Intelligent digital bank monitoring system based on risk control

Abstract

The invention discloses an intelligent digital bank monitoring system based on risk control, and particularly relates to the technical field of risk control, comprising a multi-source information collection module, a multi-level risk assessment module, a model optimization module and a decision response module, the multi-source information collection module is used for collecting transaction factor information, behavior factor information, external factor information and internal factor information; the multi-level risk assessment module is used for detecting abnormal transactions and comprises a primary risk assessment sub-module, an intermediate risk assessment sub-module and an advanced risk assessment sub-module, and the model optimization module periodically checks the performance of multi-level risk assessment and verifies the effectiveness of the multi-level risk assessment. And the decision response module generates a comprehensive risk index according to a periodic inspection result of multilevel risk assessment in combination with abnormal detection of risk control, and performs interactive response, so that the running effectiveness of a black box model based on a deep learning algorithm can be effectively inspected, and excessive dependence of a digital bank on an automatic monitoring system is reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of risk control, and more specifically, to an intelligent digital bank monitoring system based on risk control. Background Art

[0002] In the field of risk control in digital banks, with the huge increase in daily transaction volume, manual review cannot cover all transaction processes, and automated monitoring becomes an inevitable choice. With the rapid development of algorithms and implementation paths based on artificial intelligence and machine learning, automated monitoring systems are able to process and analyze large amounts of transaction data and behavioral data, which is faster and more efficient than manual processing. However, even if the algorithm optimization of intelligent digital bank monitoring systems has surpassed human monitoring and identification capabilities, algorithm-based monitoring systems still have false positives or missed positives, and digital banks are often prone to dependence on automated monitoring. When risk control assessments deviate, it is difficult to determine the true risk level of the transaction. Therefore, the true effectiveness of risk control must be determined by the fluctuation of risk assessment deviations.

[0003] In order to solve the above defects, a technical solution is now proposed. Summary of the invention

[0004] The purpose of the present invention is to provide an intelligent digital bank monitoring system based on risk control to solve the problems in the above-mentioned background technology.

[0005] To achieve the above-mentioned purpose, the present invention provides the following technical solutions: an intelligent digital bank monitoring system based on risk control, comprising a multi-source information collection module, a multi-level risk assessment module, a model optimization module, and a decision response module; The multi-source information collection module is used for transaction factor information, behavior factor information, external factor information, and internal factor information. It cleans and integrates the transaction factor information, behavior factor information, external factor information, and internal factor information, and transmits them to the multi-level risk assessment module; The multi-level risk assessment module is used to detect abnormal transactions, including primary risk assessment submodule, intermediate risk assessment submodule, and advanced risk assessment submodule. The primary risk assessment submodule is used to screen transactions according to preset rules and mark abnormal transactions. The intermediate risk assessment submodule is used to use classification models to conduct risk assessment on transactions and identify abnormal transactions that the primary risk assessment submodule fails to mark. The advanced risk assessment submodule is used to apply deep learning algorithms to conduct dynamic risk assessment through real-time monitoring of transaction events and to mine abnormal transactions that the intermediate risk assessment submodule fails to mark. The model optimization module is used to periodically test the performance of multi-level risk assessment and verify the effectiveness of multi-level risk assessment; The decision response module is used to generate a comprehensive risk index based on the periodic inspection results of multi-level risk assessment and abnormal detection of risk control for interactive response.

[0006] Preferably, the method for cleaning and integrating the transaction factor information, behavior factor information, external factor information, and internal factor information is: Use mean, median, and interpolation methods to fill missing data. When missing values ​​cannot be filled, delete related data records. Identify and delete duplicate records. Identify and correct erroneous data. Use anomaly detection algorithms to identify and handle outliers. Unify the format and scale of data. Format unification includes time unification and monetary unit unification. The methods of scale unification are data normalization and data standardization. Use unique identifiers to associate data from different sources, and use matching algorithms to bring together highly related data; Use principal component analysis to reduce the dimension and extract features, use cluster analysis to identify natural groups and patterns in the data, and store the integrated data in a centralized storage system through a data warehouse; Verify the consistency and coordination between different data sources through cross-source consistency checks, define and execute data integrity rules through integrity rule checks, and compare data sources with actual records through comparison verification.

