Object anomaly prediction method, device and computer readable storage medium

Abstract

The embodiment of the application discloses an object abnormality prediction method and device and a computer readable storage medium, which can be applied to various scenes such as cloud technology, artificial intelligence and intelligent transportation; object behavior data of a target object for a resource transfer event is obtained, and a plurality of abnormality prediction models for the resource transfer event are determined, wherein each abnormality prediction model corresponds to predicting an object abnormality category; for each object abnormality category, the object behavior data is filtered to obtain target object behavior data corresponding to each abnormality prediction model; the target object behavior data is subjected to multi-stage abnormality prediction by using the abnormality prediction model to obtain multi-stage prediction results of each abnormality prediction model under the corresponding object abnormality category; and the multi-stage prediction results of all abnormality prediction models are subjected to fusion processing to obtain a target abnormality category of the target object. In this way, the accuracy of the abnormality prediction result is improved, and the abnormality prediction efficiency of the target object is improved.

Description

Technical Field

[0001] This application relates to the field of Internet technology, specifically to a method, apparatus, and computer-readable storage medium for predicting object anomalies. Background Technology

[0002] With the rapid development of internet technology, the transfer of virtual resources via the internet is becoming increasingly common in users' daily lives, such as in payment or money transfer transactions. To ensure the normal operation of virtual resource transfer services, it is necessary to predict the degree of abnormality in user-related virtual resource transfer events in order to effectively manage the risks associated with these events.

[0003] In existing methods for predicting user anomalies, most banks and fintech institutions rely on basic user information (such as education, income, occupation, etc.) and user feedback based on virtual resource transfer events to identify user anomalies. However, this information is often lagging and inaccurate, affecting the accuracy of user anomaly prediction results and thus leading to low efficiency in predicting user anomalies. Summary of the Invention

[0004] This application provides an object anomaly prediction method, apparatus, and computer-readable storage medium, which can improve the accuracy of anomaly prediction results and enhance the efficiency of anomaly prediction for target objects.

[0005] This application provides an object anomaly prediction method, including:

[0006] Acquire object behavior data of the target object in response to the resource transfer event and determine multiple anomaly prediction models for the resource transfer event, wherein each anomaly prediction model corresponds to predicting an object anomaly category.

[0007] For each object anomaly category, filter the object behavior data to obtain the target object behavior data corresponding to each anomaly prediction model;

[0008] The anomaly prediction model is used to perform multi-stage anomaly prediction on the target object's behavioral data, and the multi-stage prediction results of each anomaly prediction model under the corresponding object anomaly category are obtained. The multi-stage prediction results include the anomaly prediction results of the target object under the object anomaly category for multiple preset time stages.

[0009] The multi-stage prediction results of all anomaly prediction models are fused to obtain the target anomaly category of the target object.

[0010] Accordingly, embodiments of this application provide an object anomaly prediction device, including:

[0011] The acquisition unit is used to acquire object behavior data of the target object in response to the resource transfer event and to determine multiple anomaly prediction models for the resource transfer event, wherein each anomaly prediction model corresponds to predicting an object anomaly category.

[0012] The filtering unit is used to filter the object behavior data for each object anomaly category to obtain the target object behavior data corresponding to each anomaly prediction model.

[0013] The prediction unit is used to perform multi-stage anomaly prediction on the target object behavior data using the anomaly prediction model, and obtain the multi-stage prediction result of each anomaly prediction model under the corresponding object anomaly category. The multi-stage prediction result includes the anomaly prediction results of the target object under the object anomaly category for multiple preset time stages.

[0014] The fusion unit is used to fuse the multi-stage prediction results of all anomaly prediction models to obtain the target anomaly category of the target object.

[0015] In one embodiment, the fusion unit includes:

[0016] The preset weight value acquisition sub-unit is used to acquire the preset weight value of the multi-stage prediction result corresponding to the anomaly category of each object;

[0017] The weighting subunit is used to weight the multi-stage prediction results of the anomaly prediction model according to the preset weight values ​​to obtain the anomaly weighted prediction value of the target object at each preset time stage.

[0018] The target anomaly category determination subunit is used to determine the target anomaly category of the target object based on the anomaly weighted prediction value of the target object at each preset time stage.

[0019] In one embodiment, the weighting subunit includes:

[0020] The weighting module is used to weight each abnormal prediction result corresponding to each preset time stage in the multi-stage prediction result according to the preset weight value.

[0021] The determination module is used to determine the abnormal weighted prediction value of the target object at each preset time stage based on the weighted processing result.

[0022] In one embodiment, the target anomaly category determination subunit includes:

[0023] The comparison module is used to compare the abnormal weighted prediction values ​​of the target object at each preset time stage, and determine the target preset time stage in which the target object is located based on the comparison results.

[0024] The comparison module is used to compare the anomaly weighted prediction value corresponding to the target preset time stage with a preset threshold, and determine the target anomaly category of the target object based on the comparison result.

[0025] In one embodiment, the prediction unit includes:

[0026] An anomaly prediction subunit is used to perform multi-stage anomaly prediction on the target object behavior data using the anomaly prediction model, and to obtain the anomaly probability value of each object anomaly category corresponding to each preset time stage.

[0027] The multi-stage prediction result determination subunit is used to determine the multi-stage prediction result of the target object matching each object anomaly category based on the anomaly probability value of the target object corresponding to each object anomaly category in each preset time stage.

[0028] In one embodiment, the object anomaly prediction device further includes:

[0029] The access control unit is used to determine the target access control strategy based on the target anomaly category of the target object, and to control the access of the target object based on the target access control strategy;

[0030] The feedback data acquisition unit is used to acquire the control feedback data of the target object based on the target permission control policy;

[0031] The adjustment unit is used to determine the control effect based on the control feedback data, and to adjust the target permission control strategy based on the control effect.

[0032] In one embodiment, the access control unit includes:

[0033] The strategy determination subunit is used to determine the corresponding target alert strategy and target permission adjustment strategy based on the target anomaly category.

[0034] The reminder subunit is used to generate a corresponding reminder event based on the target reminder strategy, and to perform a reminder operation on the target object according to the reminder event;

[0035] The permission adjustment subunit is used to perform permission adjustment operations on the transaction permissions of the target object according to the target permission adjustment strategy.

[0036] In one embodiment, the adjustment unit includes:

[0037] The feedback score calculation subunit is used to calculate the feedback score corresponding to the target permission control policy based on the control feedback data.

[0038] The adjustment subunit is used to adjust the target access control strategy based on the feedback score.

[0039] In one embodiment, the adjustment subunit includes:

[0040] The comparison module is used to compare the feedback score with multiple preset score intervals in a preset score interval set to obtain the interval comparison result;

[0041] The target preset score interval determination module is used to determine the target preset score interval corresponding to the feedback score based on the interval comparison result.

[0042] The adjusted target access control strategy determination module is used to determine the adjusted target access control strategy based on the target preset score range.

[0043] In one embodiment, the adjustment subunit includes:

[0044] The adjustment weight value determination module is used to determine the adjustment weight value based on the target preset score range;

[0045] The adjustment module is used to adjust the preset weight value of the multi-stage prediction result corresponding to each object anomaly category based on the adjustment weight value, so as to obtain the adjusted preset weight value.

[0046] The update module is used to update the target anomaly category of the target object according to the adjusted preset weight value, so as to adjust the target permission control strategy.

[0047] Furthermore, embodiments of this application also provide a computer-readable storage medium storing a plurality of instructions adapted for loading by a processor to execute steps in any of the object anomaly prediction methods provided in embodiments of this application.

[0048] Furthermore, this application also provides a computer device, including a processor and a memory, wherein the memory stores an application program, and the processor is used to run the application program in the memory to implement the object anomaly prediction method provided in this application.

[0049] This application also provides a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the steps in the object anomaly prediction method provided in this application.

[0050] This application embodiment obtains object behavior data of a target object in response to a resource transfer event and determines multiple anomaly prediction models for the same event. Each anomaly prediction model predicts a specific object anomaly category. For each object anomaly category, the object behavior data is filtered to obtain target object behavior data corresponding to each anomaly prediction model. The anomaly prediction models are then used to perform multi-stage anomaly prediction on the target object behavior data, yielding multi-stage prediction results for each model under the corresponding object anomaly category. The multi-stage prediction results of all anomaly prediction models are then fused to obtain the target anomaly category of the target object. This improves the accuracy and efficiency of anomaly prediction for the target object by using multiple anomaly prediction models to perform multi-stage predictions on the target object behavior data, obtaining multi-stage prediction results for each model under the corresponding object anomaly category, and fusing the multi-stage prediction results of all anomaly prediction models to obtain the target anomaly category. Attached Figure Description

[0051] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0052] Figure 1 This is a schematic diagram illustrating an implementation scenario of an object anomaly prediction method provided in this application embodiment;

[0053] Figure 2 This is a flowchart illustrating an object anomaly prediction method provided in an embodiment of this application;

[0054] Figure 3 This is a schematic diagram of a specific process for an object anomaly prediction method provided in an embodiment of this application;

[0055] Figure 4 This is another specific flowchart illustrating an object anomaly prediction method provided in an embodiment of this application;

[0056] Figure 5a This is a schematic diagram illustrating the specific architecture of an object anomaly prediction method provided in an embodiment of this application.

[0057] Figure 5b This is another flowchart illustrating an object anomaly prediction method provided in an embodiment of this application;

[0058] Figure 6 This is a schematic diagram of the object anomaly prediction device provided in the embodiments of this application;

[0059] Figure 7 This is a schematic diagram of the structure of the computer device provided in the embodiments of this application. Detailed Implementation

[0060] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0061] This application provides an object anomaly prediction method, apparatus, and computer-readable storage medium. The object anomaly prediction apparatus can be integrated into a computer device, which may be a server or a terminal, etc.

[0062] The server can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery network (CDN) acceleration services, and big data and artificial intelligence platforms. The terminal can be a smartphone, tablet, laptop, desktop computer, smart speaker, smartwatch, or other device capable of information processing, but is not limited to these. The terminal and server can be directly or indirectly connected via wired or wireless communication, and this application does not impose any restrictions on this connection.

[0063] Please see Figure 1 Taking the integration of an object anomaly prediction device into a computer device as an example, Figure 1 This is a schematic diagram illustrating an implementation scenario of the object anomaly prediction method provided in this application. The computer device can be a server. The server can acquire object behavior data of the target object in response to a resource transfer event and determine multiple anomaly prediction models for the resource transfer event. Each anomaly prediction model corresponds to predicting an object anomaly category. For each object anomaly category, the object behavior data is filtered to obtain target object behavior data corresponding to each anomaly prediction model. The anomaly prediction model is used to perform multi-stage anomaly prediction on the target object behavior data to obtain the multi-stage prediction result of each anomaly prediction model under the corresponding object anomaly category. The multi-stage prediction results of all anomaly prediction models are fused to obtain the target anomaly category of the target object.

[0064] It should be noted that, Figure 1The illustrated scenario of the object anomaly prediction method is merely an example. The implementation environment scenario of the object anomaly prediction method described in this application is for the purpose of more clearly illustrating the technical solution of this application and does not constitute a limitation on the technical solution provided in this application. Those skilled in the art will understand that, with the evolution of object anomaly prediction and the emergence of new business scenarios, the technical solution provided in this application is also applicable to similar technical problems.

