A consumer finance full-process monitoring and early warning method

Abstract

The present application discloses a method for monitoring and warning the entire process of consumer finance, which relates to the field of computer information processing technology, and includes: obtaining first target indicator data of existing users at various stages in the entire process of financial transactions; obtaining pre-processed first target indicator data by pre-processing the first target indicator data; obtaining thresholds corresponding to the pre-processed first target indicator data at various stages to obtain a single-point risk identification model; obtaining second target indicator data of applicant users at various stages in the entire financial process, comparing the second target indicator data of applicant users with the threshold to obtain a comparison result of a single stage; constructing a multi-point risk combination identification model, calculating the degree to which a single risk point exceeds the threshold, assigning a weight to each risk point, performing weighted summation, obtaining a multi-point risk combination result, and comparing it with a preset threshold to issue an early warning when the threshold is exceeded; and being able to adjust credit strategies in a timely manner to reduce consumer finance risks.

Description

Technical Field

[0001] The present invention relates to the field of computer information processing, and in particular to a consumer finance full-process monitoring and early warning method. Background Art

[0002] As an important branch of the financial industry, consumer finance faces diverse and complex risks due to its business characteristics. Consumer finance includes multiple risk types such as credit risk, market risk, and operational risk. These risks run through various links such as loan issuance, fund recovery, and customer service. Therefore, it is crucial for consumer finance to establish a full-process monitoring and early warning mechanism.

[0003] The invention with patent announcement number CN110349002B discloses a method, device and electronic device for monitoring and warning of the entire process of consumer finance, including: obtaining the first target indicator data of existing users at each stage in the entire process of financial transactions, obtaining the threshold value corresponding to the first target indicator data at each stage, obtaining the second target indicator data of the applicant user at each stage in the entire process of finance, comparing the second target indicator data of the applicant user with the threshold value, obtaining the comparison result, triggering the warning according to the comparison result, and then conducting risk management of the financial industry, so that financial enterprises can know the risk performance of users in real time, adjust credit strategies in time, and reduce the credit risk of financial enterprises. However, the above scheme still has the following problems: 1. Single-point risk identification does not exceed the standard in a wide range, but there is no identification of multi-point risk combination, which may cause the combination behavior to point to a clear risk behavior but no warning; 2. The user will have malicious behavior, that is, after multiple explorations, find out a way without warning to complete the risk behavior, such as completing registration and application at a specific time node, and the value has no warning at single point and multi-point combination, which eventually causes malicious losses. Summary of the invention

[0004] The embodiment of the present application provides a method for monitoring and warning the entire process of consumer finance, thereby solving the problem in the prior art that single-point risk identification does not exceed the standard within a wide range, but there is no identification of multi-point risk combinations, which may result in combined behavior pointing to clear risky behavior but no warning, thereby achieving timely adjustment of credit strategies and reducing consumer finance risks.

[0005] The present application embodiment provides a consumer finance full-process monitoring and early warning method, including:

[0006] S1: Obtain the first target indicator data of existing users at each stage of the entire financial transaction process;

[0007] The obtaining of the first target indicator data of the existing user at each stage of the entire financial transaction process specifically includes:

[0008] Obtain target indicator data for status transformation at each stage after the existing user registers, where the status transformation is from customer registration to application, from application to credit granting, from credit granting to borrowing, and from borrowing to repayment;

[0009] Obtain target indicator data of risk performance at various stages after the existing user applies for a loan, wherein the various stages of risk performance are stages before the customer applies for a loan, during the loan, and after the loan by product and by pricing;

[0010] S2: obtaining preprocessed first target indicator data by preprocessing the first target indicator data;

[0011] The preprocessing refers to cleaning the first target indicator data and removing abnormal data and duplicate data;

[0012] S3: Obtain the threshold value corresponding to the first target indicator data of each stage preprocessing to obtain a single point risk identification model, which specifically includes:

[0013] Calculate the conversion mean μ of the target indicator data of the state conversion at each stage after the existing user registration m and the transformed standard deviation σ m (m>=1), where m represents the various stages of state transformation;

[0014] Calculate the risk mean μ of the target indicator data of risk performance at each stage after the existing user registers and applies for a loan n and the risk standard deviation σ n (n>=1), where n represents the various stages after applying for a loan;

[0015] According to the transformed mean μ m and the transformed standard deviation σ m (m>=1) Calculate the conversion threshold of each stage;

[0016] According to the risk mean μ n and the risk standard deviation σ n (n>=1) Calculate the risk thresholds at each stage;

[0017] The conversion threshold is μ m ±σ m (m>=1)*X, where X is a variable;

