Account list generation method, device, equipment and storage medium

Abstract

The present disclosure provides an account list generation method, device, equipment and storage medium, which can be applied to the technical field of telecommunications anti-fraud, the technical field of artificial intelligence, the technical field of information security and the technical field of finance. The method comprises the following steps: determining a to-be-analyzed account list according to a control list and a first target list; performing feature analysis on financial data of an account in the to-be-analyzed account list to determine expected transaction parameter information corresponding to a rule model; determining second actual transaction parameters corresponding to the rule model according to the expected transaction parameter information corresponding to the rule model and first actual transaction parameters corresponding to the rule model; adjusting current transaction parameters corresponding to the rule model according to the second actual transaction parameters corresponding to the rule model; and generating a second suspicious account list according to the rule model adjusted by the second actual transaction parameters.

Description

Technical Field

[0001] This disclosure relates to the fields of telecommunications anti-fraud technology, artificial intelligence technology, information security technology, and financial technology, and in particular to an account list generation method, apparatus, device, medium, and program product. Background Technology

[0002] As the volume of financial accounts held by financial institutions continues to grow, the difficulty of preventing telecommunications fraud is increasing. Financial institutions will conduct data analysis and modeling on information such as the characteristics of customers involved in the case and the transaction history of the accounts involved in the case in order to identify the accounts involved in the case and to control them.

[0003] However, due to the many characteristics of the accounts involved and the fact that the individuals involved constantly adjust their trading habits in order to conceal their transactions, how to accurately and effectively identify the accounts involved is a technical problem that needs to be solved in the relevant technologies. Summary of the Invention

[0004] In view of the above problems, this disclosure provides an account list generation method, apparatus, device, medium and program product.

[0005] According to a first aspect of this disclosure, a method for generating an account list is provided, comprising:

[0006] Based on the control list and the first target list, a list of accounts to be analyzed is determined, wherein the control list includes a first suspicious account list, which includes suspicious accounts and some accounts in the first target list;

[0007] Feature analysis is performed on the financial data of the accounts in the above-mentioned list of accounts to be analyzed to determine the expected transaction parameters corresponding to the rule model. The rule model is established based on the transaction characteristics of the accounts involved, and the transaction characteristics are determined based on the expected transaction parameters.

[0008] Based on the expected trading parameter information corresponding to the above rule model and the first actual trading parameter corresponding to the above rule model, the second actual trading parameter corresponding to the above rule model is determined, wherein the first actual trading parameter represents the current trading parameter corresponding to the above rule model;

[0009] Based on the second actual transaction parameters corresponding to the above rule model, adjust the above current transaction parameters corresponding to the above rule model;

[0010] Based on the rule model adjusted according to the second actual transaction parameters, a second list of suspicious accounts is generated.

[0011] According to embodiments of this disclosure, determining the list of accounts to be analyzed based on the control list and the first target list includes:

[0012] Financial data corresponding to the above rule model obtained from the first full account list is input into the above rule model obtained based on the above first actual transaction parameters to generate the above first suspicious account list;

[0013] Based on the aforementioned first suspicious account list and the aforementioned first target list, the aforementioned account list to be analyzed is generated.

[0014] According to embodiments of this disclosure, the above-described account list generation method further includes:

[0015] Based on the number of suspicious accounts in the first suspicious account list that correspond to the rule model and the number of accounts in the first target list that correspond to the rule model, determine the first hit rate corresponding to the rule model.

[0016] Based on the first hit rate corresponding to the above rule model, the classification information corresponding to the above rule model is obtained, wherein the above classification information includes a first-level rule model, a second-level rule model, and a third-level rule model;

[0017] Based on the aforementioned control list, accounts in the first-level rule model will be temporarily frozen, accounts in the second-level rule model will be subject to outflow control, and accounts in the third-level rule model will be subject to risk warnings.

[0018] According to embodiments of this disclosure, the above-mentioned temporary freezing of accounts in the first-level rule model, outflow control of accounts in the second-level rule model, and risk warning processing of accounts in the third-level rule model, based on the above-mentioned control list, includes:

[0019] Based on the aforementioned control list and protected account list, a control list for implementation is determined, wherein the aforementioned protected account list includes special accounts;

[0020] Based on the aforementioned control list, accounts in the first-level rule model will be temporarily frozen, accounts in the second-level rule model will be subject to outflow control, and accounts in the third-level rule model will be subject to risk warnings.

[0021] According to embodiments of this disclosure, the above-mentioned feature analysis of the financial data of accounts in the aforementioned list of accounts to be analyzed to determine the expected transaction parameter information corresponding to the rule model includes:

[0022] Feature analysis is performed on the financial data of the accounts in the above-mentioned list of accounts to be analyzed to obtain the above-mentioned expected transaction parameter information corresponding to the accounts in the above-mentioned list of accounts to be analyzed;

[0023] The expected trading parameters are assigned to the corresponding rule models to obtain the expected trading parameters corresponding to the rule models.

[0024] According to embodiments of this disclosure, determining the second actual trading parameter corresponding to the rule model based on the expected trading parameter information corresponding to the rule model and the first actual trading parameter corresponding to the rule model includes:

[0025] Based on the expected trading parameter information corresponding to the above rule model and the first actual trading parameter corresponding to the above rule model, determine the parameter deviation corresponding to the above rule model;

[0026] Based on the aforementioned first full account list and the aforementioned expected transaction parameter information corresponding to the aforementioned rule model, determine the aforementioned expected transaction parameter information corresponding to the aforementioned rule model that causes the number of accounts in the generated first suspicious account list to fall below the preset value.

[0027] Based on the expected trading parameter information corresponding to the above rule model that did not reach the above preset value and the parameter deviation corresponding to the above rule model, the second actual trading parameter corresponding to the above rule model is determined.

[0028] According to embodiments of this disclosure, the above-described account list generation method further includes:

[0029] Financial data corresponding to the aforementioned rule model, obtained from the second full account list, is input into the aforementioned rule model derived from the second actual transaction parameters to generate a second suspicious account list; and

[0030] Based on the number of accounts in the second suspicious account list that correspond to the rule model and the number of accounts in the second target list that correspond to the rule model, a second hit rate corresponding to the rule model is determined. The second target list is generated based on the control list and the first target list.

[0031] According to embodiments of this disclosure, the above-described account list generation method further includes:

[0032] If the second hit rate corresponding to the above rule model does not reach the preset hit rate threshold, an adjustment operation is performed until the second hit rate of the above rule model reaches the above preset hit rate threshold. The adjustment operation represents adjusting the second actual transaction parameter corresponding to the above rule model.

