A risk identification method, apparatus, computer device, and storage medium

Abstract

This application relates to the field of big data technology, and in particular to a risk identification method, apparatus, computer equipment, storage medium, and computer program product. The method includes: acquiring transaction data to be processed; constructing a data processing queue based on the transaction data; processing the data processing queue based on a pre-built stream computing model to filter out risk account data that conforms to preset rules, wherein the stream computing model is associated with a risk identification dimension table; performing offline calculations on the risk account data to extract risk feature information associated with the risk account data; writing the risk feature information into the risk identification dimension table; updating the stream computing model based on the risk identification dimension table; and processing the data processing queue based on the updated stream computing model to obtain a risk identification result. This method can improve the efficiency and accuracy of risk detection.

Description

Technical Field

[0001] This application relates to the field of big data technology, and in particular to a risk identification method, apparatus, computer equipment, storage medium, and computer program product. Background Technology

[0002] Risk detection refers to the identification and assessment of potential risks through various means and tools in order to take timely measures to reduce or avoid losses. With the development of big data technology, it has been widely applied in the field of risk detection. Corporate involvement in gambling and fraud refers to situations where, due to loopholes or deficiencies in internal risk management or related internal compliance systems, these loopholes are exploited by relevant institutions or individuals to engage in illegal activities such as cross-border gambling, illegal fundraising, asset transfer, or online lending. These illegal activities not only expose the company to risks of financial loss, reputational damage, and external regulatory penalties, but also cause financial and psychological losses to the public who purchase or use the company's services. In real-world business scenarios, individuals involved in fraud use bank cards and related payment tools to commit fraud, making it extremely difficult for banks to intercept these accounts from massive amounts of transaction data. Existing fraud detection methods rely on supervised machine learning, blacklists, or rules to identify fraud.

[0003] In related technologies, supervised machine learning specifically uses methods such as mathematical statistics and expert analysis to find significant features, then processes and cleans the data before feeding it into the machine learning model to identify accounts involved in cases. This method reduces manual costs and significantly improves identification efficiency. Blacklists focus on monitoring suspicious accounts or accounts with a history of illegal transactions, and control large-scale transactions and other potentially problematic transactions. Rule-based models utilize mature big data technologies such as stream computing or offline computing to implement rules, thereby triggering alerts and actions for transactions that violate the rules.

[0004] However, current risk identification methods have the following technical problems:

[0005] Because the amount of negative sample data for risk detection is small, and some neural network models cannot provide reasonable explanations for false positives due to their poor interpretability, machine learning still requires a lot of human resources for investigation and maintenance. Furthermore, blacklists are lagging and cannot prevent major violations in advance, resulting in the poor effectiveness of current risk detection technology in avoiding violations. Summary of the Invention

[0006] Therefore, it is necessary to provide a risk identification method, device, computer equipment, computer-readable storage medium, and computer program product that can improve the efficiency and accuracy of risk detection, in response to the above-mentioned technical problems.

[0007] Firstly, this application provides a risk identification method. The method includes:

[0008] Obtain the transaction data to be processed, and construct a data processing queue based on the transaction data;

[0009] The data processing queue is processed based on a pre-built stream computing model to filter out risk account data that meets preset rules. The stream computing model is associated with a risk identification dimension table.

[0010] Offline calculations are performed on the risk account data to extract risk characteristic information associated with the risk account data;

[0011] The risk characteristic information is written into the risk identification dimension table, and the stream computing model is updated based on the risk identification dimension table.

[0012] The data processing queue is processed based on the updated stream computing model to obtain risk identification results.

[0013] In one embodiment, the data processing queue is processed based on a pre-built stream computing model to filter out risk account data that meets preset rules. The stream computing model is associated with a risk identification dimension table, including:

[0014] The data processing queue is filtered by a rule model built based on preset static conditions, and target transaction data that meets the static conditions is selected from the data processing queue.

[0015] The target transaction data is parsed to obtain identifier data that matches the processing conditions of the stream computing model;

[0016] The risk account data is obtained by parsing and filtering the identifier data based on the stream computing model.

[0017] In one embodiment, the application filters the data processing queue based on a rule model constructed according to preset static conditions, and selects target transaction data in the data processing queue that meets the static conditions, including:

[0018] If the amount of data in the data processing queue is less than the amount of data specified by the condition threshold of the rule model, a data window is constructed based on the amount of missing data, and a certain amount of historical data is obtained through the data window.

[0019] The historical data is processed, and the processed historical data is added to the data processing queue.