[0018] The risk threshold is μ n ±σ n (n>=1)*X, where X is a variable;

[0019] The threshold parameters are adjusted according to the evaluation of the preprocessed first target indicator data, and an adaptive mechanism is introduced to adjust the threshold parameters according to the changes in the data;

[0020] S4: obtaining the second target indicator data of the applicant at each stage in the entire financial process, comparing the second target indicator data of the applicant with the threshold value, and obtaining the comparison result of a single stage, that is, the comparison result of a single risk point;

[0021] S5: Construct a multi-point risk combination identification model, calculate the degree to which a single risk point exceeds the threshold, assign a weight to each risk point, perform weighted summation, and obtain the multi-point risk combination result. By comparing it with the preset threshold, an early warning will be issued if the threshold is exceeded;

[0022] The weights can be the same, or different values ​​can be set according to the importance of the risk points;

[0023] For example, three risk points were selected as part of the multi-point risk portfolio, namely, the conversion rate from registration to application, the loan default rate, and the recent frequent change of IP addresses;

[0024] Obtain the first target indicator data of the existing users, and obtain the means and standard deviations of the three risk points from the first target indicator data;

[0025] Conversion rate from registration to application: conversion mean μ1=0.3, conversion standard deviation σ1=0.1;

[0026] Loan default rate: default rate risk mean μ2=0.02, default rate risk standard deviation σ2=0.01;

[0027] The average number of times users change their IP addresses in the recent period: the mean risk value of IP address changes μ3 = 0.5 times / month, and the standard deviation of IP address changes σ3 = 0.3 times / month;

[0028] Using μ n ±σ n *1.5 Calculate the risk point threshold:

[0029] Registration to application conversion rate threshold: [0.15, 0.45];

[0030] Loan default rate threshold: [0.005, 0.035];

[0031] The threshold for the number of recent IP address changes: [0 times / month, 1.5 times / month];

[0032] Get the second target indicator number of applicant user U12345, including:

[0033] Conversion rate from registration to application = 0.2 (slightly below the lower threshold);

[0034] Loan default rate = 0.01 (within the threshold range);

[0035] Number of recent IP address changes = 3 times / month (much higher than the upper threshold limit);

[0036] The three risk points are assigned the same weight, and a weighted sum is taken based on the degree to which each risk point exceeds the threshold. An early warning is determined based on the sum result, which specifically includes the following steps:

[0037] The degree to which the conversion rate from registration to application exceeds the lower threshold: |0.15-0.2| / (0.45-0.15)=0.17;

[0038] The loan default rate is within the threshold range, and the excess is considered to be 0;

[0039] The degree to which the number of IP address changes exceeds the upper threshold: |3-1.5| / (1.5-0)=1;

[0040] Weighted sum result: (0.17+0+1) / 3=0.39;

[0041] The combined risk threshold is set to 0.3, and the weighted sum result is 0.39>0.3, triggering an early warning;

[0042] The warning result is: user U12345 has a combination of multiple risks, including a low conversion rate from registration to application and frequent changes in IP addresses recently, indicating that the user's behavior is abnormal or there is a risk of fraud. It is recommended to immediately suspend the user's loan application processing.

[0043] After multiple explorations of malicious behaviors, a risk behavior without warning method is obtained. The risk behavior is recorded and named as warning behavior. The behavior data of a single risk point is separately marked, and the data compliance of a single risk point and the data compliance of the combined risk point are calculated. The subsequent risk behavior is evaluated. When the data compliance exceeds the threshold, a warning is issued. The specific steps include:

[0044] S101: Record the time points of registration, application and other behaviors when the malicious behaviors occurred by recording the historical malicious behaviors;

[0045] S102: individually marking each behavior point in the malicious behavior at the identified time node, and establishing a malicious behavior database to store the marked behavior data;

[0046] The method of individually marking each behavior point in the malicious behavior at the identified time node, specifically including data information such as time, operation type and result;

[0047] S103: For a new risk point, calculate the data conformity between the new risk point and the corresponding risk point behavior in the malicious behavior database, and comprehensively evaluate the overall matching degree between the new combined risk sequence and the malicious behavior sequence in the malicious behavior database by combining the time intervals and sequences of multiple risk points;

[0048] S104: Setting the data compliance warning threshold for a single risk point and a combined risk sequence. When the data compliance of a user exceeds the set threshold, the system immediately triggers a warning and records the user's data information.