[0033] If the preset hit rate threshold is not reached after performing the above adjustment operations, the above rule model will be reclassified.

[0034] The second aspect of this disclosure provides an account list generation apparatus, comprising: a first determining module, a second determining module, a third determining module, a first adjusting module, and a generating module. The first determining module is used to determine a list of accounts to be analyzed based on a control list and a first target list, wherein the control list includes a first suspicious account list, which includes suspicious accounts and a portion of the accounts in the first target list. The second determining module is used to perform feature analysis on the financial data of the accounts in the list of accounts to be analyzed, determining expected transaction parameter information corresponding to a rule model, wherein the rule model is established based on the transaction characteristics of the accounts involved, and the transaction characteristics are determined based on the expected transaction parameter information. The third determining module is used to determine a second actual transaction parameter corresponding to the rule model based on the expected transaction parameter information and a first actual transaction parameter corresponding to the rule model, wherein the first actual transaction parameter represents the current transaction parameter corresponding to the rule model. The first adjusting module is used to adjust the current transaction parameter corresponding to the rule model based on the second actual transaction parameter. The generation module is used to generate a second list of suspicious accounts based on the rule model adjusted by the second actual transaction parameters.

[0035] A third aspect of this disclosure provides an electronic device comprising: one or more processors; and a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors perform the methods described above.

[0036] A fourth aspect of this disclosure also provides a computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, cause the processor to perform the methods described above.

[0037] The fifth aspect of this disclosure also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method.

[0038] According to the account list generation method, apparatus, device, medium, and program products provided in this disclosure, by performing feature analysis on the financial data of the accounts in the account list to be analyzed, it is possible to determine the expected transaction parameter information corresponding to the rule model, and based on the expected transaction parameter information corresponding to the rule model and the first actual transaction parameter corresponding to the rule model, determine the second actual transaction parameter corresponding to the rule model. Then, based on the second actual transaction parameter corresponding to the rule model, adjust the current transaction parameter corresponding to the rule model, so as to generate a second suspicious account list based on the rule model adjusted by the second actual transaction parameter, thereby improving the accuracy of identifying the accounts involved in the case. Attached Figure Description

[0039] The foregoing contents, as well as other objects, features, and advantages of this disclosure, will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0040] Figure 1 The illustration schematically depicts application scenarios of the account list generation method, apparatus, device, medium, and program product according to embodiments of this disclosure;

[0041] Figure 2 A flowchart illustrating an account list generation method according to an embodiment of the present disclosure is shown schematically;

[0042] Figure 3 The illustration shows a schematic diagram of determining the hit rate corresponding to the rule model according to an embodiment of the present disclosure;

[0043] Figure 4 The illustration shows a schematic diagram of a module applied according to an embodiment of the present disclosure;

[0044] Figure 5 A schematic block diagram of an account list generation apparatus according to an embodiment of the present disclosure is shown; and

[0045] Figure 6 A block diagram schematically illustrates an electronic device suitable for implementing an account list generation method according to an embodiment of the present disclosure. Detailed Implementation

[0046] The embodiments of the present disclosure will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the disclosure. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of the present disclosure for ease of explanation. However, it will be apparent that one or more embodiments may be practiced without these specific details. Furthermore, descriptions of well-known structures and techniques are omitted in the following description to avoid unnecessarily obscuring the concepts of the present disclosure.

[0047] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit this disclosure. The terms “comprising,” “including,” etc., as used herein indicate the presence of the stated features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0048] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0049] When using expressions such as "at least one of A, B, and C", they should generally be interpreted in accordance with the meaning that is commonly understood by a person skilled in the art (e.g., "a system having at least one of A, B, and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B, and C, etc.).

[0050] In the technical solution disclosed herein, the collection, storage, use, processing, transmission, provision, disclosure, and application of user personal information comply with the provisions of relevant laws and regulations, necessary confidentiality measures have been taken, and there is no violation of public order and good morals.

[0051] In the technical solution disclosed herein, the acquisition, collection, storage, use, processing, transmission, provision, disclosure, and application of data all comply with the provisions of relevant laws and regulations, necessary confidentiality measures have been taken, and they do not violate public order and good morals.

[0052] In the process of developing this disclosure, it was discovered that, in order to effectively manage financial accounts (e.g., bank accounts) and reduce the rate of account involvement in criminal activities, financial institutions conduct data analysis and modeling on information such as the characteristics of involved customers and the transaction history of involved accounts to identify and control such accounts. Accounts involved in criminal activities often exhibit some obvious characteristics, such as small-amount probing and high-frequency trading. Data analysis models can be used to filter out accounts with significant characteristics. However, due to the numerous characteristics of accounts involved in criminal activities, and the fact that individuals involved constantly adjust their trading habits to conceal their transactions, accurately and effectively identifying accounts involved in criminal activities is a technical problem that needs to be solved in related technologies.

[0053] To this end, embodiments of this disclosure provide a method for generating an account list, comprising: determining an account list to be analyzed based on a control list and a first target list, wherein the control list includes a first suspicious account list, the first suspicious account list includes suspicious accounts and a portion of the accounts in the first target list; performing feature analysis on the financial data of the accounts in the account list to be analyzed to determine expected transaction parameter information corresponding to a rule model, wherein the rule model is established based on the transaction characteristics of the accounts involved, and the transaction characteristics are determined based on the expected transaction parameter information; determining a second actual transaction parameter corresponding to the rule model based on the expected transaction parameter information corresponding to the rule model and a first actual transaction parameter corresponding to the rule model, wherein the first actual transaction parameter represents the current transaction parameter corresponding to the rule model; adjusting the current transaction parameter corresponding to the rule model based on the second actual transaction parameter; and generating a second suspicious account list based on the rule model adjusted by the second actual transaction parameter.

[0054] Figure 1An application scenario diagram illustrating the generation of an account list according to an embodiment of this disclosure is shown.

[0055] like Figure 1 As shown, application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 serves as a medium for providing a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0056] Users can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 via the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc. (for example only).

[0057] The first terminal device 101, the second terminal device 102, and the third terminal device 103 can be various electronic devices with displays and support web browsing, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0058] Server 105 can be a server that provides various services, such as a backend management server that supports websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103 (this is just an example). The backend management server can analyze and process data such as received user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices.