[0065] The following sections provide detailed descriptions of each example. It should be noted that the order in which the embodiments are described is not intended to limit the preferred order of the embodiments.

[0066] This embodiment will be described from the perspective of an object anomaly prediction device, which can be integrated into a computer device, which can be a server, and this application does not limit it.

[0067] Please see Figure 2 , Figure 2 This is a flowchart illustrating the object anomaly prediction method provided in an embodiment of this application. The object anomaly prediction method includes:

[0068] In step 101, object behavior data of the target object in response to the resource transfer event is obtained, and multiple anomaly prediction models for the resource transfer event are determined.

[0069] In the field of computer technology, resources generally refer to virtual resources corresponding to physical resources in the real world, such as storage space, computing power, e-books, bank account deposits, e-wallet account deposits, and virtual currency deposits. These can include, but are not limited to, monetary assets used in online transactions. Virtual resources can be a concept opposed to real resources, such as real currencies like RMB and virtual currencies like QQ coins, QQ points, and game points purchased by users. Correspondingly, resource transfer can refer to actions such as the transfer and payment of currency, such as online payments and online receipts; the amount of resource transfer is the quantity of currency transferred or paid, such as the amount of payment, transfer, or repayment. The resource transfer event can be an event that transfers virtual resources, such as payment, lending, repayment, or transfer. The target object can be the object of the resource transfer, which can be a mapping of entities such as people, events, and objects existing in the objective world in computer logic. For example, the target object can be the user who transferred the virtual resources.

[0070] The object behavior data can include data generated by the target object in response to resource transfer events, which can be used to measure the degree of abnormality of the target object. In one embodiment, the object behavior data can include data categorized as multi-time-stage object operation behavior data, object asset data, object identity profile data, and object historical credit data. The multi-time-stage data can be multiple different time stages pre-defined according to specific needs, and the degree of abnormality can be described by the dimension of time stage. For example, the time stage with an overdue period of 30 days can be called the early stage, the time stage with an overdue period of 30 to 60 days can be called the mid-stage, and the time stage with an overdue period of 60 to 90 days can be called the late stage. Different time stages can also be divided according to specific needs, and this is not limited here.

[0071] The multi-time-period user behavior data can include borrowing behavior data, repayment behavior data, login behavior data, and user feedback behavior data. These user behavior data dimensions will be statistically analyzed over multiple months or multiple time windows. Borrowing behavior data can include the number of virtual resource transfers (e.g., number of loans), the amount of virtual resource transfers (e.g., loan amount), and the timing of virtual resource transfers (e.g., loan time and order). Repayment behavior data can include the number of repayments, repayment amount, and repayment channel. Login behavior data can include the number of times, time, and order of operations on loan-related applications (APPs). User feedback behavior data can include message triggers and clicks. These sub-dimensions of data will be statistically analyzed over multiple months or multiple time windows.

[0072] The target asset data across multiple time periods can include estimated monthly income, monthly consumption, savings, and other asset estimates. The estimated monthly income can include data on the target's salary, rent, and red envelopes; the monthly consumption data can include data on shopping, food delivery, and regional consumption index ranking; the savings data can include data on investment transfers and cash balances; and the other asset estimates can include data on movable and immovable property obtained from the target's registration data. These sub-dimensional data will also be statistically analyzed over multiple months or multiple window periods.

[0073] Multi-time-period object identity profiles can include data such as work-related data, educational background-related data, and social activity-related data. Work-related data can include occupation, position, and length of service; educational background-related data can include education level, school, and major; and social activity-related data can include the geographical area and scope of social interactions. Similarly, these sub-dimensions of data also need to be segmented and statistically calculated across multiple time periods. Real-time and offline object identity profiles can be constructed based on multi-time-period object identity profile data.

[0074] Historical credit data of an entity may include default history data, performance history data, and other risk data. Default history data may include data such as the amount of virtual resources defaulted (e.g., default amount), default duration, default frequency, earliest and most recent default time, etc. Performance history data may include data such as the number of repayments and the amount of virtual resources repaid (e.g., repayment amount), etc. Other risk data may include data such as multiple borrowing data and cash-out data.

[0075] Simultaneously, dynamic changes in object behavior data can be statistically analyzed over a periodic dimension. For example, current features can be compared with features from historical time periods, such as comparing current features with features from 1 month, 3 months, or 6 months ago, to obtain feature change data. This feature change data can be used as input for multiple anomaly prediction models, thereby increasing the data dimension and enabling more granular feature segmentation across multiple time periods. This allows for more timely prediction of anomalies in target objects and achieves more accurate anomaly prediction results, improving the efficiency of object anomaly prediction.

[0076] Most object behavior data can be actively generated by the target object and is relatively accurate object operation behavior and credit data. Most of the data can be calculated using a daily or hourly update frequency. For inaccurate data such as asset estimation data, it can be used as auxiliary judgment information for anomaly prediction results to improve the accuracy of anomaly prediction results.

[0077] Object behavior data can primarily be obtained through technologies and platforms such as data reporting services on smart terminals, big data storage platforms, and big data analytics platforms. Big data storage platforms can include in-memory databases (e.g., Redis) or distributed file systems (e.g., Hadoop Distributed File System, HDFS), while big data analytics platforms can include mapping-reduction models (MapReduce), structured data processing modules (SparkSQL), and machine learning libraries (PyTorch). This object behavior data can be aggregated into offline and real-time data features, allowing for anomaly prediction through both offline and real-time computation. This improves the accuracy and efficiency of anomaly prediction.

[0078] This anomaly prediction model is a predictive model built based on multiple dimensions for measuring anomalies. It can measure and predict anomalies in object sample data across multiple dimensions to determine the anomaly prediction result for the target object. For example, in post-loan scenarios, it can predict the risk level of a user. This anomaly prediction model can combine real-time and offline computing, enabling more timely and accurate anomaly predictions for target objects. Each measurement dimension of the anomaly prediction model can correspond to an object anomaly category. This object anomaly category can be used to measure the anomaly type of the target object, and each object anomaly category can be used to measure the risk level of the target object. For example, the measurement dimensions can be dimensions such as default probability, repayment willingness, and whether it belongs to a certain anomaly label. Correspondingly, the object anomaly categories can be categories such as default prediction, repayment willingness prediction, and anomaly label prediction. Anomaly labels can be abnormal behaviors such as debt evasion and account transfer silence (the behavior of immediately transferring income without repayment after obvious delinquency).

[0079] Each anomaly prediction model can predict one object anomaly category. An object anomaly category can include one or more object anomaly subcategories, such as categories of different measurement sub-dimensions or categories of different time periods. In addition, an anomaly prediction model can also predict multiple object anomaly categories, which is not limited here.

[0080] Therefore, by acquiring object behavior data of the target object in response to resource transfer events, and by determining multiple anomaly prediction models for resource transfer events, the degree of anomaly of the target object can be predicted.

[0081] In step 102, the object behavior data is filtered for each object anomaly category to obtain the target object behavior data corresponding to each anomaly prediction model.

[0082] The target object behavior data can be data determined from object behavior data based on object anomaly categories, or it can be the input data for the anomaly prediction model corresponding to each object anomaly category. This target object behavior data can be filtered within the object behavior data based on the input features of the anomaly prediction model.

[0083] Specifically, the target object behavior data can be filtered based on the object anomaly category corresponding to each anomaly prediction model to obtain the target object behavior data for each anomaly prediction model. For example, assuming the object anomaly category of the anomaly prediction model is the default prediction category, data corresponding to this object anomaly category can be filtered from the object behavior data to obtain the target object behavior data for the default prediction model; when the object anomaly category of the anomaly prediction model is the repayment willingness prediction category, data corresponding to this object anomaly category can be filtered from the object behavior data to obtain the target object behavior data for the repayment willingness prediction model; when the object anomaly category of the anomaly prediction model is the anomaly label prediction category, data corresponding to this object anomaly category can be filtered from the object behavior data to obtain the target object behavior data for the anomaly label prediction model, and so on. Specifically, for example, assuming the input data for the anomaly label prediction model consists of multi-time-period object operation behavior data, object profile data, object historical credit data, and object asset data, and the object anomaly category is the anomaly label prediction category, then the object behavior data can be filtered based on the object anomaly category to find multi-time-period object operation behavior data, object profile data, object historical credit data, and object asset data, thereby obtaining the target object behavior data for each anomaly prediction model.

[0084] Optionally, the process of filtering object behavior data may not be necessary. That is, the object behavior data of the target object can be determined as the target object behavior data. The specific filtering of object behavior data to obtain the target object behavior data can be based on the actual situation, and no restrictions are imposed here.

[0085] In step 103, an anomaly prediction model is used to perform multi-stage anomaly prediction on the target object's behavioral data, and the multi-stage prediction results of each anomaly prediction model under the corresponding object anomaly category are obtained.

[0086] Specifically, anomaly prediction models can be used to predict anomalies in the target object's behavioral data across multiple time stages, yielding multi-stage prediction results for each anomaly prediction model under the corresponding object anomaly category. These multi-stage prediction results can include the anomaly prediction results of the target object under the object anomaly category for multiple preset time stages, that is, the anomaly prediction results of the target object output by multiple anomaly prediction models for multiple preset time stages.

[0087] Optionally, the anomaly prediction model can be used to perform multi-stage anomaly prediction on the target object's behavioral data to obtain the anomaly probability value of each object anomaly category corresponding to the target object in each preset time stage. Then, based on the anomaly probability value of each object anomaly category corresponding to the target object in each preset time stage, the multi-stage prediction result of the target object matching each object anomaly category can be determined.

[0088] For example, we can assume that the preset time stages are three time stages set according to actual needs: the early stage, the middle stage, and the late stage. There are three anomaly prediction models, a, b, and c, corresponding to three object anomaly categories, A, B, and C. We can use these anomaly prediction models a, b, and c to predict the anomalies of the corresponding target object behavior data in these three time stages, and obtain the anomaly probability value of the target object in each object anomaly category in each preset time stage. Specifically, we can obtain the anomaly probability values ​​of the target object in object anomaly categories A, B, and C in the early stage, in the middle stage, and in the late stage. Then, based on the anomaly probability values ​​of the target object in each object anomaly category A, B, and C in the early, middle, and late stages, we can determine the multi-stage prediction result of the target object matching each object anomaly category.

[0089] In one embodiment, please refer to Figure 3 , Figure 3 This is a schematic diagram illustrating a specific process for an object anomaly prediction method provided in an embodiment of this application. Multiple anomaly prediction models may include a repayment willingness prediction model, an anomaly label prediction model, and a default prediction model. These models can perform probability prediction through a combination of offline and real-time computation. Specifically, the repayment willingness prediction model can be used to predict the repayment willingness of a target object based on input object sample data; the anomaly label prediction model can be used to predict the probability that a target object matches a certain anomaly label based on input object sample data, for example, to identify potentially high-risk abnormal behaviors of users in post-loan scenarios; and the default prediction model can be used to predict the probability of a target object defaulting at each time stage based on input object sample data. Thus, the degree of anomaly of the target object can be comprehensively predicted based on these three dimensions and object behavior data. The multi-stage prediction result can be the anomaly probability value of each object anomaly category corresponding to the target object at each preset time stage, or it can be a prediction result determined by the anomaly probability value.