[0049] For example, a malicious behavior has been identified, which is manifested as a user registering between 12:00 and 15:00 in the morning, and submitting a loan application within two hours of registration, and the application amount exceeds the average loan level by 3 times. Now calculate the data consistency between the risk behavior of a new user and the malicious behavior;

[0050] The new user data information is:

[0051] Registration time: 1:30 am;

[0052] Loan application time: 3:15 a.m.;

[0053] Application amount: 4 times the average loan amount;

[0054] Calculate the data compliance of a single risk point for a new user:

[0055] Registration time compliance: The registration time range in the malicious behavior is from 0:00 to 3:00 a.m., and the new user registration time is 1:30 a.m., so the registration time compliance is considered to be 1 (complete compliance);

[0056] Application time compliance: The loan application in the malicious behavior is within 2 hours after registration. The time interval from registration to application for a new user is 1 hour and 45 minutes, so the application time compliance is considered to be 1 (complete compliance);

[0057] Amount compliance: The application amount in malicious behavior exceeds 3 times the average loan amount, and the application amount of new users is 4 times the average loan amount, so the amount compliance is 1 (completely compliant and beyond expectations);

[0058] Calculate the data conformity of the new user's portfolio risk point:

[0059] The default registration time compliance, application time compliance and amount compliance have the same weight, and the data compliance of the new user's combined risk point is:

[0060] Combined compliance = (registration time compliance + application time compliance + amount compliance) / 3 = (1+1+1) / 3 = 1;

[0061] The risky behavior and malicious behavior of new users are highly consistent in terms of registration time, application time and application amount. Therefore, the overall compliance is 1, and the system triggers a high-risk warning.

[0062] By identifying the correlation between multiple malicious behavior results, and based on the data information of the malicious behavior results, screening the combination of multiple risk points, determining it as a malicious behavior combination, calculating the correlation value of the malicious behavior combination, and defining it as a correlation value threshold, when the risk behavior of a new user is this combination, calculating the correlation value between the combinations, and comparing it with the correlation value of the malicious behavior combination, when the correlation value threshold is reached, an early warning is issued; that is, when there are two or more risk point correlation values ​​The combined load causes the characteristics of the loss result of the malicious behavior, an early warning is issued, specifically including the following steps:

[0063] S201: extracting user behavior features from malicious behavior data in a malicious behavior database to obtain malicious behavior data features;

[0064] S202: Identify a combination relationship between two or more malicious behavior features;

[0065] The identification of a combined relationship between two or more malicious behavior features specifically refers to a combination of two or more malicious behaviors causing malicious behavior losses;

[0066] S203: Based on the malicious behavior database, set a warning threshold for each malicious behavior combination;

[0067] S204: Monitor the risk behaviors of new users in real time, collect behavior data, and calculate the risk behavior combination value of the new users. When the risk behavior combination value of the new users exceeds the warning threshold, trigger a warning.

[0068] Add a case investigation link, test the user's subjective state by setting multiple-choice questions and essay questions. The answer result is used as one of the items to determine malicious behavior, to identify the user's customer behavior reasons and expected results. At the same time, collect the user's answer time to determine the user's familiarity with the questions and avoid malicious batch loan applications. The specific steps include:

[0069] S301: Design the content of the case investigation, including multiple-choice questions and essay questions related to the user's financial behavior;

[0070] S302: embedding a case investigation link in the process of user registration or loan application, requiring the user to complete a questionnaire;

[0071] S303: Collect and analyze the user's answer results, and use the answer situation as part of the user risk assessment, especially focusing on the user's mastery of financial knowledge, the rationality of the loan purpose, and the clarity of the repayment plan;

[0072] S304: Record and analyze the user's answering time. An abnormally fast answering time indicates that the user knows the question in advance or is suspected of batch operation, which requires further review.

[0073] S305: Combine the case investigation results with other risk point data, such as registration time, application amount, historical behavior records, etc., to comprehensively evaluate the user's risk level and decide whether to trigger an early warning based on the preset threshold;

[0074] S306: For users who trigger an early warning, a more in-depth review is conducted, such as manual review, request for supporting documents or telephone follow-up, to verify the authenticity of the user's identity and loan intention.

[0075] One or more technical solutions provided in the embodiments of the present application have at least the following technical effects or advantages:

[0076] By implementing the above technical solutions, the consumer finance full-process monitoring and early warning system has added a multi-point risk combination identification function while retaining the original single-point risk identification function; it has improved the system's ability to identify complex risk behaviors, allowing financial companies to more comprehensively grasp the user's risk status, adjust credit strategies in a timely manner, and reduce consumer finance risks.