[0059] For example, server 105 can determine the list of accounts to be analyzed based on the control list and the first target list; perform feature analysis on the financial data of the accounts in the list of accounts to be analyzed to determine the expected transaction parameter information corresponding to the rule model; determine the second actual transaction parameter corresponding to the rule model based on the expected transaction parameter information corresponding to the rule model and the first actual transaction parameter corresponding to the rule model; adjust the current transaction parameter corresponding to the rule model based on the second actual transaction parameter; and generate a second suspicious account list based on the rule model adjusted by the second actual transaction parameter.

[0060] It should be noted that the account list generation method provided in this embodiment can generally be executed by server 105. Correspondingly, the account list generation apparatus provided in this embodiment can generally be located in server 105. The account list generation method provided in this embodiment can also be executed by a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105. Correspondingly, the account list generation apparatus provided in this embodiment can also be located in a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105.

[0061] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0062] The following will be based on Figure 1 The described scene, through Figures 2-4 The method for generating an account list according to the disclosed embodiments is described in detail.

[0063] Figure 2 A flowchart illustrating an account list generation method according to an embodiment of the present disclosure is shown schematically.

[0064] like Figure 2 As shown, the method 200 includes operations S210 to S250.

[0065] When operating S210, the list of accounts to be analyzed is determined based on the control list and the primary target list.

[0066] According to embodiments of this disclosure, the control list may include a first suspicious account list. The first suspicious account list may include suspicious accounts and a subset of accounts from a first target list.

[0067] According to embodiments of this disclosure, the first target list may include a historical blacklist, which may represent a list of accounts currently involved in a case. Suspicious accounts may represent accounts that may be involved in a case. The list of accounts to be analyzed may represent accounts in the first target list that are not obtained from the control list.

[0068] According to embodiments of this disclosure, for example, the control list may include 1,000 accounts, of which 700 are suspicious accounts and 300 are accounts in a first target list. The first target list may include 400 accounts involved in the case. The list of accounts to be analyzed may include 100 accounts involved in the case from the first target list that are not obtained from the control list.

[0069] In operation S220, the financial data of the accounts in the list of accounts to be analyzed are subjected to feature analysis to determine the expected transaction parameter information corresponding to the rule model.

[0070] According to embodiments of this disclosure, the rule model is established based on the transaction characteristics of the accounts involved. These transaction characteristics are determined based on expected transaction parameter information. Feature analysis of financial data can characterize financial attribute data such as transaction flows, account characteristics, and held products of the accounts involved.

[0071] According to embodiments of this disclosure, transaction characteristics may include, for example, high-frequency trading characteristics and high-value trading characteristics. Financial data may include the frequency of transactions over a period of time or the number of transactions within a predetermined timeframe, the amount of each transaction, the number of high-frequency transactions, and the number of high-value transactions. Expected transaction parameter information may include the frequency of transactions by accounts in the account list to be analyzed over a period of time or the number of transactions within a predetermined timeframe, the ratio of high-frequency transactions to the total number of transactions, the amount of each transaction, and the ratio of high-value transactions to the total number of transactions. Rule models may include high-frequency trading models and high-value trading models.

[0072] According to embodiments of this disclosure, for example, the high-frequency trading characteristic can characterize that within a month, the account has at least 8 high-frequency transactions every 3 minutes and the ratio of the number of high-frequency transactions to the total number of transactions is not less than 1 / 4; the high-value trading characteristic can characterize that within a month, the account has high-value transactions with a transaction amount of not less than 10,000 and the ratio of the number of high-value transactions to the total number of transactions is not less than 1 / 4.

[0073] According to embodiments of this disclosure, for high-frequency trading models, it is necessary to obtain the trading frequency of accounts in the list of accounts to be analyzed, the number of transactions within a predetermined time period, and the ratio of high-frequency trading frequency to total trading frequency; for high-value trading models, it is necessary to obtain the amount of each transaction of accounts in the list of accounts to be analyzed and the ratio of high-value trading frequency to total trading frequency.

[0074] In operation S230, the second actual trading parameter corresponding to the rule model is determined based on the expected trading parameter information corresponding to the rule model and the first actual trading parameter corresponding to the rule model.

[0075] According to embodiments of this disclosure, the first actual transaction parameter can characterize the current transaction parameter corresponding to the rule model. The expected transaction parameter information is determined based on the financial data of accounts in the list of accounts to be analyzed.

[0076] According to embodiments of this disclosure, for a high-frequency trading model, the expected trading parameter information can characterize the frequency of transactions or the number of transactions within a predetermined time period, as well as the ratio of high-frequency transactions to total transactions, obtained from the financial data of accounts in the list of accounts to be analyzed; the first actual trading parameter can characterize the frequency of transactions or the number of transactions within a predetermined time period corresponding to the high-frequency trading model in the current period, as well as the ratio of high-frequency transactions to total transactions; the second actual trading parameter can characterize the frequency of transactions or the number of transactions within a predetermined time period corresponding to the high-frequency trading model in the next period, as determined by the expected trading parameter information and the first actual trading parameter, as well as the ratio of high-frequency transactions to total transactions.

[0077] According to embodiments of this disclosure, for example, based on the control list and the first target list obtained from the high-frequency trading model in November, a list of accounts to be analyzed can be determined, and based on the list of accounts to be analyzed, the expected trading parameter information of the high-frequency trading model can be determined. Based on the first actual trading parameters and expected trading parameter information of the current November high-frequency trading model, the second actual trading parameters for the December high-frequency trading model can be determined.

[0078] In operation S240, the current trading parameters corresponding to the rule model are adjusted according to the second actual trading parameters corresponding to the rule model.

[0079] According to embodiments of this disclosure, the current trading parameters of the rule model are adjusted to the second actual trading parameters based on the second actual trading parameters of the rule model.

[0080] In operation S250, a second list of suspicious accounts is generated based on the rule model adjusted by the second actual transaction parameters.

[0081] According to embodiments of this disclosure, by performing feature analysis on the financial data of currently unobtained accounts involved in the case, a second actual transaction parameter corresponding to the rule model is determined, and the transaction parameters of the corresponding rule model are adjusted according to the second actual transaction parameter so as to be used for the generation of the next suspicious account list, thereby improving the accuracy of identifying accounts involved in the case.

[0082] According to embodiments of this disclosure, determining a list of accounts to be analyzed based on a control list and a first target list includes: inputting financial data corresponding to a rule model obtained from a first full list of accounts into a rule model obtained based on first actual transaction parameters to generate a first suspicious account list; and generating a list of accounts to be analyzed based on the first suspicious account list and the first target list.