[0020] In one embodiment, acquiring the transaction data to be processed and constructing a data processing queue based on the transaction data includes:

[0021] The transaction data is acquired and preprocessed, including data filtering, data labeling, and data standardization.

[0022] The data processing queue is constructed based on the preprocessed transaction data.

[0023] In one embodiment, the offline calculation of the risk account data to extract risk characteristic information associated with the risk account data includes:

[0024] Synchronize the risk account data to the offline database;

[0025] The data in the offline database is processed in batches to obtain the batch extracted risk feature information.

[0026] In one embodiment, before writing the risk feature information into the risk identification dimension table and updating the stream computing model based on the risk identification dimension table, the method further includes:

[0027] The preset identifier is connected to the risk feature information, and the risk feature information is processed into a feature information field that conforms to a preset format.

[0028] Secondly, this application also provides a risk identification device. The device includes:

[0029] The data processing queue module is used to acquire transaction data to be processed and to construct a data processing queue based on the transaction data.

[0030] The stream computing processing module is used to process the data processing queue based on a pre-built stream computing model and filter out risk account data that meets preset rules. The stream computing model is associated with the risk identification dimension table.

[0031] The offline calculation and processing module is used to perform offline calculations on the risk account data and extract risk feature information associated with the risk account data;

[0032] The dimension table update module is used to write the risk feature information into the risk identification dimension table and update the stream computing model based on the risk identification dimension table.

[0033] The risk identification module is used to process the data processing queue based on the updated stream computing model to obtain risk identification results.

[0034] In one embodiment, the stream computing processing module includes:

[0035] The real-time computing module is used to apply a rule model built based on preset static conditions to filter the data processing queue and select target transaction data in the data processing queue that meets the static conditions.

[0036] The real-time data processing module is used to parse the target transaction data to obtain identification data that matches the processing conditions of the stream computing model;

[0037] The stream computing module is used to parse and filter the identifier data based on the stream computing model to obtain the risk account data.

[0038] In one embodiment, the real-time computing module includes:

[0039] The windowing processing module is used to construct a data window based on the missing data if the amount of data in the data processing queue is less than the amount of data specified by the condition threshold of the rule model, and to obtain a certain amount of historical data through the data window.

[0040] The data queue replenishment module is used to process the historical data and replenish the processed historical data to the data processing queue.

[0041] In one embodiment, the data processing queue module includes:

[0042] A transaction data preprocessing module is used to acquire the transaction data and preprocess the transaction data, the preprocessing including data filtering, data labeling and data standardization.

[0043] The message queue construction module is used to construct the data processing queue based on the preprocessed transaction data.

[0044] In one embodiment, the offline computing processing module includes:

[0045] An offline database module is used to synchronize the risk account data to an offline database;

[0046] The risk feature extraction module is used to process the data in the offline database in batches to obtain the batch extracted risk feature information.

[0047] In one embodiment, prior to the dimension table update module, the following is also included:

[0048] The feature data splicing module is used to connect preset identifiers to the risk feature information and process the risk feature information into feature information fields that conform to a preset format.

[0049] Thirdly, this application also provides a computer device. The computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the steps of a risk identification method as described in any embodiment of the first aspect.

[0050] Fourthly, this application also provides a computer-readable storage medium. The computer-readable storage medium stores a computer program thereon, which, when executed by a processor, implements the steps of a risk identification method as described in any embodiment of the first aspect.

[0051] Fifthly, this application also provides a computer program product. The computer program product includes a computer program that, when executed by a processor, implements the steps of a risk identification method as described in any embodiment of the first aspect.

[0052] The aforementioned risk identification method, apparatus, computer equipment, storage medium, and computer program product, derived through the technical features described in the proprietary claims, can achieve the following beneficial effects to address the technical problems in the background art:

[0053] This application provides a risk identification method, the steps of which include acquiring transaction data to be processed, constructing a data processing queue based on the transaction data, and then batch processing the data processing queue according to a pre-built stream computing model to filter out risk account data that meets preset specific filtering rules. At this point, the stream computing model is associated with a risk identification dimension table, which provides certain filtering conditions for the stream computing model. Subsequently, offline computation can be performed on the risk account data using an offline computation framework to accurately extract risk feature information associated with the risk account data. After writing the risk feature information into the risk identification dimension table, the stream computing model can be updated based on the risk identification dimension table. At this point, the risk identification rules in the stream computing model are supplemented and optimized, with the supplementation and optimization coming from the risk feature information obtained from offline computation. Risk identification is then performed on the data processing queue using the updated stream computing model, ultimately yielding the risk identification result. In implementation, the final applied stream computing model can process the data processing queue with the real-time computational efficiency of stream computing, and the risk identification detection rules in the stream computing model are continuously updated and optimized by the offline computation database, thus simultaneously improving the efficiency and accuracy of risk identification. Attached Figure Description

[0054] Figure 1 This is a diagram illustrating the application environment of a risk identification method in one embodiment.