[0077] By introducing the multi-point risk combination identification function, the system can more accurately identify potential high-risk users and reduce false positives and missed positives. BRIEF DESCRIPTION OF THE DRAWINGS

[0078] Figure 1 The present invention is a flowchart of a method for monitoring and early warning the entire process of consumer finance. DETAILED DESCRIPTION

[0079] To facilitate the understanding of the present invention, the present application will be described more comprehensively below with reference to the relevant drawings; the drawings show preferred embodiments of the present invention, but the present invention can be implemented in many different forms and is not limited to the embodiments described herein; on the contrary, the purpose of providing these embodiments is to enable a more thorough and comprehensive understanding of the disclosed content of the present invention.

[0080] It should be noted that the terms “vertical”, “horizontal”, “up”, “down”, “left”, “right” and similar expressions used in this document are only for illustrative purposes and do not represent the only implementation method.

[0081] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by technicians in the technical field to which the present invention belongs; the terms used in the specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention; the term "and / or" used herein includes any and all combinations of one or more related listed items.

[0082] Embodiment 1: Figure 1 As shown, the present application provides a consumer finance full-process monitoring and early warning method, including:

[0083] S1: Obtain the first target indicator data of existing users at each stage of the entire financial transaction process;

[0084] The obtaining of the first target indicator data of the existing user at each stage of the entire financial transaction process specifically includes:

[0085] Obtain target indicator data for status transformation at each stage after the existing user registers, where the status transformation is from customer registration to application, from application to credit granting, from credit granting to borrowing, and from borrowing to repayment;

[0086] Obtain target indicator data of risk performance at various stages after the existing user applies for a loan, wherein the various stages of risk performance are stages before the customer applies for a loan, during the loan, and after the loan by product and by pricing;

[0087] S2: obtaining preprocessed first target indicator data by preprocessing the first target indicator data;

[0088] The preprocessing refers to cleaning the first target indicator data and removing abnormal data and duplicate data;

[0089] S3: Obtain the threshold value corresponding to the first target indicator data of each stage preprocessing to obtain a single point risk identification model, which specifically includes:

[0090] Calculate the conversion mean μ of the target indicator data of the state conversion at each stage after the existing user registration m and the transformed standard deviation σ m (m>=1), where m represents the various stages of state transformation;

[0091] Calculate the risk mean μ of the target indicator data of risk performance at each stage after the existing user registers and applies for a loan n and the risk standard deviation σ n (n>=1), where n represents the various stages after applying for a loan;

[0092] According to the transformed mean μ m and the transformed standard deviation σ m(m>=1) Calculate the conversion threshold of each stage;

[0093] According to the risk mean μ n and the risk standard deviation σ n (n>=1) Calculate the risk thresholds at each stage;

[0094] The conversion threshold is μ m ±σ m (m>=1)*X, where X is a variable;

[0095] The risk threshold is μ n ±σ n (n>=1)*X, where X is a variable;

[0096] The threshold parameters are adjusted according to the evaluation of the preprocessed first target indicator data, and an adaptive mechanism is introduced to adjust the threshold parameters according to the changes in the data;

[0097] S4: obtaining the second target indicator data of the applicant at each stage in the entire financial process, comparing the second target indicator data of the applicant with the threshold value, and obtaining the comparison result of a single stage, that is, the comparison result of a single risk point;

[0098] S5: Construct a multi-point risk combination identification model, calculate the degree to which a single risk point exceeds the threshold, assign a weight to each risk point, perform weighted summation, and obtain the multi-point risk combination result. By comparing it with the preset threshold, an early warning will be issued if the threshold is exceeded;

[0099] The weights can be the same, or different values ​​can be set according to the importance of the risk points;

[0100] For example, three risk points were selected as part of the multi-point risk portfolio, namely, the conversion rate from registration to application, the loan default rate, and the recent frequent change of IP addresses;

[0101] Obtain the first target indicator data of the existing users, and obtain the means and standard deviations of the three risk points from the first target indicator data;

[0102] Conversion rate from registration to application: conversion mean μ1=0.3, conversion standard deviation σ1=0.1;

[0103] Loan default rate: default rate risk mean μ2=0.02, default rate risk standard deviation σ2=0.01;

[0104] The average number of times users change their IP addresses in the recent period: the mean risk value of IP address changes μ3 = 0.5 times / month, and the standard deviation of IP address changes σ3 = 0.3 times / month;

[0105] Using μ n ±σn *1.5 Calculate the risk point threshold:

[0106] Registration to application conversion rate threshold: [0.15, 0.45];

[0107] Loan default rate threshold: [0.005, 0.035];