[0083] According to embodiments of this disclosure, the first full account list can represent all accounts currently obtained from various financial systems. For example, for a high-frequency trading model, the high-frequency trading model for November is input based on the frequency of transactions or the number of transactions within a predetermined time period obtained from all accounts obtained from various financial systems in November, as well as the ratio of high-frequency transactions to total transactions. Accounts that exhibited at least 8 high-frequency transactions every 3 minutes and whose high-frequency transaction ratio was not less than 1 / 4 within that month are output. The trading parameters of the high-frequency trading model for November are the first actual trading parameters. The accounts output by all rule models are aggregated to generate a first suspicious account list.

[0084] According to the embodiments of this disclosure, financial data corresponding to the rule model obtained from the first full account list is input into the rule model obtained based on the first actual transaction parameters to generate a first suspicious account list. Suspicious accounts that meet the rule model can be obtained. Based on the first suspicious account list and the first target list, an account list to be analyzed is generated, and the case-related accounts that have not been obtained in the first suspicious account list can be identified.

[0085] According to embodiments of this disclosure, the above-mentioned account list generation method further includes: determining a first hit rate corresponding to the rule model based on the number of suspicious accounts corresponding to the rule model in the first suspicious account list and the number of accounts corresponding to the rule model in the first target list; obtaining classification information corresponding to the rule model based on the first hit rate corresponding to the rule model, wherein the classification information includes a first-level rule model, a second-level rule model, and a third-level rule model; and temporarily freezing accounts in the first-level rule model, controlling outflows for accounts in the second-level rule model, and issuing risk warnings to accounts in the third-level rule model based on the control list.

[0086] According to embodiments of this disclosure, the first hit rate corresponding to the rule model can be expressed as the following formula (1).

[0087]

[0088] Where y1 can represent the first hit rate corresponding to the rule model, x1 can represent the number of suspicious accounts in the first suspicious account list corresponding to the rule model, and z1 can represent the number of accounts in the first target list corresponding to the rule model.

[0089] According to embodiments of this disclosure, the hit rate can be divided into three categories: hit rate greater than or equal to 50%, greater than or equal to 10% but less than 50%, and less than 10%. When the first hit rate corresponding to the rule model is greater than or equal to 50%, the rule model is a Level 1 rule model, and accounts within this rule model should be temporarily frozen. When the first hit rate corresponding to the rule model is greater than or equal to 10% but less than 50%, the rule model is a Level 2 rule model, and accounts within this rule model should be subject to billing control. When the first hit rate corresponding to the rule model is less than 10%, the rule model is a Level 3 rule model, and accounts within this rule model should be subject to risk warnings.

[0090] According to an embodiment of this disclosure, for example, the number of suspicious accounts corresponding to the high-frequency trading model in the first suspicious account list is 200, the number of suspicious accounts corresponding to the high-frequency trading model in the first target list is 100, and the suspicious accounts corresponding to the high-frequency trading model in the first suspicious account list include 20 accounts corresponding to the high-frequency trading model in the first target list. Then the first hit rate corresponding to the high-frequency trading model is 0.2. The high-frequency trading model is a secondary rule model, and the accounts in the high-frequency trading model should be subject to billing control processing.

[0091] According to an embodiment of this disclosure, for example, if the number of suspicious accounts corresponding to the high-value transaction model in the first suspicious account list is 300, the number of suspicious accounts corresponding to the high-value transaction model in the first suspicious account list is 80, and the suspicious accounts corresponding to the high-value transaction model in the first suspicious account list include 40 accounts in the first target list that correspond to the high-value transaction model, then the first hit rate corresponding to the high-value transaction model is 0.5. The high-value transaction model is a first-level rule model, and the accounts in the high-frequency transaction model should be temporarily frozen.

[0092] According to embodiments of this disclosure, if the first hit rate does not reach a preset hit rate threshold, the system can automatically adjust the first actual transaction parameters so that the first hit rate of the rule model can reach the preset hit rate threshold, thereby ensuring that the rule model can achieve a certain hit rate.

[0093] According to embodiments of this disclosure, based on a first hit rate corresponding to the rule model, the rule model can be classified and controlled according to different hit rates, thereby realizing the management of accounts in the rule model.

[0094] According to embodiments of this disclosure, based on a control list, accounts in the first-level rule model are temporarily frozen, accounts in the second-level rule model are subject to outflow control, and accounts in the third-level rule model are subject to risk warnings. This includes: determining an implementation control list based on the control list and a protected account list, wherein the protected account list includes special accounts; and based on the implementation control list, temporarily freezing accounts in the first-level rule model, subjecting accounts in the second-level rule model to outflow control, and issuing risk warnings to accounts in the third-level rule model.

[0095] According to embodiments of this disclosure, the protected account list may include special accounts. Special accounts may exhibit unusual transaction behavior that negatively impacts customer experience, but are not the accounts involved in the case. Removing special accounts from the control list yields an implementation control list. Based on this implementation control list, accounts in the rule model are categorized and controlled.

[0096] According to embodiments of this disclosure, deleting special accounts from the control list, that is, taking protective measures for special accounts, can prevent special accounts that are not involved in the case from being controlled.

[0097] According to embodiments of this disclosure, feature analysis is performed on the financial data of accounts in the account list to be analyzed to determine expected transaction parameter information corresponding to the rule model, including: performing feature analysis on the financial data of accounts in the account list to be analyzed to obtain expected transaction parameter information corresponding to the accounts in the account list to be analyzed; and assigning the expected transaction parameter information to the corresponding rule model to obtain expected transaction parameter information corresponding to the rule model.

[0098] According to embodiments of this disclosure, the expected transaction parameter information corresponding to accounts in the account list to be analyzed may include, over a period of time, the frequency of transactions by accounts in the account list or the number of transactions within a predetermined time period, the ratio of high-frequency transactions to the total number of transactions, the amount of each transaction, and the ratio of high-value transactions to the total number of transactions. The frequency of transactions or the number of transactions within a predetermined time period, and the ratio of high-frequency transactions to the total number of transactions are assigned to the high-frequency trading model, while the amount of each transaction and the ratio of high-value transactions to the total number of transactions are assigned to the high-value trading model.

[0099] According to embodiments of this disclosure, based on the list of accounts to be analyzed, expected transaction parameter information corresponding to the accounts in the list of accounts to be analyzed can be obtained, and the expected transaction parameter information can be allocated to the corresponding rule model according to the different transaction parameters required by the rule model, so as to obtain expected transaction parameter information corresponding to the rule model.

