Banking risk behavior monitoring method and device

Abstract

The application discloses a bank business risk behavior monitoring method and device, relates to the technical field of big data, and can be applied to the field of financial technology. The method comprises the following steps: establishing a monitoring model grouping model; establishing a monitoring model group operation model; inputting bank business data into the monitoring model grouping model for solving; monitoring models with a corresponding correlation degree of the bank business data exceeding a threshold value are grouped into the same group, and monitoring model grouping results are obtained; after any monitoring model hits a risk behavior, risk behavior data is identified based on other monitoring models in the group where the monitoring model is located; the bank business data and the risk behavior data are input into the monitoring model group operation model, and solving is performed based on a genetic algorithm, so that operation strategy information of each monitoring model group is obtained; and the operation of each monitoring model group is controlled according to the operation strategy information of each monitoring model group. The application can identify potential business risks and achieve optimal identification effects under limited operation resources.

Description

Technical Field

[0001] This invention relates to the field of big data technology, and in particular to a method and apparatus for monitoring risk behaviors in banking operations. Background Technology

[0002] This section is intended to provide background or context for the embodiments of the invention set forth in the claims. The description herein is not an admission that it is prior art simply because it is included in this section.

[0003] In the daily operations of large financial institutions, various business risks often arise, such as risks related to corporate clients, personal clients, and employee operations. Large financial institutions have dedicated model design teams that develop corresponding monitoring models for different types of business risks to monitor these risks.

[0004] For the above-mentioned types of business risks, risk monitoring personnel typically process and judge the matching and occurrence of monitoring model rules in batches. These occurrences are then generated as risk events, which are identified, judged, and characterized by the risk monitoring personnel before proceeding with relevant processes. However, from the perspective of overall operational efficiency and investigation, the following pain points exist:

[0005] 1. Lack of customized monitoring model sets. Although there are many different monitoring models for each type of business risk, each monitoring model matches itself according to its own rules. When presented to monitoring personnel, a single monitoring model only shows the business risk situation hit according to its own rules. Therefore, it is difficult to find the cascading risk factors behind the business risk, and it is difficult to summarize the root cause of the risk, resulting in treating the symptoms but not the root cause.

[0006] 2. The full-scale operation of the monitoring model consumes significant server resources. The current monitoring model runs in its entirety to match business risks, which consumes substantial server resources. During peak business periods, this can lead to low efficiency and situations where risk monitoring personnel cannot handle issues promptly. A customized operational strategy for the monitoring model group is needed to achieve a balance between the accuracy of the monitoring model and the consumption of operational resources. Summary of the Invention

[0007] This invention provides a method for monitoring risk behaviors in banking operations, used to identify potential business risks, balance the operating cost and identification quality of a monitoring model group, and achieve optimal identification results with limited operating resources. The method includes:

[0008] Based on the feature information of each monitoring model and the correlation between them, a monitoring model grouping model is established; each banking business scenario is pre-configured with one monitoring model; the monitoring model grouping model uses a clustering algorithm to group the monitoring models.

[0009] Based on the running time cost, identification time cost, and identification quality cost of each monitoring model group, an operational model for the monitoring model group is established. The operational model for the monitoring model group uses whether the monitoring model group is running as the decision variable and the total running cost as the output value.

[0010] The banking business data is input into the monitoring model grouping model for solution. The monitoring models whose correlation with the banking business data exceeds the threshold are grouped into the same group to obtain the monitoring model grouping results.

[0011] Once any monitoring model identifies a risky behavior, risky behavior data is obtained based on other monitoring models within the same group as that monitoring model.

[0012] Input banking business data and risk behavior data into the monitoring model group to run the model, solve it based on the genetic algorithm, and obtain the operation strategy information of each monitoring model group;

[0013] Control the operation of each monitoring model group based on the operation strategy information of each monitoring model group.

[0014] This invention also provides a banking business risk behavior monitoring device to identify potential business risks, balance the operating cost and identification quality of the monitoring model group, and achieve optimal identification results with limited operating resources. The device includes:

[0015] The grouping model building module is used to build a monitoring model grouping model based on the feature information of each monitoring model and the correlation between the monitoring models; wherein, each banking business scenario is pre-configured with a monitoring model; the monitoring model grouping model uses a clustering algorithm to group the monitoring models;

[0016] The operational model building module is used to establish an operational model for each monitoring model group based on the operational time cost, identification time cost, and identification quality cost of each monitoring model group. The operational model of the monitoring model group uses whether the monitoring model group is running as the decision variable and the total operational cost as the output value.

[0017] The grouping result acquisition module is used to input banking business data into the monitoring model grouping model for solving, and to group the monitoring models whose correlation with banking business data exceeds the threshold into the same group to obtain the monitoring model grouping result.

[0018] The risk behavior identification module is used to identify risk behavior data based on other monitoring models in the same group as any monitoring model after a risk behavior is detected by any monitoring model.