[0108] The threshold for the number of recent IP address changes: [0 times / month, 1.5 times / month];

[0109] Get the second target indicator number of applicant user U12345, including:

[0110] Conversion rate from registration to application = 0.2 (slightly below the lower threshold);

[0111] Loan default rate = 0.01 (within the threshold range);

[0112] Number of recent IP address changes = 3 times / month (much higher than the upper threshold limit);

[0113] The three risk points are assigned the same weight, and a weighted sum is taken based on the degree to which each risk point exceeds the threshold. An early warning is determined based on the sum result, which specifically includes the following steps:

[0114] The degree to which the conversion rate from registration to application exceeds the lower threshold: |0.15-0.2| / (0.45-0.15)=0.17;

[0115] The loan default rate is within the threshold range, and the excess is considered to be 0;

[0116] The degree to which the number of IP address changes exceeds the upper threshold: |3-1.5| / (1.5-0)=1;

[0117] Weighted sum result: (0.17+0+1) / 3=0.39;

[0118] The combined risk threshold is set to 0.3, and the weighted sum result is 0.39>0.3, triggering an early warning;

[0119] The warning result is: user U12345 has a combination of multiple risks, including a low conversion rate from registration to application and frequent changes in IP addresses recently, indicating that the user's behavior is abnormal or there is a risk of fraud. It is recommended to immediately suspend the user's loan application processing.

[0120] The technical solutions in the above embodiments of the present application have at least the following technical effects or advantages:

[0121] By implementing the above technical solutions, the consumer finance full-process monitoring and early warning system has added a multi-point risk combination identification function while retaining the original single-point risk identification function; it has improved the system's ability to identify complex risk behaviors, allowing financial companies to more comprehensively grasp the user's risk status, adjust credit strategies in a timely manner, and reduce consumer finance risks.

[0122] By introducing the multi-point risk combination identification function, the system can more accurately identify potential high-risk users and reduce false positives and missed positives.

[0123] Embodiment 2: In embodiment 1, after long-term use of the above method, even if the risk identification of multi-point combination behavior is increased, there will still be problems. After multiple attempts at malicious behavior, a method without risk warning can be searched to complete the risky behavior, such as completing registration and application at a specific time node. There is no warning for the values ​​at single point and multi-point combination, but losses are caused.

[0124] Therefore, the embodiments of the present application are optimized based on the above embodiments.

[0125] In some embodiments, multiple explorations are conducted for malicious behaviors, and a risk behavior without a warning method is obtained. The risk behavior is recorded, and the recorded behavior is named as a warning behavior. By separately marking the behavior data of a single risk point, the data compliance of the single risk point and the data compliance of the combined risk point are calculated, and subsequent risk behaviors are evaluated. When the data compliance exceeds a threshold, a warning is issued, which specifically includes the following steps:

[0126] S101: Record the time points of registration, application and other behaviors when the malicious behaviors occurred by recording the historical malicious behaviors;

[0127] S102: individually marking each behavior point in the malicious behavior at the identified time node, and establishing a malicious behavior database to store the marked behavior data;

[0128] The method of individually marking each behavior point in the malicious behavior at the identified time node, specifically including data information such as time, operation type and result;

[0129] S103: For a new risk point, calculate the data conformity between the new risk point and the corresponding risk point behavior in the malicious behavior database, and comprehensively evaluate the overall matching degree between the new combined risk sequence and the malicious behavior sequence in the malicious behavior database by combining the time intervals and sequences of multiple risk points;

[0130] S104: Setting the data compliance warning threshold for a single risk point and a combined risk sequence. When the data compliance of a user exceeds the set threshold, the system immediately triggers a warning and records the user's data information.

[0131] For example, a malicious behavior has been identified, which is manifested as a user registering between 12:00 and 15:00 in the morning, and submitting a loan application within two hours of registration, and the application amount exceeds the average loan level by 3 times. Now calculate the data consistency between the risk behavior of a new user and the malicious behavior;

[0132] The new user data information is:

[0133] Registration time: 1:30 am;

[0134] Loan application time: 3:15 a.m.;

[0135] Application amount: 4 times the average loan amount;

[0136] Calculate the data compliance of a single risk point for a new user:

[0137] Registration time compliance: The registration time range in the malicious behavior is from 0:00 to 3:00 a.m., and the new user registration time is 1:30 a.m., so the registration time compliance is considered to be 1 (complete compliance);

[0138] Application time compliance: The loan application in the malicious behavior is within 2 hours after registration. The time interval from registration to application for a new user is 1 hour and 45 minutes, so the application time compliance is considered to be 1 (complete compliance);