[0100] According to embodiments of this disclosure, determining a second actual transaction parameter corresponding to a rule model based on expected transaction parameter information corresponding to the rule model and a first actual transaction parameter corresponding to the rule model includes: determining a parameter deviation corresponding to the rule model based on expected transaction parameter information corresponding to the rule model and the first actual transaction parameter corresponding to the rule model; determining expected transaction parameter information corresponding to the rule model that causes the number of accounts in the generated first suspicious account list to fall below a preset value based on a first full account list and expected transaction parameter information corresponding to the rule model; and determining the second actual transaction parameter corresponding to the rule model based on expected transaction parameter information corresponding to the rule model that falls below the preset value and the parameter deviation corresponding to the rule model.

[0101] According to embodiments of this disclosure, for example, for the current high-frequency trading model, the expected trading parameter information obtained from the accounts in the list of accounts to be analyzed may include accounts that trade at least 7 times every 3 minutes, at least 6 times every 3 minutes, and at least 4 times every 3 minutes. The current first actual trading parameter of the high-frequency trading model can be expressed as at least 8 times every 3 minutes. Then, based on the expected trading parameter information and the first actual trading parameter, the parameter deviations corresponding to the high-frequency trading model can be determined to be 1, 2, and 4, respectively.

[0102] According to embodiments of this disclosure, for example, the time corresponding to 8 transactions of accounts in the first full account list of the current period is input into a high-frequency trading model that is sequentially adjusted according to the aforementioned expected trading parameter information, and it is determined whether the number of generated accounts reaches a preset value. If the first actual trading parameter of the high-frequency trading model in this period is adjusted from at least 8 transactions per 3 minutes to at least 4 transactions per 3 minutes, the number of generated suspicious accounts reaches the preset value; if the first actual trading parameter of the high-frequency trading model in this period is adjusted from at least 8 transactions per 3 minutes to at least 7 transactions per 3 minutes or at least 6 transactions per 3 minutes, the number of generated suspicious accounts does not reach the preset value. Therefore, the expected trading parameter information corresponding to the rule model that causes the number of accounts in the generated first suspicious account list to not reach the preset value is determined to be at least 7 transactions per 3 minutes or at least 6 transactions per 3 minutes. Then, based on the parameter deviation corresponding to the high-frequency trading model, the second actual trading parameter corresponding to the high-frequency trading model can be determined to be at least 6 transactions per 3 minutes.

[0103] According to embodiments of this disclosure, based on limiting the number of accounts in the suspicious account list according to preset values, a second actual transaction parameter corresponding to the rule model is determined according to the parameter deviation corresponding to the rule model.

[0104] According to embodiments of this disclosure, the above-mentioned account list generation method further includes: inputting financial data corresponding to the rule model obtained from the second full account list into the rule model obtained according to the second actual transaction parameters to generate a second suspicious account list; and determining a second hit rate corresponding to the rule model based on the number of accounts corresponding to the rule model in the second suspicious account list and the number of accounts corresponding to the rule model in the second target list, wherein the second target list is generated based on the control list and the first target list.

[0105] According to embodiments of this disclosure, the second full account list can represent the full accounts obtained from various financial systems in the next period. For example, for a high-frequency trading model, the high-frequency trading model for the next December period is input based on the frequency of transactions or the number of transactions within a predetermined time period obtained from the full accounts obtained from various financial systems in the next period, as well as the ratio of high-frequency transactions to total transactions. Accounts that exhibit at least 8 high-frequency transactions every 3 minutes and whose high-frequency transaction ratio is not less than 1 / 4 within this month are output. The trading parameters of the high-frequency trading model for the next December period are the second actual trading parameters. The accounts output by all rule models are aggregated to generate a second suspicious account list.

[0106] According to embodiments of this disclosure, the second hit rate corresponding to the rule model can be expressed as the following formula (2).

[0107]

[0108] Where y2 can represent the second hit rate corresponding to the rule model, x2 can represent the number of suspicious accounts in the second suspicious account list corresponding to the rule model, and z2 can represent the number of accounts in the second target list corresponding to the rule model.

[0109] According to an embodiment of this disclosure, for example, if the number of suspicious accounts corresponding to the high-frequency trading model in the second suspicious account list is 200, the number of suspicious accounts corresponding to the high-frequency trading model in the second target list is 100, and the suspicious accounts corresponding to the high-frequency trading model in the second suspicious account list include 20 accounts corresponding to the high-frequency trading model in the second target list, then the second hit rate corresponding to the high-frequency trading model is 0.2.

[0110] According to embodiments of this disclosure, the second target list may include a list of accounts already involved in the case. Based on the control list obtained in November, newly identified accounts involved in the case in November can be obtained, and these newly identified accounts can be added to the first target list to obtain a second target list that can be used in December.

[0111] According to embodiments of this disclosure, a second hit rate corresponding to a rule model can be determined based on a second list of suspicious accounts and a second target list, so as to classify and manage the rule model according to the second hit rate.

[0112] According to embodiments of this disclosure, the above-mentioned account list generation method further includes: performing an adjustment operation when the second hit rate corresponding to the rule model does not reach a preset hit rate threshold, until the second hit rate of the rule model reaches the preset hit rate threshold, wherein the adjustment operation represents adjusting the second actual transaction parameter corresponding to the rule model; and reclassifying the rule model if the preset hit rate threshold is not reached after performing the adjustment operation.

[0113] According to embodiments of this disclosure, if the second hit rate corresponding to the rule model does not reach a preset hit rate threshold, an adjustment operation is performed until the second hit rate of the rule model reaches the preset hit rate threshold. The adjustment operation can represent adjusting the second actual transaction parameter corresponding to the rule model to ensure that the rule model can achieve a certain hit rate.

[0114] According to the embodiments of this disclosure, if the preset hit rate threshold is still not reached after the adjustment operation is performed, the rule model can be reclassified, and the rule model that still does not reach the preset hit rate threshold can be reclassified into a level 3 rule model. It can be seen that the rule model may not be applicable to the characteristics of the account involved in this case.

[0115] According to embodiments of this disclosure, if the second hit rate of the rule model does not reach the preset hit rate threshold, an adjustment operation can be performed to enable the second hit rate of the rule model to reach the preset hit rate threshold. If the preset hit rate threshold is still not reached, the rule model can be classified into a third-level rule model.

