embodiments, there may be at least two display screens, respectively disposed on different surfaces of electronic device 100 or in a folded design; in still other embodiments, display screen 118 may be a flexible display screen, disposed on a curved or folded surface of electronic device 100. Furthermore, display screen 118 may be configured as a non-rectangular irregular shape, i.e., a non-rectangular screen. Display screen 118 may be made of materials such as LCD (Liquid Crystal Display) or OLED (Organic Light-Emitting Diode).

[0171] Power supply 122 is used to supply power to various components in electronic device 100. Power supply 122 can be alternating current, direct current, a disposable battery, or a rechargeable battery. When power supply 122 includes a rechargeable battery, the rechargeable battery can be a wired rechargeable battery or a wireless rechargeable battery. A wired rechargeable battery is a battery that is charged via a wired line, while a wireless rechargeable battery is a battery that is charged via a wireless coil. The rechargeable battery can also be used to support fast charging technology.

[0172] This application also provides a computer-readable storage medium. This computer-readable medium stores program code that can be called by a processor to execute the methods described in the above method embodiments.

[0173] Computer-readable storage media can be electronic storage devices such as flash memory, EEPROM (Electrically Erasable Programmable Read-Only Memory), EPROM, hard disk, or ROM. Optionally, computer-readable storage media includes non-transitory computer-readable storage medium. The computer-readable storage medium has storage space for program code that performs any of the method steps described above. This program code can be read from or written to one or more computer program products. The program code can be compressed, for example, in a suitable form.

[0174] This application also provides a computer program product or computer program that includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the methods described in the various optional implementations above.

[0175] In summary, the keyword processing method, apparatus, electronic device, storage medium, and computer program product or computer program provided in this application first acquire multiple message files, then extract keywords and event types from the multiple message files to obtain the event type associated with each keyword in the multiple message files, and the number of message files corresponding to each keyword under the associated event type. Then, based on the number of message files corresponding to each keyword under the associated event type, the target event type corresponding to each keyword is determined from the associated event types. Finally, based on the number of message files corresponding to each keyword under the associated event type, the target risk value of each keyword under the corresponding target event type is calculated. Among them, keywords with target risk values ​​higher than a threshold are used to determine the keyword tags of the message files. Thus, by automatically processing multiple message files, the target risk value of a keyword under the target event type can be obtained, improving the efficiency of determining the target risk value of a keyword under the target event type. In addition, since the target risk value of each keyword under the corresponding target event type is calculated based on the number of message files corresponding to each keyword under the associated event type, the influence of human subjective factors can be eliminated, improving the accuracy of determining the target risk value of a keyword under the target event type. Furthermore, since keyword tags for message files can be determined using keywords with target risk values ​​higher than the threshold, the efficiency and accuracy of determining keyword tags for message files can also be improved.

[0176] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A method for processing keywords, characterized in that, include: Retrieve multiple message files, each message file carrying at least one keyword and an event type, with each keyword in the same message file associated with the same event type; Keywords and event types are extracted from the multiple message files to obtain the event type associated with each keyword in the multiple message files, and the number of message files corresponding to each keyword under the associated event type; Based on the number of message files corresponding to each keyword under the associated event type, determine the target event type corresponding to each keyword among the associated event types; Based on the number of message files corresponding to each keyword under the associated event type, determine the probability of each keyword appearing under the associated event type; Based on the probability of each keyword appearing under the associated event type, calculate the risk value of each keyword and the risk concentration value of each keyword under the corresponding target event type. The risk concentration value is a value that characterizes the degree of risk concentration of the keyword under the corresponding target event type. Based on the product of the risk value of each keyword and the risk set value of each keyword under the corresponding target event type, the target risk value of each keyword under the corresponding target event type is obtained. The target risk value is used to characterize the degree of risk. Keywords with target risk values ​​higher than the threshold are used to determine the keyword tags of the message file.

2. The method according to claim 1, characterized in that, The event types associated with keywords include a first event type representing the presence of risk and a second event type representing the absence of risk. Based on the probability of each keyword appearing under the associated event types, a risk value for each keyword is calculated, including: Obtain the difference between the probability of each keyword appearing under the first associated event type and the probability of each keyword appearing under the second associated event type; The larger of the difference and the set value is selected as the risk value for each keyword.

3. The method according to claim 1, characterized in that, Based on the probability of each keyword appearing under the associated event type, a risk value is calculated for each keyword, including: The risk value of each keyword is obtained using the risk value calculation formula, which includes: , where x is the risk value of the keyword, and Pi is the probability of the keyword appearing under the i-th associated event type that represents a risk.

