Risk identification method and device, equipment and storage medium

Abstract

The invention provides a risk identification method and device, equipment and a storage medium. Relates to the technical field of data analysis. The method comprises the steps of determining a to-be-analyzed operation record for risk identification, then determining a transaction link in the to-be-analyzed operation record based on a transaction code and operation time in the to-be-analyzed operation record, and then determining an operation record with a risk based on the to-be-analyzed operation record containing an incomplete link. According to the method provided by the invention, the problem of insufficient identification accuracy of risk behaviors influencing user information security in the prior art is solved.

Description

Technical Field

[0001] The present application relates to the field of data analysis technology, and in particular to a risk identification method, device, equipment and storage medium. Background Art

[0002] In the customer-facing commercial banking sector, staff are usually required to assist customers in handling various businesses. In the process of assisting customers in handling business, staff will be exposed to user information involving personal security, such as user identity information and account information, and there is a risk of leakage and abuse of user information.

[0003] The related technology can only identify the leakage and abuse of user information based on the leakage behavior of pre-specified types of user information. It is insufficient to identify risky behaviors that may lead to the leakage and abuse of user information, and the identification accuracy is poor. Summary of the invention

[0004] The present application provides a risk identification method, device, equipment and storage medium to solve the problem of insufficient accuracy in identifying risk behaviors that affect user information security in the prior art.

[0005] In a first aspect, the present application provides a risk identification method, including: determining an operation record to be analyzed for risk identification, the operation record to be analyzed containing corresponding operator information, object information, a transaction code corresponding to the operation, and an operation time; based on the transaction code and operation time in the operation record to be analyzed, determining a transaction link in the operation record to be analyzed, wherein the transaction link is used to represent an operation record containing all operations corresponding to a single transaction, and the transaction link contains an incomplete link, and the incomplete link is used to represent an operation record of all operations corresponding to a single unfinished transaction; based on the operation record to be analyzed containing the incomplete link, determining an operation record with risks.

[0006] In a possible design, based on the transaction code and operation time in the operation record to be analyzed, the transaction link in the operation record to be analyzed is determined, including: based on the transaction code and the corresponding operation time in the operation record to be analyzed by the same operator and the same object, the transaction link contained in the analysis operation record is determined; based on the transaction link, the transaction link containing the most transaction codes in the operation record to be analyzed corresponding to the same operator and the same object is determined as the longest operation link; the transaction code corresponding to the last operation in the transaction link with the longest operation time in the longest operation link is determined as the last transaction code; among the transaction codes other than the last transaction code included in the longest operation link, the transaction code whose appearance ratio exceeds a first ratio threshold is determined as a transaction key item; and the transaction link that does not contain the last transaction code and contains the transaction key item is determined as an incomplete link.

[0007] In a possible design, based on the transaction codes and corresponding operation times in the operation records to be analyzed of the same operator and the same object, after determining the transaction links contained in the analysis operation records, it also includes: removing adjacent and repeated transaction codes and operation records corresponding to the transaction codes in the transaction links.

[0008] In a possible design, based on the transaction code and the corresponding operation time in the operation record to be analyzed of the same operator and the same object, the transaction chain contained in the analysis operation record is determined, including: determining the operation whose operation time distance from the previous transaction code in the operation record to be analyzed corresponding to the same operator and the same object is greater than a first set time length, or the operation without the previous transaction code, as the starting operation, and determining the transaction code corresponding to the starting operation as the starting transaction code; if there is an operation whose operation time is located after the starting operation and the interval between the corresponding operation time and the operation time of the previous transaction code is greater than a second set time length, determining the previous transaction code as the termination transaction code of the transaction chain corresponding to the starting transaction code; determining the operation whose operation time is located after the starting operation and the interval between the corresponding operation time and the operation time of the previous transaction code is less than the second set time length as an operation belonging to the transaction chain where the starting operation is located; and determining all transaction codes in the transaction chain where the starting transaction code is located.

[0009] In one possible design, the transaction code corresponding to the last operation in the transaction link with the longest operation duration in the longest operation link is determined as the end transaction code, including: determining the time difference between the operation times corresponding to the start transaction code and the end transaction code in the longest operation link as the operation duration; and determining the transaction code corresponding to the last operation in the transaction link corresponding to the maximum value in the operation duration as the end transaction code.

[0010] In a possible design, after the transaction code corresponding to the last operation in the transaction link corresponding to the maximum operation time in the longest operation link is determined as the end transaction code, it includes: filtering the longest operation link in the transaction links corresponding to the same operator and the same object; and determining the end transaction code in the filtered transaction link.

[0011] In one possible design, based on the transaction code and operation time in the operation record to be analyzed, the transaction link in the operation record to be analyzed is determined, including: inputting the operation record to be analyzed into a transaction link extraction model, and determining the result output by the transaction record extraction model as the transaction link and incomplete link in the operation record to be analyzed.

[0012] In one possible design, based on the operation records to be analyzed that include incomplete links, determining the operation records that are at risk, including: based on the operation records to be analyzed, determining the number of customers corresponding to all incomplete links of the same operator as the number of risky customers, and determining the total number of customers corresponding to the operation records to be analyzed of the same operator; if the ratio of the number of risky customers to the total number of customers exceeds a second set threshold, determining the operation records to be analyzed corresponding to the operator as risky operation records.

[0013] In a possible design, the operation record to be analyzed also includes: interception information corresponding to the interception of the operator's outgoing email operation, release information corresponding to the successful sending of the email, and employee status information.