[0116] Figure 3 The diagram illustrates the determination of the hit rate corresponding to the rule model according to an embodiment of the present disclosure.

[0117] like Figure 3 As shown, financial data for all accounts in the current period can be obtained from each financial system 301. For example, if rule model 302 is a high-frequency trading model, the frequency of transactions or the number of transactions within a predetermined time period for each account in the total number of accounts, as well as the ratio of high-frequency transactions to total transactions, are input into rule model 302. This outputs accounts in the current period that have at least 8 high-frequency transactions every 3 minutes and whose high-frequency transaction ratio is not less than 1 / 4 (the number of output accounts is x). Target list 303 can include a first target list and a second target list, with z accounts in the target list. Then, the hit rate 304 can be expressed as (x∩z) / z, where the hit rate can represent the first hit rate and the second hit rate.

[0118] Figure 4 The illustration shows a schematic diagram of a module for applying a rule model according to an embodiment of the present disclosure.

[0119] like Figure 4 As shown, the rule model application can be divided into a model management module 401, an account management module 402, and a monitoring module 403.

[0120] According to embodiments of this disclosure, the model management module 401 can be used to perform data preprocessing and data analysis on the financial data of all accounts obtained from various financial systems, input the data required for each type of rule model into the corresponding rule model. For example, the data required for the high-frequency trading model may include how often a transaction is made or the number of transactions within a predetermined time period, as well as the ratio of the number of high-frequency transactions to the total number of transactions. Finally, the accounts output by each rule model are summarized into a list of suspicious accounts, and a hit rate corresponding to each rule model is generated. The list of suspicious accounts may include a first list of suspicious accounts and a second list of suspicious accounts, and the hit rate may include a first hit rate and a second hit rate.

[0121] According to embodiments of this disclosure, the account management module 402 can be used to classify and control accounts in the rule models based on the list of suspicious accounts obtained from the model management module 401 and the hit rate corresponding to each rule model, and generate a control list. The control list can be used to determine what kind of processing to be performed on the accounts in the rule models, including temporarily freezing accounts in the first-level rule models, controlling the outflow of accounts in the second-level rule models, and providing risk warnings to accounts in the third-level rule models.

[0122] According to embodiments of this disclosure, the monitoring module 403 can be used to monitor the effectiveness of the list, evaluate the effectiveness of each model rule, analyze the characteristics of the accounts involved in the current period, determine the rule model parameter configuration with the highest hit rate, and feed back the effect of the determined parameter configuration to the model management module 401. The model management module 401 adjusts the first actual transaction parameter of the rule model according to the parameter configuration for the generation of the next suspicious account list. The rule model parameter configuration with the highest hit rate can represent the second actual transaction parameter.

[0123] According to embodiments of this disclosure, the rule model application enables the rule model to be continuously adjusted according to the constant changes in account transaction habits, thereby improving work efficiency.

[0124] Based on the above-described account list generation method, this disclosure also provides an account list generation apparatus. The following will be combined with... Figure 5 The device is described in detail.

[0125] Figure 5 A schematic block diagram of an account list generation apparatus according to an embodiment of the present disclosure is shown.

[0126] like Figure 5 As shown, the account list generation device 500 of this embodiment includes a first determining module 510, a second determining module 520, a third determining module 530, a first adjusting module 540, and a first generating module 550.

[0127] The first determining module 510 is used to determine a list of accounts to be analyzed based on the control list and the first target list, wherein the control list includes a first suspicious account list, and the first suspicious account list includes suspicious accounts and a portion of the accounts in the first target list. In one embodiment, the first determining module 510 can be used to perform the operation S210 described above, which will not be repeated here.

[0128] The second determining module 520 is used to perform feature analysis on the financial data of the accounts in the list of accounts to be analyzed, and to determine the expected transaction parameter information corresponding to the rule model. The rule model is established based on the transaction characteristics of the accounts involved, and the transaction characteristics are determined based on the expected transaction parameter information. In one embodiment, the second determining module 520 can be used to perform the operation S220 described above, which will not be repeated here.

[0129] The third determining module 530 is used to determine the second actual trading parameters corresponding to the rule model based on the expected trading parameter information corresponding to the rule model and the first actual trading parameters corresponding to the rule model, wherein the first actual trading parameters represent the current trading parameters corresponding to the rule model. In one embodiment, the third determining module 530 can be used to perform the operation S230 described above, which will not be repeated here.

[0130] The first adjustment module 540 is used to adjust the current trading parameters corresponding to the rule model based on the second actual trading parameters corresponding to the rule model. In one embodiment, the first adjustment module 540 can be used to perform the operation S240 described above, which will not be repeated here.

[0131] The first generation module 550 is used to generate a second list of suspicious accounts based on a rule model adjusted by the second actual transaction parameters. In one embodiment, the generation module 550 can be used to perform the operation S250 described above, which will not be repeated here.

[0132] According to embodiments of this disclosure, the first determining module 510 includes a first generating unit and a second generating unit.

[0133] The first generation unit is used to generate a first list of suspicious accounts by inputting the financial data corresponding to the rule model obtained from the first full account list into the rule model obtained according to the first actual transaction parameters.

[0134] The second generation unit is used to generate a list of accounts to be analyzed based on the first list of suspicious accounts and the first target list.

[0135] According to embodiments of this disclosure, the account list generation apparatus 500 further includes a fourth determining module, an obtaining module, and a processing module.

[0136] The fourth determination module is used to determine the first hit rate corresponding to the rule model based on the number of suspicious accounts in the first suspicious account list that correspond to the rule model and the number of accounts in the first target list that correspond to the rule model.

[0137] The acquisition module is used to obtain classification information corresponding to the rule model based on the first hit rate corresponding to the rule model. The classification information includes a first-level rule model, a second-level rule model, and a third-level rule model.

[0138] The processing module is used to temporarily freeze accounts in the first-level rule model, control outflows for accounts in the second-level rule model, and issue risk warnings for accounts in the third-level rule model, based on the control list.

[0139] According to embodiments of this disclosure, the processing module includes a first determining unit and a processing unit.

[0140] The first determining unit is used to determine the implementation of the control list based on the control list and the protection account list, wherein the protection account list includes special accounts.

[0141] The processing unit is used to temporarily freeze accounts in the first-level rule model, control outflows for accounts in the second-level rule model, and issue risk warnings to accounts in the third-level rule model, based on the implementation control list.