[0055] Figure 2This is a schematic diagram of the first process of a risk identification method in one embodiment;

[0056] Figure 3 This is a schematic diagram of the second process of a risk identification method in another embodiment;

[0057] Figure 4 This is a schematic diagram of the third process of a risk identification method in another embodiment;

[0058] Figure 5 This is a schematic diagram of the fourth process of a risk identification method in another embodiment;

[0059] Figure 6 This is a schematic diagram of the fifth process of a risk identification method in another embodiment;

[0060] Figure 7 This is a schematic diagram of the sixth process of a risk identification method in another embodiment;

[0061] Figure 8 This is a structural block diagram of a risk identification device in one embodiment;

[0062] Figure 9 FIG. 1 is a diagram showing the internal structure of a computer device in one embodiment. Detailed Implementation

[0063] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0064] In related technologies, supervised machine learning specifically uses methods such as mathematical statistics and expert analysis to find significant features, then processes and cleans the data before feeding it into the machine learning model to identify accounts involved in cases. This method reduces manual costs and significantly improves identification efficiency. Blacklists focus on monitoring suspicious accounts or accounts with a history of illegal transactions, and control large-scale transactions and other potentially problematic transactions. Rule-based models utilize mature big data technologies such as stream computing or offline computing to implement rules, thereby triggering alerts and actions for transactions that violate the rules.

[0065] However, current risk identification methods have the following technical problems:

[0066] Because the amount of negative sample data for risk detection is small, and some neural network models cannot provide reasonable explanations for false positives due to their poor interpretability, machine learning still requires a lot of human resources for investigation and maintenance. Furthermore, blacklists are lagging and cannot prevent major violations in advance, resulting in the poor effectiveness of current risk detection technology in avoiding violations.

[0067] Based on this, the risk identification method provided in this application embodiment can be applied to, for example... Figure 1 In the application environment shown, terminal 102 communicates with server 104 via a network. A data storage system can store the data that server 104 needs to process. The data storage system can be integrated onto server 104 or located in the cloud or on other network servers. Terminal 102 can be, but is not limited to, various personal computers, laptops, smartphones, tablets, IoT devices, and portable wearable devices. IoT devices can include smart speakers, smart TVs, smart air conditioners, smart in-vehicle devices, etc. Portable wearable devices can include smartwatches, smart bracelets, head-mounted devices, etc. Server 104 can be implemented using a standalone server or a server cluster consisting of multiple servers.

[0068] In one embodiment, such as Figure 2 As shown, a risk identification method is provided, which can be applied to... Figure 1 Taking the terminal in the example, the explanation includes the following steps:

[0069] Step 201: Obtain the transaction data to be processed, and construct a data processing queue based on the transaction data.

[0070] Transaction data can refer to data related to transaction events occurring on a trading platform or institution. A data processing queue can refer to a queue between data acquisition and data processing. Sending data to the queue and retrieving data from the queue for processing decouples the data production and consumption processes, improving the system's scalability and stability.

[0071] For example, the terminal can acquire transaction data to be processed and construct a data processing queue based on the transaction data.

[0072] Step 203: Process the data processing queue based on the pre-built stream computing model to filter out risk account data that meets preset rules. The stream computing model is associated with the risk identification dimension table.

[0073] Stream computing is a computational model used for real-time data processing, typically handling real-time data streams and generating real-time results. In stream computing, data is continuously generated and processed as a stream, rather than batch-processing static datasets. This model is suitable for scenarios requiring real-time monitoring, analysis, and decision-making, such as real-time recommendation systems and real-time risk monitoring. Dimension tables are a type of table in a database used to store descriptive information and dimensional data. Dimension tables typically store static data used for classifying, filtering, and summarizing factual data.

[0074] For example, the terminal can process the data processing queue based on a pre-built stream computing model to filter out risk account data that meets preset rules, wherein the stream computing model is associated with a risk identification dimension table.

[0075] Step 205: Perform offline calculations on the risk account data to extract risk characteristic information associated with the risk account data.