[0090] Optionally, the default prediction model may include multiple sub-stage models, such as early stage, mid-stage, and late stage, or other time stages. There are no restrictions on this. For example, it may include sub-models with multiple time stages, such as the M0-M1 stage transition sub-model, the M1-M2 stage transition sub-model, and the M2-M3 stage transition sub-model. Here, M0 can represent the stage of no default (e.g., no overdue payment), M1 can represent the stage of default 1-30 days (e.g., overdue payment 1 to 30 days), M2 can represent the stage of default 30-60 days (e.g., overdue payment 30 to 60 days), and so on. This model can employ machine learning algorithms such as logistic regression, ensemble learning (gradient boosting trees, XGBoost), and neural networks for anomaly prediction. It determines the degree of anomaly based on the predicted anomaly probability values. For example, if the anomaly probability of a target object defaulting in the M0-M1 sub-model this month is >0.8, the anomaly level is considered high for the target object to default in the M1 stage; if the anomaly probability is <0.2, the anomaly level is considered low. Similarly, if the predicted anomaly probability in the M0-M1 stage this month is <0.2, but the predicted anomaly level in the M1-M2 stage next month is higher (>0.6), the target object is considered to have a high anomaly level in the middle of the M2 stage, and so on. The default prediction model can comprehensively judge the prediction results across different time stages, correlate them with the model's historical output results, and output combined anomaly probability values ​​for multiple time stages.

[0091] The repayment willingness prediction model can include sub-models such as repayment willingness prediction within M1 and repayment willingness prediction within M1+, spanning multiple time periods. This model can employ machine learning algorithms such as logistic regression, ensemble learning (gradient boosting trees, XGBoost), and neural networks to predict repayment willingness. Based on different predicted anomaly probabilities, it estimates the probability of repayment at different time periods. For example, in the M1 repayment willingness prediction sub-model, an anomaly probability > 0.9 indicates a higher probability of repayment within M1 (within 30 days of delinquency), while an anomaly probability < 0.2 indicates a lower probability. Furthermore, the repayment willingness prediction model can comprehensively assess the prediction results across different time periods, consider historical model outputs, and combine these to output multi-time-period anomaly probability values.

[0092] The abnormal label prediction model can include sub-models such as debt evasion label prediction, account transfer silence label prediction, and missing person label prediction. The specific label prediction sub-model can be set according to the abnormal labels that need to be predicted. Its samples mainly come from the abnormal behavior of the target object. For example, for target objects with debt evasion behavior, it can be users who have obviously defaulted and immediately transferred out the virtual resources of their income but did not make repayments. For target objects with account transfer silence behavior, it can be users who have made account transfers. For users with missing person behavior, it can be users who cannot be contacted through normal means. Anomaly label prediction models can use machine learning algorithms such as ensemble learning (gradient boosting trees, XGBoost) and neural networks to classify and identify anomaly labels. Based on the anomaly probability value output by the model, it is determined whether the target object has the anomaly label category. For example, for the debt evasion label prediction sub-model in the anomaly label prediction model, when the output result is 0.8, it can be considered that the target object has an 80% probability of engaging in debt evasion behavior, which is relatively high. When the output result is 0.1, it can be considered that the target object has a 10% probability of engaging in debt evasion behavior, which is relatively low, and so on, thereby predicting the degree of possibility that the target object has abnormal behavior.

[0093] Specifically, when the object anomaly category corresponding to the target object's behavioral data is the default prediction category, the default prediction model corresponding to this default prediction category can be used to perform multi-time-stage anomaly prediction on the target object's behavioral data to obtain the default anomaly probability value of the target object in each preset time stage; when the object anomaly category corresponding to the target object's behavioral data is the repayment willingness prediction category, the repayment willingness prediction model corresponding to this repayment willingness prediction category can be used to perform multi-time-stage repayment willingness prediction on the target object's behavioral data to obtain the repayment anomaly probability value of the target object in each preset time stage; when the object anomaly category corresponding to the target object's behavioral data is the anomaly label prediction category, anomaly label prediction can be performed on the target object's behavioral data corresponding to this anomaly label prediction category to obtain the anomaly label probability value of the target object. Thus, based on the default anomaly probability value, repayment probability value, and anomaly label probability value of the target object in each preset time stage, the anomaly probability value of the target object corresponding to each object anomaly category in each preset time stage can be obtained.

[0094] In one specific implementation, multiple historical output results of each anomaly prediction model can be obtained, namely, the anomaly probability values ​​of each object anomaly category corresponding to the target object in each preset time period as output by the anomaly prediction model in the past. By combining these historical anomaly probability values ​​of each object anomaly category in each preset time period with the anomaly probability values ​​of the target object output by the current anomaly prediction model in each preset time period, a multi-stage prediction result for the target object matching each object anomaly category can be comprehensively determined. Optionally, the anomaly probability values ​​of each object anomaly category in each preset time period output by the historical anomaly prediction model and the anomaly probability values ​​of the target object output by the current anomaly prediction model in each preset time period can be weighted to obtain the multi-stage prediction result for the target object matching each object anomaly category.

[0095] Specifically, different weight values ​​can be assigned to the anomaly probability values ​​of historical outputs at different time intervals based on the temporal relationship. For example, the maximum weight value can be assigned to the anomaly probability value of each object anomaly category corresponding to the target object output by the current anomaly prediction model at each preset time stage, while a smaller weight value can be assigned to the historical anomaly prediction model output that is far removed from the current anomaly prediction model output. For instance, assuming the anomaly prediction model is a repayment willingness prediction model, and assuming that the current repayment willingness prediction model output includes the anomaly probability values ​​of the target object making repayments in January, February, and March, then the weight value for the anomaly probability values ​​of the target object making repayments in January, February, and March can be set to 0.85, the weight value for the anomaly probability values ​​of the target object making repayments in January, February, and March can be set to 0.1, and the weight value for the anomaly probability values ​​of the target object making repayments in January, February, and March can be set to 0.05. The specific weight values ​​can be set according to the actual situation and are not limited here. This allows for the weighting of the abnormal probability values ​​output by the repayment willingness prediction model for the current period, one month ago, and three months ago, based on pre-set weight values, to obtain the multi-stage prediction results of the repayment willingness prediction model.

[0096] In step 104, the multi-stage prediction results of all anomaly prediction models are fused to obtain the target anomaly category of the target object.

[0097] The target anomaly category can be used to assess the degree of anomaly of the target object. It can include two assessment dimensions: time stage and anomaly level. For example, the time stage can be multiple different stages pre-set according to specific needs. For instance, the time stage where the overdue time of the target object is within 30 days can be called the early stage, the time stage where the overdue time is between 30 and 60 days can be called the mid-stage, and the time stage where the overdue time is between 60 and 90 days can be called the late stage. Different time stages can also be divided according to specific needs. There is no limitation here. This can more accurately assess the degree of anomaly of the target object.

[0098] For example, we can assume that the degree of anomaly represents the user's risk level in the post-loan scenario. Then, the target anomaly category can include the user's risk stage and risk level. The risk stage can include the early stage, the middle stage, and the late stage, etc., and the risk level can include low risk, medium risk, and high risk, etc. Therefore, the target anomaly category can be early low risk, early medium risk, early high risk, middle low risk, middle medium risk, middle high risk, late low risk, late medium risk, late high risk, etc.

[0099] The early stage can be divided into three levels: high-risk users are mainly those who are obviously evading debt or committing fraud, with risk labels indicating debt evasion or transfer of risk, and a low probability of repayment, resulting in a high risk probability; medium-risk users are mainly those who have mild debt evasion and have a history of repayment, and may have debt evasion labels or a high risk probability; low-risk users are mainly those who have occasional delinquencies or are high-value users, with a low probability of default, a high probability of repayment willingness, and almost no risk labels indicating debt evasion. The mid-stage can be mainly divided into high-risk and low-risk users. Since some mid-stage users are already difficult to recover, the focus shifts to identifying customers who are relatively likely to be recovered. Mid-stage high-risk users are generally converted from early-stage mid-stage high-risk users. For high-risk users, the mid-stage mainly employs as many collection and account freezing measures as possible, while for low-risk users, the focus is also on account control and the implementation of most collection methods. The late stage mainly targets users who are likely to repay. These users are mostly converted from early- and mid-stage medium- and low-risk users, so a comprehensive strategy matching and ranking can be implemented based on the early and mid-stage risk levels.

[0100] Among them, the multi-stage prediction results of all anomaly prediction models can be fused to obtain the target anomaly category of the target object. For example, assuming that the anomaly prediction model includes a repayment willingness prediction model, anomaly label prediction model and default prediction model, and each anomaly prediction model includes prediction sub-models for early, middle and late stages, the multi-stage prediction results of the repayment willingness prediction model, anomaly label prediction model and default prediction model in the early, middle and late stages can be fused, and the target anomaly category of the target object can be obtained based on the fusion processing result.

[0101] In one embodiment, the target anomaly category of the target object can be determined by weighting the multi-stage prediction results of all anomaly prediction models and then calculating the weighted results. Specifically, this may include:

[0102] (1) Obtain the preset weight value of the multi-stage prediction result corresponding to the anomaly category of each object;

[0103] (2) The multi-stage prediction results of the anomaly prediction model are weighted according to the preset weight values ​​to obtain the anomaly weighted prediction value of the target object in each preset time stage.

[0104] (3) Determine the target anomaly category of the target object based on the anomaly weighted prediction value of the target object in each preset time stage.

[0105] Specifically, a preset weight value can be obtained for the multi-stage prediction results corresponding to each object's anomaly category. Then, based on this preset weight value, the multi-stage prediction results of the anomaly prediction model are weighted to obtain the weighted anomaly prediction value for the target object at each preset time stage. Based on the weighted anomaly prediction value for the target object at each preset time stage, the target anomaly category of the target object is determined. The weight of each object's anomaly category can be set to different values, and the prediction results for different preset time stages of each object's anomaly category can also be set to different values. Specific settings can be selected according to actual circumstances and are not limited here.

[0106] Please continue to refer to the following: Figure 3To more accurately assess the degree of anomaly of a target object, the degree of anomaly can be measured over time. This means obtaining the degree of anomaly of the target object at each preset time stage based on the prediction results of multiple anomaly prediction models. Specifically, the step of weighting the multi-stage prediction results of the anomaly prediction models according to preset weight values ​​to obtain the weighted anomaly prediction value of the target object at each preset time stage can be achieved by weighting each anomaly prediction result corresponding to each preset time stage in the multi-stage prediction results according to the preset weight values. Then, the weighted anomaly prediction value of the target object at each preset time stage can be determined based on the weighted processing result. For example, the weighted processing calculation formula can be as follows:

[0107]

[0108] Where F(m) i ) represents the anomaly-weighted predicted values ​​for different time periods, m i It can represent a certain preset time stage. For example, m1 represents the early stage of overdue payment, m2 represents the middle stage of overdue payment, and so on. f(x) k ) represents a certain anomaly prediction model x k In m i Anomaly prediction results for a preset time period, x k Represents the k-th anomaly prediction model; a k This represents the preset weight value of the k-th anomaly prediction model. The preset weight value can be configured based on the degree of anomaly at each stage, or it can be set according to the actual situation. No restrictions are imposed here.