[0019] The model group operation module is used to input banking business data and risk behavior data into the monitoring model group operation model, solve the problem based on the genetic algorithm, obtain the operation strategy information of each monitoring model group, and control the operation of each monitoring model group according to the operation strategy information of each monitoring model group.

[0020] This invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the above-described method for monitoring risk behaviors in banking operations.

[0021] This invention also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the aforementioned banking business risk behavior monitoring method.

[0022] This invention also provides a computer program product, which includes a computer program that, when executed by a processor, implements the above-described banking business risk behavior monitoring method.

[0023] In this embodiment of the invention, the banking business risk behavior monitoring solution, compared with existing technologies that lack customized monitoring model groups, making it difficult to discover the cascading risk factors behind business risks; and where full-scale operation of monitoring models consumes huge server resources, resulting in low operating efficiency and inability of risk monitoring personnel to handle situations in a timely manner during peak business periods, establishes a monitoring model grouping model based on the feature information of each monitoring model and the correlation between them. Specifically, one monitoring model is pre-configured for each banking business scenario; the monitoring model grouping model uses a clustering algorithm to group the monitoring models; and a grouping model is established based on the running time cost, identification time cost, and identification quality cost of each monitoring model group. A monitoring model group operation model is established. This model uses the decision of whether a monitoring model group operates as the decision variable and the total operating cost as the output value. Banking business data is input into the monitoring model grouping model for solution. Monitoring models whose correlation with banking business data exceeds a threshold are grouped together, resulting in the monitoring model grouping results. When any monitoring model detects a risky behavior, risky behavior data is identified based on other monitoring models within its group. Banking business data and risky behavior data are then input into the monitoring model group operation model, and a genetic algorithm is used to solve the problem, obtaining the operating strategy information for each monitoring model group. Based on the operating strategy information of each monitoring model group, the operation of each monitoring model group is controlled. This process identifies potential business risks, balances the operating cost and identification quality of the monitoring model groups, and achieves optimal identification results with limited operating resources. Attached Figure Description

[0024] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. In the drawings:

[0025] Figure 1 This is a flowchart illustrating the banking business risk behavior monitoring method in an embodiment of the present invention;

[0026] Figure 2 This is a flowchart illustrating the monitoring model grouping model establishment and solution method in an embodiment of the present invention;

[0027] Figure 3 This is a flowchart illustrating the method for establishing and solving the monitoring model group in an embodiment of the present invention.

[0028] Figure 4 This is a schematic diagram of a banking business risk behavior monitoring device in an embodiment of the present invention;

[0029] Figure 5 This is a schematic diagram of a computer device in an embodiment of the present invention. Detailed Implementation

[0030] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the embodiments of the present invention will be further described in detail below with reference to the accompanying drawings. Here, the illustrative embodiments of the present invention and their descriptions are used to explain the present invention, but are not intended to limit the present invention.

[0031] In the description of this specification, the terms "comprising," "including," "having," and "containing" are open-ended terms, meaning that they include but are not limited to. The terms "one embodiment," "a specific embodiment," "some embodiments," and "for example," etc., refer to specific features, structures, or characteristics described in connection with that embodiment or example that are included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, or characteristics described can be combined in any suitable manner in one or more embodiments or examples. The order of steps involved in the various embodiments is used to illustrate the implementation of the present invention, and the order of steps is not limited and can be adjusted as needed.

[0032] In the daily operations of large financial institutions, various business risks often arise, such as risks related to corporate clients, personal clients, and employee operations. Large financial institutions typically have dedicated model design teams that develop corresponding monitoring models for different types of business risks to monitor them. The following is a brief overview of the various operational risks in large financial institutions:

[0033] Corporate Client Risk Monitoring: This mainly focuses on monitoring the risks involved in corporate client business operations, including account opening, adjustments and changes, transactions, bills, accounts involved in cases, and community data mining.

[0034] Personal Customer Risk Monitoring: This mainly focuses on monitoring the risks associated with personal customer business during the account opening, adjustment, changes, and transactions of personal customer accounts.

[0035] Employee Operation Risk Monitoring: Monitoring employee operation scenarios during business operations at grassroots branches, including financial management, customer service, payroll processing, deposits, cash, withdrawals, adjustments and changes, customer information security, accounting, internal accounts, and fraudulent marketing scenarios.

[0036] For the above-mentioned types of business risks, risk monitoring personnel typically process and judge the matching and hit of monitoring model rules in batches, then generate risk events from the relevant hits, which are then identified, judged, and characterized by risk monitoring personnel before proceeding with relevant processes. However, from the perspective of overall operational efficiency and investigation, the following problems exist:

[0037] The lack of customized monitoring model sets makes it difficult to discover the cascading risk factors behind business risks; the full operation of the monitoring model consumes huge amounts of server resources, and during peak business periods, there will be situations where the operating efficiency is low and risk monitoring personnel cannot handle the situation in a timely manner.