[0142] According to embodiments of this disclosure, the second determining module 520 includes a first obtaining unit and a second obtaining unit.

[0143] The first acquisition unit is used to perform feature analysis on the financial data of the accounts in the list of accounts to be analyzed, and to obtain the expected transaction parameter information corresponding to the accounts in the list of accounts to be analyzed.

[0144] The second acquisition unit is used to assign the expected trading parameter information to the corresponding rule model to obtain the expected trading parameter information corresponding to the rule model.

[0145] According to embodiments of this disclosure, the third determining module 530 includes a second determining unit, a third determining unit, and a fourth determining unit.

[0146] The second determining unit is used to determine the parameter deviation corresponding to the rule model based on the expected trading parameter information corresponding to the rule model and the first actual trading parameters corresponding to the rule model.

[0147] The third determining unit is used to determine the expected transaction parameter information corresponding to the rule model that causes the number of accounts in the generated first suspicious account list to fall below a preset value, based on the first full account list and the expected transaction parameter information corresponding to the rule model.

[0148] The fourth determining unit is used to determine the second actual trading parameters corresponding to the rule model based on the expected trading parameter information corresponding to the rule model that has not reached the preset value and the parameter deviation corresponding to the rule model.

[0149] According to embodiments of this disclosure, the account list generation apparatus 500 further includes a second generation module and a fifth determination module.

[0150] The second generation module is used to generate a second list of suspicious accounts by inputting the financial data corresponding to the rule model obtained from the second full account list into the rule model obtained according to the second actual transaction parameters.

[0151] The fifth determination module is used to determine the second hit rate corresponding to the rule model based on the number of accounts in the second suspicious account list that correspond to the rule model and the number of accounts in the second target list that correspond to the rule model. The second target list is generated based on the control list and the first target list.

[0152] According to embodiments of this disclosure, the account list generation apparatus 500 further includes a second adjustment module and a reclassification module.

[0153] The second adjustment module is used to perform adjustment operations when the second hit rate corresponding to the rule model does not reach the preset hit rate threshold, until the second hit rate of the rule model reaches the preset hit rate threshold. The adjustment operation represents adjusting the second actual transaction parameter corresponding to the rule model.

[0154] The reclassification module is used to reclassify the rule model if the preset hit rate threshold is not reached after the adjustment operation is performed.

[0155] According to embodiments of this disclosure, any plurality of modules among the first determining module 510, the second determining module 520, the third determining module 530, the first adjusting module 540, and the first generating module 550 may be combined into one module, or any one of these modules may be split into multiple modules. Alternatively, at least a portion of the functionality of one or more of these modules may be combined with at least a portion of the functionality of other modules and implemented in one module. According to embodiments of this disclosure, at least one of the first determining module 510, the second determining module 520, the third determining module 530, the first adjusting module 540, and the first generating module 550 may be at least partially implemented as hardware circuitry, such as a field-programmable gate array (FPGA), a programmable logic array (PLA), a system-on-a-chip, a system-on-a-substrate, a system-on-package, an application-specific integrated circuit (ASIC), or implemented in hardware or firmware by any other reasonable means of integrating or packaging the circuitry, or implemented in any one of software, hardware, and firmware methods, or in a suitable combination of any of these methods. Alternatively, at least one of the first determining module 510, the second determining module 520, the third determining module 530, the first adjusting module 540, and the first generating module 550 may be at least partially implemented as a computer program module, which can perform corresponding functions when the computer program module is run.

[0156] Figure 6 A block diagram schematically illustrates an electronic device suitable for implementing an account list generation method according to an embodiment of the present disclosure.

[0157] like Figure 6 As shown, an electronic device 600 according to an embodiment of this disclosure includes a processor 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage portion 608 into a random access memory (RAM) 603. The processor 601 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 601 may also include onboard memory for caching purposes. The processor 601 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of this disclosure.

[0158] RAM 603 stores various programs and data required for the operation of electronic device 600. Processor 601, ROM 602, and RAM 603 are interconnected via bus 604. Processor 601 performs various operations of the method flow according to embodiments of the present disclosure by executing programs in ROM 602 and / or RAM 603. It should be noted that the programs may also be stored in one or more memories other than ROM 602 and RAM 603. Processor 601 may also perform various operations of the method flow according to embodiments of the present disclosure by executing programs stored in said one or more memories.

[0159] According to embodiments of this disclosure, the electronic device 600 may further include an input / output (I / O) interface 605, which is also connected to a bus 604. The electronic device 600 may also include one or more of the following components connected to the I / O interface 605: an input section 606 including a keyboard, mouse, etc.; an output section 607 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 608 including a hard disk, etc.; and a communication section 609 including a network interface card such as a LAN card, modem, etc. The communication section 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the I / O interface 605 as needed. A removable medium 611, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 610 as needed so that computer programs read from it can be installed into the storage section 608 as needed.

[0160] This disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs that, when executed, implement the method according to the embodiments of this disclosure.

[0161] According to embodiments of this disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, such as including, but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this disclosure, the computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this disclosure, the computer-readable storage medium may include ROM 602 and / or RAM 603 and / or one or more memories other than ROM 602 and RAM 603 described above.

[0162] Embodiments of this disclosure also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code is used to cause the computer system to implement the item recommendation method provided in the embodiments of this disclosure.

[0163] When the computer program is executed by the processor 601, it performs the functions defined in the system / apparatus of this disclosure embodiments. According to embodiments of this disclosure, the systems, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0164] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and downloaded and installed via the communication section 609, and / or installed from the removable medium 611. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0165] In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 609, and / or installed from the removable medium 611. When the computer program is executed by the processor 601, it performs the functions defined in the system of this disclosure embodiment. According to embodiments of this disclosure, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0166] According to embodiments of this disclosure, program code for executing the computer programs provided in embodiments of this disclosure can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can execute entirely on the user's computing device, partially on the user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0167] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0168] Those skilled in the art will understand that the features described in the various embodiments and / or claims of this disclosure can be combined or combined in various ways, even if such combinations or combinations are not explicitly described in this disclosure. In particular, the features described in the various embodiments and / or claims of this disclosure can be combined or combined in various ways without departing from the spirit and teachings of this disclosure. All such combinations and / or combinations fall within the scope of this disclosure.

[0169] The embodiments of this disclosure have been described above. However, these embodiments are for illustrative purposes only and are not intended to limit the scope of this disclosure. Although various embodiments have been described above, this does not mean that the measures in the various embodiments cannot be used advantageously in combination. The scope of this disclosure is defined by the appended claims and their equivalents. Various substitutions and modifications can be made by those skilled in the art without departing from the scope of this disclosure, and all such substitutions and modifications should fall within the scope of this disclosure.