[0109] For example, suppose the anomaly prediction model includes a repayment willingness prediction model, an anomaly label prediction model, and a default prediction model, and the preset weight values ​​for each anomaly prediction model are D, E, and F, respectively. Each anomaly prediction model includes prediction sub-models for early, middle, and late stages. It can also be assumed that the anomaly prediction results for the repayment willingness prediction model in the early, middle, and late stages are d, e, and f, respectively; the anomaly label prediction model in the early, middle, and late stages are g, h, and n, respectively; and the anomaly prediction results for the default prediction model in the early, middle, and late stages are j, s, and l, respectively. Then, according to the preset weight values ​​D, E, and F of each anomaly prediction model, each anomaly prediction result corresponding to the early, middle, and late stages of the multi-stage prediction results can be weighted to obtain the anomaly weighted prediction value Dd+Eg+Fj for the target object in the early stage, the anomaly weighted prediction value De+Eh+Fs in the middle stage, and the anomaly weighted prediction value Df+En+Fl in the late stage.

[0110] The step of determining the target anomaly category of the target object based on the anomaly-weighted predicted value of the target object at each preset time stage may include:

[0111] (1) Compare the abnormal weighted prediction value of the target object in each preset time stage, and determine the target preset time stage of the target object based on the comparison results.

[0112] (2) Compare the anomaly weighted prediction value corresponding to the preset time stage of the target with the preset threshold, and determine the target anomaly category of the target object based on the comparison result.

[0113] Specifically, the anomaly-weighted predicted values ​​of the target object at each preset time stage can be compared. Based on the comparison results, the target preset time stage in which the target object is located can be determined. Then, the anomaly-weighted predicted value corresponding to the target preset time stage can be compared with a preset threshold. Based on the comparison results, the target anomaly category of the target object can be determined. The preset threshold can be a pre-set critical value. The target anomaly category of the target object can be determined by the relationship between the anomaly-weighted predicted value corresponding to the target preset time stage and the critical value. The preset threshold can be one or multiple, depending on the anomaly category. For example, when the target anomaly category includes two anomaly levels, the preset threshold can be one; when the target anomaly category includes three anomaly levels, the preset threshold can be two; when the target anomaly category includes four anomaly levels, the preset threshold can be three, and so on. The size of the preset threshold can be set according to the actual situation. For example, based on the comparison results, the anomaly-weighted predicted value with the largest value is obtained. Then, the preset time stage corresponding to the maximum anomaly-weighted predicted value can be determined as the target preset time stage. Specifically, for example, assuming the anomaly-weighted predicted value of the target object is 1.5 in the early stage, 0.4 in the middle stage, and 0.2 in the late stage, the early stage corresponding to the anomaly-weighted predicted value of 1.5 can be determined as the target preset time stage. Then, the anomaly-weighted predicted value of 1.5 corresponding to the early stage can be compared with a preset threshold, and the target time stage can be determined based on the comparison result. The anomaly category is labeled. For example, suppose the target anomaly category includes three anomaly levels: low-level anomaly, medium-level anomaly, and high-level anomaly. Suppose the preset threshold can be 1 and 2. When the weighted predicted value of the anomaly is less than the preset threshold 1, the anomaly level can be determined to be low-level. When the weighted predicted value of the anomaly is greater than the preset threshold 1 but less than the preset threshold 2, the anomaly level can be determined to be medium-level. When the weighted predicted value of the anomaly is greater than the preset threshold 2, the anomaly level can be determined to be high-level. Thus, the anomaly level of the target object can be determined to be medium-level. In this way, the target anomaly category of the target object can be determined to be medium-level anomaly in the early stage.

[0114] In existing multi-institutional post-loan risk management methods, most banks and P2P lending institutions primarily focus on collection methods targeting high-risk users, such as sending text messages, making robotic calls, conducting in-person visits, linking customer groups, and reporting to credit bureaus. These methods are relatively traditional for payment institutions or banks and fail to fully utilize their risk management capabilities. Coupled with low accuracy in risk identification and inefficient risk management methods, this easily leads to unnecessary collection interference for normal and low-risk users, while delays in taking collection control measures against high-risk users negatively impact their normal lives and legal rights, potentially resulting in losses for banks and P2P lending institutions.

[0115] To address the above issues, in one embodiment, a corresponding control strategy can be determined based on the target object's anomaly category to effectively control the anomalies of the target object. For example, please refer to... Figure 4 , Figure 4 This is another specific flowchart illustrating an object anomaly prediction method provided in this application embodiment. For example, for early-stage high-risk users, multiple collection methods can be implemented simultaneously, along with various account controls to prevent further borrowing and increased losses. For early-stage low-risk users, differentiated risk reminders can be provided to ensure a better repayment experience and retain users. For later-stage users, more low-risk users who may be eligible for repayment are identified, and collection reminders are strengthened to increase their likelihood of repayment. For late-stage high-risk users, account freezing and penalties for associated accounts are primarily implemented to prevent further losses. Specifically, this may include:

[0116] (1) Determine the target access control strategy based on the target anomaly category of the target object, and perform access control on the target object based on the target access control strategy;

[0117] (2) Obtain the control feedback data of the target object based on the target permission control policy;

[0118] (3) Determine the control effect based on the control feedback data, and adjust the control strategy for the target's permissions based on the control effect.

[0119] The target permission control strategy can be a permission control strategy determined according to the target object's target anomaly category, used to manage and control the target object's permissions in order to control the anomaly level of the target object. The control feedback data can be the feedback data generated after the target object is controlled by the weight of the target permission control strategy. The control feedback data can be used to evaluate the permission control effect of the target permission control strategy.

[0120] Specifically, the severity of an anomaly of a target object can be determined based on its anomaly category. Then, a corresponding access control strategy can be established based on this severity, and access control can be implemented for the target object according to this strategy. For example, a mild alert strategy can be used for targets with low anomaly severity, while a stronger alert strategy and access adjustment strategy can be used for targets with high anomaly severity to further control the anomaly and reduce unnecessary losses. After implementing access control based on the target access control strategy, feedback data on the control of the target object based on this strategy can be obtained. This feedback data can then be used to determine the control effectiveness of the target access control strategy, and the strategy can be adjusted accordingly to achieve more effective control over the severity of the target object's anomalies.

[0121] In one embodiment, the target permission control strategy may include a target alert strategy and a target permission adjustment strategy. The permission control may include alert operations and permission adjustment operations. The step of determining the target permission control strategy based on the target anomaly category and performing permission control on the target object based on the target permission control strategy may specifically include: determining the corresponding target alert strategy and target permission adjustment strategy based on the target anomaly category, then generating a corresponding alert event based on the target alert strategy, performing an alert operation on the target object based on the alert event, and simultaneously performing a permission adjustment operation on the transaction permissions of the target object based on the target permission adjustment strategy.

[0122] The reminder strategy can include various collection methods of different levels. The target reminder strategy is the one that matches the target object's target anomaly category. The reminder event is used to notify the target object of information, prompting them to take corresponding measures to positively adjust their target anomaly category. For example, in the post-loan scenario of a transaction, the reminder event can include: sending collection messages within the relevant application (APP), sending collection SMS messages, sending collection voice messages via Interactive Voice Response (IVR), and automatic deductions from linked bank cards and cash. Different combinations of collection methods can be used for target objects at different stages. For example, for high-risk customers (users) in the early stages (generally referring to those within M1): various deductions can be implemented in advance, including timely forced deductions after funds are deposited (transferred into payment wallets, WeChat Wallet, etc.), fixed-time deductions from cash and debit cards, etc. At the same time, various traditional collection methods can be combined for punishment (including sending collection voice messages via IVR and collection messages within the APP). For early-stage medium-risk customers, selective early deductions will be implemented: such as immediate forced deductions after large deposits (transfers to payment wallets, WeChat Wallet, etc.), fixed-time deductions from cash balance and debit cards, etc. Basic collection methods include: sending collection SMS messages, sending collection voice messages via IVR, and sending collection messages within the app. For early-stage low-risk customers, only regular fixed deductions can be implemented: such as fixed-time deductions from cash balance and debit cards. For mid-stage (generally referring to the M1-M2 period) high-risk customers, collection and punishment methods are basically the same as for early-stage high-risk customers, but account punishment can be strengthened. For late-stage (generally referring to M2+ and beyond), users with the highest repayment willingness can be identified, and various collection capabilities can be deployed. For other high-risk customers in the late stage, regular message reminders and deduction collection capabilities will be used. To reduce unnecessary costs, methods requiring additional costs such as manual / telephone calls can be reduced to maximize overall efficiency while better matching access control capabilities.

[0123] This target permission adjustment strategy can be a strategy that adjusts the permissions of a target object based on the target object's abnormal category. For example, adjusting the transaction permissions of a target object can reduce the losses caused by an abnormal target object. This could involve restricting the target object's permissions. For example, in post-loan transaction scenarios, this target permission adjustment strategy could include: overdue loan restrictions, account periodic freezing, activation and transaction freezing of associated accounts, and account limit restrictions. For example, for early high-risk customers, overdue loan restrictions and short-term account transaction freezing with a slight credit limit reduction can be implemented to prevent excessive losses from this group. For mid-term high-risk customers, overdue loan restrictions, longer-term account transaction freezing with a significant credit limit reduction can be implemented to prevent continued losses from this group. For late-stage customers, overdue loan restrictions, long-term / permanent account transaction freezing, minimum credit limit penalties, and activation and transaction freezing of associated (via device / registered associated user) accounts can be implemented to prevent the spread of losses from these customers.

[0124] In one embodiment, a feedback score corresponding to the target access control strategy can be calculated based on the control feedback data. This feedback score can serve as an indicator to evaluate the control effect of the target access control strategy on the target object, and the target access control strategy can be adjusted based on the feedback score. When the control effect does not meet expectations, a target access control strategy with stronger control can be selected; when the control effect exceeds expectations and affects the legitimate rights and interests of the target object, a target access control strategy with weaker control can be selected, and so on.

[0125] Optionally, the feedback score can be compared with multiple preset score intervals in a preset score interval set to obtain an interval comparison result. The preset score interval set can be a whole composed of pre-defined score intervals, and each preset score interval can be a single pre-defined interval. By judging the relationship between the feedback score and the preset intervals, the degree of control effectiveness can be determined. Furthermore, based on the interval comparison result, the target preset score interval corresponding to the feedback score can be determined, and the adjusted target access control strategy can be determined based on the target preset score interval. For example, assuming the preset score interval set contains preset score intervals O, P, and Q, when the feedback score is in preset score interval O, it indicates a low control effectiveness; when the feedback score is in preset score interval P, it indicates a moderate control effectiveness; and when the feedback score is in preset score interval Q, it indicates an excessively strong control effectiveness. When the feedback score is in preset score interval Q, the target preset score interval can be determined as Q, indicating an excessively strong control effectiveness. In this case, the adjusted target access control strategy can be determined based on the target preset score interval. For example, the adjusted target access control strategy can be a strategy with lower control intensity compared to the target access control strategy.