[0038] To address the aforementioned issues, this invention provides a method for monitoring risk behaviors in banking operations, which identifies potential business risks, balances the operating costs and identification quality of the monitoring model group, and achieves optimal identification results with limited operating resources. Figure 1 This is a flowchart illustrating the banking business risk behavior monitoring method in an embodiment of the present invention, as shown below. Figure 1 As shown, the method includes:

[0039] Step 101: Based on the feature information of each monitoring model and the correlation between them, establish a monitoring model grouping model; wherein, one monitoring model is pre-configured for each banking business scenario; the monitoring model grouping model uses a clustering algorithm to group the monitoring models;

[0040] Step 102: Based on the running time cost, identification time cost, and identification quality cost of each monitoring model group, establish a monitoring model group operation model; wherein the monitoring model group operation model uses whether the monitoring model group is running as the decision variable and the total running cost as the output value;

[0041] Step 103: Input the banking business data into the monitoring model grouping model for solution, and group the monitoring models whose correlation with the banking business data exceeds the threshold into the same group to obtain the monitoring model grouping results;

[0042] Step 104: After any monitoring model detects a risky behavior, risky behavior data is identified based on other monitoring models within the same group as that monitoring model.

[0043] Step 105: Input banking business data and risk behavior data into the monitoring model group running model, solve it based on the genetic algorithm, and obtain the running strategy information of each monitoring model group;

[0044] Step 106: Control the operation of each monitoring model group according to the operation strategy information of each monitoring model group.

[0045] In one embodiment, the characteristic information of each monitoring model includes one or any combination of the following: risk object monitoring type, risk object number, monitoring model running date, operational risk factors, operational risk motivation, risk hit rate, monitoring model hit result, and risk point number.

[0046] In one embodiment, in step 103 above, the banking business data is input into the monitoring model grouping model for solution. Monitoring models whose correlation with the banking business data exceeds a threshold are grouped into the same group to obtain the monitoring model grouping results, including:

[0047] Using the simulated annealing algorithm, banking business data is input into the monitoring model grouping model for solution. Monitoring models whose correlation with banking business data exceeds the threshold are grouped into the same group to obtain the monitoring model grouping results.

[0048] Based on the risk point number, the monitoring model grouping results are deduplicated.

[0049] In one embodiment, step 102 above, establishing a monitoring model group operation model based on the running time cost, identification time cost, and identification quality cost of each monitoring model group, includes:

[0050] The total operating cost is calculated based on the preset equilibrium point coefficient, the operating time cost, identification time cost, and identification quality cost of the monitoring model group, and the costs other than the operating time cost, identification time cost, and identification quality cost of the monitoring model group.

[0051] Calculate the total operating cost using the following formula:

[0052]

[0053] in, This represents the total operating cost. This represents the sum of the running time cost and the identification time cost of the monitoring model group. This represents the identification quality cost of the monitoring model group. Represents the equilibrium point coefficient, used to determine... and The respective proportions of total operating costs; This represents the total cost of the monitoring model group excluding the operating time cost, identification time cost, and identification quality cost.

[0054] The following is combined Figure 2 and Figure 3 This invention provides a detailed description of the modeling process for the monitoring model grouping model and the monitoring model group operation model of the banking business risk behavior monitoring method provided in this embodiment.

[0055] Generally speaking, large banking institutions typically face the following types of risks in the daily operation of their branches:

[0056] 1. Risks associated with corporate clients

[0057] The risk assessment for corporate clients mainly targets whether corporate clients violate regulatory requirements, engage in illegal activities, or are suspected of fraud in major scenarios such as account opening, adjustments and changes, daily transactions, community mining, bills, and accounts involved in cases. Each major scenario is further refined for different business sub-scenarios. For example, in the transaction scenario, monitoring is implemented for specific scenarios such as abnormal payments from inter-regional accounts and special important transactions.

[0058] 2. Risks for individual customers

[0059] Personal customer risk monitoring primarily targets the monitoring of illegal and irregular activities in major scenarios such as the opening, adjustment, and changes of personal customer accounts, as well as daily transactions. This includes monitoring for abnormal withdrawals and unusual fund transfers. Similar to corporate customer risk monitoring, detailed monitoring models have been designed for each major risk scenario for personal customers, and monitoring is implemented for different sub-scenarios.

[0060] 3. Employee operational risks

[0061] Employee operational risks, as the name suggests, refer to actions taken by branch employees during daily business operations that violate financial institutions' operational rules and regulations, or laws and regulations, due to subjective violations or unfamiliarity with management rules. Currently, large banks primarily conduct monitoring in scenarios such as wealth management purchases, customer agency operations, payroll processing, deposit business, cash business, withdrawals, adjustments and changes, customer information security, and accounting business, and have designed monitoring models for each sub-scenario.