[0139] Amount compliance: The application amount in malicious behavior exceeds 3 times the average loan amount, and the application amount of new users is 4 times the average loan amount, so the amount compliance is 1 (completely compliant and beyond expectations);

[0140] Calculate the data conformity of the new user's portfolio risk point:

[0141] The default registration time compliance, application time compliance and amount compliance have the same weight, and the data compliance of the new user's combined risk point is:

[0142] Combined compliance = (registration time compliance + application time compliance + amount compliance) / 3 = (1+1+1) / 3 = 1;

[0143] The risky behavior and malicious behavior of new users are highly consistent in terms of registration time, application time and application amount. Therefore, the overall compliance is 1, and the system triggers a high-risk warning.

[0144] The technical solutions in the above embodiments of the present application have at least the following technical effects or advantages:

[0145] By implementing the above technical solutions, the system can more comprehensively identify malicious behaviors that do not appear abnormal at single points or in combination of multiple points and issue early warnings. By defining malicious behavior patterns, data labeling, compliance model development, threshold setting, real-time monitoring and early warning, as well as feedback and optimization, the system can dynamically adapt to changes in malicious behaviors and effectively reduce consumer finance risks.

[0146] By comparing new risk points with data in the malicious behavior database, calculating data conformity, and integrating multiple risk points for overall matching assessment, the early warning system can accurately determine whether user behavior poses a risk, reduce false alarms and missed alarms, and improve the effectiveness of early warnings; by recording and analyzing historical malicious behaviors, especially key information such as time nodes, operation types and results, a detailed malicious behavior database is established, which not only covers single-point risks, but also takes into account the time intervals and sequences between behaviors, so that more complex and hidden malicious behaviors can be identified.

[0147] Embodiment 3: In Embodiment 1 and Embodiment 2, the problem of narrow risk value warning range may be caused when calculating the data compliance of the combined risk points. This problem can be solved by identifying the correlation between multiple malicious results.

[0148] Therefore, the embodiments of the present application are optimized based on the above embodiments.

[0149] In some embodiments, by identifying the correlation between multiple malicious behavior results, and based on the data information of the malicious behavior results, screening the combination of multiple risk points, determining the malicious behavior combination, calculating the correlation value of the malicious behavior combination, and defining it as a correlation value threshold, when the risk behavior of a new user is the combination, calculating the correlation value between the combinations, and comparing it with the correlation value of the malicious behavior combination, when the correlation value threshold is reached, an early warning is issued; that is, when there are two or more risk point correlation values ​​that have the characteristics of causing the loss result of the malicious behavior, an early warning is issued, specifically including the following steps:

[0150] S201: extracting user behavior features from malicious behavior data in a malicious behavior database to obtain malicious behavior data features;

[0151] S202: Identify a combination relationship between two or more malicious behavior features;

[0152] The identification of a combined relationship between two or more malicious behavior features specifically refers to a combination of two or more malicious behaviors causing malicious behavior losses;

[0153] S203: Based on the malicious behavior database, set a warning threshold for each malicious behavior combination;

[0154] S204: Monitor the risk behaviors of new users in real time, collect behavior data, and calculate the risk behavior combination value of the new users. When the risk behavior combination value of the new users exceeds the warning threshold, trigger a warning.

[0155] The technical solutions in the above embodiments of the present application have at least the following technical effects or advantages:

[0156] By identifying the correlations between multiple malicious behaviors and screening specific behavioral combinations based on data from historical malicious loss results, we build a system that can dynamically warn of potential risks. When a new user's behavioral combination meets the characteristics of causing malicious losses, the system will trigger an early warning, helping financial companies intervene and adjust strategies in advance, effectively reducing credit risks.

[0157] By deeply analyzing the malicious behavior database, extracting user behavior features, and identifying the combined relationship between multiple malicious behaviors, the early warning system can more accurately identify potential risk behavior patterns, thereby improving the accuracy of the early warning; traditional methods may only issue early warnings for a single risk point, while this solution, by considering the combination of multiple malicious behaviors, can capture more complex and hidden malicious behavior patterns, thereby expanding the scope of the early warning and reducing the risk of missed reports.

[0158] Embodiment 4: In the above embodiment, when the above solution is used for a long time, there is a problem that malicious users may find loopholes and cause losses due to malicious behavior.

[0159] Therefore, the embodiments of the present application are optimized based on the above embodiments.