4. The method according to claim 3, characterized in that, Based on the probability of each keyword appearing under the associated event type, calculate the risk concentration value of each keyword under the corresponding target event type, including: Based on the probability of each keyword appearing under the associated event type and a preset constant, the risk concentration value of each keyword under the corresponding target event type is obtained using the risk concentration value calculation formula, wherein the risk concentration value calculation formula includes: y is the risk concentration value of the keyword under the corresponding target event type, and a is a preset constant, and a is greater than 0.

5. The method according to claim 1, characterized in that, The step of determining the target event type corresponding to each keyword among the associated event types based on the number of message files corresponding to each keyword under the associated event type includes: The event type with the largest number of message files corresponding to each keyword under the associated event type is determined as the target event type corresponding to each keyword.

6. The method according to any one of claims 1-5, characterized in that, The keywords carry preset identifiers. The extraction of keywords and event types from the multiple message files to obtain the event type associated with each keyword in the multiple message files, and the number of message files corresponding to each keyword under its associated event type, includes: The first regular expression is used to perform regular expression matching on the multiple message files respectively to obtain the keywords included in the multiple message files. The first regular expression defines a string that matches a preset identifier. The event types included in the multiple message files are obtained by performing regular expression matching on the multiple message files using a second regular expression, whereby the second regular expression defines a string that matches a preset text. Based on the keywords included in the multiple message files and the event types included in the multiple message files, the event type associated with each keyword in the multiple message files and the number of message files corresponding to each keyword under the associated event type are obtained.

7. The method according to claim 1, characterized in that, After obtaining the target risk value for each keyword under the corresponding target event type by multiplying the risk value of each keyword by the risk set value of each keyword under the corresponding target event type, the method further includes: Write the keyword, the target event type corresponding to the keyword, and the target risk value of the keyword under the corresponding target event type into the keyword library.

8. The method according to claim 7, characterized in that, The keyword database includes keyword phrases. The step of writing the keyword, the target event type corresponding to the keyword, and the target risk value of the keyword under the corresponding target event type into the keyword database includes: Based on the keywords, the target event types corresponding to the keywords, and the target risk values ​​of the keywords under the corresponding target event types, an updated phrase is generated; The updated phrase is compared with the keyword phrases in the keyword library to obtain the deduplicated phrases. The deduplicated phrases are written into the keyword database.

9. The method according to claim 8, characterized in that, The updated phrases are compared with the keyword phrases in the keyword database to obtain deduplicated phrases, including: Obtain multiple target keyword groups corresponding to the same event type from the set consisting of the keyword phrases and the updated phrases; When there is a first keyword and a second keyword in the multiple target keyword groups that have an inclusion relationship, and the risk value of the first keyword under the corresponding target event type is less than or equal to the risk value of the second keyword under the corresponding target event type, the word group containing the first keyword is deleted from the set composed of the keyword word group and the updated word group to obtain the deduplicated word group. The text information corresponding to the first keyword includes the text information corresponding to the second keyword.

10. The method according to claim 8, characterized in that, The step of generating an updated phrase based on the keyword, the target event type corresponding to the keyword, and the target risk value of the keyword under the corresponding target event type includes: From the given keywords, obtain target keywords whose character length is greater than a preset character length; Based on the target keyword, the target event type corresponding to the target keyword, and the target risk value of the target keyword under the corresponding target event type, an updated phrase is generated.

11. The method according to any one of claims 7-10, characterized in that, After writing the keyword, the target event type corresponding to the keyword, and the target risk value of the keyword under the corresponding target event type into the keyword database, the method further includes: Obtain the target message file; Using the keyword library, keyword matching is performed on the target message file to obtain the target risk value of each keyword included in the target message file under the corresponding target event type; Based on the target risk value of each keyword under the corresponding target event type, the keyword tags corresponding to the target message file are determined.

12. A keyword processing device, characterized in that, include: The acquisition module is used to acquire multiple message files. Each message file carries at least one keyword and an event type. Each keyword in the same message file is associated with the same event type. The extraction module is used to extract keywords and event types from the multiple message files to obtain the event type associated with each keyword in the multiple message files, and the number of message files corresponding to each keyword under the associated event type; The target event type determination module is used to determine the target event type corresponding to each keyword in the associated event types based on the number of message files corresponding to each keyword under the associated event types; The probability calculation submodule is used to determine the probability of each keyword appearing under an associated event type based on the number of message files corresponding to each keyword under the associated event type. The risk value and risk concentration value calculation submodule is used to calculate the risk value of each keyword and the risk concentration value of each keyword under the corresponding target event type based on the probability of each keyword appearing under the associated event type. The risk concentration value is a value that characterizes the degree of risk concentration of the keyword under the corresponding target event type. The target risk value calculation submodule is used to obtain the target risk value of each keyword under the corresponding target event type based on the product of the risk value of each keyword and the risk set value of each keyword under the corresponding target event type. The target risk value is used to characterize the degree of risk. Keywords with target risk values ​​higher than the threshold are used to determine the keyword tags of the message file.