[0014] In one possible design, based on the operation records to be analyzed that contain incomplete transaction links, the operation records with risks are determined, including: determining the operation records to be analyzed corresponding to the operator that contain incomplete links and have both interception information and release information as operation records with risks; and / or, determining the operation records to be analyzed corresponding to the operator that contain incomplete links and employee status information of the operator being resigned as operation records with risks; and / or, determining the operation records to be analyzed corresponding to the operator that contain at least two incomplete links as operation records with risks.

[0015] In a second aspect, the present application provides a risk identification device, including: an acquisition module, used to determine an operation record to be analyzed for risk identification, the operation record to be analyzed containing corresponding operator information, object information, operation corresponding transaction code and operation time; an analysis module, used to determine a transaction link in the operation record to be analyzed based on the transaction code and operation time in the operation record to be analyzed, wherein the transaction link is used to represent an operation record containing all operations corresponding to a single transaction, and the transaction link contains an incomplete link, and the incomplete link is used to represent an operation record of all operations corresponding to a single unfinished transaction; a determination module, used to determine an operation record with risks based on the operation record to be analyzed containing the incomplete link.

[0016] In a third aspect, an embodiment of the present application provides an electronic device, comprising: at least one processor and a memory; the memory stores computer-executable instructions; the at least one processor executes the computer-executable instructions stored in the memory, so that the at least one processor executes the risk identification method described in the first aspect and various possible designs of the first aspect.

[0017] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When a processor executes the computer-executable instructions, the risk identification method described in the first aspect and various possible designs of the first aspect is implemented.

[0018] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program. When the computer program is executed by a processor, it implements the risk identification method described in the first aspect and various possible designs of the first aspect.

[0019] The risk identification method, device, equipment and storage medium provided by the present application determine the operation records to be analyzed for risk identification, then determine the transaction links in the operation records to be analyzed based on the transaction code and operation time in the operation records to be analyzed, and then determine the operation records with risks based on the operation records to be analyzed containing incomplete links. Thus, through analysis based on the operation records to be analyzed, the transaction links corresponding to each business function can be determined without determining the key operations corresponding to each business function, and the incomplete links therein can be automatically identified. In combination with other behaviors of the operator, the operation records with risks can be identified, thereby realizing the identification of the risky parts in the operation records of a large number of operators, significantly improving the accuracy of identifying risky behaviors that affect the security of user information, and thus significantly improving the security of user information. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0021] Figure 1 Application scenario diagram for risk identification of existing technologies;

[0022] Figure 2 This is an application scenario diagram of the risk identification method applicable to the embodiment of the present application;

[0023] Figure 3 The process of the risk identification method provided in the embodiment of the present application Figure 1 ;

[0024] Figure 4a The process of the risk identification method provided in the embodiment of the present application Figure 2 ;

[0025] Figure 4b for Figure 4a A flow chart of a method for determining a transaction link provided in the illustrated embodiment;

[0026] Figure 4c for Figure 4a A flow chart of a method for determining a last transaction code provided in the illustrated embodiment;

[0027] Figure 4d for Figure 4a A flow chart of a method for supplementing the end transaction code provided in the illustrated embodiment;

[0028] Figure 5 A schematic diagram of the structure of a risk identification device provided in an embodiment of the present application;

[0029] Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application.

[0030] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0031] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0032] First, the terms involved in this application are explained:

[0033] Risk identification, in the embodiments of the present disclosure, is used to refer to the process of finding out behaviors that may affect the security of user information. Through risk identification, it is possible to further analyze and determine whether there are behaviors that endanger the security of user information, and take corresponding measures to deal with them in a timely manner.

[0034] Figure 1 This is an application scenario diagram for risk identification of existing technologies. Figure 1 As shown, the application scenario includes: a server 110 and an information leakage behavior record 120, and the server 110 contains a database 111.

[0035] In the prior art, in the field of customer-oriented commercial banks, staff are usually required to assist customers in handling various businesses. In the process of assisting users in handling businesses, staff will come into contact with user-related identity information, account information and other user information involving personal security. If the staff uses the user information they have come into contact with in scenarios other than the business required by the user, user information leakage and abuse will occur, such as reselling user contact information.

[0036] In the related art, the identification of the behavior of leaking and abusing user information can only be detected based on the leakage behavior of pre-specified types of user information, that is, the pre-specified types of information leakage behavior records 120 are identified from the database 111 in the server 110. If the staff has the intention to abuse user information, there are many ways to actually realize it, and there are many actual operations and corresponding scenarios. As a result, the detection based only on the leakage behavior of the specified type will have the problem of insufficient ability to identify risk behaviors that may lead to the leakage and abuse of user information, and poor identification accuracy.

[0037] In response to the above technical problems, this application proposes the following technical concept: by analyzing the operation records, identifying the transaction links therein, and based on the incomplete links and the behavior of the operators, identifying the operation records with risks. In this way, the problem of insufficient accuracy in identifying risky behaviors that affect user information security in the prior art can be solved.

[0038] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0039] Figure 2 FIG. 1 is an application scenario diagram of the risk identification method applicable to the embodiment of the present application. Figure 2 As shown, the application scenario includes: a server 210 and operation records 220 to be analyzed, and operation records 230 with risks, and the server 210 contains a database 211. Among them, the server 210 can be a server or a server cluster including multiple servers, and the database 211 can be a database, a database system or a database cluster. The user terminal 220 can be a computer, a mobile terminal, an intelligent device that can communicate with the Internet, etc. At this time, the server 210 is used to collect the operation records 220 to be analyzed from the database 211, and collect the operation records 230 with risks therein based on the method in this embodiment, thereby completing the risk identification process.