[0076] Offline computing refers to batch processing on static datasets, typically involving the analysis and processing of historical data. Offline computing is characterized by long processing times, often measured in hours, days, or even longer. It is suitable for scenarios such as historical data analysis, batch processing, and offline report generation. Examples include data mining, batch analysis, and offline recommendation systems. Risk characteristic information refers to the features or indicators used to describe and identify potential risks during risk assessment or risk management.

[0077] For example, the terminal can perform offline calculations on the risk account data to extract risk characteristic information associated with the risk account data.

[0078] Step 207: Write the risk feature information into the risk identification dimension table, and update the stream computing model based on the risk identification dimension table.

[0079] For example, the terminal can write the risk feature information into the risk identification dimension table and update the stream computing model based on the risk identification dimension table.

[0080] Step 209: Process the data processing queue based on the updated stream computing model to obtain risk identification results.

[0081] For example, the terminal can process the data processing queue based on the updated stream computing model to obtain risk identification results.

[0082] In the aforementioned risk identification method, by reasonably deducing the technical features in the embodiments, the following beneficial effects can be achieved in solving the technical problems raised in the background art:

[0083] This application provides a risk identification method, the steps of which include acquiring transaction data to be processed, constructing a data processing queue based on the transaction data, and then batch processing the data processing queue according to a pre-built stream computing model to filter out risk account data that meets preset specific filtering rules. At this point, the stream computing model is associated with a risk identification dimension table, which provides certain filtering conditions for the stream computing model. Subsequently, offline computation can be performed on the risk account data using an offline computation framework to accurately extract risk feature information associated with the risk account data. After writing the risk feature information into the risk identification dimension table, the stream computing model can be updated based on the risk identification dimension table. At this point, the risk identification rules in the stream computing model are supplemented and optimized, with the supplementation and optimization coming from the risk feature information obtained from offline computation. Risk identification is then performed on the data processing queue using the updated stream computing model, ultimately yielding the risk identification result. In implementation, the final applied stream computing model can process the data processing queue with the real-time computational efficiency of stream computing, and the risk identification detection rules in the stream computing model are continuously updated and optimized by the offline computation database, thus simultaneously improving the efficiency and accuracy of risk identification.

[0084] In one embodiment, such as Figure 3 As shown, step 203 includes:

[0085] Step 301: Apply a rule model built based on preset static conditions to filter the data processing queue and select target transaction data in the data processing queue that meets the static conditions.

[0086] Static conditions can refer to pre-built fixed rules or constraints used for preliminary screening of the data to be processed.

[0087] For example, the terminal can apply a rule model built based on preset static conditions to filter the data processing queue and select target transaction data in the data processing queue that meets the static conditions.

[0088] Step 303: Parse the target transaction data to obtain identifier data that matches the processing conditions of the stream computing model.

[0089] Identification data refers to data that is uniquely identified or marked so that it can be identified, retrieved, and managed in the system.

[0090] For example, the terminal can parse the target transaction data to obtain identification data that matches the processing conditions of the stream computing model.

[0091] Step 304: Based on the stream computing model, parse and filter the identifier data to obtain the risk account data.

[0092] For example, the terminal can parse and filter the identification data based on the stream computing model to obtain the risk account data.

[0093] In this embodiment, the screening of risk account data first involves using a rule model constructed based on static conditions through real-time computation to initially filter the data processing queue, thereby selecting target transaction data that meets the static conditions. Subsequently, complex batch historical data is parsed into easily processed, real-time identifier data using real-time data processing techniques. Finally, the identifier data is parsed and filtered according to the rule model to obtain the risk account data. This approach improves the efficiency and accuracy of stream computing.

[0094] In one embodiment, such as Figure 4 As shown, before step 301, the following steps are also included:

[0095] Step 401: If the amount of data in the data processing queue is less than the amount of data specified by the condition threshold of the rule model, then a data window is constructed based on the amount of missing data, and a certain amount of historical data is obtained through the data window.

[0096] Data window processing refers to using window operations provided by the stream processing framework. Sliding or scrolling windows can be defined to retrieve a specified amount of historical data. Window operations can be defined based on event time or processing time to ensure that data is processed in chronological order.

[0097] For example, if the amount of data in the data processing queue is less than the amount of data specified by the condition threshold of the rule model, the terminal can construct a data window based on the amount of missing data and obtain a certain amount of historical data through the data window.

[0098] Step 403: Process the historical data and add the processed historical data to the data processing queue.