[0007] Preferably, the method of data normalization and data standardization is: The data normalization formula is: , where x is the original data, is the minimum value of the original data, is the maximum value of the original data, and z is the data after normalization; The data normalization formula is: , where x is the original data, is the mean of the original data, is the standard deviation of the original data, d is the data after data standardization, where the calculation expression of the mean is , where N is the number of data, i is the serial number of the data, and i is a positive integer. The calculation expression of the standard deviation is .

[0008] Preferably, the method for primary risk assessment is: There are two parts to primary risk assessment, namely, preliminary screening of data and threshold testing by setting up a rule engine according to preset rules; The specific method of threshold detection is: The minimum value in the calibration data set is Q0, 25% of the data points are less than or equal to Q1, the median value of the data set is Q2, 75% of the data points are less than or equal to Q3, and the maximum value in the data set is Q4, then the difference distance Di is , where Di is the difference between Q3 and Q1, then the abnormal interval is and , where m is the critical coefficient that controls the test scaling degree, and m is a positive number, and the data in the abnormal interval are marked as abnormal data; After the primary risk assessment marks the abnormal transaction events, it defines the abnormal transaction events as surface risks.

[0009] Preferably, the analysis method for intermediate risk assessment is: Use filling, deletion or interpolation methods to deal with missing values, delete duplicate data records, correct incorrect data entries, and convert categorical variables into numerical codes; Aggregate transaction frequency and transaction amount over time windows to create interaction terms between features; The dataset is divided into training set and test set, the features are trained using the random forest classification model, and the model performance is evaluated using the k-fold cross validation method; Use grid search or random search methods to adjust model hyperparameters, use accuracy, precision, recall, F1 score, and AUC-ROC curve indicators to evaluate model performance, use test sets to test the performance of the evaluation model, and use confusion matrices to analyze the accuracy and error rates of classification results. When the performance of the random forest classification model reaches the preset conditions, input real-time data into the random forest classification model for risk assessment;

[0010] For abnormal transactions that are not marked by the primary risk assessment, they are defined as intermediate risks after being marked by the intermediate risk assessment.

[0011] Preferably, the analysis method for high-level risk assessment is: Use big data platforms to process massive transaction data and combine it with real-time data stream processing to achieve real-time risk assessment; Extract time series features from transaction data, build a network diagram of user transaction behavior, and use window functions to extract features within different time windows; Use convolutional neural network to build models for image data, long short-term memory network models for time series data, graph neural network models for network graph data, and use ensemble learning technology to fuse neural network models; The variational autoencoder is used to detect anomalies by learning the probability distribution of data, and a prediction model based on long short-term memory network is constructed to predict the risk status. When the risk trend of a transaction event is deteriorating, the transaction event is marked as an abnormal transaction. For abnormal transactions that are not marked by intermediate risk assessment, they are defined as basic-level risks after being marked by advanced risk assessment.

[0012] Preferably, the method for verifying the effectiveness of the multi-level risk assessment is: The model stability index of the multi-level risk analysis is calibrated as Ms, and the calculation expression is: , where Er is a factor related to data transmission delay, Sl is the number of surface risk transaction events, In is the number of intermediate risk transaction events, and Gl is the number of grassroots risk transaction events. is the weight coefficient of the number of surface risk transaction events, the number of intermediate risk transaction events, and the number of grassroots risk transaction events, and All are positive numbers; The model stability index of the periodic multi-level risk assessment is calculated, and the difference between the model stability indexes of two consecutive periods is defined as , the preset stability threshold is Mt, when When it is greater than or equal to Mt, the model is marked as fluctuating; when When it is less than Mt, the model is marked as stable.

[0013] Preferably, based on the periodic inspection results of multi-level risk assessment, combined with the abnormal detection of risk control to generate a comprehensive risk index, the logic of interactive response is: calculate The difference with Mt is Ef, the proportion of calibrated surface layer risk to total risk events is A, the proportion of interlayer risk to total risk events is B, the proportion of base layer risk to total risk events is C, the proportion of actual risk events to predicted risk events is Fa, and the comprehensive risk index is calculated. The calculation expression is: , a comprehensive risk index threshold is preset. When the calculated comprehensive risk index is greater than or equal to the comprehensive risk index threshold, the deep risk mining is marked as invalid. When the calculated comprehensive risk index is greater than or equal to the comprehensive risk index threshold, the deep risk mining is marked as valid.