[0040] based on Figure 2 In the application scenario shown, the embodiment of the present application also provides a risk identification method. Figure 3 The process of the risk identification method provided in the embodiment of the present application Figure 1 .like Figure 3 As shown, the risk identification method includes:

[0041] S301. Determine operation records to be analyzed for risk identification.

[0042] The operation record to be analyzed includes the corresponding operator information, object information, transaction code corresponding to the operation and operation time.

[0043] The execution subject of the method of this embodiment may be Figure 2 The server shown in .

[0044] Specifically, risk identification is mainly based on data in the bank's internal system. By identifying behaviors that may cause security losses to the bank's customer information (i.e., object information) (such as leakage or abuse of object information), relevant personnel can conduct targeted inspections and judgments on these behaviors and records, thereby ensuring the security of object information.

[0045] The operation records to be analyzed are data collected in the internal system of the bank. During the specific collection, the operator information, the operator's operation and the corresponding transaction code, the object information corresponding to the operation, and the operation time can be collected through the employee channel corresponding system in the bank system.

[0046] Furthermore, in addition to the customer's identity information (such as name, age, profile picture, etc.), the object information also includes the customer's corresponding bank card related information (such as card number information), which are all information related to the customer's identity security and account security.

[0047] S302: Determine the transaction link in the operation record to be analyzed based on the transaction code and operation time in the operation record to be analyzed.

[0048] Among them, the transaction link is used to represent the operation record of all operations corresponding to a single transaction. The transaction link includes an incomplete link, and the incomplete link is used to represent the operation record of all operations corresponding to a single unfinished transaction.

[0049] Specifically, the service provided by the operator for each customer is a transaction (such as handling deposits and withdrawals for customers, applying for new cards, etc.). Each transaction involves multiple operations (such as unfreezing the card, including confirming the customer's identity, determining the card status, confirming the corresponding operation of the card, entering the unfreezing instruction, entering the customer's authorization information, obtaining the unfreezing instruction result, etc.). These operations corresponding to the same transaction constitute a transaction link.

[0050] The transaction link of a single transaction can be defined by the transaction code and operation time contained therein, so the transaction link in the operation record to be analyzed can be identified based on the time correlation and distribution pattern between the transaction codes. Among them, the transaction code is the identification code corresponding to each operation pre-defined in the system. Therefore, by determining the transaction code in the operation record, it is possible to determine which operations are included in the transaction link.

[0051] If a single transaction is not completed (for example, the above-mentioned card unfreezing operation requires obtaining the unfreezing instruction result before the transaction is considered completed. If the unfreezing instruction is not entered after confirming the corresponding operation of the card, or the customer authorization information is not entered after the unfreezing instruction is entered, it can be regarded as an unfinished single transaction), then the corresponding transaction link is an incomplete link.

[0052] When analyzing whether there are risks in the operation records, it is necessary to identify the transaction links and incomplete links, because the operator behavior corresponding to the incomplete link is the behavior most likely to cause loss of user information security.

[0053] S303: Determine risky operation records based on the operation records to be analyzed that contain incomplete links.

[0054] Specifically, after obtaining the transaction link including the incomplete link, the operation record with risks may be determined based on the situation of the incomplete link in the operation record to be analyzed.

[0055] Because an incomplete link may be caused by the customer giving up the business midway, or it may be caused by a temporary failure of the bank system, or it may be caused by the discovery that the conditions for continuing the business are not met during the business process (the business can only be terminated). Therefore, the occasional incomplete link in the operation record may not mean that there has been a loss of customer information security.

[0056] However, if there are a large number of incomplete links in the operation records corresponding to a certain operator, it is difficult to explain it as an unexpected situation. It is necessary to conduct targeted and focused inspections on such operators and the corresponding incomplete links to ensure the security of customer information.

[0057] This embodiment determines the operation records to be analyzed for risk identification, and then determines the transaction links in the operation records to be analyzed based on the transaction code and operation time in the operation records to be analyzed, and then determines the operation records with risks based on the operation records to be analyzed that contain incomplete links. Thus, through analysis based on the operation records to be analyzed, the transaction links corresponding to each business function can be determined without determining the key operations corresponding to each business function, and the incomplete links therein can be automatically identified. In combination with other behaviors of the operator, the operation records with risks can be identified, thereby realizing the identification of the risky parts in the operation records of a large number of operators, significantly improving the accuracy of identifying risky behaviors that affect the security of user information, and thus significantly improving the security of user information.

[0058] Figure 4a The process of the risk identification method provided in the embodiment of the present application Figure 2 .like Figure 4a As shown, the risk identification method includes the following steps:

[0059] S401. Determine operation records to be analyzed for risk identification.

[0060] Specifically, this embodiment further describes in detail the complete method flow of the risk identification method.

[0061] In addition to the information related to the operator and the object, the operation records to be analyzed also include the interception information corresponding to the interception of the operator's outgoing email operation, the release information of the corresponding successful email sending, and the employee status information.

[0062] The employee status information can be collected from the banking institution management system, and the interception information and release information can be collected from the email system.

[0063] In some embodiments, the bank may configure an email data leakage prevention system, which has a built-in interception function for outbound sensitive information and a release function based on an application. Bank system managers may also configure related programs to implement email interception and release functions, which are not limited here.