[0126] In one embodiment, the target access control strategy can be adjusted by adjusting the preset weight value of each anomaly prediction model. Specifically, the adjustment weight value can be determined based on the target preset score range. This adjustment weight value can be a value used to adjust the preset weight value based on the target preset score range. Then, the preset weight value of the multi-stage prediction result corresponding to each object anomaly category can be adjusted based on the adjustment weight value to obtain the adjusted preset weight value. The target anomaly category of the target object can be updated based on the adjusted preset weight value. For example, assuming the adjustment weight value corresponding to the target preset score range is 0.9 and the preset weight value of the object anomaly category R is 0.8, the adjusted preset weight value can be 0.72. Then, the multi-stage anomaly prediction result of each anomaly prediction model can be weighted based on the adjusted preset weight value to update the target anomaly category of the target object, thereby achieving the adjustment of the target access control strategy.

[0127] As described above, this embodiment of the application obtains object behavior data of the target object in response to resource transfer events and determines multiple anomaly prediction models for resource transfer events. Each anomaly prediction model predicts a specific object anomaly category. For each object anomaly category, the object behavior data is filtered to obtain the target object behavior data corresponding to each anomaly prediction model. The anomaly prediction models are then used to perform multi-stage anomaly prediction on the target object behavior data, yielding multi-stage prediction results for each model under the corresponding object anomaly category. Finally, the multi-stage prediction results of all anomaly prediction models are fused to obtain the target anomaly category of the target object. Therefore, by using multiple anomaly prediction models to perform multi-stage prediction on the target object behavior data, obtaining multi-stage prediction results for each model under the corresponding object anomaly category, and fusing the multi-stage prediction results of all anomaly prediction models to obtain the target anomaly category of the target object, the accuracy of the anomaly prediction results is improved, and the efficiency of anomaly prediction for the target object is enhanced.

[0128] Based on the method described in the above embodiments, the following examples will provide further detailed explanations.

[0129] In this embodiment, the object anomaly prediction device will be specifically integrated into a computer device as an example for explanation. The object anomaly prediction method will be specifically described using a server as the execution entity. For details, please refer to... Figure 5a , Figure 5a This is a schematic diagram illustrating the specific architecture of an object anomaly prediction method provided in an embodiment of this application.

[0130] For a better description of the embodiments of this application, please refer to the following: Figure 5a and Figure 5b .like Figure 5b As shown, Figure 5b Another flowchart illustrating the object anomaly prediction method provided in this application embodiment is shown below.

[0131] In step 201, the server obtains the object behavior data of the target object in response to the resource transfer event and determines multiple anomaly prediction models for the resource transfer event. For each object anomaly category, the server filters the object behavior data to obtain the target object behavior data corresponding to each anomaly prediction model.

[0132] Specifically, the server can predict the degree of anomaly of the target object by acquiring object behavior data related to resource transfer events and determining multiple anomaly prediction models for these events. Then, it can filter the object behavior data based on the object anomaly category corresponding to each anomaly prediction model to obtain the target object behavior data corresponding to each model.

[0133] Optional, please refer to Figure 5a The target object can be a user in a resource transfer scenario, such as a user in a post-loan scenario. Specifically, the data collection module can collect data on user operations, device attributes, network environment, and third-party information associated with resource transfer events, and report the data collection results to obtain object behavior data. Then, the object behavior data can be filtered according to the object anomaly category of each anomaly prediction model to obtain the target object behavior data corresponding to each anomaly prediction model.

[0134] For example, assuming the anomaly category of the anomaly prediction model is the default prediction category, the server can filter data corresponding to this anomaly category from the object behavior data to obtain the target object behavior data corresponding to the default prediction model; when the anomaly category of the anomaly prediction model is the repayment willingness prediction category, the server can filter data corresponding to this anomaly category from the object behavior data to obtain the target object behavior data corresponding to the repayment willingness prediction model; when the anomaly category of the anomaly prediction model is the anomaly label prediction category, the server can filter data corresponding to this anomaly category from the object behavior data to obtain the target object behavior data corresponding to the anomaly label prediction model, and so on. Specifically, for example, assuming the input data for the anomaly label prediction model consists of multi-time-period object operation behavior data, object profile data, object historical credit data, and object asset data, and the object anomaly category is the anomaly label prediction category, then the server can filter the object behavior data according to the object anomaly category to find multi-time-period object operation behavior data, object profile data, object historical credit data, and object asset data, thereby obtaining the target object behavior data corresponding to each anomaly prediction model.

[0135] Optionally, the server may not need to perform a filtering process on the object behavior data. That is, the object behavior data of the target object can be determined as the target object behavior data. The specific filtering of the object behavior data to obtain the target object behavior data can be based on the actual situation, and there is no limitation here.

[0136] In this embodiment, the object anomaly prediction method can be applied to the post-loan stage in a transaction scenario. The anomaly prediction can be used to predict the post-loan risks of a target object, such as a user.

[0137] In step 202, the server uses the anomaly prediction model to perform multi-stage anomaly prediction on the target object's behavior data, and obtains the anomaly probability value of each object anomaly category corresponding to the target object in each preset time stage. Based on the anomaly probability value of each object anomaly category corresponding to the target object in each preset time stage, the server determines the multi-stage prediction result of the target object matching each object anomaly category.

[0138] Specifically, the server can use this anomaly prediction model to perform multi-stage anomaly prediction on the target object's behavior data, obtain the anomaly probability value of each object anomaly category corresponding to the target object in each preset time stage, and then determine the multi-stage prediction result of the target object matching each object anomaly category based on the anomaly probability value of the target object corresponding to each object anomaly category in each preset time stage.

[0139] For example, we can assume that the preset time stages are three time stages set according to actual needs: the early stage, the middle stage, and the late stage. There are three anomaly prediction models, a, b, and c, corresponding to three object anomaly categories, A, B, and C. We can use these anomaly prediction models a, b, and c to predict the anomalies of the corresponding target object behavior data in these three time stages, and obtain the anomaly probability value of the target object in each object anomaly category in each preset time stage. Specifically, the server can obtain the anomaly probability values ​​of the target object in object anomaly categories A, B, and C in the early stage, the anomaly probability values ​​of object anomaly categories A, B, and C in the middle stage, and the anomaly probability values ​​of object anomaly categories A, B, and C in the late stage. Then, based on the anomaly probability values ​​of the target object in each object anomaly category A, B, and C in the early, middle, and late stages, we can determine the multi-stage prediction result of the target object matching each object anomaly category.

[0140] In one embodiment, please refer to Figure 5aThe multiple anomaly prediction models can include repayment willingness prediction models, anomaly label prediction models, and default prediction models. These models can be used to make probabilistic predictions through a combination of offline batch computing and real-time stream computing. The repayment willingness prediction model can be used to predict the repayment willingness of the target object based on the input object sample data. Since the repayment willingness prediction needs to use more dimensions of historical features, the repayment willingness prediction model can be an offline model, which can use offline features based on offline storage of target object behavioral data to predict repayment willingness. This anomaly label prediction model can be used to predict the probability of a target object matching a certain anomaly label based on input object sample data. For example, it can be used to identify users exhibiting high-risk abnormal behavior in post-loan scenarios. The anomaly label prediction model can be a combination of real-time and offline models, using both offline and real-time features based on target object behavior data to predict anomaly labels. Similarly, this default prediction model can be used to predict the probability of a target object defaulting at each time stage based on input object sample data. This default prediction model can also be a combination of real-time and offline models, using both offline and real-time features based on target object behavior data to predict anomaly labels. Thus, the degree of anomaly of the target object can be comprehensively predicted based on these three dimensions and object behavior data. The multi-stage prediction result can be the anomaly probability value of each object anomaly category corresponding to each preset time stage, or it can be the prediction result determined by this anomaly probability value.

[0141] Optionally, the default prediction model may include multiple sub-stage models, such as early stage, mid-stage, and late stage, or other time stages. There are no restrictions on this. For example, it may include sub-models with multiple time stages, such as the M0-M1 stage transition sub-model, the M1-M2 stage transition sub-model, and the M2-M3 stage transition sub-model. Here, M0 can represent the stage of no default (e.g., no overdue payment), M1 can represent the stage of default 1-30 days (e.g., overdue payment 1 to 30 days), M2 can represent the stage of default 30-60 days (e.g., overdue payment 30 to 60 days), and so on. This model can employ machine learning algorithms such as logistic regression, ensemble learning (gradient boosting trees, XGBoost), and neural networks for anomaly prediction. It determines the degree of anomaly based on the predicted anomaly probability values. For example, if the anomaly probability of a target object defaulting in the M0-M1 sub-model this month is >0.8, the anomaly level is considered high for the target object to default in the M1 stage; if the anomaly probability is <0.2, the anomaly level is considered low. Similarly, if the predicted anomaly probability in the M0-M1 stage this month is <0.2, but the predicted anomaly level in the M1-M2 stage next month is higher (>0.6), the target object is considered to have a high anomaly level in the middle of the M2 stage, and so on. The default prediction model can comprehensively judge the prediction results across different time stages, correlate them with the model's historical output results, and output combined anomaly probability values ​​for multiple time stages.

[0142] The repayment willingness prediction model can include sub-models such as repayment willingness prediction within M1 and repayment willingness prediction within M1+, spanning multiple time periods. This model can employ machine learning algorithms such as logistic regression, ensemble learning (gradient boosting trees, XGBoost), and neural networks to predict repayment willingness. Based on different predicted anomaly probabilities, it estimates the probability of repayment at different time periods. For example, in the M1 repayment willingness prediction sub-model, an anomaly probability > 0.9 indicates a higher probability of repayment within M1 (within 30 days of delinquency), while an anomaly probability < 0.2 indicates a lower probability. Furthermore, the repayment willingness prediction model can comprehensively assess the prediction results across different time periods, consider historical model outputs, and combine these to output multi-time-period anomaly probability values.

[0143] The abnormal label prediction model can include sub-models such as debt evasion label prediction, account transfer silence label prediction, and missing person label prediction. The specific label prediction sub-model can be set according to the abnormal labels that need to be predicted. Its samples mainly come from the abnormal behavior of the target object. For example, for target objects with debt evasion behavior, it can be users who have obviously defaulted and immediately transferred out the virtual resources of their income but did not make repayments. For target objects with account transfer silence behavior, it can be users who have made account transfers. For users with missing person behavior, it can be users who cannot be contacted through normal means. Anomaly label prediction models can use machine learning algorithms such as ensemble learning (gradient boosting trees, XGBoost) and neural networks to classify and identify anomaly labels. Based on the anomaly probability value output by the model, it is determined whether the target object has the anomaly label category. For example, for the debt evasion label prediction sub-model in the anomaly label prediction model, when the output result is 0.8, it can be considered that the target object has an 80% probability of engaging in debt evasion behavior, which is relatively high. When the output result is 0.1, it can be considered that the target object has a 10% probability of engaging in debt evasion behavior, which is relatively low, and so on, thereby predicting the degree of risk of the target object's abnormal behavior.