[0014] In the above technical solution, the technical effects and advantages provided by the present invention are: This application conducts a hierarchical assessment of transaction risk events, uses a rule engine and threshold test for primary risk assessment, uses a classification model for intermediate risk assessment, and uses a prediction model with a fusion algorithm for advanced risk assessment. It conducts in-depth mining of abnormal transaction behaviors of different types and difficulties, tests the operational stability of prediction models with black box characteristics, and verifies the effectiveness of a multi-level risk assessment framework through verification of advanced risk assessment. This can accurately obtain the operational effectiveness of a digital bank's automatic monitoring system and avoid over-reliance on automated monitoring and the loss of effective management of risk control. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0016] Figure 1 It is a system module diagram of the present invention. DETAILED DESCRIPTION

[0017] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0018] Example 1: Please refer to Figure 1 As shown, the present invention is an intelligent digital bank monitoring system based on risk control, including a multi-source information collection module, a multi-level risk assessment module, a model optimization module, and a decision response module; The multi-source information collection module is used for transaction factor information, behavior factor information, external factor information, and internal factor information. It cleans and integrates the transaction factor information, behavior factor information, external factor information, and internal factor information, and transmits them to the multi-level risk assessment module; The multi-level risk assessment module is used to detect abnormal transactions, including primary risk assessment submodule, intermediate risk assessment submodule, and advanced risk assessment submodule. The primary risk assessment submodule is used to screen transactions according to preset rules and mark abnormal transactions. The intermediate risk assessment submodule is used to use classification models to conduct risk assessment on transactions and identify abnormal transactions that the primary risk assessment submodule fails to mark. The advanced risk assessment submodule is used to apply deep learning algorithms to conduct dynamic risk assessment through real-time monitoring of transaction events and to mine abnormal transactions that the intermediate risk assessment submodule fails to mark. The model optimization module is used to periodically test the performance of multi-level risk assessment and verify the effectiveness of multi-level risk assessment; The decision response module is used to generate a comprehensive risk index based on the periodic inspection results of multi-level risk assessment and abnormal detection of risk control for interactive response.

[0019] Excessive reliance on automated monitoring systems for digital bank risk control may lead to a variety of adverse consequences, which may have a significant impact on the bank's operations, security and reputation. Automated systems may produce false positives and omissions, affecting the accuracy of risk control. Machine learning models may have biases, resulting in certain risks not being identified or low-risk transactions being misjudged as high-risk. Automated systems may find it difficult to quickly adapt to and respond to new risks or complex attack methods, resulting in delayed risk control. The lack of a deep understanding of transaction contexts and situations may lead to misjudgments. Technical failures or system vulnerabilities may cause monitoring failures and bring potential security risks. If the system is too dependent, any technical problem may have serious consequences. High reliance on automated systems may become the main target of hackers. If the system is hacked, the risk will be extremely high. Certain complex or unconventional risk scenarios require the judgment and decision-making of human experts. Over-reliance on automated systems may lead to insufficient risk management in these scenarios. Reliance on automated systems may weaken employees' risk identification and emergency response capabilities, reduce the flexibility and response speed of overall risk management, and misjudge high-risk transactions may lead to legitimate customers' transactions being rejected or their accounts being frozen, affecting customer experience and satisfaction. Frequent false alarms and transaction restrictions may reduce customers' trust in the banking system and affect customer relationships and loyalty. Over-reliance on automated systems may result in the inability to fully meet certain complex compliance requirements, increasing compliance risks. In compliance audits, the black box effect of automated systems may make it difficult to explain certain decision-making processes, affecting the transparency of compliance audits. If employees rely on automated systems for a long time, their risk identification and management skills may degenerate, affecting the bank's long-term risk management capabilities. Over-reliance on existing automated systems may limit innovation capabilities and make it difficult to develop and apply new risk management technologies and strategies. If there is algorithmic bias in automated systems, it may lead to unfair treatment of certain groups, bringing social and ethical issues. The black box effect of automated decision-making may lead to a lack of transparency in the decision-making process, which is difficult for customers and regulators to understand and accept. Over-reliance on a single automated system may form a single point of failure risk. Once the system fails, it will have a significant impact on the overall operation of the bank. Over-reliance on a certain technology or supplier may lead to risk concentration. Once there is a problem with the technology or supplier, the risk will be difficult to control. If there is no effective feedback and continuous improvement mechanism, the defects and problems of the automated system may not be discovered and corrected in time, resulting in a gradual weakening of the risk control effect. A false positive is marking a normal transaction as abnormal, and a false negative is failing to detect a real abnormal transaction.