[0064] S402: Based on the transaction code and the corresponding operation time in the operation record to be analyzed of the same operator and the same object, determine the transaction link contained in the operation record.

[0065] Specifically, a transaction link is a single transaction between a single operator and a single customer. Therefore, it is necessary to determine the transaction link based on the operation records to be analyzed of the same operator and the same object according to the correlation between the corresponding transaction code and the operation time.

[0066] Furthermore, if Figure 4b As shown, it is a flow chart of a method for determining a transaction link, which includes the following steps:

[0067] S4021. In the operation records to be analyzed corresponding to the same operator and the same object, an operation whose time distance from the operation of the previous transaction code is greater than a first set time length, or an operation without a previous transaction code, is determined as a starting operation, and the transaction code corresponding to the starting operation is determined as the starting transaction code.

[0068] Specifically, when determining a transaction link, it is necessary to determine a starting operation so as to determine other operations belonging to the same link based on the starting operation.

[0069] Here, the first operation within a period of time (that is, the operation whose time distance from the previous transaction code operation is greater than the first set time length, or the operation without the previous transaction code) can be determined as the starting operation. The first set time length can be 2 minutes, 3 minutes or other time lengths, and the first set time length represents the time interval in the business handling process.

[0070] S4022. If there is an operation whose operation time is after the start operation, and the interval between the corresponding operation time and the operation time of the previous transaction code is greater than the second set time length, determine that the previous transaction code is the abort transaction code of the transaction link corresponding to the start transaction code.

[0071] Specifically, after determining the starting operation, the subsequent operations in the same transaction link can be determined in sequence. However, if the time interval between the previous operation and the previous operation is too long (i.e., exceeds the second set time length), it can be considered that the transaction has been terminated, so the previous operation is regarded as a terminated operation, and its corresponding transaction code is a terminated transaction code.

[0072] The second set time can be configured by yourself, such as 1 minute, 2 minutes or longer, but usually the second set time will not exceed 5 minutes, because during the business processing of a single user, there will usually not be a blank time of more than 5 minutes without any operation. Even if the system is stuck, the operation will usually be repeated many times.

[0073] S4023: Determine an operation whose operation time is after the starting operation and whose interval between the corresponding operation time and the operation time of the previous transaction code is less than a second set time as an operation belonging to the transaction link where the starting operation is located.

[0074] Specifically, if the operation time corresponding to the operation retrieved in the process of determining the transaction link is within the second set time period between the operation time and the time interval between the previous operation, it can be directly determined to belong to the transaction link.

[0075] S4024. Determine all transaction codes in the transaction chain where the starting transaction code is located.

[0076] Specifically, by repeating the above steps, all operations and corresponding transaction codes in the transaction link can be determined, and all transaction links in the operation record to be analyzed can be determined thereby.

[0077] Furthermore, after determining the transaction link, in order to facilitate the subsequent determination of the validity of the longest operation link, it is also necessary to remove adjacent and repeated transaction codes and operation records corresponding to the transaction codes in the transaction link.

[0078] Specifically, considering the possibility that the operator may repeatedly send instructions due to system jams (for example, after sending an instruction to unfreeze a card, no feedback information is received, so the action needs to be repeated), such repeated operations and the corresponding transaction codes need to be filtered out from the transaction chain.

[0079] S403: Based on the transaction link, the transaction link containing the most transaction codes in the operation records to be analyzed corresponding to the same operator and the same object is determined as the longest operation link.

[0080] Specifically, after obtaining the transaction link, it is necessary to determine the complete link in the corresponding single transaction for each operator and each corresponding object (as opposed to an incomplete link, which is the transaction link corresponding to the operation when the transaction is completed).

[0081] The identification of the complete link requires a lot of pre-definition through operation functions, and some operations may not be able to advance to the predefined final state (for example, when handling financial management business, some financial management may require users to confirm multiple times, including the last confirmation, while some financial management does not require the last confirmation. If the last confirmation is used as the identification mark of the complete link, it is easy to mistakenly identify a large number of "incomplete links"). Therefore, the identification of the longest operation link can be used instead.

[0082] S404: Determine the transaction code corresponding to the last operation in the transaction link with the longest operation duration in the longest operation link as the end transaction code.

[0083] Specifically, in the embodiment of the present disclosure, incomplete links in the transaction links corresponding to the same operator and the same object are identified based on the longest operation link.

[0084] The identification mark of an incomplete link is that it does not include the last operation in the longest operation chain. In terms of identification, it is judged by whether it contains the corresponding end transaction code.

[0085] Furthermore, if Figure 4c As shown, it is a flow chart of a method for determining the last transaction code, which includes the following steps:

[0086] S4041. Determine the time difference between the operation times corresponding to the start transaction code and the end transaction code in the longest operation link as the operation duration.

[0087] Specifically, there may be multiple longest operation links in the operation record to be analyzed, but the same customer usually only handles one business at a time, so it is necessary to select the longest operation link for confirming the last transaction code. In the embodiment of the present disclosure, the operation duration is selected for judgment.

[0088] For example, the operation time determined by the operation records is that the operation time of operator 1 operating customer 1 is 14:03:24; the operation time of operator 2 operating customer 2 is 15:31:03; the operation time of operator 3 operating customer 3 is 11:24:32; the operation time of operator 4 operating customer 4 is 10:44:04; and the operation time of operator 5 operating customer 5 is 15:43:42.