[0144] Specifically, when the object anomaly category corresponding to the target object's behavioral data is the default prediction category, the server can use the default prediction model corresponding to that default prediction category to perform multi-time-stage anomaly prediction on the target object's behavioral data, obtaining the default anomaly probability value of the target object in each preset time stage; when the object anomaly category corresponding to the target object's behavioral data is the repayment willingness prediction category, the server can perform multi-time-stage repayment willingness prediction on the target object's behavioral data corresponding to that repayment willingness prediction category, obtaining the repayment anomaly probability value of the target object in each preset time stage; when the object anomaly category corresponding to the target object's behavioral data is the anomaly label prediction category, the server can perform anomaly label prediction on the target object's behavioral data corresponding to that anomaly label prediction category, obtaining the anomaly label probability value of the target object. Therefore, based on the default anomaly probability value, repayment probability value, and anomaly label probability value of the target object in each preset time stage, the server can obtain the anomaly probability value of the target object corresponding to each object anomaly category in each preset time stage.

[0145] In one specific implementation, the server can obtain multiple historical output results of each anomaly prediction model, that is, the anomaly probability value of the target object for each object anomaly category corresponding to each preset time period in the historical outputs of the anomaly prediction model. By combining these historical anomaly probability values ​​for each object anomaly category corresponding to each preset time period, and the anomaly probability values ​​of the target object for each object anomaly category corresponding to each preset time period output by the current anomaly prediction model, a multi-stage prediction result matching the target object with each object anomaly category can be comprehensively determined. Optionally, the anomaly probability values ​​of the target object for each object anomaly category corresponding to each preset time period in the historical outputs, and the anomaly probability values ​​of the target object for each object anomaly category corresponding to each preset time period output by the current anomaly prediction model, can be weighted to obtain the multi-stage prediction result matching the target object with each object anomaly category.

[0146] Specifically, the server can assign different weights to the anomaly probability values ​​of historical outputs at different time intervals based on temporal relationships. For example, the maximum weight can be assigned to the anomaly probability value of each object anomaly category corresponding to the target object output by the current anomaly prediction model at each preset time stage, while a smaller weight can be assigned to the historical anomaly prediction model outputs that are far removed from the current anomaly prediction model output time. For instance, assuming the anomaly prediction model is a repayment willingness prediction model, and assuming that the current repayment willingness prediction model output includes the anomaly probability values ​​of the target object making repayments in January, February, and March, the weight can be set to 0.85 for the anomaly probability values ​​of the target object making repayments in January, February, and March from the current repayment willingness prediction model output, the weight can be set to 0.1 for the anomaly probability values ​​of the target object making repayments in January, February, and March from the anomaly prediction model output one month ago, and the weight can be set to 0.05 for the anomaly probability values ​​of the target object making repayments in January, February, and March from the anomaly prediction model output three months ago. The specific weight can be set according to the actual situation and is not limited here. This allows for the weighting of the abnormal probability values ​​output by the repayment willingness prediction model for the current period, one month ago, and three months ago, based on the set weight values, to obtain the multi-stage prediction results of the repayment willingness prediction model.

[0147] In step 203, the server obtains the preset weight value of the multi-stage prediction result corresponding to each object anomaly category, and performs weighted processing on each anomaly prediction result corresponding to each preset time stage in the multi-stage prediction result according to the preset weight value. Based on the weighted processing result, the weighted anomaly prediction value of the target object in each preset time stage is determined.

[0148] The server can obtain preset weight values ​​for the multi-stage prediction results corresponding to each object's anomaly category. It can then weight the multi-stage prediction results of the anomaly prediction model based on these preset weight values ​​to obtain the weighted anomaly prediction value for the target object at each preset time stage. Please refer to [further details omitted]. Figure 3 To more accurately assess the anomaly level of a target object, its anomaly level can be measured over time. This means that the anomaly level of the target object at each preset time stage can be determined based on the prediction results of multiple anomaly prediction models at that stage. Specifically, the server can weight each anomaly prediction result corresponding to each preset time stage in the multi-stage prediction results according to a preset weight value, and then determine the weighted anomaly prediction value of the target object at each preset time stage based on the weighted processing result. For example, the weighted processing calculation formula can be as follows:

[0149]

[0150] Where F(m) i ) represents the anomaly-weighted predicted values ​​for different time periods, m i It can represent a certain preset time stage. For example, m1 represents the early stage of overdue payment, m2 represents the middle stage of overdue payment, and so on. f(x) k ) represents a certain anomaly prediction model x k In m i Anomaly prediction results for a preset time period, x k Represents the k-th anomaly prediction model; a k This represents the preset weight value of the k-th anomaly prediction model. The preset weight value can be configured based on the degree of anomaly at each stage, or it can be set according to the actual situation. No restrictions are imposed here.

[0151] For example, suppose the anomaly prediction model includes a repayment willingness prediction model, an anomaly label prediction model, and a default prediction model, and the preset weight values ​​for each anomaly prediction model are D, E, and F, respectively. Each anomaly prediction model includes prediction sub-models for early, middle, and late stages. It can also be assumed that the anomaly prediction results for the repayment willingness prediction model in the early, middle, and late stages are d, e, and f, respectively; the anomaly label prediction model in the early, middle, and late stages are g, h, and n, respectively; and the anomaly prediction results for the default prediction model in the early, middle, and late stages are j, s, and l, respectively. Then, the server can use the preset weight values ​​D, E, and F of each anomaly prediction model to weight each anomaly prediction result in the early, middle, and late stages of the multi-stage prediction results, respectively, to obtain the anomaly weighted prediction value Dd+Eg+Fj for the target object in the early stage, the anomaly weighted prediction value De+Eh+Fs for the middle stage, and the anomaly weighted prediction value Df+En+Fl for the late stage.

[0152] In step 204, the server compares the anomaly weighted prediction value of the target object in each preset time stage, determines the target preset time stage of the target object based on the comparison result, compares the anomaly weighted prediction value corresponding to the target preset time stage with a preset threshold, and determines the target anomaly category of the target object based on the comparison result.

[0153] The server can compare the anomaly-weighted predicted value of the target object at each preset time stage. Based on the comparison result, it determines the target preset time stage in which the target object is located. Then, it can compare the anomaly-weighted predicted value corresponding to the target preset time stage with a preset threshold. Based on the comparison result, it determines the target anomaly category of the target object. The preset threshold can be a pre-set critical value. The target anomaly category of the target object can be determined by the relationship between the anomaly-weighted predicted value corresponding to the target preset time stage and the critical value. The preset threshold can be one or multiple, depending on the anomaly category. For example, when the target anomaly category includes two anomaly levels, the preset threshold can be one; when the target anomaly category includes three anomaly levels, the preset threshold can be two; when the target anomaly category includes four anomaly levels, the preset threshold can be three, and so on. The size of the preset threshold can be set according to the actual situation.

[0154] For example, the server can obtain the maximum anomaly-weighted predicted value based on the comparison results. Then, the preset time stage corresponding to the maximum anomaly-weighted predicted value can be determined as the target preset time stage. Specifically, for example, assuming the target object's anomaly-weighted predicted value is 1.5 in the early stage, 0.4 in the middle stage, and 0.2 in the late stage, the early stage corresponding to the anomaly-weighted predicted value of 1.5 can be determined as the target preset time stage. Furthermore, the anomaly-weighted predicted value of 1.5 corresponding to the early stage can be compared with a preset threshold, and the target object can be determined based on the comparison result. The target anomaly category, for example, assuming the target anomaly category includes three anomaly levels: low-level anomaly, medium-level anomaly, and high-level anomaly, and assuming the preset threshold can be 1 and 2, when the weighted predicted value of the anomaly is less than the preset threshold 1, the anomaly level can be determined as low-level anomaly; when the weighted predicted value of the anomaly is greater than the preset threshold 1 but less than the preset threshold 2, the anomaly level can be determined as medium-level anomaly; when the weighted predicted value of the anomaly is greater than the preset threshold 2, the anomaly level can be determined as high-level anomaly. Thus, the anomaly level of the target object can be determined as medium-level anomaly in the early stage. In this way, the server can determine that the target anomaly category of the target object is a medium-level anomaly in the early stage.

[0155] In step 205, the server determines the corresponding target alert strategy and target permission adjustment strategy based on the target anomaly category, generates a corresponding alert event based on the target alert strategy, performs an alert operation on the target object based on the alert event, and performs a permission adjustment operation on the target object's transaction permissions based on the target permission adjustment strategy.

[0156] In existing multi-institutional post-loan risk management methods, most banks and P2P lending institutions primarily focus on collection methods targeting high-risk users, such as sending text messages, making robotic calls, conducting in-person visits, linking customer groups, and reporting to credit bureaus. These methods are relatively traditional for payment institutions or banks and fail to fully utilize their risk management capabilities. Coupled with low accuracy in risk identification and inefficient risk management methods, this easily leads to unnecessary collection interference for normal and low-risk users, while delays in taking collection control measures against high-risk users negatively impact their normal lives and legal rights, potentially resulting in losses for banks and P2P lending institutions.

[0157] To address the above issues, in one embodiment, please refer to... Figure 5a It is possible to determine the corresponding access control policy based on the target object's exception category in order to effectively control the exception of the target object.

[0158] Specifically, services can be triggered by overdue users. Based on the target permission control policy, a permission control service for the target object can be triggered. The permission control service can then be used to control the permissions of the target object. The target permission control policy can include a target reminder policy and a target permission adjustment policy. The permission control can include reminder operations and permission adjustment operations. The server can determine the corresponding target reminder policy and target permission adjustment policy based on the target exception category. Then, a corresponding reminder event can be generated based on the target reminder policy, and a reminder operation can be performed on the target object based on the reminder event. At the same time, the transaction permissions of the target object can be adjusted based on the target permission adjustment policy.

[0159] The reminder strategy can include various collection methods at different levels. The target reminder strategy is the one that matches the target object's target anomaly category. The reminder event is used to notify the target object of information, prompting them to take corresponding measures to positively adjust their target anomaly category. For example, in post-loan transaction scenarios, it can include: sending collection messages within relevant applications (APPs), sending collection SMS messages, sending collection voice messages via interactive voice response (IVR), and automatic deductions from linked bank cards and cash balances. Different combinations of collection methods can be used for target objects at different stages. For example, for high-risk customers (users) in the early stages (generally referring to those within M1): various deductions can be implemented in advance, including timely forced deductions after funds are deposited (transferred into payment wallets, WeChat Wallet, etc.), fixed-time deductions from cash balances, and debit card deductions. At the same time, it can also be combined with various traditional collection methods for punishment (including sending collection voice messages via IVR and collection messages within APPs). For early-stage medium-risk customers, selective early deductions will be implemented: such as immediate forced deductions after large deposits (transfers to payment wallets, WeChat Wallet, etc.), fixed-time deductions from cash balance and debit cards, etc. Basic collection methods include: sending collection SMS messages, sending collection voice messages via IVR, and sending collection messages within the app. For early-stage low-risk customers, only regular fixed deductions can be implemented: such as fixed-time deductions from cash balance and debit cards. For mid-stage (generally referring to the M1-M2 period) high-risk customers, collection and punishment methods are basically the same as for early-stage high-risk customers, but account punishment can be strengthened. For late-stage (generally referring to M2+ and beyond), users with the highest repayment willingness can be identified, and various collection capabilities can be deployed. For other high-risk customers in the late stage, regular message reminders and deduction collection capabilities will be used. To reduce unnecessary costs, methods requiring additional costs such as manual / telephone calls can be reduced to maximize overall efficiency while better matching access control capabilities.