[0020] The multi-source information collection module is used for transaction factor information, behavior factor information, external factor information, and internal factor information. It cleans and integrates the transaction factor information, behavior factor information, external factor information, and internal factor information, and transmits them to the multi-level risk assessment module; Transaction factor information includes transaction amount, time, location, and transaction method; behavioral factor information includes user login habits, device information, IP address, and browsing history; external factor information includes social media data, economic indicators, market data, and credit scores; and internal factor information includes customer information, historical transaction records, and account information within the bank; The user's login habits include the user's login time, frequency, and device used; the IP address includes the login IP address and transaction IP address; the economic indicators include the GDP growth rate and inflation rate; the credit score is the user's credit score provided by a third-party agency; the customer information includes name, age, and address; the historical transaction record includes the user's past transaction history and behavior patterns; and the account information includes the account balance, account type, and account opening time; The specific steps for cleaning and integrating transaction factor information, behavioral factor information, external factor information, and internal factor information are as follows: Use mean, median, and interpolation methods to fill missing data. When missing values ​​cannot be filled, delete related data records. Identify and delete duplicate records. Identify and correct erroneous data. Use anomaly detection algorithms to identify and handle outliers. Unify the format and scale of data. Format unification includes time unification and monetary unit unification. The methods of scale unification are data normalization and data standardization. Use unique identifiers to associate data from different sources, and use matching algorithms to bring together highly related data; Use principal component analysis to reduce the dimension and extract features, use cluster analysis to identify natural groups and patterns in the data, and store the integrated data in a centralized storage system through a data warehouse; Verify the consistency and coordination between different data sources through cross-source consistency checks, define and execute data integrity rules through integrity rule checks, and compare data sources with actual records through comparison verification.

[0021] It should be noted that erroneous data includes negative transaction amounts, unique identifiers include user ID and transaction ID, matching algorithms include string matching and fuzzy matching, and integrity rules include primary key constraints and foreign key constraints.

[0022] The data normalization formula is: , where x is the original data, is the minimum value of the original data, is the maximum value of the original data, and z is the data after normalization; The data normalization formula is: , where x is the original data, is the mean of the original data, is the standard deviation of the original data, d is the data after data standardization, where the calculation expression of the mean is , where N is the number of data, i is the serial number of the data, and i is a positive integer. The calculation expression of the standard deviation is .

[0023] The multi-level risk assessment module is used to detect abnormal transactions, including primary risk assessment submodule, intermediate risk assessment submodule, and advanced risk assessment submodule. Primary risk assessment is the first level of multi-level risk assessment, which aims to quickly and effectively screen out obvious abnormal transactions or high-risk behaviors; There are two parts to primary risk assessment, namely, preliminary screening of data and threshold test by setting a rule engine according to preset rules. The preset rules are based on business experience and historical data, and the preliminary screening rules are set to detect abnormal transaction behaviors. In a typical embodiment, by setting an upper limit on the transaction amount, the transaction behaviors are filtered and screened, and transactions exceeding the upper limit will be marked as high risk; by setting a limit on the number of transactions within a certain period of time, transactions that exceed the frequency will be marked as high risk; by setting a limit on the geographical location of the transaction, when the transaction occurs in a preset geographical location, it will be marked as high risk; for specific types of transactions, they will be marked as high risk, and the specific type is large withdrawal, and the specific amount is set by professional and technical personnel in this field; When transaction data enters the system, the rule engine will filter it according to preset rules and quickly mark high-risk transaction events.

[0024] The specific method of threshold detection is: The minimum value in the calibration data set is Q0, 25% of the data points are less than or equal to Q1, the median value of the data set is Q2, 75% of the data points are less than or equal to Q3, and the maximum value in the data set is Q4, then the difference distance Di is , where Di is the difference between Q3 and Q1, then the abnormal interval is and , where m is the critical coefficient that controls the degree of test scaling, and m is a positive number, and the data in the abnormal interval are marked as abnormal data.

[0025] It should be noted that the value of m is set by professionals in this field; After the primary risk assessment marks the abnormal transaction events, it defines the abnormal transaction events as surface risks; The rule engine can quickly process large amounts of data and provide immediate feedback. The rule-based approach is simple to use, easy to understand and implement, and can effectively screen out obvious abnormal transactions, reducing the pressure of subsequent advanced evaluations; However, the preset rule approach may not be able to cope with complex and new fraud methods. Simple rules may lead to a high false alarm rate, requiring further advanced assessment and intervention. Primary assessment cannot fully understand the background and context of the transaction and may miss some potential risks.