13. The apparatus according to claim 12, characterized in that, The event types associated with the keywords include a first event type representing the presence of risk and a second event type representing the absence of risk; the risk value and risk concentration value calculation submodule is used for: The difference between the probability of each keyword appearing under the first associated event type and the probability of each keyword appearing under the second associated event type; The larger of the difference and the set value is selected as the risk value for each keyword.

14. The apparatus according to claim 12, characterized in that, The risk value and risk concentration value calculation submodule is used for: The risk value of each keyword is obtained using the risk value calculation formula, which includes: , where x is the risk value of the keyword, and Pi is the probability of the keyword appearing under the i-th associated event type that represents a risk.

15. The apparatus according to claim 14, characterized in that, The risk value and risk concentration value calculation submodule is also used for: Based on the probability of each keyword appearing under the associated event type and a preset constant, the risk concentration value of each keyword under the corresponding target event type is obtained using the risk concentration value calculation formula, wherein the risk concentration value calculation formula includes: y is the risk concentration value of the keyword under the corresponding target event type, and a is a preset constant, and a is greater than 0.

16. The apparatus according to claim 12, characterized in that, The target event type determination module is used for: The event type with the largest number of message files corresponding to each keyword under the associated event type is determined as the target event type corresponding to each keyword.

17. The apparatus according to any one of claims 12-16, characterized in that, The keywords carry preset identifiers, and the extraction module is used for: The first regular expression is used to perform regular expression matching on the multiple message files respectively to obtain the keywords included in the multiple message files. The first regular expression defines a string that matches a preset identifier. The event types included in the multiple message files are obtained by performing regular expression matching on the multiple message files using a second regular expression, whereby the second regular expression defines a string that matches a preset text. Based on the keywords included in the multiple message files and the event types included in the multiple message files, the event type associated with each keyword in the multiple message files and the number of message files corresponding to each keyword under the associated event type are obtained.

18. The apparatus according to claim 12, characterized in that, The keyword processing device further includes a writing module, used to write the keyword, the target event type corresponding to the keyword, and the target risk value of the keyword under the corresponding target event type into the keyword library.

19. The apparatus according to claim 18, characterized in that, The writing module includes: The update phrase generation submodule is used to generate update phrases based on the keyword, the target event type corresponding to the keyword, and the target risk value of the keyword under the corresponding target event type. The deduplication submodule is used to deduplicatize the updated phrase with the keyword phrases in the keyword library to obtain the deduplicated phrase; The write submodule is used to write the deduplicated phrases into the keyword library.

20. The apparatus according to claim 19, characterized in that, The deduplication submodule is used for: Obtain multiple target keyword groups corresponding to the same event type from the set consisting of the keyword phrases and the updated phrases; When there is a first keyword and a second keyword in the multiple target keyword groups that have an inclusion relationship, and the risk value of the first keyword under the corresponding target event type is less than or equal to the risk value of the second keyword under the corresponding target event type, the word group containing the first keyword is deleted from the set composed of the keyword word group and the updated word group to obtain the deduplicated word group. The text information corresponding to the first keyword includes the text information corresponding to the second keyword.

21. The apparatus according to claim 19, characterized in that, The updated phrase generation submodule is used for: From the given keywords, obtain target keywords whose character length is greater than a preset character length; Based on the target keyword, the target event type corresponding to the target keyword, and the target risk value of the target keyword under the corresponding target event type, an updated phrase is generated.

22. The apparatus according to any one of claims 18-21, characterized in that, The keyword processing device further includes a keyword tag determination module, used for: Obtain the target message file; Using the keyword library, keyword matching is performed on the target message file to obtain the target risk value of each keyword included in the target message file under the corresponding target event type; Based on the target risk value of each keyword under the corresponding target event type, the keyword tags corresponding to the target message file are determined.

23. An electronic device, characterized in that, include: One or more processors; Memory; One or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the one or more programs being configured to perform the method as described in any one of claims 1-11.

24. A computer-readable storage medium, characterized in that, The computer-readable storage medium contains program code that can be invoked by a processor to execute the method as described in any one of claims 1-11.

25. A computer program product, characterized in that, It includes computer instructions, which, when executed by a processor, implement the method as described in any one of claims 1-11.

Images