[0160] This target permission adjustment strategy can be a strategy that adjusts the permissions of a target object based on the target object's abnormal category. For example, adjusting the transaction permissions of a target object can reduce the losses caused by an abnormal target object. This could involve restricting the target object's permissions. For example, in post-loan transaction scenarios, this target permission adjustment strategy could include: overdue loan restrictions, account periodic freezing, activation and transaction freezing of associated accounts, and account limit restrictions. For example, for early high-risk customers, overdue loan restrictions and short-term account transaction freezing with a slight credit limit reduction can be implemented to prevent excessive losses from this group. For mid-term high-risk customers, overdue loan restrictions, longer-term account transaction freezing with a significant credit limit reduction can be implemented to prevent continued losses from this group. For late-stage customers, overdue loan restrictions, long-term / permanent account transaction freezing, minimum credit limit penalties, and activation and transaction freezing of associated (via device / registered associated user) accounts can be implemented to prevent the spread of losses from these customers.

[0161] In step 206, the server obtains the control feedback data of the target object based on the target permission control policy, calculates the feedback score corresponding to the target permission control policy based on the control feedback data, and compares the feedback score with multiple preset score intervals in the preset score interval set to obtain the interval comparison result.

[0162] The server can calculate a feedback score for the target access control policy based on the control feedback data. This feedback score serves as an indicator to evaluate the effectiveness of the target access control policy on the target object, and the policy can be adjusted accordingly. When the control effect fails to meet expectations, a stronger control policy can be selected; when the control effect exceeds expectations and affects the legitimate rights and interests of the target object, a weaker control policy can be selected, and so on.

[0163] Optionally, the server can compare the feedback score with multiple preset score intervals in a preset score interval set to obtain an interval comparison result. The preset score interval set can be a whole composed of pre-defined score intervals, and the preset score interval can be a pre-defined score interval. By judging the relationship between the feedback score and the preset interval, the degree of control effectiveness can be determined.

[0164] In step 207, the server determines the target preset score range corresponding to the feedback score based on the interval comparison result, and determines the adjusted target permission control policy based on the target preset score range.

[0165] After obtaining the interval comparison results, the server can determine the target preset score interval corresponding to the feedback score based on the comparison results, and then determine the adjusted target permission control strategy based on the target preset score interval. For example, assuming the preset score interval set includes preset score intervals O, P, and Q, when the feedback score is in preset score interval O, it indicates a low control effect; when the feedback score is in preset score interval P, it indicates a moderate control effect; and when the feedback score is in preset score interval Q, it indicates an excessively strong control effect. When the feedback score is in preset score interval Q, the target preset score interval can be determined to be Q, indicating an excessively strong control effect. In this case, the server can determine the adjusted target permission control strategy based on the target preset score interval. For example, the adjusted target permission control strategy can be a strategy with lower control intensity compared to the target permission control strategy.

[0166] As can be seen from the above, the embodiments of this application obtain object behavior data of the target object in response to a resource transfer event through a server and determine multiple anomaly prediction models for the resource transfer event. For each object anomaly category, the object behavior data is filtered to obtain target object behavior data corresponding to each anomaly prediction model. The server uses the anomaly prediction model to perform multi-stage anomaly prediction on the target object behavior data, obtaining the anomaly probability value of each object anomaly category corresponding to the target object in each preset time stage. Based on the anomaly probability value of each object anomaly category corresponding to the target object in each preset time stage, the multi-stage prediction result matching each object anomaly category is determined. The server obtains the preset weight value of the multi-stage prediction result corresponding to each object anomaly category, and performs weighted processing on each anomaly prediction result corresponding to each preset time stage in the multi-stage prediction result according to the preset weight value. Based on the weighted processing result, the weighted anomaly prediction value of the target object in each preset time stage is determined. The server then performs multi-stage anomaly prediction on the target object in each preset time stage. The server compares the anomaly-weighted predicted values ​​for each preset time period, determines the target preset time period of the target object based on the comparison results, compares the anomaly-weighted predicted value corresponding to the target preset time period with a preset threshold, and determines the target anomaly category of the target object based on the comparison results. The server determines the corresponding target alert strategy and target permission adjustment strategy based on the target anomaly category, generates a corresponding alert event based on the target alert strategy, performs an alert operation on the target object based on the alert event, and performs permission adjustment operation on the target object's transaction permissions based on the target permission adjustment strategy. The server obtains the control feedback data of the target object based on the target permission control strategy, calculates the feedback score corresponding to the target permission control strategy based on the control feedback data, compares the feedback score with multiple preset score intervals in a preset score interval set, and obtains the interval comparison result. The server determines the target preset score interval corresponding to the feedback score based on the interval comparison result, and determines the adjusted target permission control strategy based on the target preset score interval. Therefore, by using multiple anomaly prediction models to predict the behavioral data of target objects in multiple stages, the multi-stage prediction results of each anomaly prediction model under the corresponding object anomaly category are obtained. The multi-stage prediction results of all anomaly prediction models are then fused to obtain the target anomaly category of the target object, which improves the accuracy of anomaly prediction results and enhances the efficiency of anomaly prediction for target objects. At the same time, based on the target anomaly category of the target object, the corresponding target permission control strategy is determined to control the target object's permissions. Furthermore, the target permission control strategy is adjusted based on the control feedback data, so as to timely and effectively control the permissions of target objects with anomalies. This reasonable control of the target object's permissions reduces unnecessary losses and improves the efficiency of target object anomaly control.

[0167] To better implement the above methods, embodiments of the present invention also provide an object anomaly prediction device, which can be integrated into a computer device, which can be a server.

[0168] For example, such as Figure 6 The diagram shown is a structural schematic of an object anomaly prediction device provided in an embodiment of this application. The object anomaly prediction device may include an acquisition unit 301, a filtering unit 302, a prediction unit 303, and a fusion unit 304, as follows:

[0169] The acquisition unit 301 is used to acquire object behavior data of the target object in response to the resource transfer event and to determine multiple anomaly prediction models for the resource transfer event, wherein each anomaly prediction model corresponds to predicting an object anomaly category.

[0170] The filtering unit 302 is used to filter the object behavior data for each object anomaly category to obtain the target object behavior data corresponding to each anomaly prediction model.

[0171] The prediction unit 303 is used to perform multi-stage anomaly prediction on the target object's behavior data using the anomaly prediction model, and obtain the multi-stage prediction results of each anomaly prediction model under the corresponding object anomaly category. The multi-stage prediction results include the anomaly prediction results of the target object under the object anomaly category for multiple preset time stages.

[0172] The fusion unit 304 is used to fuse the multi-stage prediction results of all anomaly prediction models to obtain the target anomaly category of the target object.

[0173] In one embodiment, the fusion unit 304 includes:

[0174] The preset weight value acquisition sub-unit is used to acquire the preset weight value of the multi-stage prediction result corresponding to the anomaly category of each object;

[0175] The weighted sub-unit is used to weight the multi-stage prediction results of the anomaly prediction model according to the preset weight value, so as to obtain the anomaly weighted prediction value of the target object in each preset time stage.

[0176] The target anomaly category determination subunit is used to determine the target anomaly category of the target object based on the anomaly weighted prediction value of the target object at each preset time stage.

[0177] In one embodiment, the weighting subunit includes:

[0178] The weighting module is used to weight each abnormal prediction result corresponding to each preset time stage in the multi-stage prediction result according to the preset weight value.

[0179] The determination module is used to determine the abnormal weighted prediction value of the target object at each preset time stage based on the weighted processing result.

[0180] In one embodiment, the target anomaly category determination subunit includes:

[0181] The comparison module is used to compare the abnormal weighted prediction value of the target object at each preset time stage, and determine the target preset time stage of the target object based on the comparison results.

[0182] The comparison module is used to compare the anomaly weighted prediction value corresponding to the target at a preset time stage with a preset threshold, and determine the target anomaly category of the target object based on the comparison result.

[0183] In one embodiment, the prediction unit 303 includes:

[0184] The anomaly prediction subunit is used to perform multi-stage anomaly prediction on the target object's behavior data using the anomaly prediction model, and to obtain the anomaly probability value of each object anomaly category corresponding to each preset time stage.

[0185] The multi-stage prediction result determination subunit is used to determine the multi-stage prediction result of the target object matching each object anomaly category based on the anomaly probability value of the target object corresponding to each object anomaly category in each preset time stage.

[0186] In one embodiment, the object anomaly prediction device further includes:

[0187] The access control unit is used to determine the target access control policy based on the target exception category of the target object, and to control the access of the target object based on the target access control policy;

[0188] The feedback data acquisition unit is used to acquire the control feedback data of the target object based on the target permission control policy;

[0189] The adjustment unit is used to determine the control effect based on the control feedback data, and to adjust the target permission control strategy based on the control effect.

[0190] In one embodiment, the access control unit includes:

[0191] The strategy determination subunit is used to determine the corresponding target alert strategy and target permission adjustment strategy based on the target anomaly category.

[0192] The reminder subunit is used to generate a corresponding reminder event based on the target reminder strategy, and to perform reminder operations on the target object according to the reminder event.

[0193] The permission adjustment subunit is used to adjust the transaction permissions of the target object according to the target permission adjustment strategy.

[0194] In one embodiment, the adjustment unit includes:

[0195] The feedback score calculation subunit is used to calculate the feedback score corresponding to the target permission control policy based on the control feedback data.

[0196] The adjustment sub-unit is used to adjust the access control policy for the target based on the feedback score.

[0197] In one embodiment, the adjustment subunit includes:

[0198] The comparison module is used to compare the feedback score with multiple preset score intervals in a preset score interval set to obtain the interval comparison result;

[0199] The target preset score interval determination module is used to determine the target preset score interval corresponding to the feedback score based on the comparison results of the interval.

[0200] The module for determining the adjusted target access control strategy is used to determine the adjusted target access control strategy based on the preset score range of the target.

[0201] In one embodiment, the adjustment subunit includes:

[0202] The adjustment weight value determination module is used to determine the adjustment weight value based on the preset score range of the target.

[0203] The adjustment module is used to adjust the preset weight value of the multi-stage prediction result corresponding to each object's anomaly category based on the adjustment weight value, so as to obtain the adjusted preset weight value.

[0204] The update module is used to update the target anomaly category of the target object according to the preset weight value after adjustment, so as to adjust the access control policy for the target.

[0205] In practice, each of the above units can be implemented as an independent entity or can be arbitrarily combined to be implemented as the same or several entities. For the specific implementation of each of the above units, please refer to the previous method embodiments, which will not be repeated here.

[0206] As described above, this embodiment of the application acquires object behavior data of the target object in response to a resource transfer event and determines multiple anomaly prediction models for the resource transfer event through the acquisition unit 301. Each anomaly prediction model predicts a type of object anomaly. The filtering unit 302 filters the object behavior data for each object anomaly category to obtain the target object behavior data corresponding to each anomaly prediction model. The prediction unit 303 uses the anomaly prediction model to perform multi-stage anomaly prediction on the target object behavior data to obtain the multi-stage prediction result of each anomaly prediction model under the corresponding object anomaly category. The fusion unit 304 fuses the multi-stage prediction results of all anomaly prediction models to obtain the target anomaly category of the target object. Thus, by using multiple anomaly prediction models to perform multi-stage prediction on the target object behavior data, obtaining the multi-stage prediction result of each anomaly prediction model under the corresponding object anomaly category, and fusing the multi-stage prediction results of all anomaly prediction models to obtain the target anomaly category of the target object, the accuracy of the anomaly prediction results is improved, and the efficiency of anomaly prediction for the target object is enhanced.