[0026] The intermediate risk assessment submodule is used to perform risk assessment on transactions using a classification model and identify abnormal transactions that were not flagged by the primary risk assessment submodule; Intermediate risk assessment uses classification models to analyze data. The specific analysis methods are: Use filling, deletion or interpolation methods to deal with missing values, delete duplicate data records, correct incorrect data entries, and convert categorical variables into numerical codes; Aggregate transaction frequency and transaction amount over time windows to create interaction terms between features; The dataset is divided into training set and test set, the features are trained using the random forest classification model, and the model performance is evaluated using the k-fold cross validation method; Use grid search or random search methods to adjust model hyperparameters, use accuracy, precision, recall, F1 score, and AUC-ROC curve indicators to evaluate model performance, use the test set to test the performance of the evaluation model, and use the confusion matrix to analyze the accuracy and error rate of the classification results. When the performance of the random forest classification model reaches the preset conditions, input real-time data into the random forest classification model for risk assessment.

[0027] For abnormal transactions that are not marked by the primary risk assessment, they are defined as intermediate risks after being marked by the intermediate risk assessment; Intermediate risk assessment combines multi-source data to provide comprehensive risk assessment. It can use algorithms and models to adapt to different risk scenarios. Through model training and verification, it can improve the accuracy of risk identification. However, the quality and consistency of multi-source data used in intermediate risk assessment have a significant impact on the assessment results. Complex algorithm models are difficult to interpret and maintain, and large-scale data processing and model training require higher computing resources.

[0028] The advanced risk assessment submodule is used to apply deep learning algorithms to conduct dynamic risk assessment through real-time monitoring of transaction events, and to discover abnormal transactions that the intermediate risk assessment submodule fails to mark; The process of applying deep learning algorithms to conduct dynamic risk assessment through real-time monitoring of transaction events is as follows: Use big data platforms to process massive transaction data and combine it with real-time data stream processing to achieve real-time risk assessment; Extract time series features from transaction data, build a network diagram of user transaction behavior, and use window functions to extract features within different time windows; Use convolutional neural network to build models for image data, long short-term memory network models for time series data, graph neural network models for network graph data, and use ensemble learning technology to fuse neural network models; The variational autoencoder is used to detect anomalies by learning the probability distribution of data, and a prediction model based on long short-term memory network is constructed to predict the risk status. When the risk trend of a transaction event is deteriorating, the transaction event is marked as an abnormal transaction.

[0029] For abnormal transactions that are not marked by intermediate risk assessment, they are defined as basic-level risks after being marked by advanced risk assessment.

[0030] Commonly used big data platforms include Hadoop, Spark, etc., real-time data stream processing methods include Kafka, Flink, etc., typical time series features include periodicity, trends, etc., and the network graph of user transaction behavior includes network centrality and social network relationships.

[0031] The model optimization module is used to periodically test the performance of multi-level risk assessment and verify the effectiveness of multi-level risk assessment; The method to verify the effectiveness of multi-level risk assessment is: The model stability index of the multi-level risk analysis is calibrated as Ms, and the calculation expression is: , where Er is a factor related to data transmission delay, Sl is the number of surface risk transaction events, In is the number of intermediate risk transaction events, and Gl is the number of grassroots risk transaction events. is the weight coefficient of the number of surface risk transaction events, the number of intermediate risk transaction events, and the number of grassroots risk transaction events, and All are positive numbers.

[0032] The model stability index of the periodic multi-level risk assessment is calculated, and the difference between the model stability indexes of two consecutive periods is defined as , the preset stability threshold is Mt, when When it is greater than or equal to Mt, the model is marked as fluctuating; when When it is less than Mt, the model is marked as stable.

[0033] The decision response module is used to generate a comprehensive risk index based on the periodic inspection results of multi-level risk assessment and abnormal detection of risk control, and to respond interactively; calculate The difference with Mt is Ef, the proportion of calibrated surface layer risk to total risk events is A, the proportion of interlayer risk to total risk events is B, the proportion of base layer risk to total risk events is C, the proportion of actual risk events to predicted risk events is Fa, and the comprehensive risk index is calculated. The calculation expression is: , a comprehensive risk index threshold is preset. When the calculated comprehensive risk index is greater than or equal to the comprehensive risk index threshold, the deep risk mining is marked as invalid. When the calculated comprehensive risk index is greater than or equal to the comprehensive risk index threshold, the deep risk mining is marked as valid.