Claims

1. A method for generating an account list, comprising: The financial data corresponding to the rule model obtained from the first full account list is input into the rule model obtained based on the first actual transaction parameters to generate the first suspicious account list; wherein, the first full account list represents the full number of accounts currently obtained from various financial systems; Based on the control list and the first target list, a list of accounts to be analyzed is determined. The control list includes a first suspicious account list, which includes suspicious accounts and a portion of the accounts in the first target list. The first target list includes a historical blacklist, which represents the list of accounts currently involved in the case. The list of accounts to be analyzed represents accounts in the first target list that are not obtained from the control list, in order to determine the accounts involved in the case that are not obtained from the first suspicious account list. The financial data of the accounts in the list of accounts to be analyzed are subjected to feature analysis to determine the expected transaction parameter information corresponding to the rule model. The rule model is established based on the transaction characteristics of the accounts involved in the case, and the transaction characteristics are determined based on the expected transaction parameter information. Based on the expected trading parameter information corresponding to the rule model and the first actual trading parameter corresponding to the rule model, a second actual trading parameter corresponding to the rule model is determined, wherein the first actual trading parameter represents the current trading parameter corresponding to the rule model; Adjust the current transaction parameters corresponding to the rule model based on the second actual transaction parameters corresponding to the rule model; A second list of suspicious accounts is generated based on the rule model adjusted by the second actual transaction parameters.

2. The method according to claim 1, further comprising: Based on the number of suspicious accounts in the first suspicious account list that correspond to the rule model and the number of accounts in the first target list that correspond to the rule model, a first hit rate corresponding to the rule model is determined; Based on the first hit rate corresponding to the rule model, classification information corresponding to the rule model is obtained, wherein the classification information includes a first-level rule model, a second-level rule model, and a third-level rule model; According to the control list, accounts in the first-level rule model are temporarily frozen, accounts in the second-level rule model are subject to outflow control, and accounts in the third-level rule model are subject to risk warnings.

3. The method according to claim 2, wherein, The process of temporarily freezing accounts in the first-level rule model, controlling outflows from accounts in the second-level rule model, and issuing risk warnings to accounts in the third-level rule model, based on the control list, includes: Based on the control list and the protected account list, a control list for implementation is determined, wherein the protected account list includes special accounts; According to the implementation control list, accounts in the first-level rule model are temporarily frozen, accounts in the second-level rule model are subject to outflow control, and accounts in the third-level rule model are subject to risk warnings.

4. The method according to claim 1, wherein, The step of performing feature analysis on the financial data of the accounts in the list of accounts to be analyzed to determine the expected transaction parameter information corresponding to the rule model includes: The financial data of the accounts in the list of accounts to be analyzed are subjected to feature analysis to obtain the expected transaction parameter information corresponding to the accounts in the list of accounts to be analyzed; The expected transaction parameter information is assigned to the corresponding rule model to obtain the expected transaction parameter information corresponding to the rule model.

5. The method according to claim 1, wherein, The step of determining the second actual trading parameter corresponding to the rule model based on the expected trading parameter information corresponding to the rule model and the first actual trading parameter corresponding to the rule model includes: Based on the expected trading parameter information corresponding to the rule model and the first actual trading parameter corresponding to the rule model, determine the parameter deviation corresponding to the rule model; Based on the first full account list and the expected transaction parameter information corresponding to the rule model, determine the expected transaction parameter information corresponding to the rule model that causes the number of accounts in the generated first suspicious account list to not reach a preset value; Based on the expected trading parameter information corresponding to the rule model that did not reach the preset value and the parameter deviation corresponding to the rule model, the second actual trading parameter corresponding to the rule model is determined.

6. The method according to claim 1 or 5, further comprising: Financial data corresponding to the rule model obtained from the second full account list is input into the rule model obtained based on the second actual transaction parameters to generate a second suspicious account list; as well as Based on the number of accounts in the second suspicious account list that correspond to the rule model and the number of accounts in the second target list that correspond to the rule model, a second hit rate corresponding to the rule model is determined, wherein the second target list is generated based on the control list and the first target list.

7. The method according to claim 6, further comprising: If the second hit rate corresponding to the rule model does not reach the preset hit rate threshold, an adjustment operation is performed until the second hit rate of the rule model reaches the preset hit rate threshold. The adjustment operation represents adjusting the second actual transaction parameter corresponding to the rule model. If the preset hit rate threshold is not reached after the adjustment operation is performed, the rule model is reclassified.

8. An account list generation device, comprising: The first generation unit is used to input the financial data corresponding to the rule model obtained from the first full account list into the rule model obtained according to the first actual transaction parameters to generate the first suspicious account list; wherein, the first full account list represents the full account list currently obtained from various financial systems; The first determining module is used to determine a list of accounts to be analyzed based on the control list and the first target list. The control list includes a first suspicious account list, which includes suspicious accounts and a portion of the accounts in the first target list. The first target list includes a historical blacklist, which represents a list of accounts currently involved in cases. The list of accounts to be analyzed represents accounts in the first target list that are not obtained from the control list, in order to determine the accounts involved in cases that are not obtained from the first suspicious account list. The second determining module is used to perform feature analysis on the financial data of the accounts in the list of accounts to be analyzed, and determine the expected transaction parameter information corresponding to the rule model, wherein the rule model is established based on the transaction characteristics of the accounts involved, and the transaction characteristics are determined based on the expected transaction parameter information; The third determining module is used to determine the second actual transaction parameter corresponding to the rule model based on the expected transaction parameter information corresponding to the rule model and the first actual transaction parameter corresponding to the rule model, wherein the first actual transaction parameter represents the current transaction parameter corresponding to the rule model; The first adjustment module is used to adjust the current transaction parameters corresponding to the rule model according to the second actual transaction parameters corresponding to the rule model; The first generation module is used to generate a second list of suspicious accounts based on the rule model adjusted by the second actual transaction parameters.

9. An electronic device, comprising: One or more processors; Storage device for storing one or more programs. Wherein, when the one or more programs are executed by the one or more processors, the one or more processors perform the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, cause the processor to perform the method according to any one of claims 1 to 7.

11. A computer program product comprising a computer program that, when executed by a processor, implements the method according to any one of claims 1 to 7.

Images