[0089] The above operation duration corresponds to the longest operation link of each operator. Operator 1 operates the transaction link of customer 1 with 8 transaction codes; operator 2 operates the transaction link of customer 2 with 9 transaction codes; operator 3 operates the transaction link of customer 3 with 11 transaction codes; operator 4 operates the transaction link of customer 4 with 9 transaction codes; operator 5 operates the transaction link of customer 5 with 7 transaction codes.

[0090] Next, the end transaction code corresponding to the operation can be determined based on these longest operation links.

[0091] S4042. The transaction code corresponding to the last operation in the transaction link corresponding to the maximum value in the operation duration is determined as the last transaction code.

[0092] Specifically, the last operation in the determined transaction link (the maximum value in the above operation duration corresponds to the longest operation link) is determined as the last transaction code.

[0093] For example, taking the transaction link of the above-mentioned operator 3 operating the customer 3 as an example, the corresponding final transaction code is A0T001.

[0094] In some embodiments, Figure 4d As shown in FIG. 1 , it is a flow chart of a method for supplementing the determination of the end transaction code. After determining the end transaction code corresponding to the longest operation link, it is necessary to traverse the operation records to determine other possible types of end transaction codes. At this time, the following steps are included:

[0095] S4043. Filter the longest operation link among the transaction links corresponding to the same operator and the same object.

[0096] Specifically, in addition to the longest operation link determined above, the operator may also handle other business for the customer. Therefore, in the transaction link corresponding to the same operator and the same object in the operation record to be analyzed, there may be more than one end transaction code corresponding to the complete link.

[0097] Therefore, it is necessary to filter the longest operation link obtained above for further analysis.

[0098] If step S404 is implemented based on the method from step S4041 to step S4042, step S4043 can be performed after step S4042. If step S404 is not implemented based on the method from step S4041 to step S4042, step S4043 can be performed after step S404 is completed.

[0099] Exemplarily, the transaction code corresponding to the last operation in the transaction link with the longest operation time in the longest operation link is determined as the end transaction code. Alternatively, the transaction link with the longest operation time is first determined, and then the longest operation link is determined therefrom, and the transaction code corresponding to the last operation in the transaction link determined at this time is used as the end transaction code.

[0100] S4044. Determine the last transaction code in the filtered transaction link.

[0101] Specifically, after filtering the aforementioned longest operation link, the steps from step S403 to step S404 may be repeated to re-determine the end transaction code, thereby improving the accuracy of the analysis.

[0102] S405: Determine, as a transaction key item, a transaction code whose appearance ratio among the transaction codes other than the last transaction code included in the longest operation link exceeds a first ratio threshold.

[0103] Specifically, the complete link must include the final transaction code. Various complete links (i.e., the longest operation link corresponding to different objects or different operators, i.e., the transaction code used for judgment at this time is the transaction code in the longest transaction link) must also include some identical operations. The transaction codes corresponding to such operations are the transaction key items (such as querying customer identity information, querying customer account information, etc.).

[0104] After determining the final transaction code, you can further determine the key items of the transaction.

[0105] Since the objects, operators and transaction types involved are different, the proportion of duplicate transaction codes will not be very high, so the first ratio threshold can be a smaller value such as 5%, 8% or 10%.

[0106] For example, in the longest operation link obtained in the aforementioned steps, the transaction codes A004Q8, A004C2, and A004U9 all appear at a ratio of more than 5%, but only A004Q8 contains customer information, so it is identified as a key transaction item.

[0107] S406: Determine the transaction link that does not include the final transaction code but includes the transaction key item as an incomplete link.

[0108] Specifically, when a transaction link contains transaction key items but does not contain the final transaction code, it can be considered that the operator has obtained or attempted to obtain customer-related information but has not performed a complete operation. This situation may be caused by system failure or customer instructions (such as giving up the business), or it may be caused by the operator stealing customer information. Therefore, it is necessary to identify this type of incomplete link to find out the latter situation.

[0109] In some embodiments, the method for determining an incomplete link may also be:

[0110] The operation record to be analyzed is input into the transaction link extraction model, and the result output by the transaction record extraction model is determined as the transaction link and the incomplete link in the operation record to be analyzed.

[0111] Specifically, bank system managers or developers can also deploy corresponding algorithm models (i.e., transaction record extraction models) to complete the process of extracting transaction links and determining incomplete links in the aforementioned steps, so as to improve the efficiency of processing corresponding operation records of massive operators.

[0112] S407: Determine risky operation records based on the operation records to be analyzed that include incomplete links.

[0113] Specifically, based on the incomplete link, the operation records with risks can be further analyzed accordingly.

[0114] Furthermore, the risky operation records are determined in the following ways:

[0115] In some embodiments, based on the operation records to be analyzed, the number of customers corresponding to all incomplete links of the same operator can be determined as the number of risky customers, and the total number of customers corresponding to the operation records to be analyzed of the same operator can be determined; and if the ratio of the number of risky customers to the total number of customers exceeds a second set threshold, the operation records to be analyzed corresponding to the operator are determined as risky operation records.

[0116] Specifically, the same operator may have performed multiple incomplete link operations and one complete link operation on the same customer. For example, if a system failure causes multiple incomplete link operations (actually corresponding to the same business), only the number of customers is counted but not the number of incomplete links. If the incomplete link performed by the operator on the customer is before the complete link (the complete link here can be directly distinguished by the transaction link containing the last transaction code), the customer can be considered as a risky customer and does not need to be counted in the number of risky customers. In other cases (such as the incomplete link is after the complete link, or only the incomplete link has been performed), it will be counted in the number of risky customers.