[0062] As shown above, operational risk monitoring targets three groups: corporate clients, individuals, and employees, comprehensively covering all scenarios in daily business operations, attempting to achieve full coverage of risk exposure. However, since each dimension's model operates independently, risk subjects often violate numerous monitoring rules when engaging in violations. Furthermore, current individual model assessments struggle to uncover the correlation between the risk subject and the models they trigger, hindering targeted intervention. Therefore, a monitoring model classification method is needed to categorize different monitoring models and enable collaborative risk discovery. This proposed method can optimize existing monitoring models, allowing model designers to identify deficiencies in relevant parameters, triggering model iterations and effectively improving the control over risk exposure.

[0063] Figure 2 This is a flowchart illustrating the monitoring model grouping model establishment and solution method in an embodiment of the present invention, as shown below. Figure 2 As shown, the method includes:

[0064] S10: Description of monitoring model feature information, including:

[0065] 1. Types of Risk Monitoring Targets

[0066] This section mainly describes the objects matched by the relevant models. The main categories are corporate, individual, and employee. These can generally be represented by dictionary values, such as 1-corporate; 2-individual; 3-employee.

[0067] 2. Risk object number

[0068] For corporate clients, a client information number assigned by the organization itself is generally used; for individual clients, a client information number or identity information is generally used; and for employees, an employee number is generally used.

[0069] 3. Batch Dates

[0070] The model is typically trained using only a few single-day data sets, without merging data from multiple days.

[0071] 4. Risk Collection Elements

[0072] This refers to the abbreviations set by model designers for what are called "contrary regulations" for corporate clients, individual clients, and employees when assessing relevant model risks. These abbreviations are generally also described using dictionary values.

[0073] 5. Risk Drivers

[0074] This refers to the description of the risk object's risk motivation designed by model designers when assessing the relevant model risks. It is generally stored using dictionary values.

[0075] 6. Risk Score

[0076] The total score of the model is calculated based on the hit rate of the rules in the model.

[0077] 7. Final determination result

[0078] This refers to whether the model has been truly hit, as determined by risk assessment personnel. It is maintained using dictionary values: 1 - true hit; 2 - false alarm.

[0079] 8. Risk Points

[0080] The model number itself is not used as a calculation parameter, but only as a basis for deduplication.

[0081] S11: Monitoring model grouping model establishment, including:

[0082] The monitoring model's feature information is in numerical form. The different numerical types are described below:

[0083] For dictionary values, you can directly use the numeric dictionary value as the result; here, we define this value as... .

[0084] For numerical values ​​such as model scores, a normalization method can be used as a constraint to reduce the impact of differences in total scores between different models. Here, this value is defined as... .

[0085] For corporate clients, individual clients, and employees, numbers are assigned sequentially, defined here as follows: .

[0086] Based on the feature information of the monitoring model, a grouping model of the monitoring model is established based on the multi-path spectral clustering algorithm. The specific modeling process of the grouping model of the monitoring model is as follows:

[0087] Based on the data type of the monitoring model characteristic information, a vector group is formed. This serves as an indicator for measuring the similarity of monitoring models. Assuming one model has... The vector group of the monitoring model hit the record It can be seen as being caused by A set of vector groups consisting of vectors can be constructed as a directed graph. .in, Represents the arc between the hit record vectors, with , , Indicates in The vector group of the monitoring model hit the record index, The weights of the arcs are represented by: .

[0088] For the graph Define its weighted adjacency matrix .matrix The elements in are:

[0089]

[0090] in, , Indicates in The vector group of the monitoring model hit the record index, Let represent the Gaussian kernel function, and represent the parameters to be optimized.

[0091] Furthermore, define the degree matrix. Its diagonal elements are:

[0092]

[0093] in, It represents the cursor and has no practical meaning.

[0094] In degree matrix In addition to Apart from that, all other elements are 0.

[0095] definition As a diagram The Laplace matrix has .

[0096] The goal of spectral clustering is to segment a graph into... There are several subgraphs, and it is guaranteed that the sum of the weights of the intervals connecting the subgraphs is minimized, while the sum of the weights within the subgraphs is relatively large.

[0097] Suppose we divide the graph into two subgraphs, for the subgraphs... and Assume the set of connection paths between the two is ,have:

[0098]

[0099] in, Represents an arc in the set. Indicates including the starting point and target point The set, Indicates the starting point. The target point is represented by two subgraphs.

[0100] The weight of the path set is then... Its value is:

[0101]

[0102] The partitioning objective function based on spectral clustering is shown below:

[0103]

[0104] in, Indicates the number of partition clusters.