[0207] This application also provides a computer device, such as... Figure 7 As shown, it illustrates a structural diagram of a computer device involved in an embodiment of this application. This computer device may be a server, specifically:

[0208] The computer device may include components such as a processor 401 with one or more processing cores, a memory 402 with one or more computer-readable storage media, a power supply 403, and an input unit 404. Those skilled in the art will understand that... Figure 7 The computer device structure shown does not constitute a limitation on the computer device and may include more or fewer components than shown, or combine certain components, or have different component arrangements. Wherein:

[0209] The processor 401 is the control center of the computer device. It connects various parts of the computer device via various interfaces and lines, and performs various functions and processes data by running or executing software programs and / or modules stored in the memory 402, and by calling data stored in the memory 402, thereby providing overall monitoring of the computer device. Optionally, the processor 401 may include one or more processing cores; preferably, the processor 401 may integrate an application processor and a modem processor, wherein the application processor mainly handles the operating system, user interface, and applications, and the modem processor mainly handles wireless communication. It is understood that the modem processor may not be integrated into the processor 401.

[0210] Memory 402 can be used to store software programs and modules. Processor 401 executes various functional applications and object anomaly prediction by running the software programs and modules stored in memory 402. Memory 402 may mainly include a program storage area and a data storage area. The program storage area may store the operating system, application programs required for at least one function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created according to the use of the computer device, etc. In addition, memory 402 may include high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other volatile solid-state storage device. Accordingly, memory 402 may also include a memory controller to provide processor 401 with access to memory 402.

[0211] The computer device also includes a power supply 403 that supplies power to the various components. Preferably, the power supply 403 can be logically connected to the processor 401 through a power management system, thereby enabling functions such as charging, discharging, and power consumption management through the power management system. The power supply 403 may also include one or more DC or AC power supplies, recharging systems, power fault detection circuits, power converters or inverters, power status indicators, and other arbitrary components.

[0212] The computer device may also include an input unit 404, which can be used to receive input digital or character information and generate keyboard, mouse, joystick, optical or trackball signal inputs related to user settings and function control.

[0213] Although not shown, the computer device may also include a display unit, etc., which will not be described in detail here. Specifically, in this embodiment, the processor 401 in the computer device loads the executable files corresponding to the processes of one or more applications into the memory 402 according to the following instructions, and the processor 401 runs the applications stored in the memory 402 to realize various functions, as follows:

[0214] The process involves acquiring object behavior data of the target object in response to a resource transfer event and identifying multiple anomaly prediction models for the same event. Each anomaly prediction model predicts a specific object anomaly category. For each object anomaly category, the object behavior data is filtered to obtain the target object behavior data corresponding to each anomaly prediction model. The anomaly prediction models are then used to perform multi-stage anomaly prediction on the target object behavior data, yielding multi-stage prediction results for each model under the corresponding object anomaly category. Finally, the multi-stage prediction results from all anomaly prediction models are fused to obtain the target anomaly category of the target object.

[0215] The specific implementation of each of the above operations can be found in the preceding embodiments, and will not be repeated here. It should be noted that the computer device provided in this application embodiment and the object anomaly prediction method in the above embodiments belong to the same concept, and its specific implementation process can be found in the above method embodiments, and will not be repeated here.

[0216] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be performed by instructions, or by instructions controlling related hardware. These instructions can be stored in a computer-readable storage medium and loaded and executed by a processor.

[0217] Therefore, embodiments of this application provide a computer-readable storage medium storing a plurality of instructions that can be loaded by a processor to execute steps in any of the object anomaly prediction methods provided in embodiments of this application. For example, the instructions can execute the following steps:

[0218] The process involves acquiring object behavior data of the target object in response to a resource transfer event and identifying multiple anomaly prediction models for the same event. Each anomaly prediction model predicts a specific object anomaly category. For each object anomaly category, the object behavior data is filtered to obtain the target object behavior data corresponding to each anomaly prediction model. The anomaly prediction models are then used to perform multi-stage anomaly prediction on the target object behavior data, yielding multi-stage prediction results for each model under the corresponding object anomaly category. Finally, the multi-stage prediction results from all anomaly prediction models are fused to obtain the target anomaly category of the target object.

[0219] The computer-readable storage medium may include: read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0220] Since the instructions stored in the computer-readable storage medium can execute the steps in any of the object anomaly prediction methods provided in the embodiments of this application, the beneficial effects that any of the object anomaly prediction methods provided in the embodiments of this application can achieve can be realized, as detailed in the preceding embodiments, and will not be repeated here.

[0221] According to one aspect of this application, a computer program product or computer program is provided, comprising computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the methods provided in the various optional implementations of the above embodiments.

[0222] The foregoing has provided a detailed description of an object anomaly prediction method, apparatus, and computer-readable storage medium provided in the embodiments of this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A method for predicting object anomalies, characterized in that, include: Acquire object behavior data of the target object in response to the resource transfer event and determine multiple anomaly prediction models for the resource transfer event, wherein each anomaly prediction model corresponds to predicting an object anomaly category. For each object anomaly category, filter the object behavior data to obtain the target object behavior data corresponding to each anomaly prediction model; The anomaly prediction model is used to perform multi-stage anomaly prediction on the target object's behavioral data, and the multi-stage prediction results of each anomaly prediction model under the corresponding object anomaly category are obtained. The multi-stage prediction results include the anomaly prediction results of the target object under the object anomaly category for multiple preset time stages. The multi-stage prediction results of all anomaly prediction models are fused to obtain the target anomaly category of the target object.

2. The object anomaly prediction method as described in claim 1, characterized in that, The process of fusing the multi-stage prediction results of all anomaly prediction models to obtain the target anomaly category of the target object includes: Obtain the preset weight value of the multi-stage prediction result corresponding to the anomaly category of each object; The multi-stage prediction results of the anomaly prediction model are weighted according to the preset weight values ​​to obtain the anomaly weighted prediction value of the target object at each preset time stage. The target anomaly category of the target object is determined based on the anomaly weighted prediction value of the target object at each preset time stage.

3. The object anomaly prediction method as described in claim 2, characterized in that, The step of weighting the multi-stage prediction results of the anomaly prediction model according to the preset weight values ​​to obtain the anomaly weighted prediction value of the target object at each preset time stage includes: Each abnormal prediction result corresponding to each preset time stage in the multi-stage prediction result is weighted according to the preset weight value. The abnormal weighted prediction value of the target object at each preset time stage is determined based on the weighted processing result.

4. The object anomaly prediction method as described in claim 2, characterized in that, The step of determining the target anomaly category of the target object based on the anomaly-weighted prediction value of the target object at each preset time stage includes: The abnormal weighted prediction value of the target object at each preset time stage is compared, and the target preset time stage of the target object is determined based on the comparison result. The anomaly weighted prediction value corresponding to the target preset time stage is compared with a preset threshold, and the target anomaly category of the target object is determined based on the comparison result.

5. The object anomaly prediction method as described in claim 1, characterized in that, The step of using the anomaly prediction model to perform multi-stage anomaly prediction on the target object's behavioral data, obtaining multi-stage prediction results for each anomaly prediction model under the corresponding object anomaly category, includes: The anomaly prediction model is used to perform multi-stage anomaly prediction on the target object's behavioral data to obtain the anomaly probability value of each object anomaly category corresponding to each preset time stage. Based on the anomaly probability value of the target object corresponding to each object anomaly category in each preset time stage, the multi-stage prediction result of the target object matching each object anomaly category is determined.

6. The object anomaly prediction method as described in any one of claims 1 to 5, characterized in that, The method further includes: The target access control strategy is determined based on the target anomaly category of the target object, and access control is performed on the target object based on the target access control strategy; Obtain the control feedback data of the target object based on the target permission control policy; The control effect is determined based on the control feedback data, and the target permission control strategy is adjusted based on the control effect.

7. The object anomaly prediction method as described in claim 6, characterized in that, The target permission control strategy includes a target alert strategy and a target permission adjustment strategy. Permission control includes alert operations and permission adjustment operations. The step of determining the target permission control strategy based on the target anomaly category and performing permission control on the target object based on the target permission control strategy includes: Determine the corresponding target alert strategy and target permission adjustment strategy based on the target anomaly category; Based on the target reminder strategy, a corresponding reminder event is generated, and a reminder operation is performed on the target object according to the reminder event; The transaction permissions of the target object are adjusted according to the target permission adjustment strategy.

8. The object anomaly prediction method as described in claim 6, characterized in that, The step of determining the control effect based on the control feedback data and adjusting the target permission control strategy based on the control effect includes: Calculate the feedback score corresponding to the target permission control strategy based on the control feedback data; The target access control strategy is adjusted based on the feedback score.

9. The object anomaly prediction method as described in claim 8, characterized in that, The step of adjusting the target access control strategy based on the feedback score includes: The feedback score is compared with multiple preset score intervals in a preset score interval set to obtain the interval comparison result; The target preset score range corresponding to the feedback score is determined based on the interval comparison results. The adjusted target permission control strategy is determined based on the target preset score range.

10. The object anomaly prediction method as described in claim 9, characterized in that, The step of adjusting the target access control strategy based on the feedback score includes: The adjustment weight value is determined based on the target preset score range; The preset weight value of the multi-stage prediction result corresponding to the anomaly category of each object is adjusted based on the adjusted weight value to obtain the adjusted preset weight value. The target anomaly category of the target object is updated according to the adjusted preset weight value, so as to adjust the target permission control strategy.

11. An object anomaly prediction device, characterized in that, include: The acquisition unit is used to acquire object behavior data of the target object in response to the resource transfer event and to determine multiple anomaly prediction models for the resource transfer event, wherein each anomaly prediction model corresponds to predicting an object anomaly category. The filtering unit is used to filter the object behavior data for each object anomaly category to obtain the target object behavior data corresponding to each anomaly prediction model. The prediction unit is used to perform multi-stage anomaly prediction on the target object behavior data using the anomaly prediction model, and obtain the multi-stage prediction result of each anomaly prediction model under the corresponding object anomaly category. The multi-stage prediction result includes the anomaly prediction results of the target object under the object anomaly category for multiple preset time stages. The fusion unit is used to fuse the multi-stage prediction results of all anomaly prediction models to obtain the target anomaly category of the target object.

12. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a plurality of instructions adapted for loading by a processor to perform the steps of the object anomaly prediction method according to any one of claims 1 to 10.

13. A computer device, characterized in that, The method includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the object anomaly prediction method according to any one of claims 1 to 10.

14. A computer program product, characterized in that, The computer program product includes computer instructions stored in a storage medium. A processor of a computer device reads the computer instructions from the storage medium and executes the computer instructions, causing the computer device to perform the object anomaly prediction method according to any one of claims 1 to 10.

Images