[0117] When the ratio calculated in this way exceeds the second set threshold (such as 10%), it can be considered that the operator has performed too many incomplete link operations and may have intentionally stolen user information. Therefore, the corresponding operation records to be analyzed can be determined as risky operation records and analyzed in detail.

[0118] In some embodiments, the operation records corresponding to the operators that contain incomplete links and have both interception information and release information and are to be analyzed may be determined as operation records with risks.

[0119] Specifically, combined with the interception information and release information in the mail system, it indicates that the operator may have sent customer information to the outside. If there are incomplete link corresponding operations, the corresponding operation records to be analyzed can be identified as risky operation records and analyzed in detail.

[0120] In some embodiments, the operation records to be analyzed corresponding to operators containing incomplete links and whose employee status information indicates that they have resigned may be determined as operation records with risks.

[0121] Specifically, if an operator leaves the job soon after performing an incomplete link operation, it means that he or she may have abused customer information. Therefore, such operators and the corresponding operation records to be analyzed can be identified as risky operation records and analyzed in detail.

[0122] In some embodiments, the operation records corresponding to the operators that contain at least two incomplete links are to be analyzed and determined as operation records with risks.

[0123] Specifically, scenarios that may lead to incomplete links do not usually occur frequently. Therefore, if an operator has an incomplete link in a variety of transactions and businesses, the operator is at obvious security risk. Therefore, it is necessary to identify such operators and the corresponding operation records to be analyzed as risky operation records and conduct focused analysis.

[0124] This embodiment can further determine the transaction link, the longest operation link, the last transaction code and the key transaction item according to the correlation between the transaction code and the operation time before processing the search request, and determine the incomplete link accordingly, so as to analyze the operation records with risks based on the incomplete link and the user behavior. In this way, the operation records with risks in the massive operation records can be automatically identified, so as to facilitate the inspection personnel and management personnel to conduct targeted analysis and ensure the security of customer information and bank security.

[0125] Figure 5 This is a schematic diagram of the structure of the risk identification device provided in the embodiment of the present application. Figure 5 As shown, the risk identification device 500 includes: an acquisition module 510, an analysis module 520 and a determination module 530;

[0126] The acquisition module 510 is used to determine the operation record to be analyzed for risk identification, wherein the operation record to be analyzed includes the corresponding operator information, object information, operation corresponding transaction code and operation time;

[0127] The analysis module 520 is used to determine the transaction link in the operation record to be analyzed based on the transaction code and operation time in the operation record to be analyzed, wherein the transaction link is used to represent the operation record of all operations corresponding to a single transaction, and the transaction link includes an incomplete link, and the incomplete link is used to represent the operation record of all operations corresponding to a single unfinished transaction;

[0128] The determination module 530 is configured to determine risky operation records based on the operation records to be analyzed that contain incomplete links.

[0129] In some embodiments, the analysis module 520 is specifically used to determine the transaction links contained in the analysis operation records based on the transaction codes and corresponding operation times in the operation records to be analyzed by the same operator and the same object; based on the transaction links, determine the transaction link containing the most transaction codes in the operation records to be analyzed corresponding to the same operator and the same object as the longest operation link; determine the transaction code corresponding to the last operation in the transaction link with the longest operation time in the longest operation link as the last transaction code; determine the transaction codes whose appearance ratio exceeds a first ratio threshold among the transaction codes other than the last transaction code included in the longest operation link as transaction key items; determine the transaction link that does not contain the last transaction code and contains transaction key items as an incomplete link.

[0130] In some embodiments, the analysis module 520 is also used to remove adjacent and repeated transaction codes and operation records corresponding to the transaction codes in the transaction links after determining the transaction links contained in the analysis operation records based on the transaction codes and corresponding operation times in the operation records to be analyzed of the same operator and the same object.

[0131] In some embodiments, the analysis module 520 is specifically used to determine, in the operation records to be analyzed corresponding to the same operator and the same object, an operation whose operation time distance from the previous transaction code is greater than a first set time length, or an operation without a previous transaction code, as a starting operation, and determine the transaction code corresponding to the starting operation as the starting transaction code; if there is an operation whose operation time is after the starting operation and the interval between the corresponding operation time and the operation time of the previous transaction code is greater than a second set time length, determine the previous transaction code as the abort transaction code of the transaction link corresponding to the starting transaction code; determine an operation whose operation time is after the starting operation and the interval between the corresponding operation time and the operation time of the previous transaction code is less than the second set time length as an operation belonging to the transaction link where the starting operation is located; and determine all transaction codes in the transaction link where the starting transaction code is located.

[0132] In some embodiments, the analysis module 520 is specifically used to determine the time difference between the operation times corresponding to the starting transaction code and the ending transaction code in the longest operation chain as the operation duration; and determine the transaction code corresponding to the last operation in the transaction chain corresponding to the maximum value of the operation duration as the ending transaction code.

[0133] In some embodiments, the analysis module 520 is also used to, after determining the transaction code corresponding to the last operation in the transaction link corresponding to the maximum operation time in the longest operation link as the end transaction code, filter the longest operation link in the transaction links corresponding to the same operator and the same object; and determine the end transaction code in the filtered transaction link.

[0134] In some embodiments, the analysis module 520 is specifically used to input the operation record to be analyzed into the transaction link extraction model, and determine the results output by the transaction record extraction model as the transaction links and incomplete links in the operation record to be analyzed.