[0160] In some embodiments, a case investigation link is added to test the user's subjective state by setting multiple-choice questions and essay questions. The answer result is used as one of the items for determining malicious behavior to identify the reasons and expected results of the user's customer behavior. At the same time, the user's answer time is collected to determine the user's familiarity with the questions and avoid malicious batch loan applications. Specifically, the following steps are included:

[0161] S301: Design the content of the case investigation, including multiple-choice questions and essay questions related to the user's financial behavior;

[0162] S302: embedding a case investigation link in the process of user registration or loan application, requiring the user to complete a questionnaire;

[0163] S303: Collect and analyze the user's answer results, and use the answer situation as part of the user risk assessment, especially focusing on the user's mastery of financial knowledge, the rationality of the loan purpose, and the clarity of the repayment plan;

[0164] S304: Record and analyze the user's answering time. An abnormally fast answering time indicates that the user knows the question in advance or is suspected of batch operation, which requires further review.

[0165] S305: Combine the case investigation results with other risk point data, such as registration time, application amount, historical behavior records, etc., to comprehensively evaluate the user's risk level and decide whether to trigger an early warning based on the preset threshold;

[0166] S306: For users who trigger an early warning, a more in-depth review is conducted, such as manual review, request for supporting documents or telephone follow-up, to verify the authenticity of the user's identity and loan intention.

[0167] The technical solutions in the above embodiments of the present application have at least the following technical effects or advantages:

[0168] Through case file investigation, we can directly understand the user's subjective state and financial knowledge level, thereby comprehensively assessing the user's risks and reducing risk misjudgments caused by information asymmetry.

[0169] Combining the answer results with other risk point data can accurately screen out high-risk users, while reducing accidental harm to low-risk users, and improving the efficiency and accuracy of credit approval.

[0170] By recording and analyzing the time users spend answering questions, we can effectively identify malicious batch applications and take timely measures to prevent potential fraud risks.

[0171] The case investigation process itself is also an opportunity for user education. By asking questions, it guides users to think about their real loan needs and repayment responsibilities, which helps to cultivate users' financial literacy and sense of responsibility.

[0172] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A consumer finance full-process monitoring and early warning method, characterized in that: include: S1: Obtain the first target indicator data of existing users at each stage of the entire financial transaction process; S2: obtaining preprocessed first target indicator data by preprocessing the first target indicator data; S3: Obtain the threshold value corresponding to the first target indicator data of each stage preprocessing to obtain a single point risk identification model; S4: obtaining the second target indicator data of the applicant at each stage in the entire financial process, comparing the second target indicator data of the applicant with the threshold value, and obtaining the comparison result of a single stage, that is, the comparison result of a single risk point; S5: Construct a multi-point risk combination identification model, calculate the degree to which a single risk point exceeds the threshold, assign a weight to each risk point, perform weighted summation, and obtain the multi-point risk combination result. By comparing it with the preset threshold, an early warning will be issued if the threshold is exceeded; After multiple explorations of malicious behaviors, a risk behavior without warning method is obtained. The risk behavior is recorded and named as warning behavior. By separately marking the behavior data of a single risk point, the data compliance of a single risk point and the data compliance of the combined risk point are calculated, and subsequent risk behaviors are evaluated. When the data compliance exceeds the threshold, a warning is issued. Specifically, the following steps are included: S101: Record the historical malicious behaviors that have occurred and record the time nodes of each stage of the malicious behaviors; S102: individually marking each stage of the malicious behavior at the identified time node, and establishing a malicious behavior database to store the marked behavior data; S103: For a new risk point, calculate the data conformity between the new risk point and the corresponding risk point behavior in the malicious behavior database, and comprehensively evaluate the overall matching degree between the new combined risk sequence and the malicious behavior sequence in the malicious behavior database by combining the time intervals and sequences of multiple risk points; S104: Set the data compliance warning threshold for a single risk point and a combined risk sequence. When the data compliance of a user exceeds the set threshold, the system immediately triggers a warning and records the user's data information.

2. A consumer finance full-process monitoring and early warning method as claimed in claim 1, characterized in that: The obtaining of the first target indicator data of the existing user at each stage of the entire financial transaction process specifically includes: Obtain target indicator data for status transformation at each stage after the existing user registers, where the status transformation is from customer registration to application, from application to credit granting, from credit granting to borrowing, and from borrowing to repayment; Obtain target indicator data for risk performance at various stages after the existing user applies for a loan, wherein the various stages of risk performance are product-based and pricing stages before, during and after the loan.