[0105] Here, the present invention uses the multi-way canonical cut set criterion as an implementation method, which has higher execution efficiency compared to other criteria. Its identification model is as follows:

[0106]

[0107] in, To represent a subset, , , This indicates a cursor, but has no practical meaning. Let arc represent the sum of the weights of the subsets to the whole set. This represents the sum of weights between subgraphs.

[0108] This identification model serves as a grouping model for monitoring models, used to group... The graph composed of the record vectors hit by the pen monitoring model is divided into several... The goal is to create subgraphs, where the similarity between records hit by each monitoring model within a subgraph reaches its maximum, while the similarity between records hit by monitoring models across subgraphs reaches its minimum. This process requires algorithm-driven execution, and the following describes the solution process for grouping monitoring models.

[0109] S12: Solving the monitoring model grouping model, including:

[0110] After the monitoring model grouping model is established, there are two parameters to be optimized, one of which is the Gaussian kernel function. The other is the number of partition clusters S. To determine the optimal values, an optimization algorithm based on simulated annealing is proposed to optimize the values ​​of the two parameters.

[0111] Therefore, the constraints are:

[0112]

[0113] in, For the number of iterations, Temperature threshold, This represents the temperature decay rate.

[0114] The detailed solution process for the model is given here:

[0115] Step 1 Initialization as well as ,calculate , , ;

[0116] Step 2: Standardize the Laplace matrix ,calculate The former Eigenvectors corresponding to eigenvalues , forming a vector space ;

[0117] Step 3 Convert all row vectors in the matrix to unit vectors to obtain the matrix. ;

[0118] Step 4 Each row of the matrix is ​​analyzed using the k-means algorithm to obtain... A cluster;

[0119] Step 5 In the matrix The The row belongs to the category At that time, the data points Classified into categories middle;

[0120] Step 6: Calculate the objective function value (The objective function is a constant value obtained under specified parameters based on the objective model. During the annealing process, the goal is to reduce the value of the objective function, which is also the iterative objective.) Random as well as Repeat Steps 1-5 to obtain the new function value;

[0121] Step 7: Calculate the objective function value Increment And choose whether to receive increments. ;

[0122] Step 8: If the required number of iterations has been reached, proceed to Step 9; otherwise, proceed to Step 6.

[0123] Step 9: Determine if the termination condition is met. If it is, proceed to Step 10; otherwise, reduce the temperature and proceed to Step 6.

[0124] Step 10: Output the Gaussian kernel function and the number of partition clusters The optimal solution;

[0125] After obtaining the Gaussian kernel function and the number of partition clusters After finding the optimal solution, the monitoring model grouping results are deduplicated according to the risk point number to finally obtain the monitoring model grouping results.

[0126] The method described in the above embodiments enables the grouping of monitoring models based on feature information, achieving grouping of different monitoring models in practical application scenarios and breaking down barriers between monitoring models. By operating based on monitoring model groups, potential risk points can be effectively identified. When a single monitoring model is hit, it can simultaneously trigger alerts to other monitoring models in the same group, facilitating monitoring personnel's review and analysis. However, as the situation continues to change, operational risks themselves exhibit diversified and evolving trends, leading to a decrease in the accuracy of monitoring model identification. Furthermore, since the monitoring model groups themselves consume a significant amount of time during operation, and risk identification personnel also spend considerable time on risk assessment, the increasing scale of monitoring models may result in substantial cost expenditures. Therefore, there is a certain contradiction between whether to run a monitoring model and the resource consumption of its operation, yet both are important optimization objectives. Thus, there is a game-theoretic relationship between prioritizing resource consumption and prioritizing indiscriminate risk control. Here, we define: for an iterative process that prioritizes control while relatively ignoring time efficiency, it is called optimal effect; for an iterative process that prioritizes resource consumption relative to control effectiveness, it is called optimal efficiency. In reality, for multiple monitoring model groups, users aim to minimize the sum of the costs incurred to achieve optimal efficiency and the costs incurred to achieve optimal recognition results; this total cost is called "cost". This doesn't mean that both optimal time efficiency and optimal recognition results can be achieved simultaneously, but rather that the total operating cost is minimized—that is, a balance point is found between the two, or a balance point determined by the user. This balance point is defined as: the point sought by the operations management department administrator to minimize cost while achieving optimal recognition results and optimal time efficiency. Under this condition, partial optimal recognition results and optimal resource consumption can be achieved as much as possible with minimal cost. This total operating cost is denoted by a symbol... The equilibrium point coefficient is represented by the symbol... express

[0127] Figure 3 This is a flowchart illustrating the method for establishing and solving the monitoring model group in an embodiment of the present invention. Figure 3 As shown, the method includes:

[0128] S20: Determining the operating cost of the monitoring model group includes: First, defining the metrics for recognition effectiveness and resource consumption. For the measurement of recognition efficiency, the number of recognition deviations is used as the metric, i.e., the cost of the monitoring model group's recognition quality; for the measurement of resource consumption, the operating time cost and the recognition time cost of the monitoring model group are used as the metric.