[0099] For example, the terminal can process the historical data and add the processed historical data to the data processing queue.

[0100] In this embodiment, when performing real-time calculations on the data processing queue, if the amount of data in the data processing queue is less than a condition threshold, historical data can be obtained by opening a window. This helps to complete the current data processing queue with historical data and improves the stability of risk identification.

[0101] In one embodiment, such as Figure 5 As shown, step 201 includes:

[0102] Step 501: Obtain the transaction data and preprocess the transaction data, including data filtering, data labeling, and data standardization.

[0103] For example, the terminal can acquire the transaction data and preprocess the transaction data, the preprocessing including data filtering, data labeling and data standardization.

[0104] Step 503: Construct the data processing queue based on the preprocessed transaction data.

[0105] For example, the terminal can construct the data processing queue based on the pre-processed transaction data.

[0106] In this embodiment, preprocessing the transaction data to construct a data processing queue helps improve the data quality of the data processing queue.

[0107] In one embodiment, such as Figure 6 As shown, step 205 includes:

[0108] Step 601: Synchronize the risk account data to the offline database.

[0109] Offline databases are typically used in scenarios where operation is required even without a network connection, such as mobile applications, offline data acquisition, and edge computing. With offline databases, users can continue using applications offline and synchronize local data to a remote server when the network is restored, ensuring data integrity and consistency.

[0110] For example, the terminal can synchronize the risk account data to an offline database.

[0111] Step 603: Perform batch processing on the data in the offline database to obtain the batch extracted risk feature information.

[0112] For example, the terminal can perform batch processing on the data in the offline database to obtain the batch extracted risk feature information.

[0113] In this embodiment, the scheme of batch processing risk account data in an offline database can improve the processing efficiency of offline data.

[0114] In one embodiment, such as Figure 7 As shown, before step 207, the following steps are also included:

[0115] Step 701: Connect the preset identifier to the risk feature information, and process the risk feature information into a feature information field that conforms to the preset format.

[0116] For example, the terminal can connect a preset identifier to the risk feature information and process the risk feature information into a feature information field that conforms to a preset format.

[0117] In this embodiment, the identifier is linked to the risk feature information, thereby processing the risk feature information into a feature information field that conforms to a specific format. This helps to improve the uniformity of the data in the risk identification dimension table, and thus improves the stability of the stream computing model.

[0118] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0119] Based on the same inventive concept, this application also provides a risk identification device for implementing the risk identification method described above. The solution provided by this device is similar to the solution described in the above method; therefore, the specific limitations of one or more embodiments of the risk identification device provided below can be found in the limitations of the risk identification method described above, and will not be repeated here.

[0120] In one embodiment, such as Figure 8 As shown, a risk identification device is provided, including: a data processing queue module, a stream computing processing module, an offline computing processing module, a dimension table update module, and a risk identification module, wherein:

[0121] The data processing queue module is used to acquire transaction data to be processed and to construct a data processing queue based on the transaction data.

[0122] The stream computing processing module is used to process the data processing queue based on a pre-built stream computing model and filter out risk account data that meets preset rules. The stream computing model is associated with the risk identification dimension table.

[0123] The offline calculation and processing module is used to perform offline calculations on the risk account data and extract risk characteristic information associated with the risk account data;

[0124] The dimension table update module is used to write the risk feature information into the risk identification dimension table and update the stream computing model based on the risk identification dimension table.

[0125] The risk identification module is used to process the data processing queue based on the updated stream computing model to obtain risk identification results.

[0126] In one embodiment, the stream computing processing module includes:

[0127] The real-time computing module is used to apply a rule model built based on preset static conditions to filter the data processing queue and select target transaction data in the data processing queue that meets the static conditions.

[0128] The real-time data processing module is used to parse the target transaction data to obtain identification data that matches the processing conditions of the stream computing model;

[0129] The stream computing module is used to parse and filter the identifier data based on the stream computing model to obtain the risk account data.

[0130] In one embodiment, the real-time computing module includes:

[0131] The windowing processing module is used to construct a data window based on the missing data if the amount of data in the data processing queue is less than the amount of data specified by the condition threshold of the rule model, and to obtain a certain amount of historical data through the data window.

[0132] The data queue replenishment module is used to process the historical data and replenish the processed historical data to the data processing queue.

[0133] In one embodiment, the data processing queue module includes:

[0134] A transaction data preprocessing module is used to acquire the transaction data and preprocess the transaction data, the preprocessing including data filtering, data labeling and data standardization.