3. A consumer finance full-process monitoring and early warning method as claimed in claim 1, characterized in that: The step of obtaining the threshold corresponding to the first target indicator data of each stage of preprocessing to obtain a single point risk identification model specifically includes: Calculate the conversion mean μ of the target indicator data of the state conversion at each stage after the existing user registration m and the transformed standard deviation σ m (m>=1), where m represents the various stages of state transformation; Calculate the risk mean μ of the target indicator data of risk performance at each stage after the existing user registers and applies for a loan n and the risk standard deviation σ n (n>=1), where n represents the various stages after applying for a loan; According to the transformed mean μ m and the transformed standard deviation σ m (m>=1) Calculate the conversion threshold of each stage; According to the risk mean μ n and the risk standard deviation σ n (n>=1) Calculate the risk thresholds at each stage; The conversion threshold is μ m ±σ m (m>=1)*X, where X is a variable; The risk threshold is μ n ±σ n (n>=1)*X, where X is a variable; The threshold parameters are adjusted according to the evaluation of the preprocessed first target indicator data, and an adaptive mechanism is introduced to adjust the threshold parameters according to the changes in the data.

4. A consumer finance full-process monitoring and early warning method as claimed in claim 1, characterized in that: The weights may be the same, or different values ​​may be set according to the importance of the risk points.

5. A consumer finance full-process monitoring and early warning method as claimed in claim 1, characterized in that: Each behavior point in the malicious behavior at the identified time node is individually marked, specifically including data information of time, operation type and result.

6. A consumer finance full-process monitoring and early warning method as claimed in claim 5, characterized in that: By identifying the correlation between multiple malicious behavior results, and based on the data information of the malicious behavior results, screening the combination of multiple risk points, determining it as a malicious behavior combination, calculating the correlation value of the malicious behavior combination, and defining it as a correlation value threshold, when the risk behavior of a new user is this combination, calculating the correlation value between the combinations and comparing it with the correlation value of the malicious behavior combination, and issuing an early warning when the correlation value threshold is reached; That is, when there are two or more risk point values ​​with combined loads that cause characteristics of loss results from malicious behavior, an early warning is issued.

7. A consumer finance full-process monitoring and early warning method as claimed in claim 6, characterized in that: The method comprises identifying the correlation between multiple malicious behavior results, screening the combination of multiple risk points based on the data information of the malicious behavior results, determining the malicious behavior combination, calculating the correlation value of the malicious behavior combination, and defining it as the correlation value threshold. When the risk behavior of a new user is the combination, the correlation value between the combinations is calculated and compared with the correlation value of the malicious behavior combination. When the correlation value threshold is reached, an early warning is issued. That is, when there are two or more risk point values ​​with combined loads that cause the characteristics of malicious behavior loss results, an early warning is issued, which specifically includes the following steps: S201: extracting user behavior features from malicious behavior data in a malicious behavior database to obtain malicious behavior data features; S202: Identify a combination relationship between two or more malicious behavior features; S203: Based on the malicious behavior database, set a warning threshold for each malicious behavior combination; S204: Monitor the risk behaviors of new users in real time, collect behavior data, and calculate the risk behavior combination value of the new users. When the risk behavior combination value of the new users exceeds the warning threshold, trigger a warning.

8. A consumer finance full-process monitoring and early warning method as claimed in claim 7, characterized in that: A case investigation session is added to test the user's subjective state by setting multiple-choice questions and essay questions. The answer results are used as one of the factors to determine malicious behavior and to identify the reasons for the user's customer behavior and expected results. At the same time, the user's answer time is collected to determine the user's familiarity with the questions and avoid malicious batch loan applications.

9. A consumer finance full-process monitoring and early warning method as claimed in claim 8, characterized in that: The added case investigation link tests the user's subjective state by setting multiple-choice questions and essay questions. The answer result is used as one of the items to determine malicious behavior, to identify the user's customer behavior reasons and expected results. At the same time, the user's answer time is collected to determine the user's familiarity with the questions and avoid malicious batch loan applications. Specifically, the following steps are included: S301: Design the content of the case investigation, including multiple-choice questions and essay questions related to the user's financial behavior; S302: embedding a case investigation link in the process of user registration or loan application, requiring the user to complete a questionnaire; S303: Collect and analyze the user's answer results, and use the answer results as part of the user risk assessment, focusing on the user's mastery of financial knowledge, the rationality of the loan purpose, and the clarity of the repayment plan; S304: Record and analyze the user's answering time. An abnormally fast answering time indicates that the user knows the question in advance or is suspected of batch operation, which requires further review. S305: Combine the case investigation results with other risk point data to comprehensively evaluate the user's risk level and decide whether to trigger an early warning based on a preset threshold; S306: For users who trigger the warning, a more in-depth review is conducted to verify the authenticity of the user's identity and loan intention.

Images