[0135] In some embodiments, the determination module 530 is specifically used to determine, based on the operation records to be analyzed, the number of customers corresponding to all incomplete links of the same operator as the number of risky customers, and determine the total number of customers corresponding to the operation records to be analyzed of the same operator; if the ratio of the number of risky customers to the total number of customers exceeds a second set threshold, the operation records to be analyzed corresponding to the operator are determined as risky operation records.

[0136] In some embodiments, the acquisition module 510 further includes that the operation record to be analyzed also includes: interception information corresponding to the interception of the operator's outgoing email operation, release information corresponding to successful email sending, and employee status information.

[0137] In some embodiments, the determination module 530 is specifically used to determine the operation records to be analyzed corresponding to operators that contain incomplete links and have both interception information and release information as operation records with risks; and / or, to determine the operation records to be analyzed corresponding to operators that contain incomplete links and employee status information of resigned status as operation records with risks; and / or, to determine the operation records to be analyzed corresponding to operators that contain at least two types of incomplete links as operation records with risks.

[0138] The risk identification device provided in the embodiment of the present application can be used to execute the technical solution of the risk identification method in the above embodiment. Its implementation principle and technical effect are similar and will not be repeated here.

[0139] It should be noted that it should be understood that the division of the various modules of the above device is only a division of logical functions. In actual implementation, they can be fully or partially integrated into one physical entity, or they can be physically separated. And these modules can all be implemented in the form of software called by processing elements; they can also be all implemented in the form of hardware; some modules can also be implemented in the form of software called by processing elements, and some modules can be implemented in the form of hardware. For example, the acquisition module 510 can be a separately established processing element, or it can be integrated in a chip of the above device. In addition, it can also be stored in the memory of the above device in the form of program code, and called and executed by a processing element of the above device. The function of the above acquisition module 510. The implementation of other modules is similar. In addition, these modules can be fully or partially integrated together, or they can be implemented independently. The processing element here can be an integrated circuit with signal processing capabilities. In the implementation process, each step of the above method or each module above can be completed by an integrated logic circuit of hardware in the processor element or instructions in the form of software.

[0140] Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Figure 6 As shown, the electronic device may include: a transceiver 61 , a processor 62 , and a memory 63 .

[0141] The processor 62 executes the computer execution instructions stored in the memory, so that the processor 62 executes the scheme in the above embodiment. The processor 62 can be a general-purpose processor, including a central processing unit CPU, a network processor (NP), etc.; it can also be a digital signal processor DSP, an application-specific integrated circuit ASIC, a field programmable gate array FPGA or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components.

[0142] The memory 63 is connected to the processor 62 via a system bus and completes communication between them. The memory 63 is used to store computer program instructions.

[0143] The transceiver 61 may be used to obtain tasks to be executed and configuration information of the tasks to be executed.

[0144] The system bus can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The system bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus. The transceiver is used to realize the communication between the database access device and other computers (such as clients, read-write libraries, and read-only libraries). The memory may include random access memory (RAM) and may also include non-volatile memory.

[0145] The electronic device provided in the embodiment of the present application may be the terminal device of the above embodiment.

[0146] An embodiment of the present application also provides a chip for running instructions, which is used to execute the technical solution of the risk identification method in the above embodiment.

[0147] An embodiment of the present application also provides a computer-readable storage medium, in which computer instructions are stored. When the computer instructions are executed on a computer, the computer executes the technical solution of the risk identification method of the above embodiment.

[0148] An embodiment of the present application also provides a computer program product, which includes a computer program stored in a computer-readable storage medium. At least one processor can read the computer program from the computer-readable storage medium. When at least one processor executes the computer program, the technical solution of the risk identification method in the above embodiment can be implemented.

[0149] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of modules is only a logical function division, and there may be other division methods in actual implementation, such as multiple modules can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or modules, which can be electrical, mechanical or other forms.

[0150] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to implement the solution of this embodiment.

[0151] In addition, each functional module in each embodiment of the present application can be integrated into one processing unit, or each module can exist physically separately, or two or more modules can be integrated into one unit. The above-mentioned module-composed unit can be implemented in the form of hardware or in the form of hardware plus software functional units.

[0152] The above-mentioned integrated module implemented in the form of a software function module can be stored in a computer-readable storage medium. The above-mentioned software function module is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to perform some steps of the methods of various embodiments of the present application.

[0153] It should be understood that the above processor can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in the invention can be directly embodied as being executed by a hardware processor, or can be executed by a combination of hardware and software modules in the processor.

[0154] The memory may include a high-speed RAM memory, and may also include a non-volatile storage NVM, such as at least one disk memory, and may also be a USB flash drive, a mobile hard disk, a read-only memory, a magnetic disk or an optical disk, etc.

[0155] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of this application is not limited to only one bus or one type of bus.

[0156] The above storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The storage medium can be any available medium that can be accessed by a general or special purpose computer.

[0157] An exemplary storage medium is coupled to a processor so that the processor can read information from the storage medium and write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and the storage medium can be located in an application specific integrated circuit (ASIC). Of course, the processor and the storage medium can also exist as discrete components in an electronic control unit or a main control device.

[0158] Those skilled in the art can understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, disk or optical disk and other media that can store program codes.