[0129] S21: Monitor model group operation and model establishment, including: measuring the operating cost of the model group, assuming a model group involves A model, denoted as ,have Each monitoring model involves rules. One, represented as ,have The overall runtime of this monitoring model is... Therefore, the runtime cost of the monitoring model group is expressed as: ,have:

[0130]

[0131] in, Indicates the serial number of the monitoring model. Indicates the rule number. Indicates monitoring model Rules The overall runtime of the program. Indicates monitoring model Rules The operating coefficient at that time.

[0132] For measuring the time cost of monitoring model group identification, assuming a model group hits... A model, which is represented as ,have Each model involves rules. One, which is represented as ,have For this model group, the overall runtime is approximately [time value missing]. Therefore, the time cost of the monitoring model group identification is expressed as: ,have:

[0133]

[0134] in, Indicates the serial number of the monitoring model. Indicates the rule number. Indicates monitoring model Rules The overall runtime of the program. Indicates monitoring model Rules involved The operating coefficient at that time.

[0135] For total time cost ,have:

[0136]

[0137] For measuring the cost of identifying quality, for a set of monitoring models, identifying true hits... One, which is represented as ,have Therefore, for the monitoring model group, its identification quality cost is... ,have:

[0138]

[0139] in, Indicates the serial number of the monitoring model. Indicates the sequence number of the true hit. Indicates monitoring model The model with true hits in the middle, This represents the recognition quality coefficient.

[0140] Therefore, the total operating cost model is as follows:

[0141]

[0142] Will and Substituting into the above equation, we have:

[0143]

[0144] in, Represents the equilibrium point coefficient. This indicates the hit weight. Represents a constant.

[0145] The corresponding constraints are:

[0146]

[0147]

[0148]

[0149]

[0150]

[0151]

[0152]

[0153]

[0154] S22: Monitoring Model Group Operation Model Solving, including: Solving the total cost model of the monitoring model group operation based on a genetic algorithm. The decision variable is whether the model group is running; the value is 1 if selected, and 0 otherwise. Variables are defined. To refer to the set, therefore we have ,in This represents a single monitoring model within the group. Further, a population symbol is defined. , used to indicate the first For each generation of populations, there are ,in This represents the population size. The implementation details of the algorithm will be explained below.

[0155] (1) Crossover process

[0156] Assume the crossover probability in each iteration is To ensure the proper conduct of crossover, the following assumptions are made: gene segments are indivisible, and a set of genes (individuals) serves as the basic unit for crossover; crossover does not occur when two gene loci are identical, and the genes are directly passed on to offspring; otherwise, crossover is implemented.

[0157] (2) Variation process

[0158] Assuming each chromosome has it in every generation The probability of mutation occurs, and the mutation process involves swapping 0 and 1, with the mutation position being random.

[0159] (3) Selection process

[0160] The selection process aims to ensure that good individuals can be inherited. Here, a standard roulette wheel selection method is used, with the individual fitness as the objective function. Assume that the fitness of a given individual is... The overall fitness is The probability of selecting an individual is:

[0161]

[0162] The solution steps are as follows:

[0163] Step 1: Initialize the relevant parameters of the monitoring model group and generate multiple model group operation strategies, i.e., populations, based on random numbers.

[0164] Step 2: Iterate based on different model group running strategies to obtain relevant iterative data.

[0165] Step 3: Calculate the fitness of individuals and groups based on the results of iterative data.

[0166] Step 4: Perform mutation, crossover, and selection operations on individuals within the population to generate a new population set;

[0167] Step 5: Check the number of iterations. If it exceeds the limit, proceed to Step 6; otherwise, proceed to Step 2.

[0168] Step 6: Output the optimal operating strategy for the monitoring model group.

[0169] Using the above algorithms, users can filter whether the monitoring model group is running or not by setting a custom balance point, seeking a balance between risk identification accuracy and time efficiency, obtaining the operation strategy information of each monitoring model group, controlling the operation of each monitoring model group, and achieving the requirement of minimizing the total operating cost of the monitoring model group.

[0170] This invention also provides a banking business risk behavior monitoring device, as described in the following embodiments. Since the principle by which this device solves the problem is similar to that of the banking business risk behavior monitoring method, the implementation of this device can refer to the implementation of the banking business risk behavior monitoring method; repeated details will not be elaborated further.

[0171] Figure 4 This is a schematic diagram of a banking business risk behavior monitoring device in an embodiment of the present invention, such as... Figure 4 As shown, the device includes:

[0172] The grouping model building module 01 is used to build a monitoring model grouping model based on the feature information of each monitoring model and the correlation between the monitoring models; wherein, each banking business scenario is pre-configured with a monitoring model; the monitoring model grouping model uses a clustering algorithm to group the monitoring models;

[0173] The operation model establishment module 02 is used to establish the operation model of the monitoring model group based on the operation time cost, identification time cost, and identification quality cost of each monitoring model group; the operation model of the monitoring model group uses whether the monitoring model group is running as the decision variable and the total operation cost as the output value.