[0034] This application conducts a hierarchical assessment of transaction risk events, uses a rule engine and threshold test for primary risk assessment, uses a classification model for intermediate risk assessment, and uses a prediction model with a fusion algorithm for advanced risk assessment. It conducts in-depth mining of abnormal transaction behaviors of different types and difficulties, tests the operational stability of prediction models with black box characteristics, and verifies the effectiveness of a multi-level risk assessment framework through verification of advanced risk assessment. This can accurately obtain the operational effectiveness of a digital bank's automatic monitoring system and avoid over-reliance on automated monitoring and the loss of effective management of risk control.

[0035] The above formulas are all dimensionless and numerical calculations. The formula is a formula for the most recent real situation obtained by collecting a large amount of data and performing software simulation. The preset parameters in the formula are set by technicians in this field according to actual conditions.

[0036] The above embodiments can be implemented in whole or in part by software, hardware, firmware or any other combination. When implemented by software, the above embodiments can be implemented in whole or in part in the form of computer program goods. The computer program goods include one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website site, computer, server or data center to another website site, computer, server or data center by wired or wireless (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium. The semiconductor medium can be a solid-state hard disk.

[0037] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0038] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0039] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the system described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0040] If the functions are implemented in the form of software functional units and sold or used as independent goods, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can essentially or in other words, the part that contributes to the prior art or the part of the technical solution can be embodied in the form of software goods, and the computer software goods are stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, and other media that can store program codes.

[0041] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. Intelligent digital bank monitoring system based on risk control, characterized by: It includes multi-source information collection module, multi-level risk assessment module, model optimization module, and decision response module; The multi-source information collection module is used for transaction factor information, behavior factor information, external factor information, and internal factor information. It cleans and integrates the transaction factor information, behavior factor information, external factor information, and internal factor information, and transmits them to the multi-level risk assessment module; The multi-level risk assessment module is used to detect abnormal transactions, including primary risk assessment submodule, intermediate risk assessment submodule, and advanced risk assessment submodule. The primary risk assessment submodule is used to screen transactions according to preset rules and mark abnormal transactions. The intermediate risk assessment submodule is used to use classification models to conduct risk assessment on transactions and identify abnormal transactions that the primary risk assessment submodule fails to mark. The advanced risk assessment submodule is used to apply deep learning algorithms to conduct dynamic risk assessment through real-time monitoring of transaction events and to mine abnormal transactions that the intermediate risk assessment submodule fails to mark. The model optimization module is used to periodically test the performance of multi-level risk assessment and verify the effectiveness of multi-level risk assessment; The decision response module is used to generate a comprehensive risk index based on the periodic inspection results of multi-level risk assessment and abnormal detection of risk control for interactive response.

2. The intelligent digital bank monitoring system based on risk control according to claim 1 is characterized in that: The method for cleaning and integrating transaction factor information, behavioral factor information, external factor information, and internal factor information is as follows: Use mean, median, and interpolation methods to fill missing data. When missing values ​​cannot be filled, delete related data records. Identify and delete duplicate records. Identify and correct erroneous data. Use anomaly detection algorithms to identify and handle outliers. Unify the format and scale of data. The format unification includes time unification and monetary unit unification. The scale unification method is data normalization and data standardization. Use unique identifiers to associate data from different sources, and use matching algorithms to bring together highly related data; Use principal component analysis to reduce the dimension and extract features, use cluster analysis to identify natural groups and patterns in the data, and store the integrated data in a centralized storage system through a data warehouse; Verify the consistency and coordination between different data sources through cross-source consistency checks, define and execute data integrity rules through integrity rule checks, and compare data sources with actual records through comparison verification.

3. The intelligent digital bank monitoring system based on risk control according to claim 2 is characterized in that: The methods for data normalization and data standardization are: The data normalization formula is: , where x is the original data, is the minimum value of the original data, is the maximum value of the original data, and z is the data after normalization; The data normalization formula is: , where x is the original data, is the mean of the original data, is the standard deviation of the original data, d is the data after data standardization, where the calculation expression of the mean is , where N is the number of data, i is the serial number of the data, and i is a positive integer. The calculation expression of the standard deviation is .