[0135] The message queue construction module is used to construct the data processing queue based on the preprocessed transaction data.

[0136] In one embodiment, the offline computing processing module includes:

[0137] An offline database module is used to synchronize the risk account data to an offline database;

[0138] The risk feature extraction module is used to process the data in the offline database in batches to obtain the batch extracted risk feature information.

[0139] In one embodiment, prior to the dimension table update module, the following is also included:

[0140] The feature data splicing module is used to connect preset identifiers to the risk feature information and process the risk feature information into feature information fields that conform to a preset format.

[0141] The various modules in the aforementioned risk identification device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device in hardware form, or stored in the memory of a computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0142] In one embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 9 As shown, the computer device includes a processor, memory, input / output interface, communication interface, display unit, and input device. The processor, memory, and input / output interface are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interface. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The input / output interface is used for exchanging information between the processor and external devices. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, NFC (Near Field Communication), or other technologies. When executed by the processor, the computer program implements a risk identification method. The display unit is used to form a visually visible image and can be a display screen, projection device, or virtual reality imaging device. The display screen can be an LCD screen or an e-ink screen. The input device of the computer device can be a touch layer covering the display screen, or buttons, trackballs, or touchpads set on the casing of the computer device, or external keyboards, touchpads, or mice, etc.

[0143] Those skilled in the art will understand that Figure 9 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0144] In one embodiment, a computer device is further provided, including a memory and a processor. The memory stores a computer program, and the processor implements the steps in the above method embodiments when executing the computer program.

[0145] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the steps in the above method embodiments.

[0146] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0147] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0148] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0149] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0150] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A risk identification method, characterized in that, The method includes: Obtain the transaction data to be processed, and construct a data processing queue based on the transaction data; The data processing queue is processed based on a pre-built stream computing model to filter out risk account data that meets preset rules. The stream computing model is associated with a risk identification dimension table. Offline calculations are performed on the risk account data to extract risk characteristic information associated with the risk account data; The risk characteristic information is written into the risk identification dimension table, and the stream computing model is updated based on the risk identification dimension table. The data processing queue is processed based on the updated stream computing model to obtain risk identification results.

2. The method according to claim 1, characterized in that, The data processing queue is processed based on a pre-built stream computing model to filter out risk account data that meets preset rules. The stream computing model is associated with a risk identification dimension table, including: The data processing queue is filtered by a rule model built based on preset static conditions, and target transaction data that meets the static conditions is selected from the data processing queue. The target transaction data is parsed to obtain identifier data that matches the processing conditions of the stream computing model; The risk account data is obtained by parsing and filtering the identifier data based on the stream computing model.

3. The method according to claim 2, characterized in that, The application uses a rule model built based on preset static conditions to filter the data processing queue and select target transaction data in the data processing queue that meets the static conditions, including: If the amount of data in the data processing queue is less than the amount of data specified by the condition threshold of the rule model, a data window is constructed based on the amount of missing data, and a certain amount of historical data is obtained through the data window. The historical data is processed, and the processed historical data is added to the data processing queue.

4. The method according to claim 1, characterized in that, The step of acquiring transaction data to be processed and constructing a data processing queue based on the transaction data includes: The transaction data is acquired and preprocessed, including data filtering, data labeling, and data standardization. The data processing queue is constructed based on the preprocessed transaction data.

5. The method according to any one of claims 1 to 4, characterized in that, The offline calculation of the risk account data to extract risk characteristic information associated with the risk account data includes: Synchronize the risk account data to the offline database; The data in the offline database is processed in batches to obtain the batch extracted risk feature information.

6. The method according to claim 1, characterized in that, Before writing the risk feature information into the risk identification dimension table and updating the stream computing model based on the risk identification dimension table, the method further includes: The preset identifier is connected to the risk feature information, and the risk feature information is processed into a feature information field that conforms to the preset format.

7. A risk identification device, characterized in that, The device includes: The data processing queue module is used to acquire transaction data to be processed and to construct a data processing queue based on the transaction data. The stream computing processing module is used to process the data processing queue based on a pre-built stream computing model and filter out risk account data that meets preset rules. The stream computing model is associated with the risk identification dimension table. The offline calculation and processing module is used to perform offline calculations on the risk account data and extract risk characteristic information associated with the risk account data; The dimension table update module is used to write the risk feature information into the risk identification dimension table and update the stream computing model based on the risk identification dimension table. The risk identification module is used to process the data processing queue based on the updated stream computing model to obtain risk identification results.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

Images