[0174] The grouping result acquisition module 03 is used to input banking business data into the monitoring model grouping model for solving, and to group the monitoring models whose correlation with banking business data exceeds the threshold into the same group to obtain the monitoring model grouping result.

[0175] The risk behavior identification module 04 is used to identify risk behavior data based on other monitoring models in the same group as any monitoring model after a risk behavior is detected by any monitoring model.

[0176] The model group operation module 05 is used to input banking business data and risk behavior data into the monitoring model group operation model, solve the problem based on the genetic algorithm, obtain the operation strategy information of each monitoring model group, and control the operation of each monitoring model group according to the operation strategy information of each monitoring model group.

[0177] In one embodiment, the feature information of each monitoring model includes:

[0178] The risk object monitoring type, risk object number, monitoring model running date, operational risk factors, operational risk motivation, risk hit rate, monitoring model hit result, and risk point number are one or any combination thereof.

[0179] In one embodiment, the grouping result acquisition module is specifically used for:

[0180] Using the simulated annealing algorithm, banking business data is input into the monitoring model grouping model for solution. Monitoring models whose correlation with banking business data exceeds the threshold are grouped into the same group to obtain the monitoring model grouping results.

[0181] Based on the risk point number, the monitoring model grouping results are deduplicated.

[0182] In one embodiment, the running model building module is specifically used for:

[0183] The total operating cost is calculated based on the preset equilibrium point coefficient, the operating time cost, identification time cost, and identification quality cost of the monitoring model group, and the costs other than the operating time cost, identification time cost, and identification quality cost of the monitoring model group.

[0184] Calculate the total operating cost using the following formula:

[0185]

[0186] in, This represents the total operating cost. This represents the sum of the running time cost and the identification time cost of the monitoring model group. This represents the identification quality cost of the monitoring model group. Represents the equilibrium point coefficient, used to determine... and The respective proportions of total operating costs; This represents the total cost of the monitoring model group excluding the operating time cost, identification time cost, and identification quality cost.

[0187] In summary, compared with the prior art, the beneficial effects of the present invention are as follows:

[0188] 1. This invention proposes a monitoring model grouping model. This model groups different models based on data information features and combines clustering algorithms to achieve optimal model group division, laying the foundation for subsequent model group operation strategies. It can also effectively uncover potential risks during daily risk identification, providing a basis for supplementing business risk control scenarios and model parameter tuning.

[0189] 2. This invention proposes a monitoring model group operation strategy. This strategy dynamically considers the model's recognition accuracy and operating cost, finding a dynamic balance between the two. It achieves optimal recognition results with limited operating resources. Simultaneously, based on the models that are eliminated, the monitoring model designers can specifically analyze whether the elimination is due to low recognition ability or low operating efficiency, thereby promoting further model iteration.

[0190] This invention also provides a computer device. Figure 5 This is a schematic diagram of a computer device in an embodiment of the present invention. The computer device 500 includes a memory 510, a processor 520, and a computer program 530 stored in the memory 510 and executable on the processor 520. When the processor 520 executes the computer program 530, it implements the aforementioned banking business risk behavior monitoring method. This embodiment of the present invention also provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, it implements the aforementioned banking business risk behavior monitoring method.

[0191] This invention also provides a computer program product, which includes a computer program that, when executed by a processor, implements the above-described banking business risk behavior monitoring method.

[0192] In this embodiment of the invention, the banking business risk behavior monitoring solution, compared with existing technologies that lack customized monitoring model groups, making it difficult to discover the cascading risk factors behind business risks; and where full-scale operation of monitoring models consumes huge server resources, resulting in low operating efficiency and inability of risk monitoring personnel to handle situations in a timely manner during peak business periods, establishes a monitoring model grouping model based on the feature information of each monitoring model and the correlation between them. Specifically, one monitoring model is pre-configured for each banking business scenario; the monitoring model grouping model uses a clustering algorithm to group the monitoring models; and a grouping model is established based on the running time cost, identification time cost, and identification quality cost of each monitoring model group. A monitoring model group operation model is established. This model uses the decision of whether a monitoring model group operates as the decision variable and the total operating cost as the output value. Banking business data is input into the monitoring model grouping model for solution. Monitoring models whose correlation with banking business data exceeds a threshold are grouped together, resulting in the monitoring model grouping results. When any monitoring model detects a risky behavior, risky behavior data is identified based on other monitoring models within its group. Banking business data and risky behavior data are then input into the monitoring model group operation model, and a genetic algorithm is used to solve the problem, obtaining the operating strategy information for each monitoring model group. Based on the operating strategy information of each monitoring model group, the operation of each monitoring model group is controlled. This process identifies potential business risks, balances the operating cost and identification quality of the monitoring model groups, and achieves optimal identification results with limited operating resources.