4. The intelligent digital bank monitoring system based on risk control according to claim 1 is characterized in that: The methods for primary risk assessment are: There are two parts to primary risk assessment, namely, preliminary screening of data and threshold testing by setting up a rule engine according to preset rules; The specific method of threshold detection is: The minimum value in the calibration data set is Q0, 25% of the data points are less than or equal to Q1, the median value of the data set is Q2, 75% of the data points are less than or equal to Q3, and the maximum value in the data set is Q4, then the difference distance Di is , where Di is the difference between Q3 and Q1, then the abnormal interval is and , where m is the critical coefficient that controls the test scaling degree, and m is a positive number, and the data in the abnormal interval are marked as abnormal data; After the primary risk assessment marks the abnormal transaction events, it defines the abnormal transaction events as surface risks.

5. The intelligent digital bank monitoring system based on risk control according to claim 4 is characterized in that: The analytical method for intermediate risk assessment is: Use filling, deletion or interpolation methods to deal with missing values, delete duplicate data records, correct incorrect data entries, and convert categorical variables into numerical codes; Aggregate transaction frequency and transaction amount over time windows to create interaction terms between features; The dataset is divided into training set and test set, the features are trained using the random forest classification model, and the model performance is evaluated using the k-fold cross validation method; Use grid search or random search methods to adjust model hyperparameters, use accuracy, precision, recall, F1 score, and AUC-ROC curve indicators to evaluate model performance, use test sets to test the performance of the evaluation model, and use confusion matrices to analyze the accuracy and error rates of classification results. When the performance of the random forest classification model reaches the preset conditions, input real-time data into the random forest classification model for risk assessment; For abnormal transactions that are not marked by the primary risk assessment, they are defined as intermediate risks after being marked by the intermediate risk assessment.

6. The intelligent digital bank monitoring system based on risk control according to claim 5 is characterized in that: The analytical approach for high-level risk assessment is: Use big data platforms to process massive transaction data and combine it with real-time data stream processing to achieve real-time risk assessment; Extract time series features from transaction data, build a network diagram of user transaction behavior, and use window functions to extract features within different time windows; Use convolutional neural network to build models for image data, long short-term memory network models for time series data, graph neural network models for network graph data, and use ensemble learning technology to fuse neural network models; The variational autoencoder is used to detect anomalies by learning the probability distribution of data, and a prediction model based on long short-term memory network is constructed to predict the risk status. When the risk trend of a transaction event is deteriorating, the transaction event is marked as an abnormal transaction. For abnormal transactions that are not marked by intermediate risk assessment, they are defined as basic-level risks after being marked by advanced risk assessment.

7. The intelligent digital bank monitoring system based on risk control according to claim 6 is characterized in that: The method to verify the effectiveness of multi-level risk assessment is: The model stability index of the multi-level risk analysis is calibrated as Ms, and the calculation expression is: , where Er is a factor related to data transmission delay, Sl is the number of surface risk transaction events, In is the number of intermediate risk transaction events, and Gl is the number of grassroots risk transaction events. is the weight coefficient of the number of surface risk transaction events, the number of intermediate risk transaction events, and the number of grassroots risk transaction events, and All are positive numbers; The model stability index of the periodic multi-level risk assessment is calculated, and the difference between the model stability indexes of two consecutive periods is defined as , the preset stability threshold is Mt, when When it is greater than or equal to Mt, the model is marked as fluctuating; when When it is less than Mt, the model is marked as stable.

8. The intelligent digital bank monitoring system based on risk control according to claim 7 is characterized in that: Based on the periodic inspection results of multi-level risk assessment, combined with the abnormal detection of risk control to generate a comprehensive risk index, the logic of interactive response is: calculate The difference with Mt is Ef, the proportion of calibrated surface layer risk to total risk events is A, the proportion of interlayer risk to total risk events is B, the proportion of base layer risk to total risk events is C, the proportion of actual risk events to predicted risk events is Fa, and the comprehensive risk index is calculated. The calculation expression is: , a comprehensive risk index threshold is preset. When the calculated comprehensive risk index is greater than or equal to the comprehensive risk index threshold, the deep risk mining is marked as invalid. When the calculated comprehensive risk index is greater than or equal to the comprehensive risk index threshold, the deep risk mining is marked as valid.

Images