[0159] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A risk identification method, characterized in that: include: Determine the operation record to be analyzed for risk identification, wherein the operation record to be analyzed includes corresponding operator information, object information, transaction code corresponding to the operation, and operation time; Based on the transaction code and operation time in the operation record to be analyzed, determining the transaction link in the operation record to be analyzed, wherein the transaction link is used to represent the operation record of all operations corresponding to a single transaction, and the transaction link includes an incomplete link, and the incomplete link is used to represent the operation record of all operations corresponding to a single unfinished transaction; Based on the operation records to be analyzed that contain incomplete links, operation records with risks are determined.

2. The method according to claim 1, characterized in that The determining the transaction link in the operation record to be analyzed based on the transaction code and the operation time in the operation record to be analyzed includes: Determine the transaction link contained in the analysis operation record based on the transaction code and the corresponding operation time in the operation record to be analyzed of the same operator and the same object; Based on the transaction link, the transaction link containing the most transaction codes in the operation records to be analyzed corresponding to the same operator and the same object is determined as the longest operation link; Determine the transaction code corresponding to the last operation in the transaction link with the longest operation duration in the longest operation link as the last transaction code; Determining, among the transaction codes other than the last transaction code included in the longest operation link, transaction codes whose appearance ratio exceeds a first ratio threshold as transaction key items; A transaction link that does not contain the final transaction code but contains transaction key items is determined as an incomplete link.

3. The method according to claim 2, characterized in that After determining the transaction link contained in the analysis operation record based on the transaction code and the corresponding operation time in the operation record to be analyzed by the same operator and the same object, the method further includes: Delete adjacent and repeated transaction codes and operation records corresponding to the transaction codes in the transaction link.

4. The method according to claim 2, characterized in that: The determining of the transaction link contained in the analysis operation record based on the transaction code and the corresponding operation time in the operation record to be analyzed of the same operator and the same object includes: In the operation records to be analyzed corresponding to the same operator and the same object, an operation whose time distance from the operation of the previous transaction code is greater than a first set time length, or an operation without a previous transaction code, is determined as a starting operation, and the transaction code corresponding to the starting operation is determined as the starting transaction code; If there is an operation whose operation time is after the start operation, and the interval between the corresponding operation time and the operation time of the previous transaction code is greater than the second set time length, the previous transaction code is determined to be the abort transaction code of the transaction link corresponding to the start transaction code; Determine an operation whose operation time is after the starting operation and whose interval between the corresponding operation time and the operation time of the previous transaction code is less than a second set time as an operation belonging to the transaction link where the starting operation is located; All transaction codes in the transaction link where the starting transaction code is located are determined.

5. The method according to claim 4, characterized in that The step of determining the transaction code corresponding to the last operation in the transaction link with the longest operation duration in the longest operation link as the last transaction code comprises: Determine the time difference between the operation time corresponding to the starting transaction code and the ending transaction code in the longest operation link as the operation duration; The transaction code corresponding to the last operation in the transaction link corresponding to the maximum value of the operation duration is determined as the last transaction code.

6. The method according to claim 4, characterized in that After determining the transaction code corresponding to the last operation in the transaction link corresponding to the maximum operation time in the longest operation link as the last transaction code, the method includes: Filter the longest operation link among the transaction links corresponding to the same operator and the same object; Determine the last transaction code in the filtered transaction chain.

7. The method according to claim 1, characterized in that The determining the transaction link in the operation record to be analyzed based on the transaction code and the operation time in the operation record to be analyzed includes: The operation record to be analyzed is input into a transaction link extraction model, and the result output by the transaction record extraction model is determined as the transaction link and the incomplete link in the operation record to be analyzed.

8. The method according to any one of claims 1 to 7, characterized in that The step of determining the operation records with risks based on the operation records to be analyzed that contain incomplete links includes: Based on the operation records to be analyzed, the number of customers corresponding to all incomplete links of the same operator is determined as the number of risky customers, and the total number of customers corresponding to the operation records to be analyzed of the same operator is determined; If the ratio of the number of risky customers to the total number of customers exceeds a second set threshold, the to-be-analyzed operation record corresponding to the operator is determined as an operation record with risks.

9. The method according to any one of claims 1 to 7, characterized in that The operation record to be analyzed also includes: interception information corresponding to the interception of the operator's outgoing email operation, release information corresponding to the successful sending of the email, and employee status information.

10. The method according to claim 9, characterized in that The step of determining the operation records with risks based on the operation records to be analyzed that contain incomplete transaction links includes: Determine the operation records of operators that contain incomplete links and both interception information and release information as operation records with risks; and / or, Determine the operation records to be analyzed that contain incomplete links and whose employee status information indicates that the operator has resigned as operation records with risks; and / or, The operation records of operators that contain at least two incomplete links are to be analyzed and determined as operation records with risks.

11. A risk identification device, characterized in that: include: An acquisition module, used to determine the operation record to be analyzed for risk identification, wherein the operation record to be analyzed includes corresponding operator information, object information, operation corresponding transaction code and operation time; An analysis module, configured to determine a transaction link in the operation record to be analyzed based on the transaction code and operation time in the operation record to be analyzed, wherein the transaction link is used to represent an operation record containing all operations corresponding to a single transaction, and the transaction link contains an incomplete link, and the incomplete link is used to represent an operation record of all operations corresponding to a single unfinished transaction; The determination module is used to determine the operation records with risks based on the operation records to be analyzed that contain incomplete links.

12. An electronic device, characterized in that: include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the method according to any one of claims 1 to 10.

13. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 10 when executed by a processor.

14. A computer program product, characterized in that The invention comprises a computer program, which implements the method according to any one of claims 1 to 10 when being executed by a processor.

Images