[0193] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0194] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0195] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0196] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0197] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above descriptions are merely specific embodiments of the present invention and are not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for monitoring risky behaviors in banking operations, characterized in that, include: Based on the feature information of each monitoring model and the correlation between them, a monitoring model grouping model is established; each banking business scenario is pre-configured with one monitoring model; the monitoring model grouping model uses a clustering algorithm to group the monitoring models. Based on the running time cost, identification time cost, and identification quality cost of each monitoring model group, an operational model for the monitoring model group is established. The operational model for the monitoring model group uses whether the monitoring model group is running as the decision variable and the total running cost as the output value. The banking business data is input into the monitoring model grouping model for solution. The monitoring models whose correlation with the banking business data exceeds the threshold are grouped into the same group to obtain the monitoring model grouping results. Once any monitoring model identifies a risky behavior, risky behavior data is obtained based on other monitoring models within the same group as that monitoring model. Input banking business data and risk behavior data into the monitoring model group to run the model, solve it based on the genetic algorithm, and obtain the operation strategy information of each monitoring model group; Control the operation of each monitoring model group based on the operation strategy information of each monitoring model group.

2. The method as described in claim 1, characterized in that, The characteristic information of each monitoring model includes: The risk object monitoring type, risk object number, monitoring model running date, operational risk factors, operational risk motivation, risk hit rate, monitoring model hit result, and risk point number are one or any combination thereof.

3. The method as described in claim 2, characterized in that, The banking business data is input into the monitoring model grouping model for solution. Monitoring models whose correlation with the banking business data exceeds a threshold are grouped together to obtain the monitoring model grouping results, including: Using the simulated annealing algorithm, banking business data is input into the monitoring model grouping model for solution. Monitoring models whose correlation with banking business data exceeds the threshold are grouped into the same group to obtain the monitoring model grouping results. Based on the risk point number, the monitoring model grouping results are deduplicated.

4. The method as described in claim 1, characterized in that, Based on the operating time cost, identification time cost, and identification quality cost of each monitoring model group, an operating model for the monitoring model group is established, including: The total operating cost is calculated based on the preset equilibrium point coefficient, the operating time cost, identification time cost, and identification quality cost of the monitoring model group, and the costs other than the operating time cost, identification time cost, and identification quality cost of the monitoring model group in the total cost of the monitoring model group.

5. A device for monitoring risk behavior in banking operations, characterized in that, include: The grouping model building module is used to build a monitoring model grouping model based on the feature information of each monitoring model and the correlation between the monitoring models; wherein, each banking business scenario is pre-configured with a monitoring model; the monitoring model grouping model uses a clustering algorithm to group the monitoring models; The operational model building module is used to establish an operational model for each monitoring model group based on the operational time cost, identification time cost, and identification quality cost of each monitoring model group. The operational model of the monitoring model group uses whether the monitoring model group is running as the decision variable and the total operational cost as the output value. The grouping result acquisition module is used to input banking business data into the monitoring model grouping model for solving, and to group the monitoring models whose correlation with banking business data exceeds the threshold into the same group to obtain the monitoring model grouping result. The risk behavior identification module is used to identify risk behavior data based on other monitoring models in the same group as any monitoring model after a risk behavior is detected by any monitoring model. The model group operation module is used to input banking business data and risk behavior data into the monitoring model group operation model, solve the problem based on the genetic algorithm, obtain the operation strategy information of each monitoring model group, and control the operation of each monitoring model group according to the operation strategy information of each monitoring model group.

6. The apparatus as claimed in claim 5, characterized in that, The characteristic information of each monitoring model includes: The risk object monitoring type, risk object number, monitoring model running date, operational risk factors, operational risk motivation, risk hit rate, monitoring model hit result, and risk point number are one or any combination thereof.

7. The apparatus as claimed in claim 6, characterized in that, The grouping result retrieval module is specifically used for: Using the simulated annealing algorithm, banking business data is input into the monitoring model grouping model for solution. Monitoring models whose correlation with banking business data exceeds the threshold are grouped into the same group to obtain the monitoring model grouping results. Based on the risk point number, the monitoring model grouping results are deduplicated.

8. The apparatus as claimed in claim 5, characterized in that, The model building module is specifically used for: The total operating cost is calculated based on the preset equilibrium point coefficient, the operating time cost, identification time cost, and identification quality cost of the monitoring model group, and the costs other than the operating time cost, identification time cost, and identification quality cost of the monitoring model group in the total cost of the monitoring model group.

9. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method of any one of claims 1 to 4.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the method of any one of claims 1 to 4.

11. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the method of any one of claims 1 to 4.

Images